Method to grant access to a data communication network and related devices
View Patent ↗A method to grant a supplicant access to a data communication network and related devices is claimed. The supplicant is associated to a Medium Access Control address and is coupled to a port of an authenticator of the data communication network. The method includes: transmitting an authentication request by the authenticator to an authentication server being coupled thereto; making by the authentication server an authentication decision based upon predefined rules and conditions; and transmitting by the authentication server to the authenticator an authentication reply that comprises a result of the authentication decision.
1. A method to grant a supplicant access to a data communication network, said supplicant having associated a Medium Access Control address and being coupled to an ingress port of an authenticator of said data communication network,
said method comprises:
transmitting an authentication request by said authenticator to an authentication server being coupled thereto; and
making by said authentication server an authentication decision based upon predefined rules and conditions; and
transmitting by said authentication server to said authenticator an authentication reply that comprises a result of said authentication decision, characterized in that said method further comprises
developing by said authentication server a registration memory (MEM) that comprises entries whereby an entry comprises an association between a Medium Access Control address of a granted supplicant and an authenticated ingress port for said granted supplicant that already received a grant to access an allowed data communication network via said authenticated ingress port; and that said predefined rules and conditions comprises a first controlling step of controlling said registration memory if there exists a first previous entry that comprises a first association between said Medium Access Control address of said supplicant and said ingress port of said authenticator,
wherein in the event that said first previous entry does not exist, said method further comprises:
a second controlling step of controlling said registration memory if there exists a second previous entry that comprises a second association between said Medium Access Control address of said supplicant with another ingress port,
wherein the first controlling step and the second controlling step are different operations.
2. The method to grant a supplicant access to a data communication network according to claim 1 , wherein in the event that the first previous entry exists, said method further comprises
generating a result that comprises an authentication for said ingress port and for said Medium Access Control address and thereby granting said supplicant with said Medium Access Control address to access said data communication network via said ingress port of said authenticator.
3. The method to grant a supplicant access to a data communication network according to claim 1 ,
wherein in the event that the second previous entry exists, said method further comprises generating a result that comprises a refusal for said ingress port and for said Medium Access Control address and denying said supplicant with said Medium Access Control address access to said data communication network via said ingress port of said authenticator.
4. The method to grant a supplicant access to a data communication network according to claim 3 , whereby
in the event that said first previous entry and said second previous entry do not exist, said method further comprises
inserting a new entry in said registration memory that comprises said Medium Access Control address of said supplicant and said ingress port of said authenticator; and
generating a result that comprises an authentication for said ingress port and for said Medium Access Control address and thereby granting said supplicant with said Medium Access Control address to access said data communication network via said ingress port of said authenticator.
5. An authentication server to transmit to an authenticator, upon reception of an authentication request from said authenticator, an authentication reply that comprises a result of an authentication decision said authentication server comprises:
a decision module, wherein said decision module generates said result of the authentication decision being based upon predefined rules and conditions, said authentication request concerns a permission to grant for a supplicant access to a data communication network, said supplicant having associated a Medium Access Control address and being coupled to a ingress port of said authenticator of said data communication network, characterized in that said authentication server further comprises
a registration memory device coupled to said decision module, said registration memory comprises entries whereby an entry comprises an association between a Medium Access Control address of a granted supplicant and an authenticated ingress port for said granted supplicant that already received a grant to access an allowed data communication network via said authenticated ingress port; and
that said decision module comprises a first control module to execute a first control on said registration memory is there exists a first previous entry that comprises a first association between said Medium Access Control address of said supplicant and said ingress port of said authenticator,
wherein in the event that said first previous entry does not exist, said decision module comprises a second control module to execute a second control on said registration memory if a second previous entry exists that comprises a second association between said Medium Access Control address of said supplicant with another ingress port,
wherein the first control on said registration memory is different from said second control on said registration memory.
6. The authentication server according to claim 5 , wherein in the event that said first previous entry exists,
said decision module generates a result that comprises an authentication for said ingress port and for said Medium Access Control address whereby said supplicant with said Medium Access Control address being granted to access said data communication network via said ingress port of said authenticator.
7. The authentication server according to claim 5 ,
whereby in the event when said second control is positive,
said decision module generates a result that comprises a refusal for said ingress port and for said Medium Access Control address whereby said supplicant with said Medium Access Control address is denied access to said data communication network via said ingress port of said authenticator.
8. The authentication server according to claim 7 , wherein
in the event that said first previous entry does not exist; and
in the event that said second previous entry does not exist;
the authentication server inserts a new entry in said registration memory that comprises said Medium Access Control address of said supplicant and said ingress port of said authenticator; and
said decision module generates a result that comprises an authentication for said ingress port and for said Medium Access Control address whereby said supplicant with said Medium Access Control address being granted to access said data communication network via said ingress port (P 2 ) of said authenticator.
9. An authenticator that enables a supplicant access to a data communication network, said supplicant having associated a Medium Access Control (MAC) address and being coupled to a ingress port of said authenticator of said data communication network,
said authenticator therefor comprises
a transmitter device to transmit an authentication request to an authentication server being coupled to said authenticator; and
a receiver to receive from said authentication server an authentication reply that comprises a result of an authentication decision based upon predefined rules and conditions, characterized in that
said authenticator comprises an interpreter, wherein said interpreter interprets said authentication reply as being received from the authentication server and to set a filter of said authenticator accordingly, whereby
when said result comprises an authentication for said ingress port and for said Medium Access Control address whereby said supplicant with said Medium Access Control address is granted access to said data communication network via said ingress port of said authenticator, said filter accepts traffic of said supplicant via said ingress port only for said Medium Access Control address; and whereby
when said result comprises a refusal for said ingress port and for said Medium Access Control address whereby said supplicant with said Medium Access Control address is denied access to said data communication network via said ingress port of said authenticator, said filter refuses traffic of said supplicant,
wherein said ingress port and said MAC are authenticated if there exists an entry, in a memory, that comprises an association between said ingress port and said MAC.