Granted Patent B2

US 12,309,134 · App. 17/824,721 · Granted May 20, 2025

Inventors: Shiv Mehra (Saratoga, CA); Suresh Katukam (Milpitas, CA)

Assignee: Nile Global, Inc.

H04L63/0815H04L63/10H04W4/24H04W12/069

Abstract

Claims (27)

1. A method for communications, the method comprising:

at a cloud server that comprises a network management module, a customer information portal connected to the network management module, and a network management database configured to store network management data, restricting network access of a user after a Pre-Shared Key (PSK) of the user is transmitted from the user to a network element that is located between the user and the cloud server in a first sign-on session for the user to verify against a plurality of pre-stored keys in a database, wherein at the cloud server, restricting network access of the user after the PSK of the user is transmitted comprises determining that a Media Access Control (MAC) address of a network device at which the user operates does not match an entry in a predetermined list of allowed MAC addresses; and

at the cloud server, redirecting the user to an identity provider for authentication after restricting network access of the user, wherein at the cloud server, redirecting the user to the identity provider for authentication after restricting network access of the user comprises at the cloud server, redirecting the user to the identity provider for Security Assertion Markup Language (SAML) based authentication after restricting network access of the user.

2. The method of claim 1 , wherein at the cloud server, redirecting the user to the identity provider for authentication after restricting network access of the user comprises at the cloud server, redirecting the user to the identity provider for single sign-on (SSO) authentication after restricting network access of the user.

3. The method of claim 1 , further comprising at the cloud server, allowing network access of a second user after a second PSK of the second user is transmitted when a MAC address of a second network device at which the second user operates matches an entry in the predetermined list of allowed MAC addresses.

4. The method of claim 1 , further comprising exchanging Dynamic Host Configuration Protocol (DHCP) information between a network device at which the user operates and a network element that has access to the cloud server.

5. The method of claim 1 , wherein the identity provider is not a Remote Authentication Dial-In User Service (RADIUS) server.

6. The method of claim 1 , wherein the user operates a network device that is connected to the cloud server through a wireless link.

7. The method of claim 6 , wherein the network device is wirelessly connected to a wireless access point (AP) that has access to the cloud server.

8. The method of claim 1 , further comprising at the cloud server, receiving a plurality of attributes of the user from the identity provider after the user is successfully authenticated.

9. The method of claim 8 , further comprising at the cloud server, allowing network access of the user after the attributes of the user are received from the identity provider.

10. The method of claim 8 , further comprising at the cloud server, performing an accounting operation of the user based on the attributes of the user are received from the identity provider.

11. The method of claim 10 , wherein at the cloud server, performing the accounting operation of the user comprises at the cloud server, performing the accounting operation of the user to generate billing information for the user based on the attributes of the user are received from the identity provider.

12. The method of claim 1 , further comprising at the cloud server, allowing network access of the user after the Pre-Shared Key (PSK) of the user is retransmitted in a subsequent sign-on session.

13. The method of claim 12 , further comprising at the cloud server, exchanging Media Access Control (MAC) Authentication Bypass (MAB) request and response messages in the subsequent sign-on session.

14. A method for communications, the method comprising:

at a cloud server that comprises a network management module, a customer information portal connected to the network management module, and a network management database configured to store network management data, restricting network access of a user after a Pre-Shared Key (PSK) of the user is transmitted from the user to a network element that is located between the user and the cloud server in a first sign-on session for the user to verify against a plurality of pre-stored keys in a database, wherein the user operates a network device that is connected to the cloud server through a wireless link, and wherein at the cloud server, restricting network access of the user after the PSK of the user is transmitted comprises determining that a Media Access Control (MAC) address of a network device at which the user operates does not match an entry in a predetermined list of allowed MAC addresses; and

redirecting the user to an identity provider for single sign-on (SSO) authentication after restricting network access of the user, wherein at the cloud server, redirecting the user to the identity provider for authentication after restricting network access of the user comprises at the cloud server, redirecting the user to the identity provider for Security Assertion Markup Language (SAML) based authentication after restricting network access of the user.

15. The method of claim 14 , further comprising at the cloud server, allowing network access of a second user after a second PSK of the second user is transmitted when a MAC address of a second network device at which the second user operates matches an entry in the predetermined list of allowed MAC addresses.

16. The method of claim 14 , further comprising:

at the cloud server, receiving a plurality of attributes of the user from the identity provider after the user is successfully authenticated; and

at the cloud server, allowing network access of the user after the attributes of the user are received from the identity provider.

17. A method for communications, the method comprising:

at a cloud server that comprises a network management module, a customer information portal connected to the network management module, and a network management database configured to store network management data, restricting network access of a user after a Pre-Shared Key (PSK) of the user is transmitted from the user to a network element that is located between the user and the cloud server in a first sign-on session for the user to verify against a plurality of pre-stored keys in a database, wherein at the cloud server, restricting network access of the user after the PSK of the user is transmitted comprises determining that a Media Access Control (MAC) address of a network device at which the user operates does not match an entry in a predetermined list of allowed MAC addresses;

at the cloud server, redirecting the user to an identity provider for Security Assertion Markup Language (SAML) based authentication after restricting network access of the user;

receiving a plurality of attributes of the user from the identity provider after the user is successfully authenticated; and

at the cloud server, allowing network access of the user after the attributes of the user are received from the identity provider.

Assignments (1)

Continuity (1)

References Cited (16)

Cited By (1)

US 12,647,409