Wireless roaming and authentication
In one embodiment, a method includes receiving a Wi-Fi authentication request from a mobile device at a wireless controller, the request including a network access identifier, transmitting the request from the wireless controller to an authentication proxy, wherein the authentication proxy is in communication with a plurality of mobile operator authentication devices and operable to forward the request to one of the mobile operator authentication devices based on the network access identifier, and receiving a response to the request at the wireless controller, wherein the mobile device is permitted Wi-Fi access to a network by the wireless controller if the request is authenticated by the mobile operator authentication device. An apparatus and logic are also disclosed herein.
1. A method comprising:
receiving a Wi-Fi authentication request from a mobile device at a wireless controller, said request comprising a network access identifier, the wireless controller operable to perform control functions for a wireless network and communicate with the mobile device through an access point in the wireless network;
transmitting said request from the wireless controller to an authentication proxy over a tunnel with endpoints at the wireless controller and the authentication proxy, wherein the authentication proxy is in communication with a plurality of mobile operator authentication devices and operable to forward said request to one of the mobile operator authentication devices based on said network access identifier;
receiving a response to said request at the wireless controller authenticating the mobile device; and
transmitting mobile device traffic on a path different than said tunnel;
wherein the mobile device is permitted Wi-Fi access to a network by the wireless controller if said request is authenticated by the mobile operator authentication device; and
wherein the authentication proxy comprises a mapping of network access identifiers to mobile operator authentication devices and is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers for transmittal to one of the mobile operator authentication devices.
2. The method of claim 1 wherein said network address identifier comprises a realm and the authentication proxy comprises a list of realms and the mobile operator authentication devices corresponding to the realms.
3. The method of claim 1 wherein the authentication proxy is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers.
4. The method of claim 1 wherein the wireless controller and the authentication proxy are in communication over a virtual private network.
5. The method of claim 1 wherein transmitting said Wi-Fi authentication request comprises transmitting said request over an Internet Protocol security (IPsec) tunnel comprising endpoints at the authentication proxy and the wireless controller.
6. The method of claim 1 wherein the authentication proxy comprises an authentication, authorization, and accounting proxy server.
7. The method of claim 1 wherein receiving said Wi-Fi authentication request comprises receiving said request from an access point in wireless communication with the mobile device.
8. An apparatus comprising:
a roaming module for receiving a Wi-Fi authentication request from a mobile device at a wireless controller operable to perform control functions for a wireless network, transmitting said request to an authentication proxy over a tunnel with endpoints at the wireless controller and the authentication proxy, receiving a response to said request, and transmitting mobile device traffic on a path different than said tunnel; and
memory for storing said response for use in enabling Wi-Fi access for the mobile device if said request is authenticated by a mobile operator authentication device;
wherein said request comprises a network access identifier and the authentication proxy is configured for communication with a plurality of mobile operator authentication devices and operable to forward said request to the mobile operator authentication device selected based on said network access identifier; and
wherein the authentication proxy comprises a mapping of network access identifiers to mobile operator authentication devices and is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers for transmittal to one of the mobile operator authentication devices.
9. The apparatus of claim 8 wherein said network address identifier comprises a realm and the authentication proxy comprises a list of realms and the mobile operator authentication devices corresponding to the realms.
10. The apparatus of claim 8 wherein the authentication proxy is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers.
11. The apparatus of claim 8 wherein the apparatus is configured for communication with the authentication proxy over a virtual private network.
12. The apparatus of claim 8 wherein said Wi-Fi authentication request is transmitted over an Internet Protocol security (IPsec) tunnel with endpoints at the authentication proxy and the apparatus.
13. The apparatus of claim 8 wherein the authentication proxy comprises an authentication, authorization, and accounting proxy server.
14. The apparatus of claim 8 wherein said Wi-Fi authentication request is received from an access point in wireless communication with the mobile device.
15. Logic encoded on one or more non-transitory computer readable media for execution and when executed operable to:
receive a Wi-Fi authentication request from a mobile device at a wireless controller, the request comprising a network access identifier, the wireless controller operable to perform control functions for a wireless network and communicate with the mobile device through an access point in the wireless network;
transmit said request to an authentication proxy over a tunnel with endpoints at the wireless controller and the authentication proxy, wherein the authentication proxy is configured for communication with a plurality of mobile operator authentication devices and operable to forward said request to one of the mobile operator authentication devices based on said network access identifier;
receive a response to said request authenticating the mobile device; and
transmit mobile device traffic on a path different than said tunnel;
wherein the mobile device is permitted Wi-Fi access to a network by the wireless controller if said request is authenticated by the mobile operator authentication device; and
wherein the authentication proxy comprises a mapping of network access identifiers to mobile operator authentication devices and is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers for transmittal to one of the mobile operator authentication devices.
16. The logic of claim 15 wherein said network address identifier comprises a realm and the authentication proxy comprises a list of realms and the mobile operator authentication devices corresponding to the realms.
17. The logic of claim 15 wherein the authentication proxy is configured to aggregate a plurality of authentication requests from a plurality of wireless controllers.
18. The logic of claim 15 wherein the wireless controller is configured for communication with the authentication proxy over a virtual private network.
19. The logic of claim 15 wherein said Wi-Fi authentication request is transmitted over an Internet Protocol security (IPsec) tunnel with endpoints at the authentication proxy and the wireless controller.
20. The logic of claim 15 wherein said Wi-Fi authentication request is received from an access point in wireless communication with the mobile device.