Method and apparatus for assigning network addresses to network devices

[0001] The present invention generally relates to management of computer networks. The invention relates more specifically to a method and apparatus for assigning network addresses to network devices.

[0002] The approaches described in this section could be pursued, but are not necessarily approaches that have been previously conceived or pursued. Therefore, unless otherwise indicated herein, the approaches described in this section are not prior art to the claims in this application and are not admitted to be prior art by inclusion in this section.

[0003] Many companies have a desire to provide remote access to their private computer intranets. By permitting remote access, users can connect to the company's computer intranet to work and obtain resource information while located at a remote site. A drawback associated with providing remote access to a company's private computer intranet is that unauthorized users may sometimes gain access to the network system, thus potentially allowing the company's resources and information to be accessed, used or compromised.

[0004] One approach to prevent unauthorized access to a company's private intranet is to limit access to only specific “trusted” network devices. For example, an address allocator located in customer premises equipment (CPE) may control the allocation of Internet protocol (IP) addresses to network devices such that “trusted” network devices are assigned an address from a “trusted” pool of network addresses, while “untrusted” network devices are assigned addresses from an “untrusted” pool of network addresses. In order to determine whether a network device should be allocated an address from the trusted pool, the client ID, which uniquely identifies the network device, may be authenticated locally in the CPE by comparing the client ID to a statically configured list of trusted client ID's.

[0005] A drawback to the above approach is that the trusted client ID list is statically configured, and therefore any change to this list requires a configuration change on the local CPE. Further, this approach does not prevent a network device with a static IP address in the secure address range from accessing the private company intranet.

[0006] Based on the foregoing, there is a clear need for a method for assigning network addresses to network devices in which authentication of a client ID is performed by an external, centrally located entity, which is easily configured by a central administrator.

[0012] A method and apparatus for assigning network addresses to network devices is described. In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide a thorough understanding of the present invention. It will be apparent, however, to one skilled in the art that the present invention may be practiced without these specific details. In other instances, well-known structures and devices are shown in block diagram form in order to avoid unnecessarily obscuring the present invention.

[0013] Embodiments are described herein according to the following outline:

• • [0014] 1.0 Overview
  • [0015] 2.0 Network Address Assignment Architecture
  • [0016] 3.0 Assigning Network Addresses to Network Devices
  • [0017] 4.0 Implementation Mechanisms
  • [0018] 5.0 Extensions and Alternatives
    1.0 OVERVIEW

[0019] An approach for assigning network addresses to network devices includes generating an authentication request that requests authentication of identification data that uniquely identifies a network device. The authentication request is sent to an authentication mechanism. An authentication response is received from the authentication mechanism that indicates whether the network device is authorized to access a first network. If the authentication response indicates that the network device is authorized to access the first network, then a first network address on a first network is assigned to the network device. If the authentication response indicates that the network device is not authorized to access the first network, then a second network address on a second network to the network device is assigned. According to another embodiment, if no authentication response is received from the authentication mechanism, then the second network address on the second network is assigned to the network device.

[0020] Other embodiments include generating an authentication request in response to receiving, from the network device, a request for a network address, and sending the authentication request to the authentication mechanism via a secure connection.

2.0 NETWORK ADDRESS ASSIGNMENT ARCHITECTURE

[0021] FIG. 1 is a block diagram illustrating an arrangement 100 for assigning network addresses to network devices according to one embodiment. Arrangement 100 includes a network device 102, an address allocator 104, a public network 106, a private network 108, and an authentication mechanism 110 that are interconnected by communications links 103, 105 and 107, respectively. Communications links 103, 105 and 107 may be implemented by any medium or mechanism that provides for the exchange of data between network elements. Examples of communications links 103, 105 and 107 include, without limitation, a network such as a Local Area Network (LAN), Wide Area Network (WAN), Ethernet or the Internet, or one or more terrestrial, satellite or wireless links. Communications links 103, 105 and 107 may be secure, depending upon the requirements of a particular application.

[0022] Network device 102 is communicatively coupled to address allocator 104 by communications link 103. Examples of network devices include, without feature, personal computers, Internet protocol phones, and wireless devices. In FIG. 1, for purposes of illustrating a clear example, only one network device 102 and address allocator 104 are illustrated. Embodiments, however, are applicable to any number of network devices and address allocators, and multiple connections may be used to connect network device 102 to address allocator 104.

[0023] Address allocator 104 may be implemented by a computer, or a group of hardware or software components and/or processes that cooperate or execute in one or more computer systems. In one embodiment, address allocator 104 is implemented in a Dynamic Host Control Protocol (DHCP) server that contains a pool of Internet protocol (IP) logical network addresses (IP addresses) available for responding to process requests from a DHCP client. In this context, network device 102 includes a DHCP client. In one embodiment, the DHCP server is disposed within customer premises equipment (CPE), including, but not limited to, a personal computer, workstation, or Internet protocol phone. In another embodiment, the DHCP server is disposed external to CPE.

[0024] Address allocator 104 is communicatively coupled to public network 106 by communications link 105. In one embodiment, the accessibility of public network 106 is less restricted relative to private network 108. For example, public network 106 is the global packet-switched internetworks collectively known as the Internet.

[0025] Public network 106 is communicatively coupled to private network 108 by communications link 107. In one embodiment, the accessibility of private network 108 is more restricted relative to public network 106. For example, private network 108 may be a corporate intranet.

[0026] Authentication mechanism 110 is configured to determine whether a particular network device 102 is authorized to access private network 108. An example of authentication mechanism 110 is an authentication, authorization and accounting (“AAA”) server. Although authentication mechanism 110 is illustrated as being disposed within private network 108, authentication mechanism 110 may be disposed external to private network 108, depending on the requirements of a particular application.

3.0 ASSIGING NETWORK ADDRESSES TO NETWORK DEVICES

[0027] FIG. 2 is a flow diagram that illustrates one embodiment of a method for assigning network addresses to network devices. For purposes of illustrating a clear example, the method of FIG. 2 is described herein with reference to arrangement 100 of FIG. 1. However, the method of FIG. 2 is not limited to arrangement 100.

[0028] In block 202, an authentication request that requests authentication of identification data that uniquely identifies network device 102 is generated. Examples of identification data include, without limitation, Media Access Control (MAC) addresses, device hostnames and American Standard Code for Information Interchange (ASCII) strings unique to network devices. In one embodiment, a DHCP server generates an authentication request that requests authentication of a MAC address of network device 102.

[0029] In one embodiment, address allocator 104 generates the authentication request in response to receiving from network device 102, a request for a network address, which includes the identification data. In this context, the network address is an Internet protocol address. In one specific embodiment, a DHCP server receives a process request from a DHCP client included in network device 102. The process request includes the MAC address of network device 102.

[0030] In block 204, the authentication request is sent to authentication mechanism 110. In one embodiment, the authentication request is sent to authentication mechanism 110 via a virtual private network (VPN) through public network 106 and secure communications links. For example, communications links 105 and 107 may conform to Internet Protocol Security (IPsec) or Secure Sockets Layer (SSL) protocols, depending upon the requirements of a particular application.

[0031] Authentication mechanism 110 authenticates the identification data by determining whether network device 102 is authorized to access private network 108. For example, authentication mechanism 110 compares the MAC address of network device 102 contained in the authentication request to a set of MAC addresses stored on authentication mechanism 110. An administrator may add, remove or update the MAC addresses in authentication mechanism 110 based on changes to user accessibility privileges.

[0032] Authentication mechanism 110 then generates an authentication response that indicates whether the identification data has been authenticated, and therefore whether network device 102 is authorized to access private network 108. Authentication mechanism sends the authentication response to address allocator 104.

[0033] In one embodiment, the authentication response received from the authentication mechanism 110 indicates “Authenticated”, “Not Authenticated” or “Rejected”. In this context, an “Authenticated” response indicates network device 102 is authorized to access a first network based on verification of the identification data by authentication mechanism 110. A “Not Authenticated” response indicates that network device 102 is not authorized to access a first network based on verification of the identification data by authentication mechanism 110. A “Rejected” response indicates that the authentication request was rejected or otherwise not able to be processed by authentication mechanism 110, and network device 102 is therefore not authorized to access a first network.

[0034] In block 206, an authentication response is received from authentication mechanism 110. In block 208, a network address is assigned to network device 102 based upon the authentication response received from authentication mechanism 110. In one embodiment, accessibility to the first network is more restricted relative to the second network. For example, the first network may be private network 108 and the second network may be public network 106. In one embodiment, if the authentication response indicates that network device 102 is authorized to access a first network, then address allocator 104 assigns a network address from a “trusted” pool of network addresses. The trusted pool of network addresses may be stored internal or external to address allocator 104. In this context, “trusted” refers to addresses that permit access to the first network. If the authentication response indicates that network device 102 is not authorized to access the first network, then address allocator 104 assigns an network address from an “untrusted” pool of network addresses stored in the address allocator. In this context, “untrusted” refers to addresses that permit access to the second network.

[0035] In one embodiment, address allocator 104 is configured with an access control list (ACL) for managing the trusted pool of network addresses. For example, the ACL may contain trusted pool network addresses that are available to be assigned to network devices that are properly authorized.

[0036] FIG. 3 is a flow diagram of another embodiment of a method of assigning network addresses to network devices. In block 302, an authentication request is generated that requests authentication of identification data that uniquely identifies network device 102. In block 304, the authentication request is sent to authentication mechanism 110.

[0037] In block 306, a determination is made whether an authentication response is received from authentication mechanism 110. In block 308, if an authentication response is received from authentication mechanism 110, a determination is made whether network device 102 is authorized to access the first network.

[0038] If network device 102 is authorized to access a first network, then in block 310, a first network address is assigned to network device 102 from the first network. If network device 102 is not authorized to access a first network, then in block 312, a second network address is assigned to network device 102 from a second network. If in block 306, an authentication response is not received from authentication mechanism 110, then the second network address is assigned on a second network.

4.0 IMPLEMENTATION MECHANISMS

[0039] FIG. 4 is a block diagram that illustrates a computer system 400 upon which an embodiment of the invention may be implemented. Computer system 400 includes a bus 402 or other communication mechanism for communicating information, and a processor 404 coupled with bus 402 for processing information. Computer system 400 also includes a main memory 406, such as a random access memory (“RAM”) or other dynamic storage device, coupled to bus 402 for storing information and instructions to be executed by processor 404. Main memory 406 also may be used for storing temporary variables or other intermediate information during execution of instructions to be executed by processor 404. Computer system 400 further includes a read only memory (“ROM”) 408 or other static storage device coupled to bus 402 for storing static information and instructions for processor 404. A storage device 410, such as a magnetic disk or optical disk, is provided and coupled to bus 402 for storing information and instructions.

[0040] Computer system 400 may be coupled via bus 402 to a display 412, such as a cathode ray tube (“CRT”), for displaying information to a computer user. An input device 414, including alphanumeric and other keys, is coupled to bus 402 for communicating information and command selections to processor 404. Another type of user input device is cursor control 416, such as a mouse, trackball, stylus, or cursor direction keys for communicating direction information and command selections to processor 404 and for controlling cursor movement on display 412. This input device typically has two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), that allows the device to specify positions in a plane.

[0041] The invention is related to the use of computer system 400 for assigning network addresses to network devices. According to one embodiment of the invention, the assigning of network addresses to network devices is provided by computer system 400 in response to processor 404 executing one or more sequences of one or more instructions contained in main memory 406. Such instructions may be read into main memory 406 from another computer-readable medium, such as storage device 410. Execution of the sequences of instructions contained in main memory 406 causes processor 404 to perform the process steps described herein. In alternative embodiments, hard-wired circuitry may be used in place of or in combination with software instructions to implement the invention. Thus, embodiments of the invention are not limited to any specific combination of hardware circuitry and software.

[0042] The term “computer-readable medium” as used herein refers to any medium that participates in providing instructions to processor 404 for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and transmission media. Non-volatile media includes, for example, optical or magnetic disks, such as storage device 410. Volatile media includes dynamic memory, such as main memory 406. Transmission media includes coaxial cables, copper wire and fiber optics, including the wires that comprise bus 402. Transmission media can also take the form of acoustic or light waves, such as those generated during radio-wave and infra-red data communications.

[0043] Common forms of computer-readable media include, for example, a floppy disk, a flexible disk, hard disk, magnetic tape, or any other magnetic medium, a CD-ROM, any other optical medium, punchcards, papertape, any other physical medium with patterns of holes, a RAM, a PROM, and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave as described hereinafter, or any other medium from which a computer can read.

[0044] Various forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to processor 404 for execution. For example, the instructions may initially be carried on a magnetic disk of a remote computer. The remote computer can load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to computer system 400 can receive the data on the telephone line and use an infra-red transmitter to convert the data to an infra-red signal. An infra-red detector can receive the data carried in the infra-red signal and appropriate circuitry can place the data on bus 402. Bus 402 carries the data to main memory 406, from which processor 404 retrieves and executes the instructions. The instructions received by main memory 406 may optionally be stored on storage device 410 either before or after execution by processor 404.

[0045] Computer system 400 also includes a communication interface 418 coupled to bus 402. Communication interface 418 provides a two-way data communication coupling to a network link 420 that is connected to a local network 422. For example, communication interface 418 may be an integrated services digital network (“ISDN”) card or a modem to provide a data communication connection to a corresponding type of telephone line. As another example, communication interface 418 may be a local area network (“LAN”) card to provide a data communication connection to a compatible LAN. Wireless links may also be implemented. In any such implementation, communication interface 418 sends and receives electrical, electromagnetic or optical signals that carry digital data streams representing various types of information.

[0046] Network link 420 typically provides data communication through one or more networks to other data devices. For example, network link 420 may provide a connection through local network 422 to a host computer 424 or to data equipment operated by an Internet Service Provider (“ISP”) 426. ISP 426 in turn provides data communication services through the world wide packet data communication network now commonly referred to as the “Internet” 428. Local network 422 and Internet 428 both use electrical, electromagnetic or optical signals that carry digital data streams. The signals through the various networks and the signals on network link 420 and through communication interface 418, which carry the digital data to and from computer system 400, are exemplary forms of carrier waves transporting the information.

[0047] Computer system 400 can send messages and receive data, including program code, through the network(s), network link 420 and communication interface 418. In the Internet example, a server 430 might transmit a requested code for an application program through Internet 428, ISP 426, local network 422 and communication interface 418. In accordance with the invention, one such downloaded application provides for assigning network addresses to network devices as described herein.

[0048] The received code may be executed by processor 404 as it is received, and/or stored in storage device 410, or other non-volatile storage for later execution. In this manner, computer system 400 may obtain application code in the form of a carrier wave.

5.0 EXTENSIONS AND ALTERNATIVES

[0049] In the foregoing specification, the invention has been described with reference to specific embodiments thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention. The specification and drawings are, accordingly, to be regarded in an illustrative rather than a restrictive sense.