Network access control at controller

Patent metadata

Field	Value
Publication number	US-2016352731-A1
Application number	US-201415117241-A
Country	US
Kind code	A1
Filing date	May 13, 2014
Priority date	May 13, 2014
Publication date	Dec 1, 2016
Grant date	—

Abstract

An example system may include a controller to receive traffic of a host from a network device. The controller may include a network access control (NAC) unit and a network unit. The NAC unit may perform NAC authentication of the host. The network unit may indicate to the network device to allow traffic from the host, if the host is authenticated by the NAC unit.

First claim

We claim:

1 . A system, comprising:
a software-defined networking (SDN) controller to receive traffic of a host from a network device, wherein the SDN controller includes, a network access control (NAC) unit to perform NAC authentication of the host, and a network unit to indicate to the network device to allow traffic from the host, if the host is authenticated by the NAC unit.

2 . The system of claim 1 , wherein,
the SDN controller includes,
an authentication unit to authenticate an identity of the host, and
an authorization unit to authorize the host to perform an activity, if the host is authenticated, and
the network unit is to indicate to the network device to allow traffic from the host, if the host is authorized by the authorization unit.

3 . The system of claim 2 , wherein,
the network unit is to transmit at least one of identification information and a permission rule to the network device, if the host is authorized by the authorization unit, the identification information relates to identifying the host of the traffic, and the permission rule relates to controlling the traffic of the host.

4 . The system of claim 3 , wherein,
the identification information relates to at least one of an ingress port, a user name, a Media Access Control (MAC) address, an Internet Protocol (IP) address, a virtual local area network (VLAN), a password, a token, a digital certificate, a digital signature and an account attribute of the host, and the permission rule relates to at least one of a time-of-day restriction, a physical location restriction, a restrictions against multiple access by the same user, an application restriction, a user access restriction, a network access restriction, a data limit restriction, a device restriction, and a priority of the traffic of the host.

5 . The system of claim 3 , wherein,
the network device is to redirect the traffic of the host if the identification information of the traffic does not match authentication information in a table of the network device, and the network device is to add the authentication information to the table, if the network unit authorizes the network device to allow the traffic from the host.

6 . The system of claim 2 , wherein,
the NAC unit further includes an accounting unit to track network resource consumption by the host, and the authentication unit is to choose a type of the authentication for the host based on a type of the traffic from the host.

7 . The system of claim 2 , wherein,
the authentication unit is to obtain at least one of user credentials and a status information, when the authentication unit performs NAC authentication of the host, the authorization unit is to obtain at least one of a rule and a policy, when the authorization unit performs NAC authorization of the host.

8 . The system of claim 2 , wherein
the network device is to capture and transmit authentication protocol packets to the NAC unit, the NAC unit is to determine the type of the authentication based on the type of authentication control packets, and the controller further includes a Dynamic Host Configuration Protocol (DHCP) unit to at least one of snoop and inspect DHCP packets sent to the network device for processing.

9 . The system of claim 1 , wherein,
the SDN controller is provide at least one of a local repository of users and policies, access to an authentication, authorization, and accounting (AAA) server and a policy server, and the SDN controller is to obtain client credentials.

10 . The system of claim 1 , wherein,
the SDN controller and network device are to communicate via Openflow, the SDN controller is to push rules to the network device, and only the SDN controller is updated for at least one of software and policy updates related to NAC authentication.

11 . A method, comprising:
receiving, at a controller, traffic from a network device of a host that is not authenticated; performing, at the controller, network access control (NAC) authentication based on the received traffic; and authorizing, at the controller, the network device to allow traffic of the host, if the host is authenticated, wherein the network device is to redirect traffic to the controller, if the host is not authorized.

12 . The method of claim 11 , wherein,
at least one of the network device and the controller are to collect data from the host, if the host is not authorized, and the network device is to further redirect the traffic to a guest network, if the host is not authorized.

13 . The method of claim 11 , wherein,
the host is not authorized if at least one of a Media Access Control (MAC) and Internet Protocol (IP) address of the host does not match an entry of a table of the network device, and the NAC authentication includes at least one of 802.1X, web and MAC authentication on the traffic at the controller.

14 . A non-transitory computer-readable storage medium storing instructions that, if executed by a processor of a controller, cause the processor to:
perform network access control (NAC) authentication of a host based on traffic of the host; perform NAC authorization of the host, if the host is authenticated; and send a rule to a network device to permit the traffic of the host, if the host is authorized, wherein the network device is to redirect the traffic of the host to the controller, if the host is not authorized.

15 . The non-transitory computer-readable storage medium of claim 14 , further storing instructions that, if executed by a processor of the controller, cause the processor to:
send a rule to the network device to redirect the traffic from the network device to the controller, if the traffic is not authorized.

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Mentze Duane Edward
• Wakumoto Shaun
• Mills Craig Joseph

Classifications

• H04L63/0876 Primary

  based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint · CPC title

• H04L63/0227

  Filtering policies (mail message filtering H04L51/212) · CPC title

• H04L12/6418 Primary

  Hybrid transport · CPC title

• H04L63/08

  for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32) · CPC title