System and method for supplicant based accounting and access
View Patent ↗The method of the present invention comprises initiating a connection to a port on an access device by a supplicant and associating supplicant identification information with the port. The access device may comprise any network connectivity device, including a wireless access point. Data packets transmitted over the port by the supplicant are statistically sampled as they are transmitted, with each of the sample data packets also associated with the supplicant identification information. The sample data packets are stored according to their associated supplicant identification information in order to perform accounting. The sample data packets, with the supplicant identification information, are sent to a network management system where the data is archived and presented in a human readable form, e.g., charts, etc.
1. A method comprising:
associating, at a network device, supplicant identification information with a port of the network device, the supplicant identification information identifying a supplicant and received to determine whether the supplicant is authorized to use the port;
generating a set of one or more sample packets based upon sampling of packets received from the supplicant over the port; and
modifying each sample packet to include the supplicant identification information.
2. The method of claim 1 further comprising receiving the supplicant identification information according to 802.1X protocol.
3. The method of claim 1 wherein generating the sample data packet comprises using statistical sampling to generate the set of sample packets.
4. The method of claim 3 wherein the statistical sampling is performed according to sFlow protocol.
5. The method of claim 1 further comprising:
receiving a packet over the port, the packet intended for a destination;
determining that the received packet is associated with the supplicant;
determining a set of permitted destinations for the supplicant; and
authorizing transmission of the packet to its destination only if the destination is included in the set of permitted destinations for the supplicant.
6. The method of claim 1 further comprising validating the supplicant to determine whether the supplicant is authorized to use the port based upon the supplicant identification information.
7. The method of claim 6 wherein the validating is performed according to RADIUS protocol.
8. The method of claim 6 wherein the associating is performed upon determining that the supplicant is authorized to use the port.
9. The method of claim 1 wherein the supplicant identification information comprises one of a supplicant username, a password, or address information for the supplicant.
10. The method of claim 1 further comprising:
receiving, at the network device, an instruction to limit an amount of bandwidth allocated to the port, the instruction generated in response to analysis of the set of sample packets.
11. A system comprising:
a port for receiving packets; and
a module configured to:
associate supplicant identification information with the port, the supplicant identification information identifying a supplicant and received to determine whether the supplicant is authorized to use the port;
generate a set of one or more sample packets based upon sampling of packets received from the supplicant over the port; and
modify each sample packet to include the supplicant identification information.
12. The system of claim 11 the module is configured to receive the supplicant identification information according to 802.1X protocol.
13. The system of claim 11 wherein the module is configured to use statistical sampling to generate the set of sample packets.
14. The system of claim 13 wherein the module is configured to perform the statistical sampling according to sFlow protocol.
15. The system of claim 11 wherein the module is configured to:
receive a packet over the port, the packet intended for a destination;
determine that the received packet is associated with the supplicant;
determine a set of permitted destinations for the supplicant; and
authorize transmission of the packet to its destination only if the destination is included in the set of permitted destinations for the supplicant.
16. The system of claim 11 wherein the module is configured to cause the supplicant to be validated to determine whether the supplicant is authorized to use the port based upon the supplicant identification information.
17. The system of claim 16 wherein the validation is performed according to RADIUS protocol.
18. The system of claim 16 wherein the module is configured to associate the supplicant identification information with the port upon determining that the supplicant is authorized to use the port.
19. The system of claim 11 wherein the supplicant identification information comprises one of a supplicant username, a password, or address information for the supplicant.
20. The system of claim 11 wherein the module is configured to receive an instruction to limit an amount of bandwidth allocated to the port, the instruction generated in response to analysis of the set of sample packets.
21. A system comprising:
a port; and
a module configured to:
receive supplicant identification information from a supplicant over the port;
authorize the port for use by the supplicant upon validation of the supplicant based upon the supplicant identification information;
associate the supplicant identification information with the port; and
modify a set of packets associated with the supplicant to include the supplicant identification information.
22. A method comprising:
receiving, by a network device, receive supplicant identification information from a supplicant over a port of the network device;
authorizing, by the network device, the port for use by the supplicant upon validation of the supplicant based upon the supplicant identification information;
associating, by the network device, the supplicant identification information with the port; and
modifying, by the network device, a set of packets associated with the supplicant to include the supplicant identification information.