Simplified dual mode wireless device authentication apparatus and method

• US 20070249323A1
• Filed: 04/21/2006
• Published: 10/25/2007
• Est. Priority Date: 04/21/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Gutman, Andrew, Lee, Shze, Willis, Edward
• Granted Patent: US 7,822,406 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: G06F 21/33 using certificates
• CPC Class Codes: G06F 21/35 communicating wirelessly
• CPC Class Codes: G06F 21/74 operating in dual or compartmented mode, i.e. at least one secure mode
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/065 Continuous authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/084 using delegated authorisation, e.g. open authorisation [OAuth] protocol
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

Provisioned wireless service (PWS) authentication apparatus and method simplifies determination of PWS authentication state by dual mode access point (DMAP) receiving an identifying credential from supplicant dual mode mobile station (DMMS) within predefined authentication period and comparing with authentication credential. DMMS is provisioned PWS upon authentication. DMAP having multiple BSSID remotely configurable to differentiate between provisioned services (e.g., voice, VoIP) and standard wireline/fixed wireless services. DMAP and DMMS are each identifiable by respective unique provisioned service BSSID. Identifying credential can be pass code supplied to DMMS user by DMAP operator to facilitate authenticated association and to deter wireless channel interlopers.

Claims

1. A fixed wireless (USW) access point, comprising:

a local authenticator;

wherein the local authenticator is configured to be activated by a subscriber;

wherein the local authenticator is configured to receive an identifying credential from a dual mode mobile station;

wherein the local authenticator is configured to analyze the identifying credential, thereby determining an authentication state resulting therefrom; and

wherein the local authenticator is configured to one of grant access and deny access by the dual mode mobile station to the USW access point responsive to the authentication state.

2. The USW access point of claim 1, wherein the local authenticator is configured to differentially process a signal communicated with the dual mode mobile station in response to the authentication state.

3. The USW access point of claim 2, further comprising:

a provisioned service interface coupled to the local authenticator, wherein the provisioned service interface is configured to differentially process the provisioned service signal in response to the authentication state.

4. The USW access point of claim 3:

wherein the provisioned service interface is configured to provide a provisioned service channel identifiable by a provisioned service set identifier (vSSID),

wherein the provisioned service interface is configured to correspond to a provisioned service basic service set identifiable by a provisioned service basic service set identifier (hvBSSID),

wherein the hvBSSID corresponds to the vSSID and is configurably unique to the provisioned service interface, and

wherein the signal communicated with the dual mode mobile station is a provisioned service signal communicated over the provisioned service channel to the USW access point corresponding to hvBSSID.

5. The USW access point of claim 4, wherein the provisioned service interface is configured to accept the identifying credential within a predefined authentication period and configured to determine an authentication state corresponding to an identifying credential, if accepted within the predefined authentication period.

6. The USW access point of claim 3, wherein the local authenticator further comprises a managed CPE interface coupled to a provisioned service provider and coupled to the provisioned service interface, the managed CPE interface being remotely configurable by the provisioned service provider, the managed CPE interface modifying differential processing of the provisioned service signal in response to the authentication state.

7. The USW access point of claim 4, wherein the identifying credential comprises a provisioned service basic service set identifier (gvBSSID) configurably unique to the dual mode mobile station, and wherein the managed CPE interface is configured to modify differential processing of the provisioned service signal in response to the gvBSSID.

8. The USW access point of claim 5 configured such that a single keystroke on a key coupled to the provisioned service interface commences the predefined authentication period and activates the provisioned service interface to determine the authentication state corresponding to the identifying credential, if accepted within the predefined authentication period.

10. The method of claim 7, further comprising:

if the PWS authentication state is authenticated, then receiving a request for a provisioned service token from the dual mode mobile station;

evaluating an eligibility state of the dual mode mobile station for being provisioned a provisioned service token; and

if the eligibility state is eligible, then provisioning the provisioned service token to the dual mode mobile station by the USW access point.

11. The method of claim 7, wherein evaluating the identifying credential further comprises:

evaluating the identifying credential from the dual mode mobile station by the USW access point relative to a provisioning management configuration received from a managed CPE interface disposed in the USW access point.

13. The method of claim 10, wherein the identifying credential comprises a pass code, a provisioned service basic service set identifier (gvBSSID) configurably unique to the dual mode mobile station, or both.

9. A method for authenticating to a USW access point, a dual mode mobile station seeking provisioning of a provisioned wireless service, the method comprising:

receiving an identifying credential from the dual mode mobile station by the USW access point;

evaluating the identifying credential from the dual mode mobile station by the USW access point relative to an authentication credential stored in the USW access point; and

determining a PWS authentication state of the dual mode mobile station corresponding to the identifying credential.

12. The method of claim 9, wherein receiving the identifying credential from the dual mode mobile station comprises is receiving the identifying credential from the dual mode mobile station within a predefined authentication period.

14. A method for authenticating to a USW access point a dual mode mobile station seeking provisioning of a provisioned wireless service, the method comprising:

receiving a pass code from the dual mode mobile station by the USW access point;

receiving a provisioned service basic service set identifier (gvBSSID) configurably unique to the dual mode mobile station; and

transmitting the pass code and the gvBSSID received by the USW access point to a provisioned services provider, wherein the provisioned services provider determines a PWS authentication state of the dual mode mobile station responsive to the pass code and the gvBSSID, and wherein upon authentication the provisioned services provider provisions a PWS token to dual mode mobile station.

15. The method of claim 14, wherein receiving a pass code further comprises receiving the pass code within a predefined authentication period from the dual mode mobile station.

16. The method of claim 15, wherein subsequent to transmitting to the provisioned services provider, the method further comprises:

receiving the PWS token from the provisioned services provider by the USW access point; and

supplying the PWS token to the dual mode mobile station by the USW access point.

17. An authentication apparatus, comprising:

means for receiving an identifying credential from a wireless supplicant device;

means for storing an authentication credential; and

means for evaluating the identifying credential, wherein the identifying credential is compared with the authentication credential, and an authentication state is determined in response thereto.

18. The authentication apparatus of claim 17, further comprising:

means for activating the means for receiving during a predefined authentication period;

means for receiving a provisioned service basic service set identifier (gvBSSID) configurably unique to the wireless supplicant device during the predefined authentication period; and

means for provisioning a PWS token to the wireless supplicant device if the authentication state is authenticated,

wherein the means for evaluating the identifying credential further comprises means for evaluating the gvBSSID and the identifying credential relative to the authentication credential in response to which an authentication state is determined.

19. The authentication apparatus of claim 17, further comprising:

means for remote CPE management of the authentication device coupled to the means for evaluating the identifying credential and modifying the authentication state responsive to a remote CPE configuration.

20. The authentication apparatus of claim 18, further comprising:

means for remote CPE management of the authentication device coupled to the means for evaluating the identifying credential and means for evaluating the gvBSSID; and

modifying the authentication state responsive to a remote CPE configuration.

21. The authentication apparatus of claim 17, further comprising:

means for activating the means for receiving during a predefined authentication period;

means for receiving a provisioned service basic service set identifier (gvBSSID) configurably unique to the wireless supplicant device during the predefined authentication period; and

means for provisioning a PWS token to the wireless supplicant device if the authentication state is authenticated,

wherein the means for evaluating the identifying credential further comprises means for evaluating the gvBSSID and the identifying credential relative to the authentication credential in response to which an authentication state is determined.

22. An authentication apparatus, comprising:

means for activating the authentication apparatus for receiving during a predefined authentication period;

means for receiving an identifying credential from a wireless supplicant device during the predefined authentication period, wherein the identifying credential is a pass code;

first means for storing a first authentication credential corresponding to the identifying credential;

first means for evaluating the identifying credential relative to the first authentication credential, wherein the first means for evaluating is coupled to the first means for storing and;

means for receiving a provisioned service basic service set identifier (gvBSSID) configurably unique to the wireless supplicant device during the predefined authentication period;

second means for storing a second authentication credential corresponding to the gvBSSID;

second means for evaluating the gvBSSID relative to the second authentication credential, wherein the second means for evaluating is coupled to the second means for storing;

means for remote CPE management of the authentication device coupled to the first means for evaluating the identifying credential and the second means for evaluating the gvBSSID, and for receiving a remote CPE configuration from a provisioned service provider;

means for determining a PWS authentication state responsive to evaluating the identifying credential relative to the first authentication credential and for evaluating the gvBSSID relative to the second authentication credential, wherein the PWS authentication state is modified responsive to a remote CPE configuration; and

means for provisioning a PWS token to the wireless supplicant device if the PWS authentication state is authenticated.