Back to results
US 8,800,006 B2Granted
Authentication and authorization in network layer two and network layer three
AssigneeJuniper Networks, Inc.
InventorsRoger Chickering, Derek Brown, Paul Funk, Oliver Tavakoli
Life of this patent
Estimating the term…
Abstract
A method may include authenticating a node over layer 2 in a network based on authentication rules; sending a node authentication code to the node; and providing layer 3 network access based on the node authentication code.
Claims20
A method comprising:
- receiving, by a first device, identification information of a user of a second device that is different than the first device;
- providing, by the first device and to the second device, layer 2 access in a network when the second device is authenticated over layer 2 based on the identification information;
- determining, by the first device and based on the identification information, one or more resources, in the network, that the user is authorized to access;
- sending to the second device and when the second device is authenticated:
- a network address of the first device,
- first information that is based on the determined one or more resources, and
- second information that is used by the second device to verify an identity of the first device;
- receiving, by the first device and from the second device, a request to verify the identity of the first device after sending the second information to the second device,
- the request to verify the identity of the first device being sent by the second device using the network address of the first device;
- providing, by the first device and to the second device, the second information to verify the identity of the first device, after receiving the request to verify the identity of the first device;
- receiving, by the first device and from the second device, third information after providing the second information to verify the identity of the first device;
- and
- providing, by the first device and to the second device, layer 3 access in the network, when the third information corresponds to the first information.
10 more elements
A device comprising:
- a non-transitory memory to store instructions;
- and
- a processor to execute the instructions to:
- determine whether another device is authenticated over layer 2 based on identification information of a user of the other device,
- provide, to the other device, layer 2 access in a network when the other device is authenticated over layer 2 based on the identification information,
- determine, based on the identification information, one or more resources, in the network, that the user is authorized to access,
- send to the other device when the other device is authenticated:
- a network address of the device,
- first information that is based on the determined one or more resources, and
- second information that is used by the other device to verify an identity of the device,
- receive, from the other device, a request to verify the identity of the device after sending the second information to the other device,
- the request to verify the identity of the device being sent by the other device using the network address of the device,
- provide, to the other device, the second information to verify the identity of the device, after receiving the request to verify the identity of the device,
- receive, from the other device, third information after providing the second information to verify the identity of the device, and
- provide, to the other device, layer 3 access in the network, when the third information corresponds to the first information.
12 more elements
A non-transitory computer-readable medium storing instructions, the instructions comprising:
- one or more instructions which, when executed by a device, cause the device to determine that another device is authenticated over layer 2 based on identification information of a user of the other device;
- one or more instructions which, when executed by the device, cause the device to provide, to the other device, layer 2 access in a network based on the other device being authenticated over layer 2;
- one or more instructions which, when executed by the device, cause the device to determine, based on the identification information, one or more resources, in the network, that the user is authorized to access;
- one or more instructions which, when executed by the device, cause the device to send to the other device based on the other device being authenticated:
- a network address of the device,
- first information that is based on the determined one or more resources, and
- second information that is used by the other device to verify an identity of the device;
- one or more instructions which, when executed by the device, cause the device to receive, from the other device, a request to verify the identity of the device after sending the second information to the other device;
- one or more instructions which, when executed by the device, cause the device to provide, to the other device, the second information to verify the identity of the device, after receiving the request to verify the identity of the device,
- the request to verify the identity of the device being sent by the other device using the network address of the device;
- one or more instructions which, when executed by the device, cause the device to receive, from the other device, third information after providing the second information to verify the identity of the device;
- and
- one or more instructions which, when executed by the device, cause the device to provide, to the other device, layer 3 access in the network, when the third information corresponds to the first information.
10 more elements
Dependencies are inferred from the claim text.