Multimode Authentication VLAN Reassignment via Short DHCP Leases
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for assigning users to the proper VLAN in digital networks, such as port flapping, are not reliable, especially in wireless networks and when multiple supplicants are involved, and can fail with poorly behaved clients or those starting authentication before DHCP address resolution.
Innovation Solution
A method where the network device assigns clients to a first VLAN with a short DHCP lease, rewrites DHCP traffic to request and provide a short lease, snoops for authentication traffic, and upon successful authentication, captures the destination VLAN, allowing reassignment when the lease expires, using a network switch with a processor and operating system to manage VLAN assignments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If port flapping is used to reassign clients to VLANs, then VLAN reassignment can be achieved, but the method is unreliable and not available in wireless networks
Solution Approach 1:
The patent applies preliminary action by assigning clients to a default VLAN with a short DHCP lease time (e.g., 30 seconds) before authentication is complete. This pre-assignment ensures the client has network access immediately, and the short lease automatically triggers reassignment after expiration, eliminating the need for port flapping and ensuring reliability across wired and wireless networks.
Solution Approach 2:
The patent changes the DHCP lease time parameter to a short duration for the default VLAN. This parameter change enables automatic client reassignment when the lease expires, providing a reliable mechanism that works universally across different network types including wireless, where port flapping cannot be used.
2Reliability
If port flapping is used to reassign clients, then VLAN switching can occur, but it fails with multiple supplicants or poorly behaved clients
Solution Approach 1:
The patent implements self-service by having the DHCP protocol itself handle the client reassignment process. When the short lease expires, the client automatically initiates a new DHCP request, and the network device reassigns the client to the appropriate VLAN based on authentication results. This eliminates the need for port flapping and works reliably with multiple supplicants and various client behaviors without requiring client cooperation.
3Speed
If clients start 802.1x authentication before DHCP address resolution, then authentication can begin early, but port flapping fails to handle this scenario
Solution Approach 1:
The patent applies preliminary action by pre-assigning clients to a default VLAN with a short DHCP lease before authentication completes. This allows clients to start 802.1x authentication immediately upon connection while ensuring they have a valid IP address. When the short lease expires, the client is automatically reassign to the correct VLAN, ensuring reliability regardless of when authentication was initiated.
Data Source
AI summary
Assigning clients to VLANs on a digital network. A client attaching to a digital network through a network device is initially assigned to a first VLAN. This VLAN may have restricted access and is used for authentication. The device snoops DHCP traffic on this first VLAN rewriting DHCP traffic from the client to request a short lease time for the client. A short lease time may be on the order of 30 seconds. The device optionally rewrites DHCP traffic to the client on the first VLAN to assure a short lease time is returned; this rewriting supports DHCP servers which do not issue short leases. Traffic on this first VLAN may be limited to authentication such as captive portals, 802.1x, Kerberos, and the like. If client authentication on the first VLAN does not succeed, when the short lease expires, the client will receive another short lease on the first VLAN. The network device snoops authentication traffic. When authentication succeeds, the device snoops this traffic and derives information such as roles and the target VLAN for the client, saving this information. When the short DHCP lease expires for the client, and the client restarts the DHCP process, the device assigns the client to the target VLAN and all further processing occurs on this target VLAN.