Techniques for offering seamless accesses in enterprise hot spots for both guest users and local users

• US 20070025302A1
• Filed: 03/08/2004
• Published: 02/01/2007
• Est. Priority Date: 04/15/2003
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: Thomson Licensing (Vantiva SA)
• Inventors: Ramaswamy, Kumar, Zhang, Junbiao
• Granted Patent: US 8,085,740 B2
• Time in Patent Office: Days
• US Class Current: 370/338
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A wireless Local Area Network (LAN 11) capable of providing “enterprise guest” hosting includes at least one an e-open wireless LAN access point (15) that provides access to both guests and local users. Upon receipt of a request for access, the access point forwards the request to an authentication proxy. The authentication proxy then authenticates the party requesting access in accordance with that party'"'"'s status (that is, whether the party is a local user or guest). Upon successful authentication, the network routes the traffic from a local user differently as compared to that for a guest. For example traffic from guests goes to gateway for receipt in an external network such as the Internet, whereas traffic from the local user goes to a local network, e.g., a corporate intranet. In this way, the Wireless LAN 11, after ascertaining the status of the party requesting access, can limit guest traffic according to the guest access policy.

Claims

1. A method for offering wireless network access to both guests and local users, comprising the steps of:

receiving at a common wireless network access point a request for access from one of a guest and local user;

authenticating the request for access received at the common access point depending on whether the request was received from the guest or local user; and

if such authentication is successful, then routing traffic from the local user differently from the guest.

2. The method according to claim 1 further including the step of determining at the wireless network point whether the access request was received from local user or guest.

3. The method according to claim 2 wherein the step of determining whether the access request was received from a local user or a guest further comprise the step of examining a user domain received from a party seeking access to determine whether such user domain designates a guest domain.

4. The method according to claim 1 wherein the authenticating step further comprises the step communicating a request for authentication to separate authentication servers depending on whether the party seeking access is a local user or a guest.

5. The method according to claim 1 wherein the authenticating step further comprises the step communicating a request for authentication to a single authentication server which performs authentication using different credentials for local users and guests.

6. The method according to claim 1 wherein the authenticating step further comprises the step of ascertaining whether the request for access included an authentication request was received in an IEEE 802.1x format or was received in a web-browser format.

7. The method according to claim 1 wherein the routing step further comprises the step of routing traffic from a guest to an external network.

8. The method according to claim 1 wherein the routing step further comprises the step of routing traffic from a local user to a corporate intranet.

9. A wireless Local area network for offering wireless Network access to both guests and local users, comprising:

at least one common wireless network access point offering access to both guests and local users in response to a request for access;

at least one server coupled to the at least one wireless network access point for authenticating the request for access depending on whether the request was received from the guest or local user; and

means coupled to the at least one wireless LAN access point for routing traffic from the local user differently from the guest.

10. The network according to claim 9 wherein the at least one wireless network access point determines whether the access request was received from a local user or a guest.

11. The network according to claim 10 wherein the at least one wireless network access point determines whether the access request was received from a local user or a guest by examining if a user domain received with the access request indicates a guest domain.

12. The network according to claim 9 wherein the authentication server performs authentication using different credentials for local users and guests.

13. The network according to claim 9 wherein the at least one wireless network access point ascertains whether the request for access was received in an IEEE 802.1x format or was received in a web-browser format.

14. The network according to claim 9 wherein the means for routing traffic includes a firewall.