Method and apparatus for establishing virtual private network tunnels in a wireless network
View Patent ↗VPN tunnels may be established from a wireless user through a wireless network without requiring the wireless user to have a relationship with the wireless network. Instead, the wireless user interfaces with an authentication, authorization, and accounting service on a VPN host network. This allows the wireless user to sign on once to gain admittance to both the wireless network and the VPN host network. The VPN host network is able to establish accounts on various wireless network providers to alleviate the need for wireless users to have individual accounts with the wireless providers. Additionally, a wireless access point on the wireless network serves as a VPN gateway to interface between an encrypted session on the wireless network and a VPN tunnel formed between the wireless access point and the VPN host network. This allows the wireless access device to participate in a VPN tunnel without instantiating a VPN client.
1. A method of establishing a VPN tunnel through a wireless network, the method comprising the steps of:
passing identifying information associated with a wireless user to a VPN host network, the identifying information comprising a conceptual ID, user ID, and password;
evaluating the identifying information by the VPN host network to obtain a VPN host network access result; and
granting wireless access to the wireless user on the wireless network based on the VPN host network access result, to thereby enable both wireless network access and VPN host network access to be obtained without requiring evaluation of the identifying information by the wireless network.
2. The method of claim 1 , wherein the step of evaluating comprises authenticating the wireless user based on the identifying information associated with the wireless user, and ascertaining whether the user is authorized to access at least one of the VPN host network and the wireless network.
3. The method of claim 1 , wherein the step of passing identifying information to the VPN host network comprises receiving by the wireless network the identifying information, and transmitting by the wireless network at least a subset of the identifying information to the VPN host network.
4. The method of claim 3 , wherein the subset of the identifying information comprises the user ID and password.
5. The method of claim 4 , wherein the conceptual ID is not encrypted when received by the wireless network, and wherein the user ID and password are encrypted when received by the wireless network, and wherein the wireless network does not decrypt the user ID and password prior to transmitting the subset of the identifying information to the VPN host network.
6. The method of claim 1 , further comprising a step of establishing a VPN tunnel between the VPN host network and the wireless network.
7. The method of claim 6 ,
wherein the wireless network includes a wireless access point, and wherein the VPN tunnel is established between the VPN host network and the wireless access point.
8. The method of claim 1 , further comprising assigning, by the VPN host network, an IP address for use by the wireless user.
9. The method of claim 1 , further comprising a step of enabling the wireless user to access an established VPN tunnel with the VPN host network.
10. The method of claim 1 , further comprising a step of establishing an encrypted session between the wireless user and the wireless network, and establishing a VPN tunnel between the wireless network and the VPN host network.
11. A wireless access point, comprising:
a processor containing control logic configured to:
establish an encrypted session with a wireless user; and
establish a VPN tunnel to a VPN host network on behalf of the wireless user;
wherein the control logic is configured to rely on the VPN host network for authentication and authorization services with respect to the wireless user.
12. The wireless access point of claim 11 , wherein the VPN tunnel to the VPN host network is an IP Sec tunnel, and wherein the encrypted session with the wireless user comprises encrypting packets to be passed over the wireless network.
13. The wireless access point of claim 11 , further comprising means for enabling the VPN host network to assign a private IP address to the wireless user.
14. The wireless access point of claim 11 , a switch fabric configured to interface network ports and wireless access ports, and a routing information base configured to enable the control logic to route packets received at least one of the network ports and wireless access ports to another of the network ports and wireless access ports.
15. The wireless access point of claim 11 , wherein the wireless access point is an aggregation point.
16. The wireless access point of claim 11 , wherein the control logic is configured to map traffic received over the wireless network from the wireless network user to the VPN tunnel.