Distributed authentication functionality

• US 20070050839A1
• Filed: 09/01/2005
• Published: 03/01/2007
• Est. Priority Date: 09/01/2005
• Status: Active Grant

• Current Assignee: WSOU Investments, LLC (WSOU Holdings, LLC)
• Original Assignee: Alcatel-Lucent SA (Nokia Corporation)
• Inventors: Absillis, Luc, Surya, Gopal, Dharanikota, Sudheer
• Granted Patent: US 8,069,475 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

A Passive Optical Network (PON) includes an Optical Network Terminal (ONT) and an Optical Line Terminal (OLT). The ONT is configured for providing controlled port operations of authenticator Port Access Entity (PAE) functionality and the OLT is configured for providing entity authentication operations of the authenticator PAE functionality. The controlled port operations of authenticator PAE functionality includes inhibiting transmission of non-authentication messages from the ONT, transmitting a supplicant authentication request to the OLT and enabling transmission of non-authentication messages from the ONT in response to receiving supplicant authentication confirmation. The entity authentication operations of the authenticator PAE functionality include facilitating authentication of an identity of the supplicant and facilitating transmission of supplicant authentication confirmation for reception by the ONT in response to the identity being authenticated.

Claims

1. A method, comprising:

inhibiting transmission of non-authentication messages from an Optical Network Terminal (ONT) of a Passive Optical Network (PON) until an identity of an entity seeking to send said non-authentication messages is authenticated, wherein said inhibiting is performed by the ONT; and

enabling transmission of non-authentication messages from the ONT in response to receiving entity authentication confirmation at the ONT, wherein said enabling is performed by the ONT.

2. The method of claim 1, further comprising:

authenticating an identity of the entity; and

transmitting said entity authentication confirmation for reception by the ONT in response to the identity being authenticated.

3. The method of claim 2 wherein:

said inhibiting and said enabling are performed by the ONT; and

said authenticating the identity of the entity and said transmitting said entity authentication confirmation are performed by at least one the OLT and an authentication server.

4. The method of claim 2 wherein transmitting the entity authentication request and transmitting said entity authentication confirmation each include at least one of:

transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT; and

transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.

5. The method of claim 2, further comprising:

directing the supplicant authentication request to authenticator Port Access Entity (PAE) functionality for enabling said authenticating the identity of the entity to be performed.

6. The method of claim 5 wherein:

said inhibiting and said enabling are performed by the ONT;

said authenticating the identity of the entity and said transmitting said entity authentication confirmation are performed by at least one the OLT and an authentication server; and

transmitting the entity authentication request and transmitting said entity authentication confirmation each include at least one of transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT and transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.

7. A Passive Optical Network (PON), comprising:

an Optical Network Terminal (ONT) including;

at least one data processing device;

memory connected to said at least one data processing device of the ONT; and

ONT instructions accessible from said memory and processable by said at least one data processing device of the ONT, wherein said ONT instructions are configured for enabling said at least one data processing device of the ONT to facilitate;

inhibiting transmission of non-authentication messages from the ONT until an identity of an entity seeking to send said non-authentication messages is authenticated; and

enabling transmission of non-authentication messages from the ONT in response to receiving entity authentication confirmation.

8. The PON of claim 7, further comprising:

an OLT including;

at least one data processing device;

memory connected to said at least one data processing device of the OLT; and

OLT instructions accessible from said memory and processable by said at least one data processing device of the OLT, wherein said OLT instructions are configured for enabling said at least one data processing device of the OLT to facilitate;

authenticating the identity of the supplicant; and

transmitting said entity authentication confirmation for reception by the ONT in response to the identity being authenticated.

9. The PON of claim 8 wherein transmitting a supplicant authentication request and transmitting said entity authentication confirmation each include at least one of:

transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT; and

transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.

10. The PON of claim 8 wherein the OLT instructions are further configured for enabling said at least one data processing device of the OLT to facilitate:

directing an entity authentication request to authenticator Port Access Entity (PAE) functionality for enabling said authenticating the identity of the entity to be performed.

11. The PON of claim 10 wherein:

transmitting the supplicant authentication request and transmitting said entity authentication confirmation each include at least one of transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT and transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.

12. A Passive Optical Network (PON), comprising:

an Optical Network Terminal (ONT) configured for providing controlled port operations of authenticator Port Access Entity (PAE) functionality; and

an Optical Line Terminal (OLT) configured for providing entity authentication operations of said authenticator Port Access Entity (PAE) functionality, wherein the OLT is connected to the ONT for enabling interaction therebetween.

13. The PON of claim 12 wherein said controlled port operations of authenticator Port Access Entity (PAE) functionality includes:

inhibiting transmission of non-authentication messages from the ONT until an identity of an entity seeking to send said non-authentication messages is authenticated; and

enabling transmission of non-authentication messages from the ONT in response to receiving entity authentication confirmation.

14. The PON of claim 13 wherein said entity authentication operations of said authenticator Port Access Entity (PAE) functionality include:

facilitating authentication of an identity of the entity; and

facilitating transmission of said entity authentication confirmation for reception by the ONT in response to the identity being authenticated.

15. The PON of claim 14 wherein transmitting the entity authentication request and transmitting said entity authentication confirmation each include at least one of:

transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT; and

transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.

16. The PON of claim 14 wherein said entity authentication operations of said authenticator PAE functionality include:

directing an entity authentication request to authenticator Port Access Entity (PAE) functionality for enabling said authenticating the identity of the entity to be performed.

17. The PON of claim 16 wherein transmitting the entity authentication request and facilitating transmission of said entity authentication confirmation each include at least one of:

transmitting Extensible Authentication Protocol (EAP) messages over a dedicated tunnel between the ONT and the OLT; and

transmitting EAP messages in a data path including EAP messages and non-EAP messages and extracting said EAP messages from the data path.