Enforcing a health policy in a local area network
A method for injecting a security token into an authentication protocol response is disclosed. An authentication protocol response from a node requesting access to a network is intercepted. It is determined if the node complies with a health policy of the network. A security token is inserted into the authentication protocol response based on the compliance node.
1. A method for injecting a security token into an authentication protocol response, comprising:
configuring at least one processor to perform the functions of:
intercepting the authentication protocol response sent from a node requesting access to a network after receiving, at said node, a request/identity message from an authenticator;
determining, at the node requesting access to the network, if the node complies with a health policy of the network;
inserting a security token by the access requesting node into the authentication protocol response based on the compliance of the node, wherein a value within the security token indicates whether the node complies with the health policy; and
forwarding said inserted authentication protocol response to the authenticator that restricts communications between the access requesting node and an authentication server in the network.
2. The method of claim 1 , wherein the inserting comprises unconditionally inserting the security token.
3. The method of claim 2 , further comprising allowing the node to unconditionally send the authentication protocol response with the security token to an authenticator.
4. The method of claim 1 , wherein the inserting comprises conditionally inserting the security token only if the node complies with the health policy.
5. The method of claim 4 , further comprising allowing the node to send the authentication protocol response to an authenticator only if the security token is inserted.
6. The method of claim 4 , further comprising terminating an authentication process if the node does not comply with the health policy.
7. The method of claim 1 , wherein the authentication protocol response is an Extensible Authentication Protocol (EAP) response.
8. A computing device that is configured for injecting a security token into an authentication protocol response, comprising:
a processor;
memory in electronic communication with the processor; instructions stored in the memory, the instructions being executable to:
intercept the authentication protocol response sent from a node requesting access to a network after receiving, at said node, a request/identity message from an authenticator;
determine, at the node requesting access to the network, if the node complies with a health policy of the network;
insert a security token by the access requesting node into the authentication protocol response based on the compliance of the node, wherein a value within the security token indicates whether the node complies with the health policy; and
forwarding said inserted authentication protocol response to the authenticator that restricts communications between the access requesting node and an authentication server in the network.
9. The computing device of claim 8 , wherein the instructions executable to insert comprise instructions executable to unconditionally insert the security token.
10. The computing device of claim 9 , further comprising instructions executable to allow the node to unconditionally send the authentication protocol response with the security token to an authenticator.
11. The computing device of claim 8 , wherein the instructions executable to insert comprise instructions executable to conditionally insert the security token only if the node complies with the health policy.
12. The computing device of claim 11 , further comprising instructions executable to allow the node to send the authentication protocol response to an authenticator only if the security token is inserted.
13. The computing device of claim 11 , further comprising instructions executable to terminate an authentication process if the node does not comply with the health policy.
14. The computing device of claim 8 , wherein the authentication protocol response is an Extensible Authentication Protocol (EAP) response.
15. A non-transitory tangible computer-readable medium for injecting a security token into an authentication protocol response comprising executable instructions for:
intercepting the authentication protocol response sent from a node requesting access to a network after receiving, at said node, a request/identity message from an authenticator;
determining, at the node requesting access to the network, if the node complies with a health policy of the network;
inserting a security token by the access requesting node into the authentication protocol response based on the compliance of the node, wherein a value within the security token indicates whether the node complies with the health policy; and
forwarding said inserted authentication protocol response to the authenticator that restricts communications between the access requesting node and an authentication server in the network.
16. The computer-readable medium of claim 15 , wherein the instructions for inserting comprise instructions for unconditionally inserting the security token.
17. The computer-readable medium of claim 16 , further comprising executable instructions for allowing the node to unconditionally send the authentication protocol response with the security token to an authenticator.
18. The computer-readable medium of claim 15 , wherein the instructions for inserting comprise instructions for conditionally inserting the security token only if the node complies with the health policy.
19. The computer-readable medium of claim 18 , further comprising executable instructions for allowing the node to send the authentication protocol response to an authenticator only if the security token is inserted.
20. The computer-readable medium of claim 18 , further comprising executable instructions for terminating an authentication process if the node does not comply with the health policy.
21. The computer-readable medium of claim 15 , wherein the authentication protocol response is an Extensible Authentication Protocol (EAP) response.
22. A method for forwarding an encapsulation protocol access request, comprising: configuring at least one processor to perform the functions of:
receiving at a proxy server the encapsulation protocol access request from an authenticator after the authenticator receives an authentication protocol response from a requesting node;
determining whether the access request includes a security token that indicates the requesting node has determined whether the requesting node complies with a health policy; and
forwarding the encapsulation protocol access request to an authentication server based on the determination.
23. The method of claim 22 , further comprising:
if a security token in the access request indicates that a requesting node complies:
forwarding the encapsulation protocol access request to the authentication server.
24. The method of claim 22 , further comprising:
if a security token is not included in the access request or a security token is included that indicates non-compliance of the requesting node:
generating an encapsulation protocol access reject message; and
sending the access reject message to the authenticator.
25. The method of claim 22 , further comprising:
receiving an encapsulation protocol access challenge from the authentication server; and
forwarding the access challenge to the authenticator.
26. The method of claim 22 , wherein the encapsulation protocol access request is a Remote Authentication Dial In User Service (RADIUS) Access-Request message.
27. A computing device that is configured for forwarding an encapsulation protocol access request, comprising:
a processor;
memory in electronic communication with the processor;
instructions stored in the memory, the instructions being executable to:
receive at a proxy server the encapsulation protocol access request from an authenticator after the authenticator receives an authentication protocol response from a requesting node;
determine whether the access request includes a security token that indicates the requesting node has determined whether the requesting node complies with a health policy; and
forward the encapsulation protocol access request to an authentication server based on the determination.
28. The computing device of claim 27 , further comprising instructions executable to:
if a security token in the access request indicates that a requesting node complies:
forward the encapsulation protocol access request to the authentication server.
29. The computing device of claim 27 , further comprising instructions executable to:
if a security token is not included in the access request or a security token is included that indicates non-compliance of the requesting node:
generate an encapsulation protocol access reject message; and
send the access reject message to the authenticator.
30. The computing device of claim 27 , further comprising instructions executable to:
receive an encapsulation protocol access challenge from the authentication server; and
forward the access challenge to the authenticator.
31. The computing device of claim 27 , wherein the encapsulation protocol access request is a Remote Authentication Dial In User Service (RADIUS) Access-Request message.
32. A non-transitory tangible computer-readable medium for forwarding an encapsulation protocol access request comprising executable instructions for:
receiving at a proxy server the encapsulation protocol access request from an authenticator after the authenticator receives an authentication protocol response from a requesting node;
determining whether the access request includes a security token that indicates the requesting node has determined whether the requesting node complies with a health policy; and
forwarding the encapsulation protocol access request to an authentication server based on the determination.
33. The computer-readable medium of claim 32 , further comprising executable instructions for:
if a security token in the access request indicates that a requesting node complies:
forwarding the encapsulation protocol access request to the authentication server.
34. The computer-readable medium of claim 32 , further comprising executable instructions for:
if a security token is not included in the access request or a security token is included that indicates non-compliance of the requesting node:
generating an encapsulation protocol access reject message; and
sending the access reject message to the authenticator.
35. The computer-readable medium of claim 32 , further comprising executable instructions for:
receiving an encapsulation protocol access challenge from the authentication server; and
forwarding the access challenge to the authenticator.
36. The computer-readable medium of claim 32 , wherein the encapsulation protocol access request is a Remote Authentication Dial In User Service (RADIUS) Access-Request message.