Method and network element for improved access to communication networks
AssigneeTecteco Security Systems, S.L.
InventorJose Antonio Enrique Salpico
Life of this patent
Estimating the term…
Abstract
The present invention proposes a method and network element which allows increasing, in different aspects, communications network protection in a single network element. This element will have the ability to manage and provide the mechanisms needed for communications, user and device protection without having to cooperate with end systems (i.e., in a transparent manner for said systems). The present invention proposes a new physical and logical architecture for said network element with various databases and verification and learning mechanisms, offering protection, management and automation abilities much greater than the systems existing today.
Claims15
A method for the improved access of a user (101) to a communications network using an electronic device (102), where the method comprises the following steps performed in the Open Systems Interconnection (OSI) model layer 2 in a network element, where the network element is a router or switch which manages access to the communications network:
- a) receiving from the electronic device a OSI model layer 2 message including a network access request and an identifier of the electronic device;
- b) if said identifier of the electronic device is registered in an internal database of the network element as an identifier of a denied electronic device (108), denying network access to said electronic device and ending the method, otherwise, proceeding to step c);
- c) if the identifier of the electronic device is registered in the internal database as an identifier of an electronic device allowed to access the network (104), proceeding to step d), and otherwise, storing the identification of the electronic device in the internal database as a denied electronic device (108), denying network access to said electronic device and ending the method;
- d) receiving from the electronic device an identifier of the user and a password for said user in one or more OSI model layer 2 messages;
- e) if said identifier of the user is registered in the internal database as an identifier of a denied user (107), denying network access and ending the method, otherwise, proceeding to step f);
- f) authenticating the user, performing at least the following verifications:
- f1) verifying that the identifier of the user is registered in the internal database as an identifier of an authorized user and if the received password corresponds to the one linked to said user in the internal database (204);
- f2) verifying that the identifier of the electronic device is in the internal database (310) as linked to said user;
- g) if any of the verifications performed in the authentication steps is negative, storing the identification of the user in the internal database as a denied user, denying network access to said user and ending the method;
- otherwise proceeding to step h);
- h) if a layer 2 message requesting network configuration parameters is received from the electronic device, verifying if the electronic device is registered in the internal database as an electronic device allowed to access the network;
- if so, proceeding to step i), and otherwise, storing the identification of the electronic device as an denied electronic device, denying network access and ending the method;
- i) if the verification of step h) is positive, assigning a set of network configuration parameters to the electronic device depending at least on the identifier of the electronic device and sending said set of network configuration parameters to the electronic device.
A network element for the improved access of a user (101) to a communications network using an electronic device (102), where the network element performs the network access control in the Open Systems Interconnection (OSI) model layer 2 and it is a router or switch which manages access to the communications network and where the network element comprises:
- a database comprising:
- a table of identifiers of electronic devices with denied network access (108) and a table of identifiers of users with denied network access (107), a table of identifiers of authorized users including the password linked to each user (204), a table of identifiers of those electronic devices having authorized network access (104), a table of identifiers of the user that are linked to each identifier of the electronic device with authorized network access (310) and a table with the set of network configuration parameters available for each identifier of the electronic device with authorized network access, where the set of available network configuration parameters comprises a range of network addresses available for each profile;
- means for receiving from the electronic device a network access request, an identifier of the electronic device, an identifier of the user and a password for said user by means of one or more OSI model layer 2 messages;
- means for receiving from the electronic device an OSI model layer 2 message, requesting network configuration parameters for accessing the network;
- a processor configured for:
- verifying if said identifier of the electronic device is in the table of electronic devices with denied network access (108) and if so, denying network access to said electronic device;
- verifying if the identifier of the electronic device is registered in the table of identifiers of those electronic devices having authorized network access (104), if the verification is negative, denying network access and storing the identification of the electronic device in the table of electronic devices with denied network access (108);
- verifying if said identifier of the user is in the table of users with denied network access (107) and if so, denying network access to said user;
- authenticating the user, performing at least the following verifications:
- verifying that the identifier of the user is in the table of authorized users (204) and the received password corresponds to the one linked to said user in said table;
- verifying that the identifier of the electronic device is in the database as linked to said user;
- if any of the authentication verifications is negative, storing the identification of the user in the table of users with denied network access and denying network access to said user;
- when receiving from the electronic device the message requesting network configuration parameters, verifying if the identifier of the electronic device is registered in the table of identifiers of those electronic devices having authorized network access, if the verification is negative, storing the identification of the electronic device in the table of devices with denied network access (108) and denying said electronic device's network access, and if the verification is positive, assigning a set of network configuration parameters to the electronic device depending at least on the identifier of the electronic device;
- means for sending a layer 2 message to the electronic device with the network configuration parameters assigned to the electronic device.
Dependencies are inferred from the claim text.