EAP telecommunication protocol extension

• US 20040010713A1
• Filed: 07/12/2002
• Published: 01/15/2004
• Est. Priority Date: 07/12/2002
• Status: Abandoned Application

• Current Assignee: Interlink Networks, Inc. (Interlink Networks LLC)
• Original Assignee: Interlink Networks, Inc. (Interlink Networks LLC)
• Inventors: Vollbrecht, John R., Moskowitz, Robert G.
• Application Number:
  US10/193,296
• Publication Number:
  US 20040010713A1
• Time in Patent Office: Days
• US Class Current: 713/201
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2859 Point-to-point connection between the data network and the subscribers encapsulation H04L12/4633; virtual LANs H04L12/4641; routing of packets H04L45/00
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

A method for providing a network connection includes a step of initiating an EAP connection between a device seeking network access and a network by way of a network access server. The network access server is configured to selectively permit—or deny—network access. Using EAP formatted messages, the device seeking network access negotiates for an additional credential that grants an authorization for a service other than network access. The network preferably provides the credential prior to completing the EAP process for granting network access.

Claims

1. A telecommunication method comprising:

(a) initiating an EAP connection between a requestor and a network authenticator via an access point, where the access point is configured to selectively permit access to the network, and where the authenticator is configured to selectively authorize access to the network;

(b) authenticating the requestor to the authenticator; and

(c) prior to signaling successful EAP completion, negotiating to provide a credential for the requestor, where the credential grants an authorization other than network access.

2. The method of claim 1 further comprising a step of providing the credential to the requester prior to signaling successful EAP completion.

3. The method of claim 2 where the step of providing the credential uses a secret used during EAP authentication.

4. The method of claim 1 where the credential may be a particular type of credential selected from a set of different types of credentials.

5. The method of claim 4 where credentials from multiple credential-issuing parties may be available to the requestor via the network access point.

6. The method of claim 5 where the network authenticator makes communications to the requester that are specific to a selected credential type.

7. The method of claim 5 where the network authenticator makes communications to the requestor that are specific to a selected credential issuer.

8. The method of claim 5 where the network authenticator enables communication to a credential issuer that are specific to the requestor.

9. A server configured to authorize access of a requestor to a network using messages conforming to an EAP protocol, said server further configured to negotiate for the provision of a credential for the requester prior to signaling successful EAP completion, where the credential authorizes the requester to access a network service other than network access.

10. The server of claim 9 where the server is further configured to provide the credential prior to signaling successful EAP completion authentication.

11. The server of claim 10 where the server is further configured to provide the credential using a secret used during EAP authentication

12. The server of claim 9 where the server is further configured to negotiate for the provision of credentials from multiple credential issuers.

13. The server of claim 9 where the server is further configured to negotiate for the provision of multiple types of credentials.

14. The server of claim 9 where the server is further configured to enable communications to a credential issuer that are specific to the requestor.

15. An electronic device configured to establish communications with a network using messages conforming to an EAP protocol, said electronic device further configured to negotiate for the provision of a credential prior to receiving an indication of successful EAP completion authentication, where the credential authorizes the electronic device to access a network service other than network access.

16. The electronic device of claim 15, where the electronic device is further configured to receive the credential prior to receiving an indication of successful EAP completion.

17. The electronic device of claim 16, where the electronic device is further configured to receive a credential issued using a secret used during EAP authentication.

18. The electronic device of claim 15 where the electronic device is further configured negotiate for the provision of credentials from multiple credential issuers.

19. The electronic device of claim 15 where the electronic device is further configured to negotiate for the provision of multiple types of credentials.

20. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message signifying an offer to negotiate a credential to access a network service other than network access; and

(b) a second message subsequent to the first message signifying EAP completion.

21. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message identifying a protocol for obtaining a credential to access a network service other than network access; and

(b) a second message subsequent to the first message signifying EAP completion.

22. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message carrying information for use in a credential to access a network service other than network access, and

(b) a second message subsequent to the first message signifying EAP completion.

23. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message carrying a credential to access a network service other than network access, and

(b) a second message subsequent to the first message signifying EAP completion.

24. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message carrying a first credential for use in obtaining a second credential; and

(b) a second message subsequent to the first message signifying EAP completion.

25. A sequence of formatted electronic messages, each message conforming with an EAP message format, the message sequence comprising:

(a) a first message carrying a first credential for use in obtaining a second credential;

(b) a second message carrying a second credential to access a network service other than network access; and

(c) a third message subsequent to the second message signifying EAP completion.