Cisco Technology, Inc.

Herbert C Morris

John S Calabrese

Rodelito L Victa

Oscar S Alonso

A method and apparatus that provide network access control are disclosed. In one embodiment, a network access control apparatus is configured to receive and authenticate a password that uses the &ldquo;Fortezza&rdquo; cryptographic protocol, and to receive and authenticate passwords of other types, to thereby selectively permit a client associated with the Fortezza password to access a protected network. A Fortezza card reader is coupled to the client and associated with a Fortezza card that contains the Fortezza password. A network access server is logically coupled to the client. An access control server is coupled logically between the client and the protected network and that controls access of the client to the protected network. A Fortezza authentication server is coupled to the access control server for communication therewith. A database is coupled to the access control server and that contains profile information associated with the user. The access control server receives, from the client, user access information associated with a particular user of the client; determining, based on the user access information and a database, a type of a password associated with the user; when the password type is FORTEZZA, requesting authentication of the password from a Fortezza server; granting the client access to the network when the Fortezza server approves the password; and when the password type is any type other than FORTEZZA, requesting authentication of the password from an authentication process that is associated with that password type.

Authentication and authorization mechanisms for Fortezza passwords

A method and apparatus for notifying a first network node that a second network node has gone off-line during a communication session is disclosed. The first network node may be a client and the second network node may be a server. The client and the server communicate using an embedded protocol, such as telnet. The protocol defines a login process that must be used by the client to establish a logical connection to the server. The protocol also specifies that the server must immediately issue a response to a login attempt, by either establishing a connection or issuing an error message. The first network node determines that no communications have been received from the second server in a pre-determined period of time. The first network node generates invalid login information, such as a randomly generated invalid user id and an invalid password. A login command is sent from the first network node to the second network node. The login command includes the previously generated invalid login information. The second network node responds, indicating that the login information is invalid or that login is refused. The response provides a positive indication to the first network node that the second network node is on-line. The process can be repeated frequently without requiring any significant system resources. If the second network node does not immediately respond, the communication session can be recovered or terminated, thereby maximizing system resources.

Growing community of inventors

Hawthorne, CA, United States of America

Herbert C Morris