Supporting multiple authentication methods on a port of a network device at the same time

Patent metadata

Field	Value
Publication number	US-11562062-B1
Application number	US-201916573379-A
Country	US
Kind code	B1
Filing date	Sep 17, 2019
Priority date	Sep 17, 2019
Publication date	Jan 24, 2023
Grant date	Jan 24, 2023

Abstract

A network device may receive, via a single port of the network device, a connection request from a user device and may obtain, based on the connection request, information related to an authentication history of the user device. The network device may determine, based on the information related to the authentication history of the user device, an authentication method to be used by the network device to authenticate the user device and may determine, using the authentication method, that the user device is authenticated. The network device may establish, based on determining that the user device is authenticated, an authenticated communication session with the user device on the single port of the network device. The network device may determine, using an additional authentication method, that an additional user device is authenticated and may establish an additional authenticated communication session with the additional user device on the single port.

First claim

What is claimed is:

1. A method, comprising:
receiving, by a network device and via a single port of the network device, a connection request from a user device;
obtaining, by the network device and based on the connection request, information related to an authentication history of the user device from a first data structure,
wherein the first data structure stores information that indicates whether the network device has previously authenticated the user device and information that indicates whether an authentication method was previously used to authenticate the user device;

determining, by the network device and based on the information related to the authentication history of the user device, the authentication method to be used by the network device to authenticate the user device,
wherein determining the authentication method to be used by the network device to authenticate the user device comprises:
determining, based on the information related to the authentication history of the user device, that the network device has not previously authenticated the user device;
obtaining, by the network device and based on determining that the network device has not previously authenticated the user device, information identifying a default authentication method from a second data structure,
wherein the second data structure stores the information identifying the default authentication method; and

selecting the default authentication method as the authentication method to be used by the network device to authenticate the user device;

generating, by the network device and based on the authentication method, an authentication request;
sending, by the network device and via the single port of the network device, the authentication request to the user device;
receiving, by the network device and via the single port of the network device, an authentication response from the user device;
determining, by the network device and based on the authentication response and the authentication method, that the user device is authenticated;
establishing, by the network device and based on determining that the user device is authenticated, an authenticated communication session with the user device on the single port of the network device; and
causing, by the network device and based on determining that the user device is authenticated, the information related to the authentication history of the user device to be updated in the first data structure.

2. The method of claim 1 , further comprising:
receiving, via the single port of the network device, an additional connection request from an additional user device;
obtaining, based on the additional connection request, information related to an authentication history of the additional user device from the first data structure;
determining, based on the information related to the authentication history of the additional user device, an additional authentication method to be used by the network device to authenticate the additional user device,
wherein the additional authentication method and the authentication method are different;

communicating, via the single port of the network device and based on the additional authentication method, with the additional user device to determine that the additional user device is authenticated;
establishing, based on determining that the additional user device is authenticated, an additional authenticated communication session with the additional user device on the single port of the network device; and
causing, based on determining that the additional user device is authenticated, the information related to the authentication history of the additional user device to be updated in the first data structure.

3. The method of claim 1 , wherein the connection request includes a media access control (MAC) address associated with the user device, an internet protocol (IP) address associated with the user device, a device identifier associated with the user device, or information associated with a user of the user device.

4. The method of claim 2 , wherein determining the additional authentication method to be used by the network device to authenticate the additional user device comprises:
determining, based on the information related to the authentication history of the additional user device, a previously used authentication method that was used by the network device to authenticate the additional user device; and
selecting the previously used authentication method as the additional authentication method to be used by the network device to authenticate the additional user device.

5. The method of claim 1 ,
wherein the authentication method is one or more of:
a web-based authentication method, or
a MAC-based authentication method.

6. The method of claim 1 , wherein the authentication method is a web-based authentication method and the authentication request is a captive portal authentication request.

7. The method of claim 1 , wherein the authentication method is an Institute of Electrical and Electronics Engineers (IEEE) 802.1x authentication method and the authentication request is an extensible authentication protocol over local area network (EAPoL) request.

8. The method of claim 1 , wherein determining that the user device is authenticated comprises:
sending the authentication response to a server device;
receiving an authentication acceptance message from the server device; and
determining, based on the authentication acceptance message, that the user device is authenticated.

9. The method of claim 1 , wherein causing the information related to the authentication history of the user device to be updated and stored in the first data structure comprises:
sending, to the first data structure, information that identifies the user device and indicates the authentication method.

10. A network device, comprising:
a first data structure,
wherein the first data structure stores information related to authentication histories associated with a plurality of user devices;

a second data structure,
wherein the second data structure stores information related to a default authentication method;

one or more memories; and
one or more processors to:
receive, via a single port of the network device, a connection request from a user device of the plurality of user devices;
obtain, based on the connection request, information related to an authentication history, of the authentication histories, of the user device;
determine, based on the information related to the authentication history of the user device, a first authentication method to be used by the network device to authenticate the user device;
determine, using the first authentication method, that the user device is not authenticated;
determine, based on determining that the user device is not authenticated, a second authentication method to be used by the network device to authenticate the user device from the second data structure;
determine, using the second authentication method, that the user device is authenticated; and
establish, based on determining that the user device is authenticated, an authenticated communication session with the user device on the single port of the network device.

11. The network device of claim 10 , wherein the one or more processors are further to:
receive, via the single port of the network device, an additional connection request from an additional user device;
obtain, based on the additional connection request, information related to an authentication history of the additional user device;
determine, based on the information related to the authentication history of the additional user d

Assignees

• Juniper Networks Inc

Inventors

• Mishra Subha Sankar
• Debnath Nandan

Classifications

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• G06F21/45 Primary

  Structures or tools for the administration of authentication · CPC title

• G06F21/44

  Program or device authentication · CPC title

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title