US 2024/0267377 A1 · MAC ADDRESS AND CONTROLLED PORT BASED NETWORK ACCESS MANAGEMENT

Abstract

A set of software components has been created to form a path of execution outside of a kernel that triggers the authentication process based on MAC address determination for connected stations and separately managing that authentication per controlled port shared across stations. The architecture of the set of software components includes a control daemon that interacts with objects and services of the network access point OS or kernel to leverage dynamic host configuration protocol (DHCP) snooping and MAC address learning to determine MAC addresses. The control daemon instantiates an authenticator object/service for each controlled port and interacts with the authenticator object/service to cause an authenticator service of the OS to perform the authentication process for stations. The control daemon also leverages an Ethernet frames rules table of the kernel to authorize traffic of authenticated stations via the controlled port.

Claims23

Dependent claims

A method comprising:

determining a media access control (MAC) address of a first station connected with a network access point that regulates access to a network based on a combination of port and MAC address, wherein the first station is not authenticated for access to the network, and wherein the network access point comprises a control daemon, a first authenticator service instantiated by the control daemon and associated with a first port, and a second authenticator service instantiated by an operating system of the network access point;
based on determining the MAC address of the first station, the control daemon calling a first function to authenticate the first station which causes the first authenticator service to send a message to the second authenticator service to authenticate the first station, wherein the first authenticator service exposes the first function;
and
based on a message from the second authenticator service indicating association of the first station with the network access point, the first authenticator service indicating to the control daemon that the first station has been authenticated on the first port based on the MAC address of the first station.

1 more element

A non-transitory machine-readable medium having program code stored thereon, the program code comprising:

first instructions to,
instantiate second instructions that implement a first authenticator service and
associate the first authenticator service with a first port in response to detecting enablement of the first port as being subject to port-based network access control;
detect connection of a first station to a network access point, wherein the instructions to detect connection of the first station comprise instructions to determine a media access control (MAC) address of the first station;
based on determination of the MAC address of the first station, invoke a first function exposed by the first authenticator service to authenticate the first station;
wherein the second instructions implement the first authenticator service to,
in response to invocation of the first function, message a second authenticator service to authenticate the first station according to the extensible authentication protocol over local area network (EAPoL), wherein the second authenticator service was instantiated by a kernel of the network access point;
indicate that the first station is associated based on a message from the second authenticator service that the first station has been authenticated;
and
wherein the first instructions are to invoke a second function exposed by the kernel to allow traffic from the first station on the first port in response to the indication that the first station has been associated.

7 more elements

A network access point comprising:

a plurality of physical network interfaces;
a processor;
and
a machine-readable medium having stored thereon an operating system including a kernel, control daemon program code, and first authenticator service program code;
the control daemon program code comprising instructions to,
instantiate the first authenticator service as a first instance of a first authenticator service and associate the first instance of the first authenticator service with a first logical port in response to detecting enablement of the first logical port as being subject to port-based network access control;
detect connection of a station with the network access point, wherein the instructions to detect connection of the station comprise instructions to determine a media access control (MAC) address of the station;
based on determination of the MAC address of the station, invoke a first function exposed by the first instance of the first authenticator service to authenticate the station;
the first authenticator service program code comprising instructions to,
in response to invocation of the first function, message a second authenticator service to authenticate the station according to the extensible authentication protocol over local area network (EAPoL), wherein the second authenticator service was instantiated by the kernel;
and
in response to a message from the second authenticator service that the station has been associated, indicate that the station has been associated.

9 more elements

Dependencies are inferred from the claim text.

Mac address and controlled port based network access management

Life of this patent

Mac address and controlled port based network access management

Life of this patent

Abstract

Claims23