# US 8,751,647 B1 · Method and apparatus for network login authorization > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,751,647 B1 - Document ID: US8751647B1 - Status: Granted - Kind: B1 - Application number: 09/895,144 - Filed: 2001-06-30 - Granted: 2014-06-10 - Earliest claimed: 2001-06-30 - Assignees: Extreme Networks, Inc. - Applicants: Michael Yip; Indranil Bagchi; Brian Bunker; Michael Polo - Inventors: Michael Yip; Indranil Bagchi; Brian Bunker; Michael Polo - Web page: https://patentgrep.com/patent/US8751647B1 ## CPC - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 61/503: using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter - H04L 63/083: {using passwords (cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226)} - H04L 61/5014: using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP] - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A method and apparatus is provided to control the admission of a user to a network by preventing a port through which the user connects to the network from forwarding data packets until the user is authorized. A network login controller operates in conjunction with a user interface to receive a user identification data from the port user. The network login controller further operates in conjunction with an authorization server to authenticate the user by sending a user authentication request containing the user identification data to the authentication server. The network login controller grants or denies permission to the user to access the network based on the user authentication response from the authentication server. If permission is granted, then the network login controller unblocks the port through which the user is connected to place it in packet-forwarding mode. If permission is denied, then the port remains in packet non-forwarding mode (i.e. it remains blocked). ## Claims ### Claim 1 A method comprising: blocking a port on a packet forwarding device to prevent a user connected to the port from sending and receiving data packets, the port belonging to a plurality of virtual local area networks (VLANs), wherein blocking comprises setting a port state of the port on the packet forwarding device to unauthorized for one or more of the plurality of VLANs to which it belongs; generating an authentication Internet Protocol (IP) address capable of being used to authenticate the user connected to the blocked port from an endstation belonging to one of the plurality of VLANs for which the port is blocked; authenticating the user connected to the port via the authentication IP address assigned to the user by an authentication server; and in response to successfully authenticating the user, unblocking the port to enable the user to send and receive data packets, wherein unblocking comprises setting the port state of the port on the packet forwarding device to authorized for the VLAN to which the endstation belongs. ### Claim 2 (depends on 1) The method of claim 1, wherein authenticating comprises: receiving a user identification data from the user connected to the port; and verifying whether the user identification data is authentic. ### Claim 3 (depends on 2) The method of claim 2, wherein verifying comprises: sending the user identification data to an authentication server; and receiving an indication from the authentication server whether the user identification data is authentic. ### Claim 4 (depends on 3) The method of claim 3, wherein sending and receiving is performed in accordance with the Remote Authentication Dial-In Service (RADIUS) communication protocol. ### Claim 5 (depends on 1) The method of claim 1, further comprises assigning the unblocked port to a permanent VLAN. ### Claim 6 (depends on 5) The method of claim 5, further comprising: assigning a temporary layer-3 address to the user when the port is blocked; and assigning a permanent layer-3 address to the user when the port is unblocked. ### Claim 7 (depends on 6) The method of claim 6, wherein the temporary address is obtained from a first address server accessible to the packet forwarding device. ### Claim 8 (depends on 6) The method of claim 6, wherein the permanent address is obtained from a second address server accessible to the permanent VLAN to which the unblocked port is assigned. ### Claim 9 (depends on 7) The method of claim 7, wherein the first address server comprises a DHCP server. ### Claim 10 (depends on 9) The method of claim 9, wherein the DHCP server is located on the packet forwarding device. ### Claim 11 (depends on 8) The method of claim 8, wherein the second address server comprises a DHCP server. ### Claim 12 An apparatus comprising: a packet forwarding device coupled to the edge of a network, the packet forwarding device having a blocked port that prevents a user connected to the port from an endstation belonging to one of a plurality of virtual local area networks (VLANs) for which the port is blocked from accessing the network, the blocked port having a port state on the packet forwarding device of unauthorized for any one or more of the plurality of VLANs for which the port is blocked; and a network login controller coupled to the packet forwarding device to unblock the port for the VLAN to which the endstation belongs when the user is authenticated so that the user can access the network, wherein the network login controller in conjunction with an address server provides the user an authentication Internet Protocol (IP) address with which to authenticate the user of the port before the user is authorized, and further wherein to unblock the port is to set the blocked port's port state on the packet forwarding device to authorized for the VLAN to which the endstation belongs. ### Claim 13 (depends on 12) The apparatus of claim 12, wherein the user is authenticated when the network login controller receives a user identification data from the user connected to the port and verifies whether the user identification data is authentic. ### Claim 14 (depends on 13) The apparatus of claim 13, wherein the network login controller verifies whether the user identification data is authentic by sending the user identification data to an authentication server and receiving an indication from the authentication server whether the user identification data is authentic. ### Claim 15 (depends on 14) The apparatus of claim 14, wherein the sending and receiving is performed in accordance with the Remote Authentication Dial-In Service (RADIUS) communication protocol. ### Claim 16 (depends on 12) The apparatus of claim 12, wherein the network login controller is capable of assigning the unblocked port to a permanent VLAN. ### Claim 17 (depends on 16) The apparatus of claim 16 wherein the network login controller assigns a temporary layer-3 address to the user when the port is blocked and assigns a permanent layer-3 address to the user when the port is unblocked. ### Claim 18 (depends on 17) The apparatus of claim 17, wherein the temporary address is obtained from a first address server accessible to the packet forwarding device. ### Claim 19 (depends on 17) The apparatus of claim 17, wherein the permanent address is obtained from a second address server accessible to the permanent VLAN to which the unblocked port is assigned. ### Claim 20 (depends on 18) The apparatus of claim 18, wherein the first address server comprises a DHCP server. ### Claim 21 (depends on 20) The apparatus of claim 20, wherein the DHCP server is located on the packet forwarding device. ### Claim 22 (depends on 19) The apparatus of claim 19, wherein the second address server comprises a DHCP server. ### Claim 23 (depends on 12) The apparatus of claim 12, wherein the packet forwarding device additionally comprises an unblocked port that requires no authentication. ### Claim 24 (depends on 12) The apparatus of claim 12, wherein the blocked port prevents a first user connected to the port through a first VLAN from accessing the network but allows network access to a second user connected to the port through a second VLAN. ### Claim 25 A network login authorization apparatus comprising: a network device, coupled to the edge of a network, having a blocked port, the blocked port tagged as belonging to more than one virtual local area network (VLAN) and having a port state on the network device of unauthorized for each VLAN for which the port is blocked; a network authentication server coupled to the network device, wherein the network authentication server provides user configuration data to configure the blocked port with an authentication Internet Protocol (IP) address for use by the network login authorization apparatus in authorizing users; and a processor, coupled to the network device and the network authentication server, to perform instructions for unblocking the blocked port in response to a request through the authentication Internet Protocol (IP) address by a user connected to the blocked port from an endstation belonging to a VLAN for which the port is blocked to access the network, wherein the request is granted when a user identification entered by the user matches a corresponding user authentication data obtained from the network authentication server, and further wherein to perform instructions for unblocking the blocked port is to perform instructions for setting the blocked port's port state on the network device, for the VLAN to which the endstation belongs, to authorized.