Patent Application
20090213733
1. Field of the Invention
Embodiments of the present invention generally relate to networking and, more particularly, to controlling the flow of network traffic.
2. Description of the Related Art
In secure networks, such as wireless networks, devices often join and leave the network, for example, as mobile users enter and leave a site. When a link between two devices needs to be established (or “brought up), the device that is trying to get admitted into the network typically takes up a role of a “Supplicant” and the other device with which it is trying to connect takes up a role of an “Authenticator.” The Authenticator has a secure connection to an Authentication Server (AS) and relays messages between supplicant and AS.
When a host device, such as a PC connects to a network, it is sometimes obvious that the host device should act as a supplicant. However, in some cases, multiple devices may be able to connect to the AS and the role of each device may not be immediately apparent. In such cases, both devices may be equally qualified to take on the role of either supplicant or authenticator.
What is needed is a technique to help establish a role in such cases.
So that features of the present invention can be understood in detail, a particular description of the invention may be had by reference to embodiments, some of which are illustrated in the appended drawings. It is to be noted, however, that the appended drawings illustrate only typical embodiments of this invention and are therefore not to be considered limiting of its scope, for the invention may admit to other equally effective embodiments.
Embodiments of the present invention provide techniques for selecting authentication roles when establishing a link between devices in a secure network. By assigning role levels to devices, devices may be more likely to assume a preferred role when establishing a link. For example, during a negotiation process, each device may establish a timer value based on their role level. Each device may initiate a timer with the timer value and, the device whose timer value expires first may assume a role as authenticator. The networks are described as wireless, but may include wireless and wireline networks.
Thus, devices that are well suited to be an authenticator may be assigned role levels having lower associated timer values relative to other role levels, increasing the likelihood their timer will expire first and they will assume the role of authenticator. In this manner, techniques presented herein may allow an operator (e.g., a network administrator) flexibility in controlling what role any given device will assume when links are brought up between devices.
For some embodiments, the network may implement network access control pursuant to the IEEE 802.1X standard. The 802.1X standard outlines an authentication method in which a potential client, “the supplicant,” is authorized. If the supplicant is not authorized then access to the network is denied.
Admission pursuant to 802.1X entails the exchange of messages between a supplicant and an authenticator. The supplicant sends a EAPOL_Start message to the authenticator. Then, the authenticator sends an EAP_Request sending the authenticator's identity to the supplicant and the supplicant sends an EAP_Response with an identity of the supplicant to the authenticator.
After the identities of the supplicant and authenticator are established, the authenticator issues a challenge to the suppliant, requesting a password. The challenge may be any one of OTP, MD5, or GTC protocols according to the EAP standard. Then, the supplicant sends a password to the authenticator and if the authenticator verifies it, the authenticator issues an EAP_Sucess message and the port is authorized. After the communication is complete between the supplicant and the authenticator, the supplicant transmits an EAPOL_Logoff message and the port is not longer authorized.
In the illustrated example, it may be assumed that both devices D1 and D2 can access the authentication server. Thus, when establishing a link between the devices (e.g., when D2 tries to gain admission to the network), either device is capable of performing authentication operations.
Thus, both devices D1 and D2 have both supplicant logic 100 and authenticator logic 101, allowing each device to act as a supplicant or authenticator, depending on a role selected by role selection logic 102. The role selection logic 102 may select a role based on an assigned role level 103 and a corresponding timer value, for example, stored in a lookup table.
The operations 200 begin, at 202, by receiving an EAPOL Start message, from the other device. For example, as illustrated in
At 204, a role level is determined and, at 206, the role level is translated into a timer value. At 208, a timer is initiated based, at least in part, on the timer value for the role level.
The role levels may be assigned, for example, by an operator during configuration of the device. In the illustrated example, D1 has been assigned a role level of “Authenticator 3” while the D2 has been assigned a role level of “Authenticator 1.” As illustrated, the Authenticator 3 role level has a corresponding base timer value of 10 ms, while Authenticator 1 role level has a base timer value of 40 ms. As will be seen, the shorter timer value associated with the Authenticator 3 role level may result in a preference given to devices assigned this role level, relative to other devices assigned to role levels having longer timer values.
For some embodiments, the timer value may be retrieved from a lookup table, such as the table shown in
If the timer expires, as determined at 212, before an EAPOL Logoff message is received, as determined at 210, the device assumes the authenticator role, at 214, and sends an EAPOL LOGOFF Message to notify the other device. On the other hand, if an EAPOL logoff message is received before the timer expires (indicating the other device has assumed the Authenticator role), the device assumes the supplicant role, at 216.
As illustrated in
In some cases, two devices may be assigned the same role level and, thus, may have the same base timer value (T1). In an effort to create a differential in the timer values (and prevent two devices from competing for the same role), at each device a random timer value may be added to the base timer value associated with the role level. The random timer value (RT) may be limited to prevent the total timer value (T1+RT) from exceeding the next higher base time. As an example, if base timer values are separated by 10 ms, the random timer value may be limited to between 0 and 1 ms and may be specified in smaller units (e.g., microsecond instead of milliseconds).
Even utilizing the random timer value, however, there may be instances when the timers expire within a time window that results in both devices assuming the Authenticator role (e.g., if the random timer values generated independently on the separate devices are close in value). Therefore, even after assuming the Authenticator role following the expiration of its timer, a device may receive an EAPOL Logoff message, indicating the other device has also assumed the Authenticator role. In response, the device may take action to again bring the link up (e.g., sending an EAPOL Start message to the other device).
As illustrated in
In response, the devices may again try and bring the link up, as illustrated in
By assigning different role levels to different devices, an operator may be able to control what devices assume desired roles. This may be advantageous, for example, when certain devices are better suited for certain roles. An operator may apply various criteria to determine what role level any particular device should be assigned to achieve a desired result.
The types of criteria that may be considered included, but are not limited to, L3 connectivity to AS, type and computing resources available to the device, operator preferences, and the role history. For example, devices with no access to the AS may be assigned a Supplicant Only role level. Similarly, a device with limited computing resources (e.g., CPU, memory size) may not be well suited to be an authenticator due to the relatively intensive processing involved.
For some embodiments, role levels may be assigned automatically, for example, utilizing a role selection algorithm implemented at the device level. Such an algorithm may consider the criteria described above. In addition, such an algorithm may consider operator preferences established via configuration (e.g., the operator may configure the device to prevent the device from assuming a specified type of role).
For some embodiments, the algorithm may consider a role history of the device, examining roles previously taken by the device and the corresponding result. For example, the algorithm may determine if the device was previously an Authenticator and, if so, whether the devices were able to successfully perform the authentication operations. If not, the algorithm may assign a Supplicant Only role level or a role level that gives a weaker preference to becoming an authenticator.
A device assigned a Supplicant Only role level may refrain from ever becoming an Authenticator. Depending on the embodiment, the corresponding timer value could be ignored or the corresponding timer value could be set to a high value, effectively assuring that device will always assume the Supplicant role. In contrast, a device assigned an Authenticator Only role level may forego the operations described herein, assume the Authenticator role, and send an EAPOL message to notify the other device. Depending on the embodiment, the corresponding timer value could be ignored or set to a low value (e.g., zero), effectively assuring that device will always assume the Authenticator role.
Different Authenticator levels with different timer values may allow an operator to provide relatively fine grained control, preferring certain devices over others. Further, for some embodiments, an operator may also have control over the base timer values associated with each role level. Thus, an operator may set a wider variance between timer values for a role level that prefers a Supplicant role and timer values that prefer Authenticator roles.
For example, the operator may set timer values for Supplicant role levels to be much higher than timer values for Authenticator role levels in an effort to ensure devices assigned to Supplicant Role levels will not assume the role of Authenticator. However, if two devices both have been assigned Authenticator role levels, even if they are different, there may be little concern as to which device assumes the Authenticator role. Therefore, the operator may assign relatively close timer values to different Authenticator role levels.
While the foregoing is directed to embodiments of the present invention, other and further embodiments of the invention may be devised without departing from the basic scope thereof, and the scope thereof is determined by the claims that follow.
