US 8,555,347 B2Granted

Dynamic host configuration protocol (DHCP) authentication using challenge handshake authentication protocol (CHAP) challenge

AssigneeJuniper Networks, Inc.

InventorsKathryn De Graaf, John Liddy, Paul Raison, John C. Scano, Sanjay Wadhwa

Life of this patent

Estimating the term…

Loading patent…

Abstract

A method performed by a Dynamic Host Configuration Protocol (DHCP) server comprising receiving a DHCP DISCOVER message from a DHCP client; generating a challenge in response to the DHCP DISCOVER message; sending the challenge to an authentication device; receiving a first challenge response from the authentication device; generating a DHCP OFFER message; sending the challenge to the DHCP client in the DHCP OFFER message; receiving a DHCP REQUEST message that includes a second challenge response from the DHCP client; comparing the first challenge response with the second challenge response; and authenticating the DHCP client when the first challenge response and the second challenge response match.

Claims21

Dependent claims

A method comprising:

receiving, by a network device, a Dynamic Host Configuration Protocol (DHCP) DISCOVER message from a DHCP client of a user device,
the DHCP DISCOVER message relating to network access;
generating, by the network device, a challenge based on receiving the DHCP DISCOVER message;
sending, by the network device, the challenge, to an authentication device, in a Remote Authentication Dial In User Service (RADIUS) access-request message;
receiving, by the network device, a RADIUS access-accept message from the authentication device based on sending the challenge to the authentication device,
the RADIUS access-accept message not including a first challenge response when the RADIUS access-request message includes a DHCP option information identifying the user device as a device of a particular type, and
the RADIUS access-accept message including the first challenge response when the RADIUS access-request message does not include the DHCP option information;
generating, by the network device, a DHCP OFFER message;
determining, by the network device, whether the RADIUS access-accept message, from the authentication device, includes the first challenge response;
when the RADIUS access-accept message, from the authentication device, does not include the first challenge response:
sending, by the network device, the DHCP OFFER message, to the DHCP client,
the challenge not being sent to the DHCP client;
and
authenticating, by the network device, the DHCP client,
the user device not being permitted the network access prior to authenticating the DHCP client;
and
when the RADIUS access-accept message, from the authentication device, includes the first challenge response:
sending, by the network device and to the DHCP client, the DHCP OFFER message and the challenge;
receiving, by the network device and based on sending the DHCP OFFER message and the challenge to the DHCP client, a DHCP REQUEST message that includes a second challenge response from the DHCP client;
comparing, by the network device, the first challenge response with the second challenge response;
and
authenticating, by the network device, the DHCP client when the first challenge response and the second challenge response match,
the user device not being permitted the network access prior to authenticating the DHCP client.

20 more elements

A network device comprising:

one or more memories to store instructions;
and
one or more processors to execute at least one of the instructions in the one or more memories to:
receive a Dynamic Host Configuration Protocol (DHCP) DISCOVER message, from a DHCP client of a user device, relating to network access by the user device;
generate a challenge based on the DHCP DISCOVER message;
send the challenge, to an authentication device, in a Remote Authentication Dial In User Service (RADIUS) access-request message;
receive a first challenge response in a RADIUS access-accept message from the authentication device,
the RADIUS access-accept message including the first challenge response based on the RADIUS access-request message not including information identifying the user device as a device of a particular type;
generate a DHCP OFFER message that includes the challenge;
send the DHCP OFFER message, including the challenge, to the DHCP client based on receiving the first challenge response in the RADIUS access-accept message from the authentication device;
receive a DHCP REQUEST message that includes a second challenge response from the DHCP client;
compare the first challenge response with the second challenge response;
and
authenticate the DHCP client when the first challenge response and the second challenge response match,
the user device not being permitted the network access prior to authenticating the DHCP client.

12 more elements

A non-transitory computer-readable medium for storing instructions, the instructions comprising:

one or more instructions which, when executed by a device, cause the device to generate a challenge based on receiving a Dynamic Host Configuration Protocol (DHCP) DISCOVER message from a DHCP client of another device;
one or more instructions which, when executed by the device, cause the device to send a message, including the challenge, to an authentication device;
one or more instructions which, when executed by the device, cause the device to receive a message from the authentication device based on sending the challenge to the authentication device,
the received message not including a first challenge response when the sent message includes a DHCP option information identifying the other device as a device of a particular type, and
the received message including the first challenge response when the sent message does not include the DHCP option information;
one or more instructions which, when executed by the device, cause the device to generate a DHCP OFFER message;
one or more instructions which, when executed by the device, cause the device to send the DHCP OFFER message to the DHCP client when the received message does not include the first challenge response,
the challenge not being sent to the DHCP client when the received message does not include the first challenge response;
one or more instructions which, when executed by the device, cause the device to authenticate the DHCP client based on sending the DHCP OFFER message to the DHCP client when the received message does not include the first challenge response,
the other device not being permitted network access prior to authenticating the DHCP client;
one or more instructions which, when executed by the device, cause the device to send the DHCP OFFER message and the challenge to the DHCP client when the received message includes the first challenge response;
one or more instructions which, when executed by the device, cause the device to receive, based on sending the challenge to the DHCP client and from the DHCP client, a DHCP REQUEST message that includes a second challenge response;
one or more instructions which, when executed by the device, cause the device to compare the first challenge response with the second challenge response;
and
one or more instructions which, when executed by the device, cause the device to authenticate the DHCP client when the first challenge response and the second challenge response match,
the other device not being permitted network access prior to authenticating the DHCP client.

13 more elements

Dependencies are inferred from the claim text.

Facts

Application: 12/644,365Filed 22 Dec 2009
Published: US 2011/0154440 A123 Jun 2011
Granted: 8 Oct 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification4 codes

H04L 63/08
Network architectures or network communication protocols for network security: for authentication of entities
H04L 61/5014
Internet protocol [IP] addresses: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
H04L 63/0892
For authentication of entities: by using authentication-authorization-accounting [AAA] servers or protocols
H04L
Digital communication