Network access control
A network controller configured to provide network access to client devices, receives a network access request from a client device. The network access request includes a media access control (MAC) address of the client device and information about a first private key. The network controller sends to a server an authentication request, which includes the MAC address of the client device. The network controller receives an authentication response from the server, which includes a second private key. The network controller determines whether the first private key is the same as the second private key. In response to determining that the first private key is different from the second private key, network access is denied to the client device, and in response to determining that the first private key is the same as the second private key, network access is granted to the client device.
1. A method comprising:
at a network device configured to provide network access to client devices, receiving a network access request from a client device, the network access request including a media access control (MAC) address of the client device;
sending, by the network device, an authentication request to a server, wherein the authentication request includes the MAC address of the client device;
receiving an authentication response from the server, the authentication response including a private key;
initiating a four-way handshake with the client device using the private key returned by the server;
in response to determining from the four-way handshake that the client device has not been configured with the private key, denying network access to the client device; and
in response to determining from the four-way handshake that the client device has been configured with the private key, granting network access to the client device.
2. The method of claim 1 , wherein the authentication response further includes vendor-specific attributes.
3. The method of claim 1 , further comprising:
registering the client device with the server, wherein the server generates the private key for the client device.
4. The method of claim 1 , wherein the private key is unique to the client device.
5. The method of claim 1 , wherein the private key is unique to a group of devices that includes the client device.
6. The method of claim 1 , wherein the network access request received from the client device is an authentication request.
7. The method of claim 1 , wherein the network device comprises a link layer network access controller.
8. The method of claim 1 , wherein the network device comprises a wireless LAN controller.
9. The method of claim 1 , further comprising denying network access to the client device if the authentication response does not include a private key.
10. The method of claim 1 , wherein the authentication response includes access restriction parameters to restrict the network access to the client device to a predetermined network resource.
11. The method of claim 1 , wherein the private key is a pre-shared key.
12. An apparatus comprising:
a network interface that enables network communications;
a processor; and
a memory to store data and instructions executable by the processor, wherein the processor is configured to execute the instructions to:
receive a network access request from a client device, the network access request including a media access control (MAC) address of the client device;
send an authentication request to a server, wherein the authentication request includes the MAC address of the client device;
receive an authentication response from the server, the authentication response including a private key;
initiate a four-way handshake with the client device using the private key returned by the server;
in response to determining from the four-way handshake that the client device has not been configured with the private key, deny network access to the client device; and
in response to determining from the four-way handshake that the client device has been configured with the private key, grant network access to the client device.
13. The apparatus of claim 12 , wherein the authentication response further includes vendor-specific attributes.
14. The apparatus of claim 12 , wherein the processor is configured to execute the instructions to:
register the client device with the server, wherein the server generates the private key for the client device.
15. The apparatus of claim 12 , wherein the private key is unique to the client device.
16. The apparatus of claim 12 , wherein the private key is unique to a group of devices that includes the client device.
17. The apparatus of claim 12 , wherein the network access request received from the client device is an authentication request.
18. The apparatus of claim 12 , wherein the apparatus comprises a link layer network access controller.
19. The apparatus of claim 12 , wherein the apparatus comprises a wireless LAN controller.
20. The apparatus of claim 12 , wherein the processor is configured to execute the instructions to:
deny network access to the client device if the authentication response does not include a private key.
21. The apparatus of claim 12 , wherein the authentication response includes access restriction parameters to restrict the network access to the client device to a predetermined network resource.
22. The apparatus of claim 12 , wherein the private key is a pre-shared key.
23. A non-transitory computer-readable storage media encoded with software comprising computer executable instructions which, when executed by a processor, cause the processor to:
receive a network access request from a client device, the network access request including a media access control (MAC) address of the client device;
send an authentication request to a server, wherein the authentication request includes the MAC address of the client device;
receive an authentication response from the server, the authentication response including a private key;
initiate a four-way handshake with the client device using the private key returned by the server;
in response to determining from initiation of the four-way handshake that the client device has not been configured with the private key, deny network access to the client device; and
in response to determining from initiation of the four-way handshake that the client device has been configured with the private key, grant network access to the client device.
24. The non-transitory computer-readable storage media of claim 23 , wherein the authentication response further includes vendor-specific attributes.
25. The non-transitory computer-readable storage media of claim 23 , wherein the instructions further cause the processor to:
register the client device with the server, wherein the server generates the private key for the client device.
26. The non-transitory computer-readable storage media of claim 23 wherein the private key is unique to the client device.
27. The non-transitory computer-readable storage media of claim 23 wherein the private key is unique to a group of devices that includes the client device.
28. The non-transitory computer-readable storage media of claim 23 , wherein the network access request received from the client device is an authentication request.
29. The non-transitory computer-readable storage media of claim 23 , wherein the instructions further cause the processor to:
deny network access to the client device if the authentication response does not include a private key.
30. The non-transitory computer-readable storage media of claim 23 , wherein the authentication response includes access restriction parameters to restrict the network access to the client device to a predetermined network resource.
31. The non-transitory computer-readable storage media of claim 23 , wherein the private key is a pre-shared key.