System and method for WLAN roaming traffic authentication

1. A method of identifying traffic generated by a device authorized to use a roaming communications service providing access via a wireless local area network to a communications system, wherein the method comprises:

at an access point of the wireless local area network:

receiving a request for roaming authorization from a roaming device which has made an association with a wireless communications network provided by the WLAN access point;

processing the roaming service request by allocating an IP address to the device;

generating, in response to allocating said IP address to an authorized device, a message including meta-data identifying authorized device and including in a source address field of the message an IP address allocated to the authorized device; and

forwarding the meta-data message to a remote server;

wherein, when said remote server receives said message, the message received has undergone network address translation of an IP address in the source field, and

wherein the remote server associates said translated IP source address of said meta-data message with an authorized device identified by retrieving from a data structure an association between the extracted translated IP source address and a client device which is authorized to access said communications system, whereby subsequent traffic generated by said identified authorized device and having said translated source IP address is automatically authorized to use said roaming service in said communications system.

2. A method as claimed in claim 1 , wherein the meta-data of the message identifies the authorized device using a device identifier.

3. A method as claimed in claim 2 , wherein the device identifier comprises a media access control (MAC) address for the device.

4. A communications system for supporting devices roaming

within a plurality of wireless local area networks, the communications system including:

a plurality of wireless access points, each wireless access point providing at least one wireless local area network; and

at least one authentication server; wherein

each of the wireless access points constitutes a WLAN access point arranged to receive a request for roaming authorization from a roaming device which has made an association with a wireless communications network provided by the WLAN access point and to process the roaming service request by allocating an IP address to the device,

said access point is further configured to generate, in response to allocating said IP address to an authorized device, a message including meta-data identifying the authenticated device and, in a source address field, the IP address allocated to the authenticated device, and to forward the message over said communications system;

the authentication server to process a meta-data message received from a WLAN access point which has undergone network address translation, and is configured to:

extract from a source address field of the received message an IP address;

determine, from information extracted from the payload of said meta-data message, a device identity;

verify that the device identity comprises a device identity of a previously authenticated roaming device, and

store said IP address extracted from the source address field of said received meta-data message as a NAT translated IP source address for traffic from said authenticated device, whereby subsequent traffic generated by said device which undergoes the same network address translation is automatically authorized to use said roaming service to access said communications system.