Method and System for Controlling Access to Communication Networks, Related Network and Computer Program Therefor

• US 20080069105A1
• Filed: 06/24/2004
• Published: 03/20/2008
• Est. Priority Date: 06/24/2004
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Costa, Luciana, Stupar, Patrick, Ruffino, Simone
• Granted Patent: US 8,561,200 B2
• Time in Patent Office: Days
• US Class Current: 370/392
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/12 Applying verification of the received information cryptographic mechanisms or cryptographic arrangements for data integrity or data verification H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A system for controlling access of a mobile terminal to a communication network including a set of terminals, wherein said mobile terminal obtains access to the network as a result of a successful authentication procedure. The system includes an authenticator module for performing the authentication procedure of the mobile terminal and a communication mechanism configured for making the successful outcome of the authentication procedure known to the terminals in the set. The mobile terminal is thus permitted to access the network via any of the terminals in the set based on the authentication procedure.

Claims

1-58. -58. (canceled)

59. A method for controlling access of a mobile terminal to a communication network comprising a set of terminals, wherein said mobile terminal obtains access to said network as a result of a successful authentication procedure, comprising the steps of:

performing said authentication procedure of said mobile terminal; and

making the successful outcome of said authentication procedure known to the terminals in said set, whereby said mobile terminal is permitted to access said network via any of the terminals in said set based on said authentication procedure.

60. The method of claim 59, comprising the steps of:

performing said authentication procedure of said mobile terminal via one of the terminals in said set; and

notifying the successful outcome of said authentication procedure to the other terminals in said set.

61. The method of claim 59, comprising the steps of:

providing an authentication function associated with said network, said authentication function being external to said network; and

performing said authentication procedure of said mobile terminal with said authentication function external to said network.

62. The method of claim 61, comprising the steps of:

performing said authentication procedure of said mobile terminal with said authentication function external to said network via one of the terminals in said set; and

notifying the successful outcome of said authentication procedure to the other terminals in said set.

63. The method of claim 61, comprising the steps of:

including said authentication function in an infrastructure network external to said network; and

providing said terminals in said set with one of;

a direct connection with said infrastructure network, and

an indirect connection with said infrastructure network via a multi-hop connection through said network.

64. The method of claim 63, comprising the step of configuring said infrastructure network as a mobile-radio network.

65. The method of claim 64, comprising the steps of providing at least one of said terminals with a mobile-radio interface having associated therewith a SIM-type module.

66. The method of claim 63, comprising the step of requesting from said infrastructure network, respective authentication data of said terminals in said set, once said mobile terminal is authenticated with said authentication function.

67. The method of claim 59, comprising the step of selectively blocking via said terminals in said set, the traffic generated by said mobile terminal until said mobile terminal obtains access to said network.

68. The method of claim 59, comprising the steps of:

providing an authentication function associated with said network;

causing said mobile terminal to generate an authentication request; and

forwarding said authentication request generated by said mobile terminal toward said authentication function associated with said network.

69. The method of claim 68, comprising the steps of configuring at least one terminal in said set as an authenticator forwarding said authentication request generated by said mobile terminal toward said authentication function associated with said network.

70. The method of claim 59, comprising the steps of:

configuring said network for propagating routing messages within the network;

creating, as a function of said successful authentication process, a set of authentication data of said mobile terminal; and

conveying said set of authentication data over said routing messages.

71. The method of claim 70, comprising the steps of configuring said network for link-state type routing of said routing messages.

72. The method of claim 70, comprising the steps of:

associating with said network an authentication function; and

including in said routing messages propagated over said network said set of authentication data of said mobile terminal signed by said authentication function.

73. The method of claim 70, comprising the steps of:

associating with said network an authentication function;

including in said routing messages propagated over said network respective authentication data of said terminals in said set signed by said authentication function.

74. The method of claim 70, comprising the steps of:

including in said routing messages propagated over said network respective authentication data of said terminals; and

causing each said terminal receiving said routing messages to verify the authenticity and integrity of said authentication data prior to propagating them to the other terminals.

75. The method of claim 74, comprising the steps of causing the terminals in said set receiving said routing messages to store the authentication data for said mobile terminal while authorizing traffic for said mobile terminal.

76. The method of claim 59, comprising the steps of:

broadcasting over said network respective authentication data related to said terminals in said set; and

causing said mobile terminal, once successfully authenticated, to detect said respective authentication data to establish thereby communication paths toward said terminals in said set.

77. The method of claim 59, comprising the step of communicating in a secure way within said network the successful outcome of said authentication procedure.

78. The method of claim 59, comprising the step of creating, as a function of said successful authentication process, a set of authentication data associated with said mobile terminal, said set of authentication data comprising ciphering keys associated with said mobile terminal.

79. The method of claim 78, comprising the steps of:

broadcasting over said network respective ciphering keys related to said terminals in said set;

causing said mobile terminal, once successfully authenticated, to detect said respective ciphering keys to establish thereby communication paths toward said terminals in said set.

80. The method of claim 78, comprising the steps of generating said ciphering keys in the form of per-user sets of ciphering keys.

81. The method of claim 78, comprising the step of dynamically generating said ciphering keys.

82. The method of claim 59, comprising the step of associating authentication data with said terminals.

83. The method of claim 82, comprising the step of associating with said authentication data a terminal medium access control address.

84. The method of claim 83, comprising the steps of selecting said terminal address a link level address or the medium access control address of IEEE 802.11.

85. The method of claim 82, comprising the step of periodically updating said authentication data associated with said terminals.

86. The method of claim 59, wherein said network is a mobile ad-hoc network.

116. A computer program product loadable in the memory of at least one computer and comprising software code portions capable of performing the method of claim 59.

87. A system for controlling access of a mobile terminal to a communication network comprising a set of terminals, wherein said mobile terminal obtains access to said network as a result of a successful authentication procedure, comprising:

an authentication server for performing said authentication procedure of said mobile terminal; and

a communication mechanism configured for making the successful outcome of said authentication procedure known to the terminals in said set, whereby said mobile terminal is permitted to access said network via any of the terminals in said set based on said authentication procedure.

88. The system of claim 87, wherein:

one of the terminals in said set is configured for supporting said mobile terminal to authenticate with said authentication server; and

said communication mechanism is capable of notifying the successful outcome of said authentication procedure to the other terminals in said set.

89. The system of claim 87, comprising an authentication server associated with said network for performing said authentication procedure of said mobile terminal, said authentication server being external to said network.

90. The system of claim 89, wherein:

said authentication server is capable of performing said authentication procedure of said mobile terminal via one of the terminals in said set; and

said communication mechanism is capable of notifying the successful outcome of said authentication procedure to the other terminals in said set.

91. The system of claim 89, comprising:

an infrastructure network external to said network, said infrastructure network comprising said authentication server;

said terminals in said set being equipped with one of;

a direct connection with said infrastructure network, and

an indirect connection with said infrastructure network via a multi-hop connection through said network.

92. The system of claim 91, wherein said infrastructure network is a mobile-radio network.

93. The system of claim 92, wherein at least one of said terminals is provided with a mobile-radio interface having associated therewith a SIM-type module.

94. The system of claim 91, wherein said mobile terminal, once authenticated with said authentication server, is configured for requesting from said infrastructure network respective authentication data of said terminals in said set.

95. The system of claim 87, wherein said terminals in said set are configured for selectively blocking the traffic generated by said mobile terminal until said mobile terminal obtains access to said network.

96. The system of claim 87, comprising:

an authentication server associated with said network; and

a communication mechanism for forwarding an authentication request generated by said mobile terminal toward said authentication server associated with said network.

97. The system of claim 96, comprising at least one terminal in said set configured as an authenticator forwarding said authentication request generated by said mobile terminal toward said authentication server associated with said network.

98. The system of claim 87, comprising:

a network comprising a communication mechanism for propagating routing messages within the network;

an authentication server for creating, as a function of said successful authentication process, a set of authentication data of said mobile terminal; and

a communication mechanism capable of conveying said set of authentication data over said routing messages.

99. The system of claim 98, wherein said network is configured for link-state type routing of said routing messages.

100. The system of claim 98, comprising:

an authentication server associated with said network, wherein said network is configured for including in said routing messages said set of authentication data of said mobile terminal signed by said authentication function.

101. The system of claim 98, comprising:

an authentication server associated with said network, wherein said network is configured for including in said routing messages propagated over said network respective authentication data of said terminals in said set signed by said authentication function.

102. The system of claim 98, comprising:

a network configured for including in said routing messages propagated over said network respective authentication data of said terminals, wherein

each said terminal is capable of receiving said routing messages configured to verify the authenticity and integrity of said authentication data prior to propagating them to the other terminals.

103. The system of claim 102, wherein the terminals in said set capable of receiving said routing messages are configured to store the authentication data for said mobile terminal while authorizing traffic for said mobile terminal.

104. The system of claim 87, comprising:

a broadcasting mechanism over said network of respective authentication data related to said terminals in said set, wherein said mobile terminal, once successfully authenticated, is configured to detect said respective authentication data to establish thereby communication paths toward said terminals in said set.

105. The system of claim 87, wherein said communication mechanism is capable of communicating in a secure way within said network the successful outcome of said authentication procedure.

106. The system of claim 87, comprising an authentication server configured for creating, as a function of said successful authentication process, a set of authentication data associated with said mobile terminal, said set of authentication data comprising ciphering keys associated with said mobile terminal.

107. The system of claim 106, comprising:

a broadcasting mechanism over said network of respective ciphering keys related to said terminals in said set, wherein said mobile terminal, once successfully authenticated, is configured to detect said respective ciphering keys to establish thereby communication paths toward said terminals in said set.

108. The system of claim 106, wherein said ciphering keys are generated in the form of per-user sets of ciphering keys.

109. The system of claim 106, comprising dynamically generated ciphering keys.

110. The system of claim 87, wherein authentication data are associated with said terminals.

111. The system of claim 110, comprising a terminal medium access control address associated with said authentication data.

112. The system of claim 111, wherein said terminal address is a link level address or a medium access control address of IEEE 802.11.

113. The system of claim 110, wherein the system is configured for periodically updating said authentication data associated with said terminals.

114. A communication network comprising a set of terminals, and having associated therewith a system according to claim 87 to control access of a mobile terminal to said network.