Enabling Dynamic Authentication With Different Protocols on the Same Port for a Switch

• US 20100333176A1
• Filed: 09/10/2010
• Published: 12/30/2010
• Est. Priority Date: 01/26/2005
• Status: Active Grant

• Current Assignee: McAfee, LLC
• Original Assignee: McAfee, Inc. (McAfee, LLC)
• Inventors: Vank, Alexandru Z., Cobb, Matt B., Webb, Evan M., Robel-Forrest, Brad, Shen, Xin
• Granted Patent: US 8,522,318 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 12/4641 Virtual LANs, VLANs, e.g. virtual private networks [VPN] LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24

Abstract

The invention enables a client device that does not support IEEE 802.1X authentication to access at least some resources provided through a switch that supports 802.1X authentication by using dynamic authentication with different protocols. When the client device attempts to join a network, the switch monitors for an 802.1X authentication message from the client device. In one embodiment, if the client fails to send an 802.1X authentication message, respond to an 802.1X request from the switch, or a predefined failure condition is detected the client may be deemed incapable of supporting 802.1X authentication. In one embodiment, the client may be initially placed on a quarantine VLAN after determination that the client fails to perform an 802.1X authentication within a backoff time limit. However, the client may still gain access to resources based on various non-802.1X authentication mechanisms, including name/passwords, digital certificates, or the like.

Claims

1-23. -23. (canceled)

24. A method, comprising:

monitoring network traffic associated with a port of a network device;

identifying an authentication request within the network traffic, wherein the authentication request is associated with a client device; and

evaluating a first policy associated with the client device in order to determine whether to authenticate the client device, wherein if the client device is authenticated then it is granted access to a network resource associated with a first local area network, and wherein if the client device is not authenticated then the client device is prohibited from accessing the network resource, and the client device is relegated to a second local area network that does not include the network resource.

25. The method of claim 24, wherein if the client device is not authenticated, then hypertext transfer protocol (HTTP) packets associated with the client device are permitted to propagate through the port of the network device.

26. The method of claim 24, wherein a non-802.1x authentication can be used in order to grant access to the network resource.

27. The method of claim 26, wherein the non-802.1x authentication permits the client device to access different resources based on a second policy associated with the client device.

28. The method of claim 24, wherein an incorrect authentication credential being provided by the client device serves as a basis for determining that the client device is not capable of an 802.1x authentication.

29. The method of claim 24, wherein if the client device is incapable of supporting an 802.1x authentication, the client device is provisioned on the second local area network for quarantining.

30. The method of claim 24, wherein the client device is provisioned on the second local area network based on exceeding a time limit allotted for 802.1x authentication.

31. The method of claim 24, wherein an interface is provided to the client device when it is quarantined, and wherein the interface is a webpage or a command line interface (CLI).

32. The method of claim 24, further comprising:

provisioning an enforcer element configured to act as an authentication server for the client device.

33. The method of claim 32, wherein the enforcer element is operable to configure a port on the network device to an auto mode to enable 802.1x authentication detection.

34. The method of claim 24, wherein an audit is performed for the client device to ensure conformance with a security policy associated with the client device.

35. The method of claim 24, wherein if the client device is incapable of supporting an 802.1x authentication, a different type of authentication is accepted for access to the network resource.

36. The method of claim 24, further comprising:

providing a simple network management protocol (SNMP) handler application for transmitting and receiving e-mail associated with the client device.

37. The method of claim 24, further comprising:

providing a hypertext transfer protocol (HTTP) handler application for receiving and handling HTTP requests associated with the client device.

38. The method of claim 24, wherein the client device is a mobile phone configured to send and receive voice communications.

39. Logic encoded in one or more tangible media that includes code for execution and when executed by a processor operable to perform operations comprising:

monitoring network traffic associated with a port of a network device;

identifying an authentication request within the network traffic, wherein the authentication request is associated with a client device; and

evaluating a first policy associated with the client device in order to determine whether to authenticate the client device, wherein if the client device is authenticated then it is granted access to a network resource associated with a first local area network, and wherein if the client device is not authenticated then the client device is prohibited from accessing the network resource, and the client device is relegated to a second local area network that does not include the network resource.

40. The logic of claim 39, wherein if the client device is not authenticated, then hypertext transfer protocol (HTTP) packets associated with the client device are permitted to propagate through the port of the network device.

41. The logic of claim 39, wherein a non-802.1x authentication can be used in order to grant access to the network resource.

42. The logic of claim 41, wherein the non-802.1x authentication permits the client device to access different resources based on a second policy associated with the client device.

43. The logic of claim 39, wherein the client device is provisioned on the second local area network based on exceeding a time limit allotted for 802.1x authentication.

44. The logic of claim 39, wherein an interface is provided to the client device when it is quarantined, and wherein the interface is a webpage or a command line interface (CLI).

45. The logic of claim 39, wherein if the client device is incapable of supporting an 802.1x authentication, a different type of authentication is accepted for access to the network resource.

46. An apparatus, comprising:

a memory element configured to store code;

a processor operable to execute instructions associated with the code; and

an enforcer element configured to interface with the memory element and the processor such that the apparatus can;

monitor network traffic associated with a port of a network device;

identify an authentication request within the network traffic, wherein the authentication request is associated with a client device; and

evaluate a first policy associated with the client device in order to determine whether to authenticate the client device, wherein if the client device is authenticated then it is granted access to a network resource associated with a first local area network, and wherein if the client device is not authenticated then the client device is prohibited from accessing the network resource, and the client device is relegated to a second local area network that does not include the network resource.

47. The apparatus of claim 46, wherein if the client device is not authenticated, then hypertext transfer protocol (HTTP) packets associated with the client device are permitted to propagate through the port of the network device.

48. The apparatus of claim 46, wherein a non-802.1x authentication can be used in order to grant access to the network resource.

49. The apparatus of claim 48, wherein the non-802.1x authentication permits the client device to access different resources based on a second policy associated with the client device.

50. The apparatus of claim 46, wherein an incorrect authentication credential being provided by the client device serves as a basis for determining that the client device is not capable of an 802.1x authentication.

51. The apparatus of claim 46, wherein if the client device is incapable of supporting an 802.1x authentication, the client device is provisioned on the second local area network for quarantining.

52. The apparatus of claim 46, wherein the client device is provisioned on the second local area network based on exceeding a time limit allotted for 802.1x authentication.

53. The apparatus of claim 46, wherein an interface is provided to the client device when it is quarantined, and wherein the interface is a webpage or a command line interface (CLI).

54. The apparatus of claim 46, wherein the enforcer element is operable to configure a port on the network device to an auto mode to enable 802.1x authentication detection.

55. The apparatus of claim 46, further comprising:

a simple network management protocol (SNMP) handler application for transmitting and receiving e-mail associated with the client device.

56. The apparatus of claim 46, further comprising:

a hypertext transfer protocol (HTTP) handler application for receiving and handling HTTP requests associated with the client device.