Method for inverse port-based authentication
View Patent ↗A service node authenticates a service provider network to which it is connected. When the service node is connected between subscriber devices and a network node of the service provider network, the service node issues an authentication request to the network node. The network node responds to the authentication request by transmitting a reply. The service node receives the reply and determines if it indicates the service provider network to which the service node is connected is authentic. These authentication communications can conform to a standard authentication protocol, such as Extensible Authentication Protocol (EAP). If the reply indicates the service provider network is authentic, the service node permits communication between the subscriber devices and the service provider network. If the reply indicates the service provider network is not authentic, the service node blocks such communication.
1. A service node comprising:
a network interface connectable to a network node for forwarding authentication requests to the network node;
a subscriber interface connectable to subscriber devices for forwarding data to subscribers;
authentication logic for initiating an authentication request that is forwarded to the network node through the network interface, receiving a reply to the authentication request from the network node through the network interface, and determining whether the network node is authentic from the reply;
a switch configured to allow data, communicated between the network interface and the subscriber interface, to pass through the switch provided the network node is authentic; and
a packet filter for filtering out downstream packets not associated with authenticating subscriber devices or authenticating the network node.
2. The service node claimed in claim 1 , further comprising service node management logic accessible to a service provider network associated with the network node regardless of whether the network node has been authenticated.
3. The service node claimed in claim 1 , wherein the authentication request and reply conform to Extensible Authentication Protocol (EAP).
4. A method for operating a service node comprising:
the service node initiating and forwarding an authentication request to a network node;
the service node receiving a reply to the authentication request from the network node;
the service node determining whether the network node is authentic; the service node allowing data to pass between the network interface and subscriber interface provided the network node is authentic; and
a packet filter filters out downstream packets not associated with authenticating subscriber devices or authenticating the network node.
5. The method claimed in claim 4 , wherein P 1 the service node permits access by a service provider network associated with the network node to management logic of the service node regardless of whether the network node has been authenticated.
6. The method claimed in claim 4 , wherein the authentication request and reply conform to Extensible Authentication Protocol (EAP).
7. A tangible computer program product comprising:
a memory for storing code portions for execution by a processor;
a first code portion for initiating and forwarding an authentication request to a network node;
a second code portion for receiving a reply to the authentication request from the network node;
a third code portion for determining whether the network node is authentic; and
a fourth code portion for allowing data to be passed between a network interface and a subscriber interface provided the network node is authentic; and
comprising a fifth code portion for filtering out downstream packets not associated with authenticating subscriber devices or authenticating the network node.
8. The computer program product claimed in claim 7 , further comprising a sixth code portion for permitting access by a service provider network associated with the network node to management logic of the service node regardless of whether the network node has been authenticated.
9. The computer program product claimed in claim 7 , wherein the authentication request and reply conform to Extensible Authentication Protocol (EAP).