Secure network access method
View Patent ↗The present invention provides network-layer authentication protocols for authenticating mobile client and access router to each other. The present invention uses Router Discovery as a carrier to implement the authentication protocols. In an embodiment of the present invention, a mobile client sends out a solicitation message to request connectivity service. The solicitation message contains a proof of identity of the mobile client. An access router that receives the solicitation message will not respond to it until the proof of the identity is verified. Only when the proof of identity of the mobile client is verified, will the access router respond and return an advertising message to the mobile client, thereby preventing unauthorized mobile clients from obtaining network access.
1. An authentication process comprising the steps of:
at an access router, receiving from a mobile client a solicitation message that contains a proof of identity of the mobile client;
when the access router has not previously received verification of the proof, verifying the proof by a trusted entity; and
returning an advertising message from an access router when the proof is verified.
2. An authentication process as recited in claim 1 , further comprising the step of certifying by the trusted entity to the mobile client any intermediate entities located between the mobile client and the trusted entity.
3. An authentication process as recited in claim 1 , wherein the process is used in a communication network comprising a plurality administrative domains each served by at least one administrative server and each having at least one access router.
4. An authentication process as recited in claim 3 , wherein the trusted entity is a server serving a home domain to which the mobile client belongs.
5. An authentication process as recited in claim 3 , wherein the trusted entity is a server serving a foreign domain visited by the mobile client.
6. An authentication process as recited in claim 3 , wherein the trusted entity is an access router that has received the solicitation message from the mobile client.
7. An authentication process as recited in claim 1 , wherein the advertising message contains a proof of identity of the access router for authentication by the mobile client.
8. An authentication process as recited in claim 1 , further comprising:
voluntarily sending out from a mobility serving node an advertising message that contains a proof of the identity of the access router for verification by mobile clients.
9. An authentication process as recited in claim 1 , wherein the steps recited in claim 1 are performed while the mobile client is in communication with the access router to re-authenticate the access router to the mobile client, and wherein the advertising message from the access router contains a proof of identity of the access router.
10. An authentication process as recited in claim 1 , wherein an access router, while in communication with the mobile client, sends out an advertisement message with short effective lifetime to initiate re-authentication of the mobile client to the access router.
11. An authentication process as recited in claim 1 , wherein IPv4 is adopted for data communication.
12. An authentication process as recited in claim 1 , wherein IPv6 is adopted for data communication.
13. An authentication process as recited in claim 1 , wherein the verification is performed, using an asymmetric key algorithm.
14. An authentication process as recited in claim 1 , wherein the verification is performed, using a symmetric key algorithm.
15. An authentication process as recited in claim 1 , wherein at least one of the solicitation message and the advertising message includes a challenge.
16. A mobile client comprising:
a transmitter;
a receiver; and
a processor that (a) sends out over the transmitter a solicitation message that contains a proof of identity of the mobile client, the proof of identity being provided to allow presentation to a trusted entity for verification, and (b) receives
an advertising message from an access router.
17. A mobile client as recited in claim 16 , wherein the advertising message contains a proof of identity of the access router.
18. A mobile client as recited in claim 16 , wherein the mobile client sends out the solicitation message through the transmitter to the access router while the mobile client is in communication with the access router in order to re-authenticate the access router.
19. A mobile client as recited in claim 16 , wherein IPv4 is adopted for data communication.
20. A mobile client as recited in claim 16 , wherein IPv6 is adopted for data communication.
21. A mobile client as recited in claim 16 , wherein the verification is performed using an asymmetric key algorithm.
22. A mobile client as recited in claim 16 , wherein the verification is performed using a symmetric key algorithm.
23. A mobile client as recited in claim 16 , wherein at least one of the solicitation message and the advertising message includes a challenge.
24. An AAA network comprised of a plurality of administrative domains each served by at least one administrative server and each having at least one access router deployed therein, comprising:
a mobile client that sends out a solicitation message that contains a proof of identity of the mobile client;
a trusted entity that verifies the proof; and
an access router that returns an advertising message only when the proof is successfully verified.
25. An AAA network as recited in claim 24 , wherein the trusted entity certifies to the mobile client any intermediary entities located between the mobile client and the trusted entity.
26. An AAA network as recited in claim 24 , wherein the trusted entity is a server serving a home domain to which the mobile client belongs.
27. An AAA network as recited in claim 24 , wherein the trusted entity is a server serving a foreign domain visited by the mobile client.
28. An AAA network as recited in claim 24 , wherein the trusted entity is an access router that has received the solicitation message from the mobile client.
29. An AAA network as recited in claim 24 , wherein the advertising message contains a proof of the identity of the access router for authentication by the mobile client.
30. An AAA network as recited in claim 24 , wherein the access router voluntarily sends out an advertisement message that contains a proof of identity of the access router, and the mobile client verifies the proof and sends out the solicitation message when it is unable to verify the proof.
31. An AAA network as recited in claim 24 , wherein the mobile client sends out the solicitation message while in communication with the access router, and the access router sends out an advertising message that contains a proof of identity of the access router for authentication by the mobile client.
32. An AAA network as recited in claim 24 , wherein the access router, while in communication with the mobile client, sends out an advertisement message with a short lifetime to induce the mobile client to send out the solicitation message.
33. An AAA network as recited in claim 24 , wherein IPv4 is adopted for data communication.
34. An AAA network as recited in claim 24 , wherein IPv6 is adopted for data communication.
35. An AAA network as recited in claim 24 , wherein the verification is performed, using an asymmetric key algorithm.
36. An AAA network as recited in claim 24 , wherein the verification is performed, using a symmetric key algorithm.
37. An AAA network as recited in claim 24 , wherein at least one of the solicitation message and the advertising message contains a challenge.