Techniques for authenticating a subscriber for an access network using DHCP

An apparatus for authenticating a user for access to a service provider network, comprising:

• one or more processor;
• means for receiving at a challenging process from a customer network node on a customer premises different from a premises for the apparatus, a Dynamic Host Configuration Protocol (DHCP) request for configuration data necessary to receive a unicast on an Internet Protocol (IP) network, wherein the DHCP request includes user identifier data that indicates a particular user identifier value;
• means for determining a current challenge value that can not be predicted by knowledge of any previous challenge value;
• means for sending to the customer network node a challenge message that includes the current challenge value;
• means for receiving from the customer network node a response message that includes a response value;
• means for causing a verification value to be determined based on a particular password value, associated with the user identifier value in an Authentication, Authorization and Accounting (AAA) process, and the current challenge value using a secure process that renders impractical an attempt to derive the particular password value from the challenge value and the verification value;
• means for determining whether the response value matches the verification value;
• means for preventing a DHCP offer from being sent to the customer network node in response to the DHCP request, if it is determined that the response value does not match the verification value, whereby unicast communication over the IP network by the customer network node is prevented;
• and
• wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option.

An apparatus for authenticating a user for access to a service provider network, comprising:

• a network interface that is coupled to a network for communicating one or more packet flows therewith;
• one or more processors;
• a computer readable medium;
• and
• one or more sequences of instructions stored on the computer readable medium, which, when executed by the one or more processors, causes the one or more processors to carry out the steps of:
• receiving on the network interface from a customer network node on a customer premises different from a service provider premises, a Dynamic Host Configuration Protocol (DHCP) request for configuration data necessary to receive a unicast on an Internet Protocol (IP) network, wherein the DHCP request includes user identifier data that indicates a particular user identifier value;
• determining a current challenge value that can not be predicted by knowledge of any previous challenge value;
• sending on the network interface to the customer network node a challenge message that includes the current challenge value;
• causing a verification value to be determined based on a particular password value, associated with the user identifier value in an Authentication, Authorization and Accounting (AAA) process, and the current challenge value using a secure process that renders impractical an attempt to derive the particular password value from the challenge value and the verification value;
• receiving on the network interface from the customer network node a response message that includes a response value;
• determining whether the response value matches the verification value;
• if it is determined that the response value does not match the verification value, then preventing a DHCP offer from being sent to the customer network node in response to the DHCP request, whereby unicast communication over the IP network by the customer network node is prevented;
• and
• wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option.

A method for authenticating a user for access to a network comprising:

• receiving from a user node, at a challenging process, a Dynamic Host Configuration Protocol (DHCP) request for configuration data necessary to receive a unicast on an Internet Protocol (IP) network, wherein the DHCP request includes user identifier data that indicates a particular user identifier value;
• in response to receiving the DHCP request, determining a current challenge value that can not be predicted by knowledge of any previous challenge value;
• sending to the user node a DHCP-formatted challenge message that includes the current challenge value;
• receiving from the user node a DHCP formatted response message that includes a response value;
• causing a verification value to be determined based on a particular password value, associated with the user identifier value in an Authentication, Authorization and Accounting (AAA) server and the current challenge value using a secure process that renders impractical an attempt to derive the particular password value from the challenge value and the verification value;
• determining whether the response value matches the verification value;
• if it is determined that the response value does not match the verification value, then preventing a DHCP offer from being sent to the customer network node in response to the DHCP request, whereby unicast communication over the IP network by the user node is prevented;
• and
• wherein at least one of the challenge message and the response message is formatted according to a DHCP message format using a unique value for a DHCP message type option.