Methods and apparatuses to provide secure communication between an untrusted wireless access network and a trusted controlled network
View Patent ↗A request for an IP address for a client device having a first identifier information is received from an AP device. The request for the IP address is associated with a first communication protocol. The first identifier information is compared to a second identifier information. The second identifier information is associated with a second communication protocol. The second communication protocol is different from the first communication protocol. The IP address for the client device based on comparing.
1. A machine-implemented method at a network element to provide a communication between a wireless access network controlled by an access point (AP) device and a packet core network, comprising:
providing a mobility gateway device between the AP device and the packet core network and between a radio network controller of a radio access network and the packet core network;
coupling a client device to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to the mobility gateway device;
establishing an IP secure tunnel between the AP device and a mobility gateway device, coupling the AP device with a packet core network, wherein the AP device is communicably coupled to the client device in the wireless network and wherein the mobility gateway device is further communicably coupled to a mobile network gateway of the wireless network;
receiving a request for an authentication for the client device from the AP device, the request for the authentication having a first identifier information, wherein the request for an authentication is associated with an authentication protocol;
receiving a request for an IP address for the client device having a second identifier information from the AP device, wherein the request for the IP address is associated with a first communication protocol and the second identifier is associated with the second communication protocol;
authenticating, by a mobile network operator's authentication process, the client device through the IP secure tunnel between the mobility gateway device and the AP device, while the client device is roaming in the wireless network;
mapping the first identifier information and the second identifier information using the mobility gateway device;
providing the first identifier information and the second identifier information through the secure tunnel;
comparing the first identifier information to the second identifier information for the client device, wherein the authentication protocol is different from the first communication protocol and the first identifier information is received as part of the authentication request associated with the authentication protocol different from the IP address request associated with the first communication protocol; and
determining whether to provide the IP address from the mobility gateway device for the client device through an access point based on the step of comparing;
providing the IP address through the IP secure tunnel to the client device if the first identifier information and the second identifier information are related;
communicating the IP address from the mobility gateway device to the packet core network and to a controller of the wireless access network controlled by AP device; and maintaining a communication session with a remote entity using the IP address while the client device roams between the wireless access network controlled by an access point and the packet core network,
wherein the mobility of the client device is managed by the mobility gateway device, and
wherein the mobility gateway device determines whether the client device is attempting to establish a connection with the Internet or operator services of the mobile network operator.
2. The method of claim 1 , wherein each of the first identifier information and the second identifier information includes a Media Access Control (MAC) address.
3. The method of claim 1 , further comprising:
formatting the request for the authentication;
transmitting the formatted request for the authentication to an authentication, authorization, and accounting (AAA) server; and
receiving an authentication response for the first identifier information from the AAA server, storing the authentication response in a memory.
4. The method of claim 1 , further comprising:
determining that the request for the authentication and the request for the IP address are related if the first identifier information matches with the second identifier information.
5. The method of claim 1 , further comprising:
transmitting a challenge request for an additional credential information for the client device; and
receiving the challenge response including the additional credential information.
6. The method of claim 1 , wherein the first communication protocol includes a Dynamic Host Configuration Protocol (DHCP).
7. The method of claim 1 , further comprising:
receiving an IP discovery message for the client device;
transmitting an authorization request based on the IP discover message to an AAA server; and
receiving an authorization response for the client device from the AAA server.
8. The method of claim 1 , wherein the authentication protocol includes an Extensible Authentication Protocol.
9. The method of claim 1 , further comprising:
transmitting a session request to the packet core network based on the first identifier information;
receiving a session response from the packet core network, the session response including the IP address allocated by the packet core network; and
assigning the IP address to the client device.
10. A non-transitory machine-readable storage medium storing instructions therein, which when executed by a data processing system, cause the data processing system to perform operations comprising:
coupling a client device to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to a mobility gateway device;
establishing an IP secure tunnel between the AP and a mobility gateway device, wherein the mobility gateway device is further communicably coupled to a mobile network gateway of the packet core network;
receiving a request for an authentication for the client device from the AP device, the request for the authentication having a first identifier information, wherein the request for an authentication is associated with an authentication protocol;
receiving a request for an IP address for the client device having a second identifier information from the AP device, wherein the request for the IP address is associated with a first communication protocol and the second identifier is associated with the second communication protocol;
authenticating, by a mobile network operator's authentication process, the client device through the IP secure tunnel between the mobility gateway device and the AP device, while the client device is roaming in the wireless network;
mapping the first identifier information and the second identifier information using the mobility gateway device;
providing the first identifier information and the second identifier information through the secure tunnel;
comparing the first identifier information to the second identifier information for the client device, wherein the authentication protocol is different from the first communication protocol and the first identifier is received as part of the authentication request associated with the authentication protocol different from the IP address request associated with the first communication protocol;
determining whether to provide the IP address from the mobility gateway device for the client device through an access point based on the step of comparing;
providing the IP address through the IP secure tunnel to the client device if the first identifier information and the second identifier information are related; and
communicating the IP address from the mobility gateway device to the packet core network and to a controller of the wireless access network controlled by an access point device to allow the client device to roam between a wireless access network controlled by an AP device and a packet core network; and
maintaining a communication session with a remote entity using the IP address while the client device roams between the wireless access network controlled by an access point and the packet core network,
wherein the mobility of the client device is managed by the mobility gateway device; and
wherein the mobility gateway device determines whether the client device is attempting to establish a connection with the Internet or operator services of the mobile network operator.
11. The non-transitory machine-readable storage medium of claim 10 , wherein each of the first identifier information and the second identifier information includes a Media Access Control (MAC) address.
12. The non-transitory machine-readable storage medium of claim 10 , further comprising instructions which when executed by the data processing system cause the system to perform operations comprising:
formatting the request for the authentication;
transmitting the formatted request for the authentication to an authentication, authorization, and accounting (AAA) server; receiving an authentication response for the first identifier information from the AAA server; and
storing the authentication response in a memory.
13. The non-transitory machine-readable storage medium of claim 10 , further comprising instructions which when executed by the data processing system cause the system to perform operations comprising:
determining that the request for the authentication and the request for the IP address are related if the first identifier information matches with the second identifier information.
14. The non-transitory machine-readable storage medium of claim 10 , further comprising instructions which when executed by the data processing system cause the system to perform operations comprising:
transmitting a challenge request for an additional credential information for the client device; and
receiving the challenge response including the additional credential information.
15. The non-transitory machine-readable storage medium of claim 10 , wherein the first communication protocol includes a Dynamic Host Configuration Protocol (DHCP).
16. The non-transitory machine-readable storage medium of claim 13 , further comprising instructions which when executed by the data processing system cause the system to perform operations comprising:
receiving an IP discovery message for the client device;
transmitting an authorization request based on the IP discover message to an AAA server; and
receiving an authorization response for the client device from the AAA server.
17. The non-transitory machine-readable storage medium of claim 10 , wherein the authentication protocol includes an Extensible Authentication Protocol.
18. The non-transitory machine-readable storage medium of claim 10 , further comprising instructions which when executed by the data processing system cause the system to perform operations comprising:
transmitting a session request to the packet core network based on the first identifier information;
receiving a session response from the packet core network, the session response including the IP address allocated by the packet core network; and
assigning the IP address to the client device.
19. A network element, comprising:
a processor; and
a memory coupled to the processor for storing instructions, which when executed from the memory, causes the processor to:
couple a client device to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to a mobility gateway device;
establish an IP secure tunnel between an access point (AP) and the mobility gateway device, wherein the mobility gateway device is further communicably coupled to a mobile network gateway of the wireless network;
receive a request for an authentication for a client device from the AP device, the request for the authentication having a first identifier information, wherein the request for an authentication is associated with an authentication protocol;
receive a request for an IP address for the client device having a second identifier information from the AP device, wherein the request for the IP address is associated with a first communication protocol and the second identifier is associated with the second communication protocol;
authenticate, by a mobile network operator's authentication process, the client device through the IP secure tunnel between mobility gateway device and the AP device, while the client device is roaming in the wireless network;
mapping the first identifier information and the second identifier information using the mobility gateway device;
providing the first identifier information and the second identifier information through the secure tunnel;
compare the first identifier information to a second identifier information for the client device, wherein the authentication protocol is different from the first communication protocol and the first identifier is received as part of the authentication request associated with the authentication protocol different from the IP address request associated with the first communication protocol; and
determine whether to provide the IP address from a mobility gateway device for the client device through an access point based on the step of comparing;
provide the IP address through the IP secure tunnel to the client device if the first identifier information and the second identifier information are related; and
communicate the IP address from the mobility gateway device to the packet core network and to a controller of the wireless access network controlled by an access point device to allow the client device to roam between the wireless access network controlled by AP point device and the packet core network; and maintaining a communication session with a remote entity using the IP address while the client device roams between the wireless access network controlled by an access point and the packet core network, and
wherein the mobility of the client device is managed by the mobility gateway device, and
wherein the mobility gateway device determines whether the client device is attempting to establish a connection with the Internet or operator services of the mobile network operator.
20. The network element of claim 19 , wherein each of the first identifier information and the second identifier information includes a Media Access Control (MAC) address.
21. The network element of claim 19 , wherein the processor is for storing further instructions, which when executed from the memory, cause the processor to format the request for the authentication; to send the formatted request for the authentication to an authentication, authorization, and accounting (AAA) server; to receive an authentication response for the first identifier information from the AAA server, and to store the authentication response in a memory.
22. The network element of claim 19 , wherein the processor is for storing further instructions, which when executed from the memory, cause the processor to determine that the request for the authentication and the request for the IP address are related if the first identifier information matches with the second identifier information.
23. The network element of claim 19 , wherein the processor is for storing further instructions, which when executed from the memory, cause the processor to send a challenge request for an additional credential information for the client device; and to receive the challenge response including the additional credential information.
24. The network element of claim 19 , wherein the first communication protocol includes a Dynamic Host Configuration Protocol (DHCP).
25. The network element of claim 19 , wherein the processor is for storing further instructions, which when executed from the memory, cause the processor to receive an IP discovery message for the client device; to send an authorization request based on the IP discover message to an AAA server; and to receive an authorization response for the client device from the AAA server.
26. The network element of claim 19 , wherein the authentication protocol includes an Extensible Authentication Protocol.
27. The network element of claim 19 , wherein the processor is for storing further instructions, which when executed from the memory, cause the processor to send a session request to the packet core network based on the first identifier information; to receive a session response from the packet core network, the session response including the IP address allocated by the packet core network; and to assign the IP address to the client device.
28. The method of claim 1 , wherein the communication between the AP and the packet core network becomes secure without running an IP secure protocol on the client device.
29. The method of claim 10 , wherein the communication between the AP and the packet core network becomes secure without running an IP secure protocol on the client device.
30. The method of claim 19 , wherein the communication between the AP and the packet core network becomes secure without running an IP secure protocol on the client device.