Secure authentication advertisement protocol
View Patent ↗A network device for distributing authentication information between authorized nodes for purposes of concurrently “pre-authenticating” a mobile user at a plurality of points throughout a LAN is disclosed. When a client attempts to access the network through the network device, the network device attempts to authenticate the client based on the credentials presented by the user. If authenticated, the client is admitted into the network at the network device and the client's pre-authentication information transmitted to one or more network nodes associated with an authentication group. Upon receipt of the pre-authentication information, the one or more network nodes are authorized to admit the client into the network at those nodes in addition to the network device at which the client was initially authenticated, thereby concurrently pre-authorizing the client at multiple points across the network.
1. A network device for advertising security authentication in a network comprising one or more network nodes associated with an authentication group, an authentication server, and a client having an associated client identifier and credentials, the network device comprising:
at least one port adapted to receive, from the client, a protocol data unit (PDU) and the credentials associated with the client;
a table adapted to retain a client identifier of each of one or more authenticated clients;
and an authentication manager adapted to:
determine whether the client is authenticated based on the PDU, wherein determining whether the client is authenticated based on the PDU comprises querying the table using information from the PDU,
if the client cannot be authenticated based on the PDU, transmit an authentication request toward the authentication server based on the client credentials, and
if the client is authenticated by the authentication server, transmit the client identifier toward the one or more network nodes.
2. The network device of claim 1 , wherein the authentication manager is adapted to determine whether the client is authenticated based on a source address of the PDU.
3. The network device of claim 1 , where the client credentials comprises a user identifier and password.
4. The network device of claim 1 , wherein the network device is selected from the group consisting of:
router, bridge, multi-layer switch, network access point, wireless network access point, and a combination thereof.
5. The network device of claim 1 , wherein the client is only prompted for the client credentials if the client cannot be authenticated based on the PDU.
6. The network device of claim 1 , wherein authentication manager is further adapted to cause the client identifier of the client to be added to the table in response to determining that the client has been authenticated by the authentication server.
7. The network device of claim 1 , wherein the network device belongs to the authentication group;
wherein the one or more authenticated clients, for which respective one or more client identifiers are maintained in the table, comprises clients that logged into the network device and clients that logged into the one or more network nodes associated with the authentication group.
8. A method for advertising security authentication in a network comprising one or more network nodes associated with an authentication group, an authentication server, and a client having an associated client identifier and credentials, the method comprising:
receiving, from the client, a protocol data unit (PDU) and the credentials associated with the client;
determining whether the client is authenticated based on the PDU, wherein determining whether the client is authenticated based on the PDU is performed using a table adapted to retain a client identifier of each of one or more authenticated clients, wherein determining whether the client is authenticated based on the PDU comprises querying the table using information from the PDU;
when the client cannot be authenticated based on the PDU, transmitting an authentication request toward the authentication server based on the client credentials, and
when the client is authenticated by the authentication server, transmitting the client identifier toward the one or more network nodes.
9. The method of claim 8 , wherein the determination as to whether the client is authenticated is based on a source address of the PDU.
10. The method of claim 8 , where the client credentials comprises a user identifier and password.
11. The method of claim 8 , wherein the method is performed by one of the network nodes, wherein the one of the network nodes comprises at least one of a router, a bridge, a multi-layer switch, a network access point, and a wireless network access point.
12. The method of claim 8 , wherein the client credentials are received in response to a request for client credentials that is initiated when a determination is made that the client cannot be authenticated based on the PDU.
13. The method of claim 8 , wherein the client identifier of the client is added to the table in response to a determination that the client has been authenticated by the authentication server.
14. The method of claim 8 , wherein the method is performed by one of the network nodes;
wherein the one or more authenticated clients, for which respective one or more client identifiers are maintained in the table, comprises clients that logged into the one or more network nodes associated with the authentication group.
15. A non-transitory computer-readable storage medium storing instructions which, when executed by a processor, cause the processor to perform a method for advertising security authentication in a network comprising one or more network nodes associated with an authentication group, an authentication server, and a client having an associated client identifier and credentials, the method comprising:
receiving, from the client, a protocol data unit (PDU) and the credentials associated with the client;
determining whether the client is authenticated based on the PDU, wherein determining whether the client is authenticated based on the PDU is performed using a table adapted to retain a client identifier of each of one or more authenticated clients, wherein determining whether the client is authenticated based on the PDU comprises querying the table using information from the PDU;
when the client cannot be authenticated based on the PDU, transmitting an authentication request toward the authentication server based on the client credentials, and
when the client is authenticated by the authentication server, transmitting the client identifier toward the one or more network nodes.
16. The non-transitory computer-readable storage medium of claim 15 , wherein the determination as to whether the client is authenticated is based on a source address of the PDU.
17. The non-transitory computer-readable storage medium of claim 15 , where the client credentials comprises a user identifier and password.
18. The non-transitory computer-readable storage medium of claim 15 , wherein the method is performed by one of the network nodes, wherein the one of the network nodes comprises at least one of a router, a bridge, a multi-layer switch, a network access point, and a wireless network access point.
19. The non-transitory computer-readable storage medium of claim 15 , wherein the client credentials are received in response to a request for client credentials that is initiated when a determination is made that the client cannot be authenticated based on the PDU.
20. The non-transitory computer-readable storage medium of claim 15 , wherein the client identifier of the client is added to the table in response to a determination that the client has been authenticated by the authentication server.
21. The non-transitory computer-readable storage medium of claim 15 , wherein the method is performed by one of the network nodes;
wherein the one or more authenticated clients, for which respective one or more client identifiers are maintained in the table, comprises clients that logged into the one or more network nodes associated with the authentication group.