Patent ID: 8555347

Claim:
A method comprising: receiving, by a network device, a Dynamic Host Configuration Protocol (DHCP) DISCOVER message from a DHCP client of a user device, the DHCP DISCOVER message relating to network access; generating, by the network device, a challenge based on receiving the DHCP DISCOVER message; sending, by the network device, the challenge, to an authentication device, in a Remote Authentication Dial In User Service (RADIUS) access-request message; receiving, by the network device, a RADIUS access-accept message from the authentication device based on sending the challenge to the authentication device, the RADIUS access-accept message not including a first challenge response when the RADIUS access-request message includes a DHCP option information identifying the user device as a device of a particular type, and the RADIUS access-accept message including the first challenge response when the RADIUS access-request message does not include the DHCP option information; generating, by the network device, a DHCP OFFER message; determining, by the network device, whether the RADIUS access-accept message, from the authentication device, includes the first challenge response; when the RADIUS access-accept message, from the authentication device, does not include the first challenge response: sending, by the network device, the DHCP OFFER message, to the DHCP client, the challenge not being sent to the DHCP client; and authenticating, by the network device, the DHCP client, the user device not being permitted the network access prior to authenticating the DHCP client; and when the RADIUS access-accept message, from the authentication device, includes the first challenge response: sending, by the network device and to the DHCP client, the DHCP OFFER message and the challenge; receiving, by the network device and based on sending the DHCP OFFER message and the challenge to the DHCP client, a DHCP REQUEST message that includes a second challenge response from the DHCP client; comparing, by the network device, the first challenge response with the second challenge response; and authenticating, by the network device, the DHCP client when the first challenge response and the second challenge response match, the user device not being permitted the network access prior to authenticating the DHCP client.