Method for authenticated connection setup

• US 20060183463A1
• Filed: 02/07/2006
• Published: 08/17/2006
• Est. Priority Date: 02/08/2005
• Status: Abandoned Application

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Falk, Rainer, Kroselberg, Dirk
• Application Number:
  US11/348,528
• Publication Number:
  US 20060183463A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06Q 30/06 Buying, selling or leasing transactions
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 67/56 Provisioning of proxy services store-and-forward switching systems in data switching networks H04L12/54
• CPC Class Codes: H04L 67/567 Integrating service provisioning from a plurality of service providers
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 80/00 Wireless network protocols or protocol adaptations to wireless operation
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The invention relates to a method for the authenticated establishment of a connection between a mobile subscriber and a WLAN radio communication system. The mobile subscriber signs on as a guest to an access point of the WLAN network via an insecure connection or via a secure connection that is only authenticated on the network side and an individual IP address is assigned to the mobile subscriber. Using the individual IP address, the mobile subscriber accesses a portal page and authenticates himself/herself in a person-related manner to the portal page. Person-related authentication data is assigned to the mobile subscriber using a Security Assertion Markup Language. In a new connection setup as part of a secure Link Layer connection, the person-related authentication data is transmitted to an AAA server for final authentication of the mobile subscriber.

Claims

1. A method for authenticated connection setup between a mobile subscriber and a WLAN radio communication system, comprising:

signing-on as a guest to an access point of the WLAN network via connection that is authenticated on the network side and assigning an individual IP address to the mobile subscriber;

using the individual IP address to access a portal page and authenticating himself/herself to the portal page in a person-related manner;

using a Security Assertion Markup Language to assign person-related authentication data to the mobile subscriber; and

transmitting, in a new connection setup as part of a secure Link Layer connection, the person-related authentication data to an AAA server for final authentication of the mobile subscriber.

2. The method as claimed in claim 1, wherein the individual IP address is assigned by an AAA server using the Dynamic Host Configuration Protocol.

3. The method as claimed in claim 1, wherein the mobile subscriber accesses the portal page via a server only connection.

4. The method as claimed in claim 1, wherein the authentication of the mobile subscriber to the portal page is carried out using a secure transmission method.

5. The method as claimed in claim 1,

wherein the person-related authentication to the portal page is carried out by specification of a user name related to the person of the mobile subscriber and/or a password, or

the person-related authentication to the portal page is carried out based on a certificate.

6. The method as claimed in claim 5, wherein the person-related authentication to the portal page is carried out over a secure connection using the HTTPS protocol.

7. The method as claimed in claim 1, wherein a person-related SAML assertion or a person-related SAML artifact is used as authentication data.

8. The method as claimed in claim 7, wherein, in the authentication using the Security Assertion Markup Language, the portal page is used as the asserting party and the AAA server as the relying party.

9. The method as claimed in claim 1, wherein the person-related authentication data is transmitted to the mobile subscriber over a secure connection using the HTTPS protocol.

10. The method as claimed in claim 2, wherein the Link Layer connection is set up to the AAA server.

11. The method as claimed in claim 1, wherein the authentication via the Link Layer connection is carried out using the EAP protocol, with a home network in which the mobile subscriber is known authenticates the mobile subscriber to the inquiring AAA server of the WLAN network.