Cisco Technology, Inc.

Andrew M Clymer

Darran Potter

Jeremy Stieglitz

Kaushik Narayan

John Zamick

A method is disclosed for determining the authentication capabilities of a supplicant before initiating an authentication conversation with a client, for example, using Extensible Authentication Protocol (EAP). In one aspect, the method provides for sending, to a supplicant that is requesting access to a computer network subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by an authentication server; receiving, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining how many second authentication methods in the counter-list match the first authentication methods; and performing an authentication policy action based on how many of the second authentication methods match the first authentication methods. Policy actions can include blocking access, re-directing to sources of acceptable authentication methods, granting one of several levels of network access, etc.

Method and apparatus for determining authentication capabilities

The invention relates to a method for requesting access to services across a computer network, preferably although not exclusively to a network in which access is controlled by a AAA server. Instead of defining on the AAA server all possible network devices that may require or provide access, along with the respective services they may need, in the present invention the network devices submit access request messages which include information both identifying the device and also specifying explicitly which services are needed. On receipt of such requests, the AAA server uses its internal policies to confirm or deny access, to select appropriate services from those requested, and to instruct the provisioning of those services. The invention provides additional granularity in authentication/authorization, and also significantly reduces the amount of work required to set up and maintain the AAA server.

Method for a network device to describe itself and the services it requires to a AAA server

A method and apparatus for load balancing within a computer system makes use of client MAC addresses, reduced modulo N, to direct client requests to a particular server within a server farm. The method is particularly applicable to load balancing applied to AAA servers. In the preferred embodiments, the method can handle failovers and fail-back with few or no aborted authentications.

Method and apparatus for load balancing within a computer system

According to one embodiment of the invention, a session list identifying communication sessions relating to supplicants that access a computer network through an access device is created and stored at an authentication server. Then, an event is received from an anti-virus system announcing an updated anti-virus policy. User input is received that requests performing posture validation for all the supplicants. Next, in response to the information received, a time value for starting the posture validation for a particular supplicant identified in the session list. Finally, in response to the information received, a request to perform posture validation is generated and sent to the access device, wherein the request includes supplicant identifying information, the time value, and instructions that instructs the access device to initiate the posture validation for that supplicant only after the time value has expired. The steps are repeated for all supplicants in the session list.

Method and apparatus for automatically re-validating multiple clients of an authentication system

Creating and storing troubleshooting information for providing access control information to a network device involves receiving a provisioning of control lists, and associations of the ACLs to users of the device. During authenticating a user login, a name of a first ACL is provided to the device, selected from among the ACLs based on the associations. A request is received from the device for a first ACL that is associated with a user of the device. The request includes the name of the ACL. The first ACL is sent to the network device in response to the request. Embodiments may use RADIUS for communicating ACLs from an authentication server to a firewall. A de-fragmentation approach enables downloading ACLs that exceed the maximum RADIUS packet size. Using an ACL renaming approach the firewall updates its cache when a user subsequently logs in and the corresponding ACL has changed.

Method and apparatus for retrieving access control information

A method of authorizing network device operations that are requested by applications is disclosed. A request for authorization from a network management application is received. The request identifies a user who is using the network management application to interact with a network device, the network management application that is seeking to execute one or more application tasks on a network device, the device, and the application tasks. A determination whether the specified user is authorized to execute the application tasks on the device is made. A success message is sent to the application only when the specified user is authorized to execute the application tasks on the device. Other embodiments support authorizing one application task against a plurality of devices or device groups. TACACS+ may be used for communication. A TACACS+ server that can support application authorization, and associated extensions to the TACACS+ protocol, are described.

Method and apparatus for authorizing network device operations that are requested by applications

A method is disclosed for creating and storing troubleshooting information for providing access control information to a network device. A provisioning of one or more access control lists, and one or more associations of the access control lists to users of the network device, are received. As part of authenticating a user login request, a name of a first access control list is provided to the network device, selected from among the one or more access control lists that based on the associations. A request is received from the network device for a first access control list that is associated with a user of the network device. The request includes the name of the access control list. The first access control list is sent to the network device in response to the request. Embodiments may use RADIUS packets for communicating ACLs from an authentication server to a firewall, and a de-fragmentation approach is disclosed for downloading ACLs that exceed the maximum RADIUS packet size. Further, using an ACL renaming approach the firewall is forced to update its cache when a user subsequently logs in and the corresponding ACL has changed in the interim.

Growing community of inventors

Chippenham, United Kingdom

Andrew M Clymer