Network access control using subnet addressing
AssigneeAdtran, Inc.
InventorsThomas F. Guevin, Ricky D. Rorex
Life of this patent
Estimating the term…
Abstract
A server responds to a DHCP request for an IP address by setting a subnet in accordance with whether the client's MAC address is recognized as previously having been authenticated or otherwise associated with a policy. If the client has not been authenticated, the server provides a captive portal to enforce authentication. A routing device positioned in the network between clients and the server controls access to network resources by routing communications from clients in accordance with subnet addressing, where each subnet is associated with a policy.
Claims23
A method for controlling access of a client device to a data network, comprising:
- receiving a first client communication via a routing device, the first client communication including a client identifier uniquely identifying the client device;
- determining whether the first client communication includes a request for a network address;
- in response to determining the first client communication includes a request for a network address, determining whether the client identifier included in the first client communication is included in a first group of client identifiers;
- in response to determining the client identifier included in the first client communication is included in the first group of client identifiers, transmitting to the client device via the routing device a response providing a network address within a first sub-network associated with a first policy;
- and
- in response to determining the client identifier included in the first client communication is not included in the first group of client identifiers, transmitting to the client device via the routing device a response providing a network address within a second sub-network associated with a second policy.
A method for controlling access of a client device to a data network, comprising:
- receiving a first client communication via a routing device, the first client communication including a client identifier uniquely identifying the client device;
- determining whether the first client communication includes a request for a network address;
- in response to determining the first client communication includes a request for a network address, determining whether the client identifier included in the first client communication is included in an Mth one of a first through an Nth group of client identifiers, wherein N is an integer greater than one and M is an integer greater than zero;
- in response to determining the client identifier included in the first client communication is included in an Mth group of client identifiers, transmitting to the client device via the routing device a response providing a network address within an Mth sub-network associated with an Mth authorized user policy of a first through an Nth authorized user policy;
- and
- in response to determining the client identifier included in the first client communication is not included in any of the first through Nth groups of client identifiers, transmitting to the client device via the routing device a response providing a network address within a (N+1)th sub-network associated with an unauthorized user policy.
A system for controlling access of a client device to a data network, comprising:
- address configuration logic configured to determine whether a first client communication received via a routing device and including a client identifier uniquely identifying the client device includes a request for a network address and further configured to respond to a request for a network address by transmitting to the client device via the routing device a response providing a network address;
- and
- address management logic configured to control storing the groups of client identifiers and to cause the address configuration logic to provide the network address within an Mth sub-network associated with an Mth authorized user policy of a first through an Nth authorized user policy if the client identifier included in the first client communication is included in an Mth one of a first through an Nth group of client identifiers, wherein N is an integer greater than one and M is an integer greater than zero, and to cause the address configuration logic to provide the network address within a (N+1)th sub-network associated with an unauthorized user policy if the client identifier included in the first client communication is not included in any of the first through Nth groups of client identifiers.
A computer program product for controlling access of a client device to a data network, the computer program product comprising a computer-readable medium having stored thereon in non-transitory computer-readable form instructions that when executed by a processing system of a server device causes the server device to effectuate a method comprising:
- receiving a first client communication via a routing device, the first client communication including a client identifier uniquely identifying the client device;
- determining whether the first client communication includes a request for a network address;
- in response to determining the first client communication includes a request for a network address, determining whether the client identifier included in the first client communication is included in a first group of client identifiers;
- in response to determining the client identifier included in the first client communication is included in the first group of client identifiers, transmitting to the client device via the routing device a response providing a network address within a first sub-network associated with a first policy;
- and
- in response to determining the client identifier included in the first client communication is not included in the first group of client identifiers, transmitting to the client device via the routing device a response providing a network address within a second sub-network associated with a second policy.
Dependencies are inferred from the claim text.