NETWORK AUTHORIZATION STATUS NOTIFICATION

• US 20080282327A1
• Filed: 05/06/2008
• Published: 11/13/2008
• Est. Priority Date: 05/11/2007
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Zhou, Hao, Salowey, Joseph A., Burns, James Edward, Winget, Nancy Cam, Thomson, Susan Elizabeth
• Granted Patent: US 8,381,268 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: Y02D 30/00 Reducing energy consumption in communication networks

Abstract

A system that enables network authorization status to be conveyed to the device requesting network services within or outside the scope of an authentication exchange is provided. The authorization status notification or information can be automatically generated or otherwise triggered by a request from the user or device. For instance, a query can be employed to solicit device authorization status related to a particular service or group of services. Additionally, authorization status notification can be automatically triggered based upon a change in the device authorization state.

Claims

1. A method, comprising:

monitoring a plurality of network services accessible to an entity;

establishing authorization status of the entity, wherein the authorization status defines a grant of access to a subset of the plurality of network services accessible to the entity;

generating a notification message that includes the authorization status; and

communicating the notification message to the entity.

2. The method of claim 1, further comprising authenticating the entity, wherein the act of communicating the notification triggers after an initial the act of authentication.

3. The method of claim 1, wherein the notification message includes at least one of network name, authorization profile name, communication permissions, provisioning permissions, remediation permissions, access permissions, type of access permission, quality of service, scope of authorization, or reasons for restrictions.

4. The method of claim 1, further comprising:

dynamically monitoring authorization status of the entity; and

triggering the act of communicating based upon identifying a change in the authorization status.

5. The method of claim 1, further comprising:

receiving a request for the authorization status; and

employing the request to prompt communication of the notification message.

6. The method of claim 5, further comprising cryptographically protecting the request or the notification message.

7. The method of claim 1, further comprising triggering an action based upon the notification message, wherein the action is at least one of communication, remediation, re-authentication, enrollment, complete rejection, or limited rejection.

8. The method of claim 1, further wherein the act of communicating employs incorporation of the notification message as an attribute in at least one of a DHCP, LLDP, EAPoL or EAPoUDP message.

9. The method of claim 1, further comprising communicating the notification message to a disparate entity.

10. A system, comprising:

a status generation component that determines authorization status of a client, wherein the authorization status identifies a plurality of network services accessible to the client; and

a notification component that conveys a message to the client wherein the message includes the authorization status.

11. The system of claim 10, further comprising a monitoring component that dynamically monitors the authorization status of the client.

12. The system of claim 10, wherein the message is a post-authentication notification.

13. The system of claim 10, wherein the message is a pre-authentication notification.

14. The system of claim 10, wherein the message is triggered as a function of a change in the authorization status.

15. The system of claim 10, wherein the notification is triggered as a function of a request from the client.

16. The system of claim 10, the authorization status includes at least one of network name, authorization profile name, communication permission, provisioning permission, remediation access permission, scope of access permission, type of access permission, quality of service, lifetime of an authorization or reason for restrictions.

17. The system of claim 10, further comprising a query response component that evaluates a request from the client, wherein the notification component triggers transmission of the message as a function of the request.

18. An apparatus, comprising:

means for dynamically monitoring authorization status of a client, wherein the authorization status is based upon at least one of network, service or application status;

means for generating a message that includes the authorization status; and

means for communicating the message to at least one of the client or a disparate entity.

19. The apparatus of claim 18, wherein the means for communicating the message is at least one of DHCP, LLDP, EAPoL or EAPoUDP.

20. The apparatus of claim 18, further comprising means for triggering an action based at least in part upon the message, wherein the action is at least one of communication, remediation, re-authentication, enrollment, complete rejection, or limited rejection.