Internetwork authentication

• US 9,762,579 B2
• Filed: 08/17/2016
• Issued: 09/12/2017
• Est. Priority Date: 08/30/2012
• Status: Active Grant

• Current Assignee: Extreme Networks, Inc.
• Original Assignee: Aerohive Networks Incorporated (Extreme Networks, Inc.)
• Inventors: Sakura, Kenshin, Gast, Matthew Stuart, Fu, Long
• Primary Examiner(s): CHANG, KENNETH W
• Application Number:
  US15/239,470
• Publication Number:
  US 20160359855A1
• Time in Patent Office: 391 Days
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A technique for network authentication interoperability involves initiating an authentication procedure on a first network, authenticating on a second network, and allowing access at the first network. The technique can include filtering access to a network, thereby restricting access to users with acceptable credentials. Offering a service that incorporates these techniques can enable incorporation of the techniques into an existing system with minimal impact to network configuration.

Claims

1. A method comprising:

providing an internetwork authentication service between a first network and a second network by establishing a connection between a first network device of the first network and a second network device of the second network through a first local authoritative user datastore interface at the first network device and an internetwork authentication proxy and a second local authoritative user datastore interface at the second network device and the internetwork authentication proxy, the first and second local authoritative user datastore interfaces associated with identity routing rules for routing to the first network;

receiving at the second network device, an authentication request for a station to access the first network;

determining if the authentication request matches a filtering rule of the identity routing rules specifying to remove identities from authentication requests;

filtering the authentication request to remove an identity from the authentication request;

routing the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces;

receiving at the second local authoritative user datastore interface from the first local authoritative user datastore interface an authentication result indicating the station is authenticated to access the first network;

providing the station access to network services provided through the second network according to the authentication result.

2. The method of claim 1, wherein the first and second network devices are coupled to the internetwork authentication proxy through the first and second local authoritative user datastore interfaces over persistent connections.

3. The method of claim 1, wherein the network services includes network services provided by the first network through the second network.

4. The method of claim 1, further comprising:

determining if the authentication request matches a filtering rule of the identity routing rules;

filtering network traffic transmitted to and from the station according to the filtering rule.

5. The method of claim 1, further comprising:

determining if the authentication request meets parameters of authentication requests suitable for off-network authentication;

if it is determined that the authentication request meets the parameters for off-network authentication, routing the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces.

6. The method of claim 1, wherein the first local authoritative user datastore interface is configured to send the authentication result to the second local authoritative user datastore interface through the internetwork authentication proxy.

7. The method of claim 1, wherein the first local authoritative user datastore interface is configured to send the authentication result directly to the second local authoritative user datastore interface bypassing the internetwork authentication proxy.

8. The method of claim 1, further comprising:

determining if the authentication request meets parameters of authentication requests suitable for off-network authentication according to a domain of the station;

if it is determined that the authentication request meets the parameters for off-network authentication, routing the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces.

9. The method of claim 1, wherein the first and second local authoritative user datastore interfaces are configured to transmit network traffic in providing the station access to the network services over a communication channel through the first and second networks uniquely associated with the station.

10. A system comprising:

a first local authoritative user datastore interface at a first network device of a first network configured to establish a connection with an internetwork authentication proxy for purposes of providing internetwork authentication services between the first network and a second network;

a second local authoritative user datastore interface at a second network device of the second network configured to;

establish a connection with the internetwork authentication proxy for purposes of providing the internetwork authentication services between the first network and the second network, the second local authoritative user datastore interface associated with identity routing rules for routing to the first network;

receive at the second network device, an authentication request for a station to access the first network;

a policy-based identity routing engine configured to;

determine if the authentication request matches a filtering rule of the identity routing rules specifying to remove identities from authentication requests;

filter the authentication request to remove an identity from the authentication request;

route the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces;

the second local authoritative user datastore interface further configured to;

receive from the first local authoritative user datastore interface an authentication result indicating the station is authenticated to access the first network;

provide the station access to network services provided through the second network according to the authentication result.

11. The system of claim 10, wherein the first and second network devices are coupled to the internetwork authentication proxy through the first and second local authoritative user datastore interfaces over persistent connections.

12. The system of claim 10, wherein the network services includes network services provided by the first network through the second network.

13. The system of claim 10, wherein the policy-based identity routing engine is further configured to:

determine if the authentication request matches a filtering rule of the identity routing rules;

filter network traffic transmitted to and from the station according to the filtering rule.

14. The system of claim 10, wherein the policy-based identity routing engine is further configured to:

determine if the authentication request meets parameters of authentication requests suitable for off-network authentication;

route the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces, if it is determined that the authentication request meets the parameters for off-network authentication.

15. The system of claim 10, wherein the first local authoritative user datastore interface is configured to send the authentication result to the second local authoritative user datastore interface through the internetwork authentication proxy.

16. The system of claim 10, wherein the first local authoritative user datastore interface is configured to send the authentication result directly to the second local authoritative user datastore interface bypassing the internetwork authentication proxy.

17. The system of claim 10, wherein the first and second local authoritative user datastore interfaces are configured to transmit network traffic in providing the station access to the network services over a communication channel through the first and second networks uniquely associated with the station.

18. A system comprising:

means for providing an internetwork authentication service between a first network and a second network by establishing a connection between a first network device of the first network and a second network device of the second network through a first local authoritative user datastore interface at the first network device and an internetwork authentication proxy and a second local authoritative user datastore interface at the second network device and the internetwork authentication proxy, the first and second local authoritative user datastore interfaces associated with identity routing rules for routing to the first network;

means for receiving at the second network device, an authentication request for a station to access the first network;

means for determining if the authentication request matches a filtering rule of the identity routing rules specifying to remove identities from authentication requests;

means for filtering the authentication request to remove an identity from the authentication request;

means for routing the authentication request according to the identity routing rules to the first network device through the first and second local authoritative user datastore interfaces;

means for receiving at the second local authoritative user datastore interface from the first local authoritative user datastore interface an authentication result indicating the station is authenticated to access the first network;

means for providing the station access to network services provided through the second network according to the authentication result.