Network access control using subnet addressing

A method for controlling access of a client device to a data network, comprising:

• receiving a first client communication via a routing device, the first client communication including a client identifier uniquely identifying the client device;
• determining whether the first client communication includes a request for a network address;
• in response to determining the first client communication includes a request for a network address, determining whether the client identifier included in the first client communication is included in an Mth one of a first through an Nth group of client identifiers, wherein N is an integer greater than one and M is an integer greater than zero;
• in response to determining the client identifier included in the first client communication is included in an Mth group of client identifiers, transmitting to the client device via the routing device a response providing a network address within an Mth sub-network associated with an Mth authorized user policy of a first through an Nth authorized user policy;
• in response to determining the client identifier included in the first client communication is not included in any of the first through Nth groups of client identifiers, transmitting to the client device via the routing device a response providing an authentication user interface and a network address within a (N+1)th sub-network associated with an unauthorized user policy;
• receiving a second client communication via the routing device, the second client communication including a client response to the authentication user interface and including the client identifier;
• determining whether the client response to the authentication user interface matches a response associated with a first policy;
• and
• in response to determining the client response to the authentication user interface matches the response associated with the first policy, including the client identifier in the first group of client identifiers.

A system for controlling access of a client device to a data network, comprising:

• a processing system comprising a processor and memory, the processing system configured to include address configuration logic, address management logic, and captive portal logic, wherein:
• the address configuration logic is configured to determine whether a first client communication received via a routing device and including a client identifier uniquely identifying the client device includes a request for a network address and further configured to respond to a request for a network address by transmitting to the client device via the routing device a response providing a network address;
• the address management logic is configured to control storing the groups of client identifiers and to cause the address configuration logic to provide the network address within an Mth sub-network associated with an Mth authorized user policy of a first through an Nth authorized user policy if the client identifier included in the first client communication is included in an Mth one of a first through an Nth group of client identifiers, wherein N is an integer greater than one and M is an integer greater than zero, and to cause the address configuration logic to provide an authentication user interface and the network address within a (N+1)th sub-network associated with an unauthorized user policy if the client identifier included in the first client communication is not included in any of the first through Nth groups of client identifiers;
• and
• the captive portal logic is configured to transmit to the client device via the routing device a response providing an authentication user interface if the client identifier included in the first client communication is not included in any of the first through Nth groups of client identifiers, the captive portal logic is further configured to determine whether a second client communication comprising a client response to the authentication user interface matches a response associated with an Mth one of the first through Nth authorized user policies, and the address management logic is further configured to include the client identifier in the Mth group of client identifiers if the captive portal logic determines that the client response to the authentication user interface matches the response associated with an Mth one of the first through Nth authorized user policies.

A computer program product for controlling access of a client device to a data network, the computer program product comprising a non-transitory computer-readable medium having stored thereon instructions that when executed by a processing system of a server device causes the server device to effectuate a method comprising:

• receiving a first client communication via a routing device, the first client communication including a client identifier uniquely identifying the client device;
• determining whether the first client communication includes a request for a network address;
• in response to determining the first client communication includes a request for a network address, determining whether the client identifier included in the first client communication is included in a first group of client identifiers;
• in response to determining the client identifier included in the first client communication is included in the first group of client identifiers, transmitting to the client device via the routing device a response providing a network address within a first sub-network associated with a first policy;
• in response to determining the client identifier included in the first client communication is not included in the first group of client identifiers, transmitting to the client device via the routing device a response providing an authentication user interface and a network address within a second sub-network associated with a second policy;
• determining whether a client response to the authentication user interface matches a response associated with a first policy;
• and
• in response to determining the client response to the authentication user interface matches the response associated with the first policy, including the client identifier in the first group of client identifiers.