IP Library Granted Patent US 8,341,700
Granted Patent B2
US 8,341,700 · App. 10/960,641 · Granted Dec 25, 2012

Authentication in heterogeneous IP networks

View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 8,341,700
App. No.
10/960,641
Granted
Dec 25, 2012
Kind
B2
Abstract

The invention proposes a system for authenticating and authorizing network services comprising: a mobile device being adapted to, upon receipt of an information message indicating at least one network access type, determine the network access type, to create a start message containing at least a user identity, and to encapsulate the start message in an authentication message compatible with the access network identified in the information message, and an access controller for reading the encapsulated message from the mobile and forwarding the encapsulated message to an authentication server identified in the encapsulated message. The invention also proposes a corresponding method for authenticating and authorizing network services, and an access control device, a subscriber device and a router device.

Claims (31)

1. An apparatus comprising:

a mobile device configured to at least

determine a network access type upon receipt of an information message indicating at least one network access type from a plurality of network access types,

create a start message containing at least a user identity and authentication data, wherein the start message initiates authentication regardless of which of the plurality of network access types is determined,

encapsulate the start message containing the at least the user identity and the authentication data in a message, wherein the message encapsulating the start message is compatible with the network access type determined from the information message, and

send, via an access network corresponding to the determined network access type, the message encapsulating the start message to an access controller to enable the access controller to read the encapsulated message from the mobile device and forward the encapsulated message to an authentication server identified in the encapsulated message.

2. The apparatus according to claim 1 , further comprising:

a router for issuing the information message comprising a router advertisement.

3. The apparatus according to claim 1 , wherein the information message is configured to indicate extensible authentication protocol support.

4. The apparatus according to claim 1 , wherein the information message is issued when the mobile device, enters a network.

5. The apparatus according to claim 1 , wherein the start message includes a client identifier option message and a extensible authentication protocol support identity option message, wherein the start message further includes information regarding at least one of a client type, a user identity, and a core address information.

6. The apparatus according to claim 1 , wherein a protocol between the mobile device and the access network comprises at least one of user datagram protocol, internet control message protocol version 6, IEEE 802. Ix, IEEE 802.11i, and a Bluetooth profile.

7. The apparatus according to claim 1 , wherein an authentication mechanism applied comprises an extensible authentication protocol.

8. The apparatus according to claim 1 , wherein the access controller is provided in a home agent of the mobile device.

9. A method comprising:

determining a network access type by a mobile device, upon receipt of an information message indicating at least one network access type from a plurality of network access types;

creating a start message containing at least a user identity and authentication data, wherein the start message initiates authentication regardless of which of the plurality of network access types is determined;

encapsulating the start message containing the at least the user identity and the authentication data in a message, wherein the message encapsulating the start message is compatible with the network access type determined from the information message; and

sending, via an access network corresponding to the determined network access type, the message encapsulating the start message to an access controller to enable the access controller to read and send the encapsulated message to an authentication server identified in the encapsulated message.

10. The method according to claim 9 , wherein the information message comprises a router advertisement.

11. The method according to claim 9 , wherein the information message indicates extensible authentication protocol support.

12. The method according to claim 9 , wherein the information message is issued when the mobile device enters a network.

13. The method according to claim 9 , wherein the start message includes a client identifier option message and a extensible authentication protocol support identity option message, wherein the start message further includes at least one of a client type, a user identity, and a core address information.

14. The method according to claim 9 , wherein a protocol between the mobile device and the access network is at least one of user datagram protocol, internet control message protocol version 6, IEEE 802. Ix, IEEE 802.11i, and a Bluetooth profile.

15. The method according to claim 9 , wherein an authentication mechanism applied comprises an extensible authentication protocol.

16. The method according to claim 9 , wherein the access controller function is provided in a home agent of the mobile device.

17. A non-transitory computer readable medium including code which when executed by at least one processor provides operations comprising:

determining a network access type upon receipt of an information message indicating at least one network access type from a plurality of network access types,

creating a start message containing at least a user identity and authentication data, wherein the start message initiates authentication regardless of which of the plurality of network access types is determined,

encapsulating the start message containing the at least the user identity and the authentication data in a message, wherein the message encapsulating the start message is compatible with the network access type determined from the information message indicating the plurality of network access types, and

sending, via the an access network corresponding to the determined network access type, the message encapsulating the start message to an access controller to enable the access controller to read the encapsulated message from the mobile device and forward the encapsulated message to an authentication server identified in the encapsulated message.

Assignments (1)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded May 5, 2015
From: NOKIA CORPORATION
To: NOKIA TECHNOLOGIES OY
Reel/Frame 035566/0086 →