Device authentication using proxy automatic configuration script requests
Methods and systems for performing device authentication using proxy automatic configuration script requests are described. One example method includes generating a unique key for a client device; configuring the client device to send a request for a proxy automatic configuration (PAC) script upon accessing a network, the request including the unique key; receiving, over a network, a request for the PAC script including a request key; and authenticating the client device on the network if the request key matches the client device's unique key.
1. A computer-implemented method executed by a network management system including one or more processors, the method comprising:
generating, by the one or more processors of the network management system, a unique key for a first client device, wherein the unique key is a string of one or more alphanumeric characters;
receiving, by the network management system over a network, a first proxy automatic configuration (PAC) script request from the first client device, the first PAC script request including a uniform resource locator (URL), the URL including a request key, wherein the request key forms at least a portion of the URL, and wherein the first PAC script request is associated with a first source address;
determining that the request key matches the generated unique key for the client device;
in response to determining that the request key matches the generated unique key for the client device;
authenticating the client device on the network; and
associating, by the network management system, the first source address with the unique key;
receiving, by the network management system, over the network, a second PAC script request including a request key matching the unique key for the first client device;
determining that the second PAC script request is associated with a second source address different than the first source address; and
in response to determining that the second PAC script request is associated with the second source address different than the first source address, blocking, by the network management system, a second client associated with the second source address from accessing the network.
2. The method of claim 1 , further comprising:
determining that the client device is no longer associated with the first source address; and
de-authenticating the client device on the network upon determining that the client device is no longer associated with the first source address.
3. The method of claim 1 , wherein the PAC script request is received according to HyperText Transfer Protocol (HTTP).
4. The method of claim 1 , wherein the PAC script request is received according to HyperText Transfer Protocol Secure (HTTPS).
5. The method of claim 1 , further comprising after authenticating the client device, authenticating a user of the client device based on user-specific credentials associated with the user and different than the unique key.
6. The method of claim 1 , further comprising de-authenticating the client device on the network after a configured period of time.
7. A network management system comprising:
a computer storage device for storing computer program instructions; and
a processor coupled with the storage device to execute the computer program instructions to perform operations comprising:
generating, by the network management system, a unique key for a first client device, wherein the unique key is a string of one or more alphanumeric characters;
receiving, by the network management system over a network, a first proxy automatic configuration (PAC) script request from the first client device, the first PAC script request including a uniform resource locator (URL), the URL including a request key, wherein the request key forms at least a portion of the URL, and wherein the first PAC script request is associated with a first source address;
determining that the request key matches the generated unique key for the client device;
in response to determining that the request key matches the generated unique key for the client device;
authenticating the client device on the network; and
associating, by the network management system, the first source address with the unique key;
receiving, by the network management system, over the network, a second PAC script request including a request key matching the unique key for the first client device;
determining that the second PAC script request is associated with a second source address different than the first source address; and
in response to determining that the second PAC script request is associated with the second source address different than the first source address, blocking, by the network management system, a second client associated with the second source address from accessing the network.
8. The network management system of claim 7 , the operations further comprising:
determining that the client device is no longer associated with the first source address; and
de-authenticating the client device on the network upon determining that the client device is no longer associated with the first source address.
9. The network management system of claim 7 , wherein the PAC script request is received according to HyperText Transfer Protocol (HTTP).
10. The network management system of claim 7 , wherein the PAC script request is received according to HyperText Transfer Protocol Secure (HTTPS).
11. The network management system of claim 7 , the operations further comprising after authenticating the client device, authenticating a user of the client device based on user-specific credentials associated with the user and different than the unique key.
12. The network management system of claim 7 , further comprising de-authenticating the client device on the network after a configured period of time.
13. A non-transitory, computer-readable medium storing instructions operable when executed to cause at least one processor to perform operations comprising:
generating a unique key for a first client device, wherein the unique key is a string of one or more alphanumeric characters;
receiving, over a network, a first proxy automatic configuration (PAC) script request from the first client device, the first PAC script request including a uniform resource locator (URL), the URL including a request key, wherein the request key forms at least a portion of the URL, and wherein the first PAC script request is associated with a first source address;
determining that the request key matches the generated unique key for the client device;
in response to determining that the request key matches the generated unique key for the client device;
authenticating the client device on the network; and
associating the first source address with the unique key;
receiving, over the network, a second PAC script request including a request key matching the unique key for the first client device;
determining that the second PAC script request is associated with a second source address different than the first source address; and
in response to determining that the second PAC script request is associated with the second source address different than the first source address, blocking a second client associated with the second source address from accessing the network.
14. The computer-readable medium of claim 13 , the operations further comprising:
determining that the client device is no longer associated with the first source address; and
de-authenticating the client device on the network upon determining that the client device is no longer associated with the first source address.
15. The computer-readable medium of claim 13 , wherein the PAC script request is received according to HyperText Transfer Protocol (HTTP).
16. The computer-readable medium of claim 13 , wherein the PAC script request is received according to HyperText Transfer Protocol Secure (HTTPS).
17. The computer-readable medium of claim 13 , the operations further comprising after authenticating the client device, authenticating a user of the client device based on user-specific credentials associated with the user and different than the unique key.