Patent ID: 8555340

Claim:
An authentication server apparatus, comprising: a network interface that is coupled to a data network for receiving one or more packet flows therefrom; a processor; one or more stored sequences of instructions which, when executed by the processor, cause the processor to carry out the steps of: sending via the network interface, to a supplicant that is requesting access to a computer network resource subject to authentication of a user of the supplicant, a list of first authentication methods that are supported by the authentication server; wherein the first authentication methods are based on authentication requirements for the supplicant; receiving via the network interface, from the supplicant, a counter-list of second authentication methods that are supported by the supplicant; determining which of the second authentication methods in the counter-list are in the list of the first authentication methods; and performing an authentication policy action based on which of the second authentication methods are in the list of the first authentication methods; initiating an authentication message exchange with the supplicant based on one of the first authentication methods that are in the counter-list of second authentication methods; if the authentication message exchange is successful and the supplicant is granted access to the computer network resource, granting one of a plurality of levels of access to the computer network resource based on which of the second authentication methods in the counter-list are in the list of the first authentication methods.