Performing authentication over label distribution protocol (LDP) signaling channels
View Patent ↗To perform end-to-end authentication between a customer premises network termination (CPNT 1 ) of a user and a network access server (NAS 1 ) of a service provider at set-up of a label switched connection in a label switched data packet system, end-to-end authentication information is transported over label distribution signaling channels.
1. Method to perform end-to-end authentication between a customer premises network termination (CPNT 1 ) of a user and a network access server (NAS 1 ) of a service provider at set-up of a label switched connection in a label switched data packet system,
CHARACTERIZED IN THAT end-to-end authentication information is transported over label distribution signaling channels.
2. Method according to claim 1 ,
CHARACTERIZED IN THAT said label switched data packet system is a Multi Protocol Label Switching (MPLS) based broadband access network, and said authentication information is transported via Label Distribution Protocol (LDP) channels.
3. Method according to claim 1 or claim 2 ,
CHARACTERIZED IN THAT said authentication information comprises a challenge request message (CHAL_REQ) encapsulating a request to set-up a label switched path between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ), a challenge response message (CHAL_RESP) encapsulating a challenge code determined by said network access server (NAS 1 ), an encrypted challenge request message (ENCR_REQ) encapsulating an encrypted version of said challenge code, and an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
4. Method according to claim 1 , CHARACTERISED IN THAT said authentication information comprises a request message encapsulating a user identity and a digital signature consisting of a secure hash value encrypted using a private key known by said user only, signed by a trusted authority and connected to a public key, and an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
5. Method according to claim 1 ,
CHARACTERISED IN THAT said authentication information comprises an authentication request (AUTH_REQ) encapsulating a unique value such as a time stamp (n) and a message authentication code (MAC) based on said unique value (n) and a secret (s) shared between said user and said service provider, and an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
6. Customer premises network termination (CPNT 1 ) for a label switched data packet system,
CHARACTERISED IN THAT said customer premises network termination (CPNT 1 ) is adapted to perform end-to-end authentication with a network access server (NAS 1 ) via label distribution signaling channels.
7. Customer premises network termination (CPNT 1 ) according to claim 6 ,
CHARACTERISED IN THAT said customer premises network termination (CPNT 1 ) comprises:
a. means for generating and sending a challenge request message (CHAL_REQ) encapsulating a request to set-up a label switched path between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 );
b. means for receiving and interpreting a challenge response message (CHAL_RESP) encapsulating a challenge code determined by said network access server (NAS 1 );
c. means for encrypting said challenge code to thereby generate an encrypted version of said challenge code;
d. means for generating and sending an encrypted challenge request message (ENCR_REQ) encapsulating said encrypted version of said challenge code; and
e. means for receiving and interpreting an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
8. Customer premises network termination (CPNT 1 ) according to claim 6 ,
CHARACTERISED IN THAT said customer premises network termination (CPNT 1 ) comprises:
a. means for generating and sending a request message encapsulating a user identity and a digital signature consisting of a secure hash value encrypted using a private key known by said user only, signed by a trusted authority and connected to a public key; and
b. means for receiving and interpreting an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
9. Customer premises network termination (CPNT 1 ) according to claim 6 ,
CHARACTERISED IN THAT said customer premises network termination (CPNT 1 ) comprises:
a. means for generating and sending an authentication request (AUTH_REQ) encapsulating a unique value such as a time stamp (n), and a message authentication code (MAC) based on said unique value (n) and a secret (s) shared between a user of said customer premises network termination (CPNT 1 ) and a service provider operating said network access server (NAS 1 ), said message authentication code (MAC) to be compared in said network access server (NAS 1 ) with a locally generated message authentication code based on said unique value (n) in said authentication request (AUTH_REQ) and said secret (s); and
b. means for receiving and interpreting an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
10. Network access server (NAS 1 ) for a label switched data packet system,
CHARACTERISED IN THAT said network access server (NAS 1 ) is adapted to perform end-to-end authentication with a customer premises network termination (CPNT 1 ) via label distribution signaling channels.
11. Network access server (NAS 1 ) according to claim 10 ,
CHARACTERISED IN THAT said network access server (NAS 1 ) comprises:
a. means for receiving and interpreting a challenge request message (CHAL_REQ) encapsulating a request to set-up a label switched path between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 );
b. means for generating and sending a challenge response message (CHAL_RESP) encapsulating a challenge code determined by said network access server (NAS 1 );
c. means for receiving and interpreting an encrypted challenge request message (ENCR_REQ) encapsulating an encrypted version of said challenge code;
d. means for comparing said challenge code with said encrypted version of said challenge code; and
e. means for generating and sending an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
12. Network access server (NAS 1 ) according to claim 10 ,
CHARACTERISED IN THAT said network access server (NAS 1 ) comprises:
a. means for receiving and interpreting a request message encapsulating a user identity and a digital signature consisting of a secure hash value encrypted using a private key known by said user only, signed by a trusted authority and connected to a public key;
b. means for decrypting said digital signature using said public key; and
c. means for generating and sending an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.
13. Network access server (NAS 1 ) according to claim 10 ,
CHARACTERISED IN THAT said network access server (NAS 1 ) comprises:
a. means for receiving and interpreting an authentication request (AUTH_REQ) encapsulating a unique value such as a time stamp (n), and a message authentication code (MAC) based on said unique value (n) and a secret (s) shared between a user of said customer premises network termination (CPNT 1 ) and a service provider operating said network access server (NAS 1 );
b. means for comparing said message authentication code (MAC) with a locally generated message authentication code based on said unique value (n) in said authentication request (AUTH_REQ) and said secret (s); and
c. means for generating and sending an authentication success/failure message (AUTH_S/F) encapsulating an indication that end-to-end authentication between said customer premises network termination (CPNT 1 ) and said network access server (NAS 1 ) is performed successfully or has failed.