Roaming Wi-Fi Access in Fixed Network Architectures

• US 20090054037A1
• Filed: 08/15/2008
• Published: 02/26/2009
• Est. Priority Date: 08/24/2007
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: Kaippallimalil, John
• Granted Patent: US 8,335,490 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer

Abstract

An apparatus comprising a node comprising an access controller (AC) and an authentication, authorization and accounting (AAA) proxy (AAA-P), wherein the AC is configured to manage authentication for a user equipment (UE), and wherein the AAA-P is configured to exchange authentication information related to the UE with an AAA server. Included is a network component comprising at least one processor configured to implement a method comprising establishing a first tunnel with a home gateway (HG), wherein the HG communicates wirelessly with a UE, and establishing a second tunnel between the UE and a Network Access Server (NAS). Also included is a network component comprising at least one processor configured to implement a method comprising receiving a Pairwise Master Key (PMK) from an AAA mediator (AAA-M), and authenticating a UE using the PMK.

Claims

1. An apparatus comprising:

a node comprising an access controller (AC) and an authentication, authorization and accounting (AAA) proxy (AAA-P);

wherein the AC is configured to manage authentication for a user equipment (UE); and

wherein the AAA-P is configured to exchange authentication information related to the UE with an AAA server.

2. The apparatus of claim 1 further comprising an Internet Protocol (IP) Edge in communication with the node and an access node (AN) in communication with the IP Edge.

3. The apparatus of claim 2, wherein the IP Edge is in communication with the AAA server and the IP network, and wherein the node is in communication with the AAA server.

4. The apparatus of claim 2, wherein the node and the AN are in communication with a home gateway (HG), and wherein the HG is in wireless communication with the UE.

5. The apparatus of claim 1, wherein the node is an AAA mediator (AAA-M) and is in communication with an Internet Protocol (IP) Edge comprising a first network access server (NAS) and a second NAS.

6. The apparatus of claim 1, wherein the node further comprises a NAS.

7. The apparatus of claim 6, wherein the node is a roaming edge (R-Edge) and is in communication with an IP Edge comprising a second NAS.

8. A network component comprising:

at least one processor configured to implement a method comprising;

establishing a first tunnel with a home gateway (HG), wherein the HG communicates wirelessly with a user equipment (UE); and

establishing a second tunnel between the UE and a network access server (NAS).

9. The network component of claim 8, wherein the first tunnel is a Wi-Fi roaming virtual local area network (VLAN), and wherein the second tunnel is an Internet Protocol Security (IPsec) tunnel.

10. The network component of claim 8, wherein the method further comprises:

establishing communications with an Internet Protocol (IP) network; and

controlling a session between the UE and the IP network.

11. The network component of claim 10, wherein the method further comprises accounting for the session.

12. The network component of claim 8, wherein the method further comprises:

obtaining a Pairwise Master Key (PMK), wherein the PMK is used to establish the second tunnel.

13. The network component of claim 12, wherein obtaining the PMK comprises receiving the PMK as part of a Remote Authentication Dial In User Service (RADIUS) or DIAMETER session.

14. The network component of claim 8, wherein the method further comprises:

obtaining a Master Session Key (MSK) from an authentication, authorization and accounting (AAA) server;

deriving a first Pairwise Master Key (PMK) and a second PMK;

sending the first PMK to the HG, wherein the first PMK is used in authentication between the HG and the UE; and

using the second PMK to establish the second tunnel,

wherein the network component is an authentication, authorization, and accounting mediator.

15. The network component of claim 14, wherein the first PMK is sent using Control and Provisioning of Wireless Access Points (CAPWAP).

16. A network component comprising:

at least one processor configured to implement a method comprising;

receiving a Pairwise Master Key (PMK) from an authentication, authorization, and accounting (AAA) mediator (AAA-M); and

authenticating a user equipment (UE) using the PMK.

17. The network component of claim 16, wherein the PMK is derived from a Master Session Key (MSK).

18. The network component of claim 16, wherein authenticating the UE comprises an 802.11 wireless link exchange.

19. The network component of claim 16, wherein the method further comprises:

establishing a Wi-Fi roaming virtual local area network (VLAN) tunnel with a network access server (NAS).

20. The network component of claim 19, wherein the method further comprises:

allowing communications between the UE and the NAS, wherein the communications comprise an Internet Key Exchange (IKE) between the UE and the NAS using a second PMK.