Liveness detection for an authenticated client session

Patent metadata

Field	Value
Publication number	US-10999379-B1
Application number	US-201916583838-A
Country	US
Kind code	B1
Filing date	Sep 26, 2019
Priority date	Sep 26, 2019
Publication date	May 4, 2021
Grant date	May 4, 2021

Abstract

A network node may determine parameters of an authenticated client session for a client device, wherein the parameters comprise a network address of the client device. The network node may determine inactivity of the client device in the authenticated client session. The network node may generate, based on determining the inactivity of the client device, an address resolution protocol (ARP) message or a neighbor solicitation (NS) message to send to the client device, wherein the ARP message or the NS message is to trigger a response from the client device to indicate that the network address of the client device is in use. The network node may provide, toward the client device, the ARP message or the NS message. The network node may perform one or more actions based on receiving or not receiving the response, from the client device, to the ARP message or the NS message.

First claim

What is claimed is:

1. A method, comprising:
determining, by a network node, parameters of an authenticated client session for a client device with a dynamic host configuration protocol (DHCP) server,
wherein the parameters comprise a network address of the client device;

determining, by the network node, inactivity of the client device in the authenticated client session,
wherein the inactivity is based on a failure of the client device to transmit data via the authenticated client session for a period of time;

generating, by the network node and based on determining the inactivity of the client device, an address resolution protocol (ARP) message or a neighbor solicitation (NS) message to send to the client device,
wherein the ARP message or the NS message identifies the network address of the client device as a target network address, and
wherein the ARP message or the NS message is to trigger a response from the client device to indicate that the network address of the client device is in use;

providing, by the network node and toward the client device, the ARP message or the NS message; and
performing, by the network node, one or more actions based on receiving or not receiving the response, from the client device, to the ARP message or the NS message,
wherein the one or more actions comprise one of:
maintaining the parameters in a data structure of the network node, or
removing the parameters in the data structure of the network node, and

wherein, before the one or more actions are performed, the parameters of the authenticated client session are maintained in the data structure of the network node as part of establishing the authenticated client session.

2. The method of claim 1 , wherein the network node supports an 802.1x protocol,
wherein the client device does not support the 802.1x protocol, and
wherein the network node facilitates authentication of the client device via a radius server.

3. The method of claim 1 , wherein the network node receives the response, from the client device, to the ARP message or the NS message,
wherein, based on receiving the response, the one or more actions comprise maintaining the parameters of the authenticated client session in the data structure of the network node, and
wherein the data structure of the network node comprises one of a filtering data structure, a forwarding data structure, or a Media Access Control (MAC) radius data structure.

4. The method of claim 1 , wherein the network node does not receive the response for a predetermined amount of time, from the client device, to the ARP message or the NS message, and
wherein, based on not receiving the response for the predetermined amount of time, the one or more actions comprise removing the parameters of the authenticated client session from the data structure of the network node, and
wherein the data structure of the network node comprises one of a filtering data structure, a forwarding data structure, or a Media Access Control (MAC) radius data structure.

5. The method of claim 1 , wherein the client device comprises one or more of:
an 801.1x client device,
a captive portal client device, or
a Media Access Control radius (MAC-radius) client device.

6. The method of claim 1 , further comprising receiving, from a radius server, a vendor-specific attribute message that instructs the network node to provide the ARP message or the NS message based on determining the inactivity of the client device.

7. The method of claim 1 , wherein the network node determines the parameters of the authenticated client session for the client device via DHCP snooping or stateless address auto-configuration snooping.

8. The method of claim 1 , wherein a network layer protocol associated with the network address of the client device is Internet Protocol version 4 (IPv4), and
wherein generating the ARP message or the NS message comprises generating the ARP message based on determining that the network layer protocol associated with the network address of the client device is IPv4.

9. The method of claim 1 , wherein a network layer protocol associated with the network address of the client device is Internet Protocol version 6 (IPv6), and
wherein generating the ARP message or the NS message comprises generating the NS message based on determining that the network layer protocol associated with the network address of the client device is IPv6.

10. A network node, comprising:
one or more memories; and
one or more processors to:
determine parameters of an authenticated client session for a client device with a dynamic host configuration protocol (DHCP) server,
wherein the parameters comprise a network address of the client device and an indication of a network layer protocol of the authenticated client session;

generate, based on the indication of the network layer protocol of the authenticated client session, an address resolution protocol (ARP) message to send to the client device,
wherein the ARP message identifies the network address of the client device as a target network address, and
wherein the ARP message is to trigger a response from the client device to indicate that the network address of the client device is in use;

provide, to the client device, repetitions of the ARP message at a periodicity having a period that is less than an age-out period,
wherein the age-out period corresponds to an amount of time of inactivity after which the one or more processors are to remove the parameters of the authenticated client session; and

perform one or more actions based on a receipt of, or a failure to receive, the response to the ARP message from the client device,
wherein the one or more actions comprise one of:
maintaining the parameters in a data structure of the network node, or
removing the parameters in the data structure of the network node, and
wherein, before the one or more actions are performed, the parameters of the authenticated client session are maintained in the data structure of the network node as part of establishing the authenticated client session.

11. The network node of claim 10 , wherein the period of the periodicity of the repetitions of the ARP message is less than half of the age-out period, and
wherein the one or more processors are further to provide two or more of the repetitions of the ARP message within a particular age-out period.

12. The network node of claim 11 , wherein, based on a receipt of the response, from the client device, to at least one of the two or more of the repetitions of the ARP message, the one or more actions comprise maintaining the parameters of the authenticated client session in the data structure of the network node, and
wherein the data structure of the network node comprises one of a filtering data structure, a forwarding data structure, or a Media Access Control radius (MAC) data structure.

13. The network node of claim 11 , wherein, based on the failure to receive the response, from the client device, to any of the two or more of the repetitions of the ARP message, the one or more actions comprise removing the parameters of the authenticated client session from the data structure of the network node, and
wherein the data structure of the network node comprises one or more of a filtering data structure, a forwarding data structure, or a Media Access Control (MAC) radius data structure of the network node.

14. The network node of claim 10 , wherein the network node supports an 802.1x protocol,
wherein the client device does not support the 802.1x protocol, and
wherein the one or more processors are further to facilitate authen

Assignees

• Juniper Networks Inc

Inventors

• Galrani Manish
• Debnath Nandan

Classifications

• H04L67/10

  in which an application is distributed across nodes in the network (software deployment G06F8/60; multiprogramming arrangements G06F9/46) · CPC title

• H04L67/145 Primary

  avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session · CPC title

• H04L61/103 Primary

  across network layers, e.g. resolution of network layer into physical layer addresses or address resolution protocol [ARP] · CPC title

• H04L2101/622

  Layer-2 addresses, e.g. medium access control [MAC] addresses · CPC title

• H04L61/5014

  using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] · CPC title