Cross access login controller

• US 10,547,617 B2
• Filed: 09/29/2017
• Issued: 01/28/2020
• Est. Priority Date: 11/17/2010
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: ARRIS Enterprises LLC (CommScope Holding Company, Inc.)
• Inventors: Givoni, Doron, Pogorelik, Oleg
• Primary Examiner(s): To, Baotran N
• Application Number:
  US15/721,537
• Publication Number:
  US 20180278615A1
• Time in Patent Office: 851 Days
• Field of Search: 726 2, 726 3, 726 5
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security

Abstract

Systems and methods here may be used for authorizing network access including using a controller with a processor and memory, the controller in communication with a first network for controlling access to the first network. From a user equipment having a user registered in a visitor network, an access request to access the first network is received, wherein the access request includes a MAC address of the user equipment. Based on a query performed in a subscriber repository, if the received MAC address is not found, a credential request is sent to the user equipment, and a credential is received from the user equipment. A single use code is generated, stored in the subscriber repository, and sent to the user equipment via a trusted channel. A new code and a new credential are received via the visitor network, and are compared. If the new code and the single use code match, the new credential is registered for re-use by the user equipment.

Claims

1. A method of authorizing network access, comprising:

by a controller with a processor and memory, the controller in communication with a first network for controlling access to the first network;

receiving via the first network, from a user equipment having a user registered in a visitor network, an access request to access the first network, wherein the access request includes a MAC address of the user equipment;

performing a query, using the received MAC address, in a subscriber repository;

if, based on a result of the query, the received MAC address is not found in the subscriber repository;

sending a credential request to the user equipment;

receiving a credential from the user equipment;

generating a single use code;

causing storage of the single use code in the subscriber repository, correlated to the received MAC address;

sending the single use code to the user equipment via a trusted channel;

receiving a new code and a new credential via the visitor network;

comparing the new code and the single use code; and

based on a result of the comparing, if the new code matches the single use code, registering the new credential for re-use by the user equipment.

2. The method of claim 1 wherein

sending to the user equipment the single use code via the trusted channel comprises:

sending the single use code to the user equipment in a voice communication.

3. The method of claim 1, wherein the credential received from the user equipment comprises a cellular phone number.

4. The method of claim 1, wherein the trusted channel comprises a short message service (SMS) communication.

5. The method of claim 1, wherein the trusted channel comprises a MMS communication.

6. The method of claim 1, wherein the sending the single use code comprises sending the single use code in an email.

7. The method of claim 1, wherein sending the credential request to the user equipment further comprises:

directing the user equipment to a registration webpage.

8. A non-transitory computer-readable medium having computer-executable instructions stored thereon which, when executed by one or more computer processors of a controller in communication with a first network for controlling access to the first network, cause the one or more computer processors to perform steps of a method for authorizing network access, the method comprising:

receiving via the first network, from a user equipment having a user registered in a visitor network, an access request to access the first network, wherein the access request includes a MAC address of the user equipment;

performing a query, using the received MAC address, in a subscriber repository;

if, based on a result of the query, the received MAC address is not found in the subscriber repository;

sending a credential request to the user equipment;

receiving a credential from the user equipment;

generating a single use code;

causing storage of the single use code in the subscriber repository, correlated to the received MAC address;

sending the single use code to the user equipment via a trusted channel;

receiving a new code and a new credential via the visitor network;

comparing the new code and the single use code; and

based on a result of the comparing, if the new code matches the single use code, registering the new credential for re-use by the user equipment.

9. The non-transitory computer readable medium of claim 8, wherein sending the credential request to the user equipment further comprises directing the user equipment to utilize a registration webpage.

10. The non-transitory computer readable medium of claim 8, wherein the credential received from the user equipment comprises a cellular phone number.

11. A system for authorizing network access, comprising

a controller with a processor and memory, the controller in communication with a first network for controlling access to the first network, the controller configured to:

receive via the first network, from a user equipment having a user registered in a visitor network, an access request to access the first network, wherein the access request includes a MAC address of the user equipment;

perform a query, using the received MAC address, in a subscriber repository;

if, based on a result of the query, the received MAC address is not found in the subscriber repository;

send a credential request to the user equipment;

receive a credential from the user equipment;

generate a single use code;

cause storage of the single use code in the subscriber repository, correlated to the received MAC address;

send the single use code to the user equipment via a trusted channel;

receive a new code and a new credential via the visitor network;

compare the new code and the single use code; and

based on a result of the compare, if the new code matches the single use code, register the new credential for re-use by the user equipment.

12. The system of claim 11, wherein the credential received from the user equipment comprises a cellular phone number.

13. The system of claim 11, wherein to send the single use code to the user equipment via the trusted channel comprises sending the single use code to the user equipment in a voice communication.

14. The system of claim 11, wherein the trusted channel comprises a short message service (SMS) communication.

15. The system of claim 11, wherein the trusted channel comprises a MMS communication.

16. The system of claim 11, wherein to send the single use code to the user equipment comprises sending the single use code in an email.

17. The system of claim 11, wherein to send the credential request to the user equipment further comprises directing the user equipment to a registration webpage.