Network system, controller and packet authenticating method

Patent metadata

Field	Value
Publication number	US-2016337372-A1
Application number	US-201615220988-A
Country	US
Kind code	A1
Filing date	Jul 27, 2016
Priority date	Apr 3, 2012
Publication date	Nov 17, 2016
Grant date	—

Abstract

A controller managing a switch receives from the switch, a notice of an unknown packet sent from an access source host that is used by a plurality of users having different authorities. The controller inquires authentication data of a packet transmission user to the access source host. The controller inquires the permission or refusal of access to the access destination host based on the authentication data. When the access is permitted, the controller instructs the switch to register a flow entry of transfer of the packet. When the access is refused, the controller instructs the switch to register a flow entry of discard of the packet.

First claim

1 - 10 . (canceled)

11 . a control apparatus, comprising:
a memory configured to store program instructions; and a processor configured to execute the program instructions to:
receive user information from an access terminal of a network user;
send, to an authentication server, an inquiry corresponding to the user information;
identify, in responds to receiving an indication of access permission corresponding to the network user from the authentication server, a processing instruction for processing a packet corresponding to the network user; and
send the processing instruction to a switch apparatus configured to receive the packet from the access terminal.

12 . The control apparatus according to claim 11 , wherein the processor is further configured to execute the program instructions to send a request for the user information to the access terminal.

13 . The control apparatus according to claim 11 , wherein the processor is further configured to execute the program instructions to receive, from the switch apparatus, a request for processing the packet.

14 . The control apparatus according to claim 11 , wherein the inquiry includes a port identifier corresponding to the user.

15 . The control apparatus according to claim 11 , wherein the processor is further configured to execute the program instructions to:
identify, in response to receiving an indication of access denial corresponding to the network user from the authentication server, a discarding instruction for discarding a packet corresponding to the network user; and send the discarding instruction to the switch apparatus.

16 . The control apparatus according to claim 15 , wherein the processor is further configured to execute the program instructions to:
count the indication of access denial received from the authentication server; send, to the switch apparatus, an instruction to cancel the discarding instruction, when a count of the indication of access denial is over a threshold.

17 . A network system, comprising:
an access terminal associated with a network user; an authentication server; a switch apparatus configured to receive the packet from the access terminal; and a control apparatus comprising:
a memory configured to store program instructions; and
a processor configured to execute the program instructions to:
receive, from the access terminal, user information of the network user;
send, to the authentication server, an inquiry corresponding to the user information;
identify, in response the receiving an indication of access permission corresponding to the network user from the authentication server, a processing instruction for processing a packet corresponding to the network user; and
send the processing instruction to the switch apparatus.

18 . the network system according to claim 17 , wherein the processor is further configured to execute the program instructions to send a request for the user information to the access terminal.

19 . The network system according to claim 17 , wherein the processor is further configured to execute the program instructions to receive, from the switch apparatus, a request for processing the packet.

20 . The network system according to claim 17 , wherein the inquiry includes a port identifier corresponding to the user.

21 . The network system according to claim 17 , wherein the processor is further configured to execute the program instructions to:
identify, in response to receiving an indication of access denial corresponding to the network user from the authentication server, a discarding instruction for discarding a packet corresponding to the network user; and send the discarding instruction to the switch apparatus.

22 . The network system according to claim 21 , wherein the processor is further configured to execute the program instructions to:
count the indication the access denial received from the authentication server; send, to the switch apparatus, an instruction to cancel the discarding instruction, when a count of the indication of access denial is over a threshold.

23 . A network control method, comprising:
receiving user information from an access terminal to which an network user access; sending, to an authentication server, an inquiry corresponding to the user information; identifying, in response to receiving an indication of access permission corresponding to the network user from the authentication server, a processing instruction for processing a packet corresponding to the network user; and sending the processing instruction to a switch apparatus configured to receive the packet from the access terminal.

24 . The network control method according to claim 23 , further comprising sending a request for the user information to the access terminal.

25 . The network control method according to claim 23 , further comprising receiving, from the switch apparatus, a request for processing the packet.

26 . The network control method according to claim 23 , wherein the inquiry includes a port identifier corresponding to the user.

27 . The network control method according to claim 23 , further comprising:
identifying, in response to receiving the indication of access denial from the authentication server; a discarding instruction for discarding a packet corresponding to the network user; and sending the discarding instruction to the switch apparatus.

28 . The network control method according to claim 27 , further comprising:
counting the indication of access denial received from the authentication server; sending, to the switch apparatus, an instruction to cancel the discarding instruction, when a count of the indication of access denial is over a threshold.

Assignees

• Nec Corp

Inventors

• Togawa Osamu

Classifications

• H04L63/0884

  by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity · CPC title

• H04L63/102 Primary

  Entity profiles · CPC title

• H04L63/08 Primary

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title