Authentication and authorization in network layer two and network layer three
View Patent ↗A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.
1. A method comprising:
receiving, by a first device, identification information of a user of a second device that is different than the first device;
providing, by the first device and to the second device, layer 2 access in a network when the second device is authenticated over layer 2 based on the identification information;
determining, by the first device and based on the identification information, one or more resources, in the network, that the user is authorized to access;
sending to the second device and when the second device is authenticated:
a network address of the first device,
first information that is based on the determined one or more resources, and
second information that is used by the second device to verify an identity of the first device;
receiving, by the first device and from the second device, a request to verify the identity of the first device after sending the second information to the second device,
the request to verify the identity of the first device being sent by the second device using the network address of the first device;
providing, by the first device and to the second device, the second information to verify the identity of the first device, after receiving the request to verify the identity of the first device;
receiving, by the first device and from the second device, third information after providing the second information to verify the identity of the first device; and
providing, by the first device and to the second device, layer 3 access in the network, when the third information corresponds to the first information.
2. The method of claim 1 , further comprising:
determining a health status of the second device,
where determining the one or more resources includes determining the one or more resources further based on the health status of the second device.
3. The method of claim 2 , further comprising:
determining that the second device is healthy when the second device is running an up-to-date anti-virus software,
where determining the one or more resources includes determining the one or more resources further based on determining that the second device is healthy.
4. The method of claim 1 , further comprising:
storing, in a memory of the first device, a plurality of:
the identification information of the user,
information identifying the one or more resources, or
information identifying a health status of the second device.
5. The method of claim 4 , further comprising:
sending, to a firewall device, the plurality of:
the identification information of the user,
the information identifying the one or more resources, or
the information identifying the health status of the second device,
to permit the firewall device to enforce the layer 3 access in the network based on the plurality of:
the identification information of the user,
the information identifying the one or more resources, or
the information identifying the health status of the second device.
6. The method of claim 1 , further comprising:
receiving the identification information of the user from a third device different than the first device and the second device.
7. The method of claim 1 , further comprising:
determining whether the second device is authenticated over layer 2 based on the identification information; and
denying layer 2 access in the network when the second device is not authenticated over layer 2 based on the identification information.
8. A device comprising:
a non-transitory memory to store instructions; and
a processor to execute the instructions to:
determine whether another device is authenticated over layer 2 based on identification information of a user of the other device,
provide, to the other device, layer 2 access in a network when the other device is authenticated over layer 2 based on the identification information,
determine, based on the identification information, one or more resources, in the network, that the user is authorized to access,
send to the other device when the other device is authenticated:
a network address of the device,
first information that is based on the determined one or more resources, and
second information that is used by the other device to verify an identity of the device,
receive, from the other device, a request to verify the identity of the device after sending the second information to the other device,
the request to verify the identity of the device being sent by the other device using the network address of the device,
provide, to the other device, the second information to verify the identity of the device, after receiving the request to verify the identity of the device,
receive, from the other device, third information after providing the second information to verify the identity of the device, and
provide, to the other device, layer 3 access in the network, when the third information corresponds to the first information.
9. The device of claim 8 , where the device corresponds to a first device and the other device corresponds to a second device, and
where the processor is further to:
receive the identification information of the user from a third device different than the first device and the second device.
10. The device of claim 8 , where the processor is further to:
deny layer 2 access in the network when the second device is not authenticated over layer 2.
11. The device of claim 8 , where the processor is further to:
determine whether an anti-virus software is installed on the other device, and
determine whether the other device is healthy based on determining whether the anti-virus software is installed on the other device,
where, when determining the one or more resources, the processor is to determine the one or more resources further based on determining whether the other device is healthy.
12. The device of claim 11 , where the processor is further to:
determine that the anti-virus software is installed on the other device, and
determine that the other device is healthy based on determining that the anti-virus software is installed on the other device,
where, when determining the one or more resources, the processor is to determine the one or more resources further based on determining that the other device is healthy.
13. The device of claim 8 , where the processor is further to:
store in the non-transitory memory:
the identification information of the user,
information identifying the one or more resources, and
information identifying a health status of the second device.
14. The device of claim 13 , where the processor is further to:
send, to a firewall device, the identification information of the user, the information identifying the one or more resources, and the information identifying a health status of the other device to permit, the firewall device to enforce layer 3 access in the network based on the identification information of the user, the information identifying the one or more resources, and the information identifying the health status of the other device.
15. A non-transitory computer-readable medium storing instructions, the instructions comprising:
one or more instructions which, when executed by a device, cause the device to determine that another device is authenticated over layer 2 based on identification information of a user of the other device;
one or more instructions which, when executed by the device, cause the device to provide, to the other device, layer 2 access in a network based on the other device being authenticated over layer 2;
one or more instructions which, when executed by the device, cause the device to determine, based on the identification information, one or more resources, in the network, that the user is authorized to access;
one or more instructions which, when executed by the device, cause the device to send to the other device based on the other device being authenticated:
a network address of the device,
first information that is based on the determined one or more resources, and
second information that is used by the other device to verify an identity of the device;
one or more instructions which, when executed by the device, cause the device to receive, from the other device, a request to verify the identity of the device after sending the second information to the other device;
one or more instructions which, when executed by the device, cause the device to provide, to the other device, the second information to verify the identity of the device, after receiving the request to verify the identity of the device,
the request to verify the identity of the device being sent by the other device using the network address of the device;
one or more instructions which, when executed by the device, cause the device to receive, from the other device, third information after providing the second information to verify the identity of the device; and
one or more instructions which, when executed by the device, cause the device to provide, to the other device, layer 3 access in the network, when the third information corresponds to the first information.
16. The non-transitory computer-readable medium of claim 15 , where the device corresponds to a first device and the other device corresponds to a second device,
the instructions further comprising:
one or more instructions to receive the identification information of the user from a third device different than the first device and the second device.
17. The non-transitory computer-readable medium of claim 15 , the instructions further comprising:
one or more instructions to determine that the other device is healthy based on an anti-virus software that is installed on the other device,
where the one or more resources are determined further based on determining that the other device is healthy.
18. The non-transitory computer-readable medium of claim 15 , the instructions further comprising:
one or more instructions to send, to a firewall device, the identification information of the user, information identifying the one or more resources, and information identifying a health status of the other device to permit the firewall device to enforce layer 3 access in the network based on the identification information of the user, the information identifying the one or more resources, and the information identifying the health status of the other device.
19. The non-transitory computer-readable medium of claim 15 , the instructions further comprising:
one or more instructions to determine whether the other device is authenticated over layer 2 based on the identification information; and
one or more instructions to deny layer 2 access in the network when the other device is not authenticated over layer 2 based on the identification information.
20. The non-transitory computer-readable medium of claim 15 , the instructions further comprising:
one or more instructions to store, in a memory of the device, a plurality of:
the identification information of the user,
information identifying the one or more resources, or
information identifying a health status of the other device; and
one or more instructions to send, to a firewall device, the plurality of the identification information of the user, the information identifying the one or more resources, or the information identifying a health status of the other device to permit the firewall device to enforce layer 3 access in the network based on the plurality of the identification information of the user, the information identifying the one or more resources, or the information identifying the health status of the other device.