Data networks

• US 20020188738A1
• Filed: 05/17/2002
• Published: 12/12/2002
• Est. Priority Date: 11/29/1999
• Status: Active Grant

• Current Assignee: British Telecommunications PLC (BT Group PLC)
• Original Assignee: British Telecommunications PLC (BT Group PLC)
• Inventors: Gray, Robert H M
• Granted Patent: US 7,647,403 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 12/2876 Handling of subscriber policies group policies management H04L41/0893
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/0838 using one-time-passwords

Abstract

A network access arrangement for connecting an end user'"'"'s computer (10) to the Internet (12) includes a network access server (16) and a proxy server (24). When an end user requests to be connected to the Internet (12), the network access server (12) forwards the access request to the proxy server (24). The proxy server (24) authenticates some requests itself but forwards other requests to authentication servers (A, B or C) for authentication. After receiving a response from one of the servers (A, B, or C), the proxy server (24) forwards the response to the network access server (16).

If the proxy server (24) does not receive a response from one of the authentication servers (A, B, or C), it follows a default procedure. This can be to authenticate the request in the proxy server (24) or simply to accept the request. The proxy server (24) has a counter associated with each of the servers (A, B or C). Each time the proxy server (24) receives a response from one of the servers (A, B or C), it decrements the appropriate counter. Each time it does not receive a response, it increments the appropriate counter. When one of the counters reaches a threshold value, the proxy server (24) then follows the default procedure for a pre-set number of requests which would normally be forwarded to the appropriate server. After following the default procedure for this predetermined number of access requests, the proxy server (24) forwards the next access requests, which would normally be forwarded to the relevant server, to that server.

Claims

1. A method of processing a request at an access server arrangement for a data terminal operated by an end user for access to a data network, said method comprising the steps of:

receiving a request from the data terminal at the access server arrangement for access to the data network;

in the event that a predetermined criterion is not satisfied;

(i) attempting to forward the access request to an authentication server;

(ii) if a response is received from the authentication server, dealing with the access request in accordance with the response; and

(iii) if a response is not received from the authentication server, dealing with the access request in accordance with a default procedure; and

in the event that the predetermined criterion is satisfied, dealing with the access request in accordance with a default procedure.

2. A method as claimed in claim 1, including the additional step of:

selecting an authentication server from a plurality of authentication servers in accordance with the value of at least one attribute contained in the access request; and

in said step of attempting to forward the access request, an attempt is made to forward the access request to the selected authentication server.

3. A method as claimed in claim 1, in which the network access arrangement includes a proxy server, the proxy server being responsible for forwarding an access request to an authentication server, receiving any response from the authentication server, and, if appropriate, handling an access request in accordance with the default procedure.

4. A method as claimed in any one of claims 1 to 3, in which the predetermined criterion is satisfied if there are repetitive failures to receive a response from an authentication server.

5. A method as claimed in any one of the preceding claims, which includes the following steps:

if a response is not received from an authentication server, changing the value held in a counter by one unit in one direction; and

if a response is received from an authentication server, changing the value held in the counter by one unit in the other direction; and

the predetermined criterion is reached when the value held in the counter has progressed in said one direction to a predetermined threshold.

6. A method as claimed in claim 5, in which, in the event that the counter has reached said predetermined threshold, the method includes steps of performing the default procedure for a predetermined number of times, then changing the value held in the counter by one unit in the other direction, then making an attempt to forward the next access request to the authentication server.

7. A network access server configured to operate according to the method of any one of the preceding claims.

8. A network including at least one network access server according to claim 7 and one or more of said authentication servers.