Method and system for managing data traffic in wireless networks

• US 20030087629A1
• Filed: 09/27/2002
• Published: 05/08/2003
• Est. Priority Date: 09/28/2001
• Status: Active Grant

• Current Assignee: Bluesocket Incorporated (ADTRAN Holdings, Inc.)
• Original Assignee: Bluesocket Incorporated (ADTRAN Holdings, Inc.)
• Inventors: Christoffel, Thomas, Crawshaw, Geoffrey, Bates, Philip, Crosbie, David, Juitt, David
• Granted Patent: US 7,042,988 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 1/22 using redundant apparatus to increase reliability
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0861 using biometrical features, e.g. fingerprint, retina-scan cryptographic mechanisms or cryptographic arrangements for entity authentication using biological data H04L9/3231
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/168 above the transport layer
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: H04W 92/02 Inter-networking arrangements

Abstract

The present invention can be used to facilitate the integration of wireless capability provided by wireless access points into an enterprise computer network. A gateway server is interposed between wireless access points and protected networks to provide security and integration functions, for example, authentication, access control, link privacy, link integrity, and bandwidth metering in various embodiments. Use of such a gateway server allows substantial control to be gained over network access even with the use of relatively simple access points. In general, such a gateway server receives a request to access the protected network. An authentication subsystem of the gateway server authenticates the user, preferably by accessing an external authentication server and returns a role to the authenticated user. An access controller in the gateway server provides differential access to the protected network based on the user'"'"'s assigned role. A multiple gateway servers can be connected together to form a mesh network architecture.

Claims

1. A method for managing access control and security with a gateway server interposed between a wireless local area network and a protected network, the method comprising the steps of:

(a) receiving, by a first gateway server from a user of a mobile device that is in communication with the gateway server via a wireless access point, a request to access the protected network;

(b) authenticating the user by the gateway server using an authentication server external to the gateway server;

(c) assigning a role to the authenticated user; and

(d) providing access to the protected network based on the assigned role.

2. The method of claim 1 further comprising providing a second gateway server interposed between the wireless network and the protected network for a fail-over configuration, and wherein step (a) further comprises receiving the request by the second gateway server if the first gateway server fails.

3. The method of claim 1, wherein the request to access the protected network received in step (a) comprises an identifier and authentication information.

4. The method of claim 3, wherein the identifier comprises at least one of a username, an email address, and an unique name.

5. The method of claim 3, wherein the authentication information comprises at least one of a PIN, password, digital certificate, encryption key, and digital code.

6. The method of claim 1, wherein the request to access the protected network received in step (a) comprises a request to access network resources.

7. The method of claim 6, wherein the authenticating step (b) comprises authenticating a previously authenticated user without requiring communication of authentication information.

8. The method of claim 1, wherein the external authentication server comprises a RADIUS server.

9. The method of claim 1, wherein the external authentication server comprises a LDAP server.

10. The method of claim 1, wherein the external authentication server comprises a NTLM server.

11. The method of claim 10, wherein the use of the external authentication server is transparent to the user.

12. The method of claim 11 further comprising the steps of:

(i) passively monitoring an authentication process, wherein the user makes a request to authenticate to a server; and

(ii) if the user successfully authenticates, assigning a role based on the server with which the user authenticated..

13. The method of claim 11, wherein the server is a Windows 2000 or NT server.

14. The method of claim 1, wherein the authenticating step (b) is performed substantially according to one of the Point-to-Point Tunneling Protocol (PPTP) or the IPSec protocol.

15. The method of claim 1 further comprising, prior to step (a), the step of defining the role for the user.

16. The method of claim 15, wherein the step of defining a role further comprises:

(i) specifying network resources available;

(ii) specifying a degree of access to the protected network; and

(iii) specifying an available connection bandwidth.

17. The method of claim 16, wherein the defining step further comprises:

(iv) specifying a tunneling protocol.

18. The method of claim 16, wherein the defining step further comprises:

(v) specifying an inherited role.

19. The method of claim 1 further comprising replicating a plurality of second gateway servers interposed between the wireless network and the protected network from the first gateway server.

20. The method of claim 1 further comprising protecting from illicit monitoring using a secure web browser page.

21. The method of clam 1 further comprising detecting unauthorized access points by monitoring network traffic.

22. A gateway server for interposition between a wireless local area network and a protected network, the server comprising:

(a) a receiver for receiving, from a user of a mobile device via a wireless access point, a request to access the protected network;

(b) an authentication subsystem for externally authenticating the user;

(c) a role assignor in communication with the receiver and the authentication subsystem for assigning a role to the authenticated user; and

(d) an access controller in communication with the assignor for providing access to the protected network based on the assigned role.

23. The gateway server of claim 22 further comprising a second gateway server for interposition between the wireless network and the protected network to provide a fail-over configuration, and wherein the second gateway server receives the request if the first gateway server fails.

24. The gateway server of claim 22, wherein the request to access the protected network received by the receiver comprises an identifier and authentication information.

25. The gateway server of claim 24, wherein the identifier comprises at least one of a username, an email address, and an unique name.

26. The gateway server of claim 24, wherein the authentication information comprises at least one of a PIN, password, digital certificate, encryption key, and digital code.

27. The gateway server of claim 22, wherein the request to access the protected network received by the receiver comprises a request to access network resources.

28. The gateway server of claim 27, wherein the external authentication server authenticates the user as a user that previously authenticated without requiring communication of authentication information.

29. The gateway server of claim 22, wherein the external authentication server used comprises a RADIUS server.

30. The gateway server of claim 22, wherein the external authentication server used comprises a LDAP server.

31. The gateway server of claim 22, wherein the external authentication server used comprises a NTLM server.

32. The gateway server of claim 31, wherein the use of the external authentication server is transparent to the user.

33. The gateway server of claim 32, the server further comprising:

a passive monitor for monitoring an authentication process, wherein the user makes a request to authenticate to a server and

if the user authenticates successfully, assigning a role based on which server the user successfully authenticated.

34. The gateway server of claim 22, wherein user authenticates with a Windows 2000 or NT server.

35. The gateway server of claim 22, wherein the communication between the mobile device and the gateway server substantially is according to one of the Point-to-Point Protocol (PPTP) or the IPSec protocol.

36. The gateway server of claim 22 further comprising a role definer for defining the role for the user.

37. The gateway server of claim 36, wherein the role definer further comprises:

(i) specifying network resources available;

(ii) specifying a degree of access to the protected network; and

(iii) specifying an available connection bandwidth.

38. The gateway server of claim 37, wherein the role definer further comprises:

(iv) specifying a tunneling protocol.

39. The gateway server of claim 37, wherein the role definer further comprises:

(v) specifying an inherited role.

40. The gateway server of claim 22 further comprising a replicator for replicating a plurality of second gateway servers for interposition between the wireless network and the protected network from the gateway server.

41. The gateway server of claim 22 further comprising a secure web browser page.

42. The gateway server of clam 22 further comprising a detector for detecting unauthorized access points by monitoring network traffic and signals.

43. A gateway server for interposition between a wireless network and a protected network, the server comprising:

(a) means for receiving, from a user of a mobile device via a wireless access point, a request to access the protected network;

(b) means for externally authenticating the user;

(c) means for assigning a role to the authenticated user; and

(d) means for providing access to the protected network based on the assigned role.

44. A mesh network of gateway servers comprising:

a plurality of gateway servers each in communication with a wireless local area network and a protected network, each of the plurality of gateway servers in communication with each other to facilitate hand-off of a mobile device from one of the plurality of gateway servers to another of the plurality of gateway servers, and,

wherein each of the plurality of gateway servers comprises;

(i) a receiver for receiving, from a user of a mobile device via a wireless access point, a request to access the protected network;

(ii) an authentication subsystem for externally authenticating the user;

(iii) a role assignor in communication with the receiver and the authentication subsystem for assigning a role to the authenticated user; and

(iv) an access controller in communication with the assignor for providing access to the protected network based on the assigned role.

45. The network of claim 44, wherein each of the plurality of gateway servers provides a fail-over configuration and configuration replication.

46. The system of claim 44, wherein at least two of the plurality of gateway are in communication with substantially different types networks.

47. The system of claim 46, wherein at least one of the plurality of gateway servers supports a cellular network.

48. The system of claim 46, wherein at least one of the plurality of gateway servers are in communication with radio-frequency based network.