Authenticating clients

A method of client authentication, the method comprising:

• receiving, at a computing device, an Internet protocol source address of a client;
• extracting, at the computing device, a media access control address from the Internet protocol source address;
• comparing, at the computing device, the extracted media access control address with at least one client media access control address associated with the client;
• extracting, at the computing device, an organizationally unique identifier from the media access control address;
• determining, at the computing device, a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier;
• comparing, at the computing device, the determined source identifier with at least one source identifier associated with the client;
• signaling execution, at the computing device, of one or more client authentication challenges when:
• the extracted media access control address fails to match the at least one client media access control address associated with the client;
• or
• the determined source identifier fails to match the at least one source identifier associated with the client;
• associating, at the computing device, the determined source identifier with the client after successful execution of the one or more client authentication challenges;
• attributing, at the computing device, an age to the determined source identifier;
• and
• disassociating, at the computing device the determined source identifier from the client after a threshold period of time.

A security system comprising:

• a data processor executing:
• an extractor receiving an Internet protocol source address of a client and extracting a media access control address from the Internet protocol source address;
• a comparer comparing the extracted media access control address with at least one client media access control address associated with the client and signaling execution of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client;
• and
• an attributer associating the extracted media access control address with the client after successful execution of the one or more client authentication challenges, the attributer disassociating the extracted media access control address from the client after a threshold period of time.

A security system comprising:

• a data processor executing:
• an extractor configured to:
• receive an Internet protocol source address of a client and extract a media access control address from the Internet protocol source address;
• and
• extract an organizationally unique identifier from the media access control address and determine a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier;
• a comparer configured to:
• compare the extracted media access control address with at least one client media access control address associated with the client;
• compare the determined source identifier with at least one source identifier associated with the client;
• and
• signal execution of one or more client authentication challenges when:
• the extracted media access control address fails to match the at least one client media access control address associated with the client;
• or
• the determined source identifier fails to match the at least one source identifier associated with the client;
• and
• an attributer configured to:
• associate the determined source identifier with the client after successful execution of the one or more client authentication challenges;
• and
• disassociate the determined source identifier from the client after a threshold period of time.

A computer program product encoded on a non-transitory computer readable storage medium comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

• receiving an Internet protocol source address of a client;
• extracting a media access control address from the Internet protocol source address;
• comparing the extracted media access control address with at least one client media access control address associated with the client;
• signaling execution of one or more client authentication challenges when the extracted media access control address fails to match the at least one client media access control address associated with the client;
• associating the extracted media access control address with the client after successful execution of the one or more client authentication challenges;
• attributing an age to the extracted media access control address;
• and
• disassociating the extracted media access control address from the client after a threshold period of time.

A computer program product encoded on a non-transitory computer readable storage medium comprising instructions that when executed by a data processing apparatus cause the data processing apparatus to perform operations comprising:

• receiving an Internet protocol source address of a client;
• extracting a media access control address from the Internet protocol source address;
• comparing the extracted media access control address with at least one client media access control address associated with the client;
• extracting an organizationally unique identifier from the media access control address;
• determining a source identifier from the organizationally unique identifier, the source identifier comprising at least one of an entity identity, a source device type, or a source device unique identifier;
• comparing the determined source identifier with at least one source identifier associated with the client;
• signaling execution of one or more client authentication challenges when:
• the extracted media access control address fails to match the at least one client media access control address associated with the client;
• or
• the determined source identifier fails to match the at least one source identifier associated with the client;
• associating the determined source identifier with the client after successful execution of the one or more client authentication challenges;
• and
• disassociating the determined source identifier from the client after a threshold period of time.