# US 2014/0157376 A1 · System and method for maintaining captive portal user authentication > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2014/0157376 A1 - Document ID: US20140157376A1 - Status: Published application - Kind: A1 - Application number: 14/018,129 - Filed: 2013-09-04 - Published: 2014-06-05 - Earliest claimed: 2012-12-03 - Assignees: Aruba Networks, Inc. - Applicants: Aruba Networks, Inc. - Inventors: Brijesh Nambiar; George Voon; Ravinder Verma - Web page: https://patentgrep.com/patent/US20140157376A1 ## CPC - H04L 47/28: in relation to timing considerations - H04L 49/3009: {Header conversion, routing tables or routing tags} - H04L 45/566: {Routing instructions carried by the data packet, e.g. active networks} - H04L 47/122: by diverting traffic away from congested entities - H04L 47/19: at layers above the network layer (network arrangements for networked applications for scheduling or organising the servicing of application requests H04L67/60) - H04L 61/25: of the same type - H04L 63/0272: {Virtual private networks} - H04L 63/101: {Access control lists [ACL]} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present disclosure discloses a method and network device for maintaining captive portal user authentication. Specifically, the disclosed system determines an association status between a client and an access point in a wireless network, as well as whether to remove an entry corresponding to the client from a network layer (L3) cache based on the association status. If it is determined that the entry is to be removed, the disclosed system removes the entry corresponding to the client from the network layer (L3) cache. Note that, the association status can be determined based on one or more of an indication by a station management process at the network device, and a detection of radio link activities. ## Claims ### Claim 1 A method comprising: determining, by a network device, an association status between a client and an access point in a wireless network; determining, by the network device, whether to remove an entry corresponding to the client from a network layer (L3) cache based on the association status; and in response to determining that the entry is to be removed, removing the entry corresponding to the client from the network layer (L3) cache. ### Claim 2 (depends on 1) The method of claim 1, wherein the entry comprises a network policy based on which the network device authenticates or denies access to network resources by the client. ### Claim 3 (depends on 2) The method of claim 2, wherein the entry comprises one or more of a user entry and a station entry. ### Claim 4 (depends on 1) The method of claim 1, further comprising: receiving a request originated by the client for accessing network resources; in response to the entry being removed from the network layer cache, denying the client's access to network resources; and in response to the request, redirecting the client to a captive portal website for credential information. ### Claim 5 (depends on 1) The method of claim 1, wherein the designated one processor receives the plurality of packets from a plurality of ingress processors, and wherein each transport layer flow corresponds to a respective ingress processor. ### Claim 6 (depends on 1) The method of claim 1, further comprising: determining, by a network device, the association status between the client and the access point in a wireless network based on one or more of: an indication by a station management process at the network device, and a detection of radio link activities. ### Claim 7 (depends on 6) The method of claim 6, wherein determining whether to remove the entry corresponding to the client from the network layer (L3) cache further comprising: determining a pre-determined timeout value corresponding to the entry in the network layer (L3) cache; in response to reaching the pre-determined timeout value, transmitting a first message to ping the client; and in response to a response message being received within a predetermined time interval after transmitting the first message, maintaining the entry in the network layer (L3) cache. ### Claim 8 (depends on 7) The method of claim 7, further comprising: in response to no response message being received within the predetermined time interval after transmitting the first message, transmitting a second message to ping the client; and in response to no response message being received within the predetermined time interval after transmitting the second message, removing the entry from the network layer (L3) cache. ### Claim 9 (depends on 8) The method of claim 8, wherein the predetermined time interval is adjusted to avoid a large number of entries being removed within the same time period, thereby spreading out temporal cache entry maintenance load. ### Claim 10 (depends on 1) The method of claim 1, wherein determining whether to remove the entry corresponding to the client from the network layer (L3) cache based on indication by the station management process further comprising: receiving a notification from the station management process that the client has been disassociated with the network; and removing the entry corresponding to the client from the network layer (L3) cache after a pre-determined period of time has lapsed. ### Claim 11 A network device having a symmetric multiprocessing architecture, the network device comprising: a plurality of CPU cores; a network interface to receive one or more data packets; and a memory whose access is shared by the dedicated CPU core and the plurality of CPU cores; wherein the plurality of CPU cores are to: determine an association status between a client and an access point in a wireless network; determine whether to remove an entry corresponding to the client from a network layer (L3) cache based on the association status; and remove the entry corresponding to the client from the network layer (L3) cache in response to determining that the entry is to be removed. ### Claim 12 (depends on 11) The network device of claim 11, wherein the entry comprises a network policy based on which the network device authenticates or denies access to network resources by the client. ### Claim 13 (depends on 12) The network device of claim 12, wherein the entry comprises one or more of a user entry and a station entry. ### Claim 14 (depends on 11) The network device of claim 11, wherein the plurality of CPU cores are further to: receive a request originated by the client for accessing network resources; deny the client's access to network resources in response to the entry being removed from the network layer cache; and redirect the client to a captive portal website for credential information in response to the request. ### Claim 15 (depends on 11) The network device of claim 11, wherein the designated one processor receives the plurality of packets from a plurality of ingress processors, and wherein each transport layer flow corresponds to a respective ingress processor. ### Claim 16 (depends on 11) The network device of claim 11, wherein the plurality of CPU cores are further to: determine the association status between the client and the access point in a wireless network based on one or more of: an indication by a station management process at the network device, and a detection of radio link activities. ### Claim 17 (depends on 16) The network device of claim 16, wherein while determining whether to remove the entry corresponding to the client from the network layer (L3) cache, the plurality of CPU cores are further to: determine a pre-determined timeout value corresponding to the entry in the network layer (L3) cache; transmit a first message to ping the client in response to reaching the pre-determined timeout value; and maintain the entry in the network layer (L3) cache in response to a response message being received within a predetermined time interval after transmitting the first message. ### Claim 18 (depends on 17) The network device of claim 17, wherein the plurality of CPU cores are further to: transmit a second message to ping the client in response to no response message being received within the predetermined time interval after transmitting the first message; and remove the entry from the network layer (L3) cache in response to no response message being received within the predetermined time interval after transmitting the second message. ### Claim 19 (depends on 18) The network device of claim 18, wherein the predetermined time interval is adjusted to avoid a large number of entries being removed within the same time period, thereby spreading out temporal cache entry maintenance load. ### Claim 20 (depends on 11) The network device of claim 11, wherein while determining whether to remove the entry corresponding to the client from the network layer (L3) cache based on indication by the station management process, the plurality of CPU cores are further to: receive a notification from the station management process that the client has been disassociated with the network; and remove the entry corresponding to the client from the network layer (L3) cache after a pre-determined period of time has lapsed. ### Claim 21 A non-transitory computer-readable storage medium storing embedded instructions for a plurality of operations that are executed by one or more mechanisms implemented within a network device having a symmetric multiprocessing architecture, the plurality of operations comprising: determining an association status between a client and an access point in a wireless network; determining whether to remove an entry corresponding to the client from a network layer (L3) cache based on the association status; and removing the entry corresponding to the client from the network layer (L3) cache in response to determining that the entry is to be removed.