Patent Application
20080070544
The present invention is described with reference to the accompanying drawings. In the drawings, like reference numbers indicate identical or functionally similar elements. The drawing in which an element first appears is indicated by the left-most digit in the corresponding reference number.
While the present invention is described herein with reference to illustrative embodiments for particular applications, it should be understood that the invention is not limited thereto. Those skilled in the art with access to the teachings provided herein will recognize additional modifications, applications, and embodiments within the scope thereof and additional fields in which the invention would be of significant utility.
Home network 120 can be any type of wireless network, such as a cellular network or a wireless LAN. Home network 120 represents the home network of mobile device 110. Mobile device 110 can include a laptop computer, a cellular phone, a smart phone, a PDA or other wireless mobile device. Mobile device 110 is shown as currently having a wireless connection to wireless LAN hot spot 170. As will be known by individuals skilled in the relevant arts, mobile device 110 can roam from one network to another, provided that the proper roaming arrangements are in place between network providers and that mobile device 110 can be properly authenticated when entering a visited or foreign network, such as wireless LAN hot spot 170 or cellular network 140. Each of the networks is coupled through Internet 180. Other types of public and private networks can be used to couple the networks.
EAP provides an authentication framework that supports multiple authentication methods. EAP typically runs directly over data link layers, such as point-to-point protocol (“PPP”) or IEEE 802., without requiring IP. EAP may be used on dedicated lines, as well as switched circuits, and wired as well as wireless links. Deployments of IEEE 802.11 wireless LANs are based on EAP and use several EAP methods, including EAP-TLS (Transport Level Security), EAP-TTLS (Tunneled Transport Level Security), PEAP (Protected Extensible Authentication Protocol), and EAP-SIM (Subscriber Identify Module). These methods support authentication credentials that include digital certificates, user-names and passwords, secure tokens, and SIM secrets. The present invention can be implemented with each of these methods, but is not limited to these methods. Furthermore, the embodiments discussed herein focus on wireless links, however, the scope and spirit of the present invention extends to wired links, as well.
Using EAP nomenclature, mobile device 110 is considered an EAP peer, while network access server 210 is considered an EAP authenticator and home AAA server 240 is considered an EAP authentication server.
One of the advantages of the EAP architecture is its flexibility. EAP is used to select a specific authentication mechanism, typically after the authenticator requests more information in order to determine the specific authentication method to be used. Rather than requiring the authenticator to be updated to support each new authentication method, EAP permits the use of a backend authentication server, which may implement some or all authentication methods, with the authenticator acting as a pass-through for some or all methods and peers.
Referring to
Currently the only method available for mobile device 110 to know the policy at the visited network, wireless LAN hot spot 170 is for mobile device 110 to be configured with the policy. The configuration could be done a priori to the mobile node arriving at the visited network, or mobile device 110 can be configured before network access is granted. Provisioning of mobile device 110 at the time of arrival is very expensive requiring the execution of a complex procedure.
In step 310, network access server 210 receives an EAP-Start message. This message comes from the network and signals that the EAP procedure should start.
In step 320 network access server 210, which is located in the visited network, issues an EAP-Request-Identity message. If network access server 210 knows the visited network Authentication Policy, it will encode the policy as part of the EAP-Request-Identity message, as shown in this
In step 330, the mobile device 110 receives the EAP-Request-Identity. Mobile device 110 decodes the message to learn the authentication policy of the visited network. Mobile device 110 uses that knowledge and the preconfigured knowledge of the authentication policy of its home network 120 to select the authentication policy required. Mobile device 110 encodes the authentication policy in an EAP-Response Identity message and sends the message to network access server 210.
In step 340, network access server 210 decodes the EAP-Response Identity message and may act on it or may forward the message to home network 120. The routing of the message is typically based on the contents of the EAP-Response-Identity. As shown in
In step 350, Home AAA server 240 receives the Access-Request containing the EAP-Response-Identity and the selection for the authentication method, as it determined from the visited network policy conveyed in step 320 and the policy configured in mobile node 110. Home AAA server 240, acting as the EAP Authentication Server, then starts to execute an EAP method appropriate to the authentication method selected. The EAP method continues to execute until it succeeds or fails. Steps 360 and 370 illustrate a successful authentication occurring that enable mobile device 110 to access network 170. Specifically, in step 370 mobile device 110 receives an EAP-Success message. If successful authentication does not occur, ultimately the process will time out.
If the authentication method required two EAP methods to be executed, one for the device and one for the user, then upon completion of the first EAP method another may start to execute.
In an alternative scenario the visited network's authentication policy may be based on the identity of a mobile node.
In step 410, network access server 210 receives an EAP-Start message. This message comes from the network and signals that the EAP procedure should start.
In step 420, the network access server 210 is in a visited network whose authentication policy is dependant on the home network of the mobile node. Therefore, network access server sends an EAP-Request Identity message that does not contain an authentication policy selection.
In step 430, the mobile device 110 sends an EAP-Response Identity message that contains its selected authentication policy, which is based on configuration information within mobile device 110.
In step 440, since the Authentication Policy specified by mobile device 110 does not conform to its policy for the mobile device, network access server 210 responds back with an EAP-Request-Identity plus the authentication policy preferred by the visited network. If the authentication policy received by network access server 210 was consistent with the visited network's authentication policy, network access server 210 would proceed to step 460.
In step 450, mobile device 110 learns the authentication policy of the visited network and responds accordingly with an EAP-Response Identity message.
In step 460, network access server 210 decodes the EAP-Response Identity message and may act on it or may forward the message to home network 120. The routing of the message is typically based on the contents of the EAP-Response-Identity. As shown in
In step 470, Home AAA server 240 receives the Access-Request containing the EAP-Response-Identity and the selection for the authentication method, as it determined from the visited network policy conveyed in step 440 and the policy configured in mobile node 110. Home AAA server 240, acting as the EAP Authentication Server, then starts to execute an EAP method appropriate to the authentication method selected. The EAP method continues to execute until it succeeds or fails. Steps 480 and 490 illustrate a successful authentication occurring that enable mobile device 110 to access network 170. Specifically, in step 480 mobile device 110 receives an EAP-Success message. If successful authentication does not occur, ultimately the process will time out.
Note that this scheme of communicating the visited network policy can also extend to the broker networks. That is, the Broker AAA networks, represented by broker AAA server 230, can also use EAP-Request Identity to convey an Authentication Policy to a mobile device, such as mobile device 110.
Methods 300 and 400 can be implemented in networks based on a variety of protocols, including but not limited to WIMAX and 3GPP2.
In an embodiment of the present invention, the methods and systems of the present invention described herein are implemented using well known computers, such as a computer 500 shown in
Computer 500 includes one or more processors (also called central processing units, or CPUs), such as processor 510. Processor 500 is connected to communication bus 520. Computer 500 also includes a main or primary memory 530, preferably random access memory (RAM). Primary memory 530 has stored therein control logic (computer software), and data.
Computer 500 may also include one or more secondary storage devices 540. Secondary storage devices 540 include, for example, hard disk drive 550 and/or removable storage device or drive 560. Removable storage drive 560 represents a floppy disk drive, a magnetic tape drive, a compact disk drive, an optical storage device, tape backup, ZIP drive, JAZZ drive, etc.
Removable storage drive 560 interacts with removable storage unit 570. As will be appreciated, removable storage unit 560 includes a computer usable or readable storage medium having stored therein computer software (control logic) and/or data. Removable storage drive 560 reads from and/or writes to the removable storage unit 570 in a well known manner.
Removable storage unit 570, also called a program storage device or a computer program product, represents a floppy disk, magnetic tape, compact disk, optical storage disk, ZIP disk, JAZZ disk/tape, or any other computer data storage device. Program storage devices or computer program products also include any device in which computer programs can be stored, such as hard drives, ROM or memory cards, etc.
In an embodiment, the present invention is directed to computer program products or program storage devices having software that enables computer 500, or multiple computer 500s to perform any combination of the functions described herein
Computer programs (also called computer control logic) are stored in main memory 530 and/or the secondary storage devices 540. Such computer programs, when executed, direct computer 500 to perform the functions of the present invention as discussed herein. In particular, the computer programs, when executed, enable processor 510 to perform the functions of the present invention. Accordingly, such computer programs represent controllers of the computer 500.
Computer 500 also includes input/output/display devices 3180, such as monitors, keyboards, pointing devices, etc.
Computer 500 further includes a communication or network interface 590. Network interface 590 enables computer 500 to communicate with remote devices. For example, network interface 590 allows computer 500 to communicate over communication networks, such as LANs, WANs, the Internet, etc. Network interface 590 may interface with remote sites or networks via wired or wireless connections. Computer 500 receives data and/or computer programs via network interface 590. The electrical/magnetic signals having contained therein data and/or computer programs received or transmitted by the computer 500 via interface 590 also represent computer program product(s).
The invention can work with software, hardware, and operating system implementations other than those described herein. Any software, hardware, and operating system implementations suitable for performing the functions described herein can be used.
Exemplary embodiments of the present invention have been presented. The invention is not limited to these examples. These examples are presented herein for purposes of illustration, and not limitation. Alternatives (including equivalents, extensions, variations, deviations, etc., of those described herein) will be apparent to persons skilled in the relevant art(s) based on the teachings contained herein. Such alternatives fall within the scope and spirit of the invention.
