Granted Patent B2

US 7,673,146 · App. 10/861,576 · Granted Mar 2, 2010

Abstract

Claims (38)

1. A method, comprising exchanging, as part of a network node authentication process, access control parameters that define a network node's ability to access other resources accessible through a computer network,

wherein exchanging the access control parameters includes transmitting a MAC address of an access point through which the network node will access the computer network in an authentication message to an authentication server to uniquely identify the access point to the authentication server;

wherein the access control parameters are selected from a list of possible rule sets during the network node authentication process;

wherein the access control parameters are provided to the access point only upon successful verification of the network node's credentials by the authentication server;

wherein exchanging the access control parameters further includes transmitting a MAC address of the network node for authentication by the authentication server;

wherein the network node authentication process includes the network node and the authentication server identifying themselves to one another using digital certificates;

wherein the network node authentication process requires the network node and the authentication server to be authenticated using a password;

wherein the access control parameters are assigned on a per-user basis;

wherein the access control parameters comprise rules for handling packets;

wherein a software application executing on the network node is configured to add the network node's and the access point's MAC addresses to a username to be used for authentication by the authentication server.

2. The method of claim 1 , wherein the authentication message comprises an EAP message.

3. The method of claim 1 , wherein the network node authentication process makes use of an EAP TTLS authentication process.

4. The method of claim 1 wherein the network node authentication process makes use of an EAP TLS authentication process.

5. The method of claim 1 wherein the network node authentication process makes use of a PEAP authentication process.

6. The method of claim 1 wherein the network node authentication process provides for only the network node to be authenticated on the basis of the password.

7. The method of claim 1 wherein the network node authentication process uses a secure channel.

8. The method of claim 7 wherein the secure channel is both encrypted and integrity-protected.

9. The method of claim 1 wherein the network node authentication process includes an exchange of encryption keys for use between the access point and the network node.

10. The method of claim 1 wherein the authentication server comprises a RADIUS server.

11. The method of claim 1 wherein the access control parameters are associated with routines that allow the access point to monitor any part of a packet header in a packet received from the network node.

12. The method of claim 1 wherein the access control parameters are associated with state machines at the access point.

13. The method of claim 1 wherein the access point includes an access privilege table to which the access control parameters refer.

14. The method of claim 1 wherein the resources include Internet access.

15. The method of claim 1 wherein the access point comprises a wireless network access point and the network node communicates with the access point using a wireless network communication protocol.

16. The method of claim 1 , wherein the MAC address of the access point is specified in a “Called-Station-ID” RADIUS protocol attribute.

17. The method of claim 1 , wherein the authentication server provides dynamic encryption keys for use between the access point and the network node.

18. The method of claim 1 , wherein the network node authentication process makes use of an EAP MSD5 authentication process.

19. The method of claim 1 , wherein the network node authentication process makes use of an EAP SRP authentication process.

20. The method of claim 1 , wherein the authentication server determines a local area network to which the network node has requested access utilizing a table lookup associating the MAC address of the access point with the local area network, and further identifies the network node authentication process from a plurality of network node authentication processes for use in authenticating the network node.

21. A method, comprising exchanging, as part of a network node authentication process, a unique identifier other than an Internet protocol address of an access point through which a network node will access a computer network in an authentication message to an authentication server to uniquely identify the access point to the authentication server;

wherein access control parameters are selected from a list of possible rule sets during the network node authentication process;

wherein the access control parameters are provided to the access point only upon successful verification of the network nod's credentials by the authentication server;

wherein a MAC address of the network node is transmitted for authentication by the authentication server;

wherein the network node authentication process includes the network node and the authentication server identifying themselves to one another using digital certificates;

wherein the network node authentication process requires the network node and the authentication server to be authenticated using a password;

wherein the access control parameters are assigned on a per-user basis;

wherein the access control parameters comprise rules for handling packets;

wherein a software application executing on the network node is configured to add the network node's and the access point's MAC addresses to a username to be used for authentication by the authentication server.

Assignments (11)