Authentication and authorization without the use of supplicants
First Claim
Patent Images
1. A system, comprising:
- a processor that executes the following computer executable components stored in a memory;
an identification manager component that generates profile data for a device based on the device being authorized to access a secure network and in response to a first authentication request, andwherein the profile data includes at least data specific to a verifying user identity associated with an acceptance of the first authentication request;
an evaluation component that determines an expected characteristic of a second authentication request by the device to access the secure network prior to receipt of the second authentication request, the expected characteristic is a prediction of a characteristic of the second authentication request,wherein the evaluation component combines the profile data with other profile data to predict a port connection for the second authentication request; and
a validation component that, in response to the receipt of the second authentication request compares the characteristic of the second authentication request to the expected characteristic and, based on the comparison, controls access to the secure network, wherein a supplicant is not deployed on the device,wherein the validation component automatically authenticates the device with the secure network based on a determination that the characteristic of the second authentication request matches the expected characteristic, andwherein the validation component request an authentication of the device based on a detected state change between the device and the secure network, wherein the request is the second authentication request; and
wherein the validation component automatically denies the device access to the secure network based on a determination that the characteristic of the second authentication request does not match the expected characteristic.
1 Assignment
0 Petitions
Accused Products
Abstract
Provided is authentication and authorization without the use of supplicants. Authentication and authorization includes generating a profile for a device based on at least one characteristic observed during a successful attempt by the device to access an 802.1X network infrastructure. Expected characteristics for a next attempt to access the infrastructure by the device are determined. A characteristic of the next access attempt is matched to the expected characteristic and access to the network is selectively controlled as a result of the matching. This is achieved without a supplicant being installed on the device.
13 Citations
18 Claims
-
1. A system, comprising:
a processor that executes the following computer executable components stored in a memory; an identification manager component that generates profile data for a device based on the device being authorized to access a secure network and in response to a first authentication request, and wherein the profile data includes at least data specific to a verifying user identity associated with an acceptance of the first authentication request; an evaluation component that determines an expected characteristic of a second authentication request by the device to access the secure network prior to receipt of the second authentication request, the expected characteristic is a prediction of a characteristic of the second authentication request, wherein the evaluation component combines the profile data with other profile data to predict a port connection for the second authentication request; and a validation component that, in response to the receipt of the second authentication request compares the characteristic of the second authentication request to the expected characteristic and, based on the comparison, controls access to the secure network, wherein a supplicant is not deployed on the device, wherein the validation component automatically authenticates the device with the secure network based on a determination that the characteristic of the second authentication request matches the expected characteristic, and wherein the validation component request an authentication of the device based on a detected state change between the device and the secure network, wherein the request is the second authentication request; and wherein the validation component automatically denies the device access to the secure network based on a determination that the characteristic of the second authentication request does not match the expected characteristic. - View Dependent Claims (2, 3, 4, 5, 6, 7)
-
8. A method, comprising:
generating, by a system comprising a processor, a profile for an endpoint based on a characteristic observed during a successful attempt by the endpoint to access a protected communications network, wherein the successful attempt is in response to a first authentication request, and, wherein the profile includes at least data specific to a verifying user identity associated with an acceptance of the first authentication request, and wherein a supplicant is not deployed on the endpoint;
determining, by the system, an expected characteristic for another attempt by the endpoint to access the protected communications network, the other attempt is a future attempt, and the expected characteristic is a prediction of a characteristic of the other authentication request, wherein the determining includes combining profile data with other profile data to predict a port connection for the second authentication request;comparing, by the system, a characteristic of the other attempt by the endpoint to access the protected communications network with the expected characteristic; and selectively controlling, by the system, access to the protected communications network by the endpoint as a result of the comparing, wherein the selectively controlling access comprises automatically granting access based on a determination that the characteristic of the other attempt matches the expected characteristic, and wherein requesting from the validation component to an authentication of the device based on a detected state change between the device and the secure network, wherein the request is the second authentication request; and wherein the selectively controlling access comprises automatically denying access based on a determination that the characteristic of the other access attempt does not match the expected characteristic. - View Dependent Claims (9, 10, 11)
-
12. A computer-readable storage device storing executable instructions that, in response to execution, cause a system comprising a processor to perform operations, comprising:
-
generating profile data for a device based on the device being authorized to access a secure network in response to a first authentication request, and wherein the profile data includes at least data specific to a verifying user identity associated with an acceptance of the first authentication request; determining an expected characteristic of a second authentication request by the device to access the secure network, the expected characteristic is a prediction of a characteristic of the second authentication request, wherein the determining includes combining the profile data with other profile data to predict a port connection for the second authentication request; after receipt of the second authentication request, comparing the characteristic of the second authentication request to the expected characteristic; and controlling access to the secure network based on the comparison, wherein a supplicant is not deployed on the device, wherein controlling access includes; upon a determination that the characteristic of the second authentication request matches the expected characteristic, automatically authenticating the device with the secure network, and wherein the second authentication request is made based on a detected state change between the device and the secure network; and upon a determination that the characteristic of the second authentication request does not match the expected characteristic, automatically denying the device access to the secure network. - View Dependent Claims (13, 14, 15, 16, 17, 18)
-
Specification