Patent ID: 8924721
Filing Date: 2014-12-30
Classification: H04L

Abstract:
1. A method for an authentication protocol, the method performed by data processing apparatus and comprising: identifying a host device attempting to connect to a network; transmitting one or more of a plurality of probes to the host device in a host information collection phase, wherein the plurality of probes includes an agent probe, the agent probe including a query of one or more agents installed on the host device, and the one or more agents are configured to determine a health level of the host device; generating, by the data processing apparatus, a source value; hashing, by the data processing apparatus, the source value to generate a nonce; providing, by the data processing apparatus, the nonce with the query of the one or more agents on the host device; receiving, in response to the query, reply data and an authentication code, wherein the reply data includes a unique agent identifier of at least one agent installed on the host device, the authentication code comprises a hash of the reply data and the nonce, and the host device is identifiable from the unique agent identifier; determining that the host device is a managed host device based on the receipt of the unique agent identifier; ending the host information collection phase prior to receiving a reply to at least one of the plurality of probes of the host device based on determining that the host device is a managed host device; hashing a combination of at least a portion of the reply data and the nonce to generate a digest; determining the reply is authentic based at least in part on a determination that the digest matches the authentication code; receiving, during a user detection preadmission state, a user identifier corresponding to the host device; and transitioning from the user detection preadmission state to a host detection preadmission state based on identifying that the user identifier is mapped to a user role and identifying that network access control for the role is enabled; wherein determining that a host device is an unmanaged host device causes the host information collection phase to persist at least until a reply is received or a timeout determined for each of the one or more of the plurality of probes.