NETWORK SERVICE HEADER USED TO RELAY AUTHENTICATED SESSION INFORMATION

• US 20170222998A1
• Filed: 02/03/2016
• Published: 08/03/2017
• Est. Priority Date: 02/03/2016
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Stites, Steven, Patil, Prashanth
• Granted Patent: US 10,237,257 B2
• Time in Patent Office: Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 69/22 Parsing or analysis of headers

Abstract

In one embodiment, a system, method, and computer program product are disclosed for authenticating a packet received from a client node, storing the results of the authentication in a cache memory of a service classifier node, and including the results of the authentication in a network service header of a packet before forwarding the packet to downstream service nodes. In one embodiment, the initial authentication is performed in conjunction with an authentication node.

Claims

1. A method comprising:

receiving a packet at a first node, wherein

the packet is received from a first client node;

authenticating the packet, wherein

the authenticating comprises determining whether a session has been established for the first client node;

setting a value in a header of the packet, wherein

the value indicates that the packet is authenticated; and

forwarding the packet to a second node.

2. The method of claim 1, further comprising:

establishing a session related to the first client node, wherein

the session comprises information about the first client node.

3. The method of claim 2, further comprising:

storing an indication as an entry in a memory, wherein

the entry indicates that the first client node is authenticated.

4. The method of claim 3, wherein the authenticating comprises:

in response to determining that the session has been established for the first client node, authenticating the packet based, at least in part, on the entry in the memory.

5. The method of claim 1, wherein the authenticating comprises:

forwarding the packet to an authentication server, and

in response to the forwarding, receiving an indication from the authentication server.

6. The method of claim 1, wherein the forwarding comprises:

determining a service path associated with the packet, wherein the determining is performed prior to the forwarding.

7. The method of claim 1, wherein

the second node is a service node.

8. A system comprising:

a first node and a second node, wherein

the first node is configured to

receive a first packet, wherein

the packet is received from a first client node,

authenticate the packet, wherein

the authentication of the packet comprises determining whether a session has been established for the first client node,

set a value in a header of the packet, wherein

the value indicates that the packet is authenticated, and forward the packet to the second node.

9. The system of claim 8, wherein the first node is further configured to:

establish a session related to the first client node, wherein

the session comprises information about the first client node.

10. The system of claim 9, wherein the first node is further configured to:

store an indication as an entry in a memory, wherein

the entry indicates that the first client node is authenticated.

11. The system of claim 10, wherein the authentication of the packet comprises:

in response to determining that the session has been established for the first client node, authenticating the packet based, at least in part, on the entry in the memory.

12. The system of claim 8, wherein the first node is further configured to:

forward the packet to an authentication server, and

in response to forwarding the packet to the authentication server, receive an indication from the authentication server.

13. The system of claim 8, wherein the forwarding comprises:

determining a service path associated with the packet, wherein the determining is performed prior to the forwarding.

14. The system of claim 8, wherein

the second node is a service node.

15. A computer program product comprising:

a plurality of program instructions, comprising

a first set of instructions, executable on a computer system, configured to

receive a first packet, wherein

the packet is received from a first client node;

a second set of instructions, executable on the computer system, configured to

authenticate the packet, wherein

authentication of the packet comprises determining whether a session has been established for the first client node, and

set a value in a header of the packet, wherein

the value indicates that the packet is authenticated;

a third set of instructions, executable on the computer system, configured to forward the packet to a second node; and

a non-transitory computer-readable storage medium, wherein the instructions are encoded in the non-transitory computer-readable storage medium.

16. The computer program product of claim 15, wherein the plurality of program instructions further comprise:

a fourth set of instructions, executable on the computer system, configured to

establish a session related to the first client node, wherein

the session comprises information about the first client node.

17. The computer program product of claim 16, wherein the plurality of program instructions further comprise:

a fifth set of instructions, executable on the computer system, configured to

store an indication as an entry in a memory, wherein

the entry indicates that the first client node is authenticated.

18. The computer program product of claim 17, wherein the second set of instructions are further configured to:

in response to determining that the session has been established for the first client node, authenticate the packet based, at least in part, on the entry in the memory.

19. The computer program product of claim 15, wherein the plurality of program instructions further comprise:

a sixth set of instructions, executable on the computer system, configured to

forward the packet to an authentication server, and

in response to forwarding the packet to the authentication server, receive an indication from the authentication server.

20. The computer program product of claim 15, wherein

the second node is a service node.