METHOD, DEVICE, AND SYSTEM FOR AUTHENTICATION

• US 20100293603A1
• Filed: 07/29/2010
• Published: 11/18/2010
• Est. Priority Date: 01/30/2008
• Status: Active Grant

• Current Assignee: Xfusion Digital Technologies Company Limited
• Original Assignee: Huawei Technologies Co., Ltd. (Huawei Investment & Holding Co., Ltd.)
• Inventors: Gu, Liang, Zhang, Wei, Liang, Wenliang, Chen, Yuhua
• Granted Patent: US 8,458,773 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for authentication includes: a Gateway Mobile Station (G-MS) receives an authentication trigger message from a host, and sends the authentication trigger message to an authentication server through an Ethernet Convergence Sublayer (Eth-CS) to trigger authentication. A network system includes a G-MS, which is connected to a host and an authentication server in communicable mode. The G-MS is configured to: receive an authentication trigger message from the host and send the authentication trigger message to the authentication server through the Eth-CS. The authentication server is configured to: receive the authentication trigger message that the G-MS sends through the Eth-CS, and authenticate the host. A G-MS includes: a receiving unit, configured to receive an authentication trigger message from the host; and a sending unit, configured to send the authentication trigger message received by the receiving unit to the authentication server through the Eth-CS.

Claims

1. A method for authentication, comprising:

receiving, by a Gateway Mobile Station (G-MS), an authentication trigger message from a host; and

sending, by the G-MS, the authentication trigger message to an authentication server through an Ethernet Convergence Sublayer (Eth-CS) to trigger authentication.

2. The method of claim 1, wherein the authentication trigger message is an Extensible Authentication Protocol over LAN (EAPoL) Start (EAPoL-Start) message or a Point-to-Point Protocol over Ethernet (PPPoE) Active Discovery Initiation (PADI) message.

3. The method of claim 1, wherein the step of sending, by the G-MS, the authentication trigger message to an authentication server through an Eth-CS comprises:

sending, by the G-MS, the authentication trigger message to a Data Path Function (DPF) through the Eth-CS; and

forwarding, by the DPF, the authentication trigger message to the authentication server when detecting that the message sent from the G-MS is an authentication trigger message or knowing in advance that the message transmitted on a service flow is an authentication trigger message.

4. The method of claim 3, wherein the authentication sever is a pre-configured authentication server or a reachable authentication server.

5. The method of claim 1, wherein the authentication server is a Broadband Remote Access Server (BRAS) or an Authentication, Authorization, and Accounting (AAA) server.

6. The method of claim 1, wherein the authentication server is an Authentication, Authorization, and Accounting (AAA) server and the step of forwarding, by the DPF, the authentication trigger message to the authentication server comprises:

forwarding, by the DPF, the authentication trigger message to a BRAS; and

forwarding, by the BRAS, the authentication trigger message to the AAA server.

7. The method of claim 3, further comprising:

storing, by the DPF and the authentication server, association information between the DPF and the authentication server.

8. The method of claim 7, further comprising:

if the DPF is migrated, updating the association information between the DPF and the authentication server.

9. The method of claim 7, further comprising:

if the authentication server is migrated, releasing host related information stored in an old authentication server, wherein the host related information comprises the association information between the old authentication server and the DPF.

10. The method of claim 3, wherein if a migration of the DPF triggers re-authentication on the host, the method further comprises:

sending, by the G-MS, an authentication trigger message to the migrated DPF through the Eth-CS; and

forwarding, by the migrated DPF, the authentication trigger message to an authentication server selected by the migrated DPF, wherein the authentication trigger message carries an initial Media Access Control (MAC) address indicating an address of an old authentication server.

11. The method of claim 3, wherein if a migration of the DPF triggers re-authentication on the host, the method further comprises:

sending, by the G-MS, an authentication trigger message to the migrated DPF through the Eth-CS;

obtaining, by the migrated DPF, an address of an old authentication server from the authentication trigger message, and forwarding, by the migrated DPF, the authentication trigger message to an authentication server corresponding to the address of the old authentication server.

12. The method of claim 3, wherein if a migration of the DPF triggers re-authentication on the host, the method further comprises:

sending, by the G-MS, an authentication trigger message to a migrated DPF through the Eth-CS;

changing, by the migrated DPF, a destination address in an uplink message to an address of a migrated authentication server during the authentication, and changing, by the migrated DPF, a source address in a downlink message returned by the migrated authentication server to an address of an old authentication server during the authentication.

13. The method of claim 3, wherein before the step of sending, by the G-MS, the authentication trigger message to an authentication server through an Eth-CS, the method further comprises:

by the G-MS, establishing a service flow of the Eth-CS or using an existing service flow, to bear data sent by the host.

14. A network system, comprising a Gateway Mobile Station (G-MS) that is connected to a host and an authentication server in communicable mode, wherein:

the G-MS is configured to receive an authentication trigger message from the host and send the authentication trigger message to the authentication server through an Ethernet Convergence Sublayer (Eth-CS); and

the authentication server is configured to receive the authentication trigger message that the G-MS sends through the Eth-CS and authenticate the host.

15. The network system of claim 14, further comprising:

a Data Path Function (DPF), configured to receive the authentication trigger message borne by the Eth-CS from the G-MS and forward the authentication trigger message to the authentication server when detecting that the message sent from the DPF is an authentication trigger message by using a data classification function or knowing in advance that the message transmitted on a service flow is an authentication trigger message.

16. The network system of claim 15, wherein the DPF is further configured to store association information between the DPF and the authentication server;

and

the authentication server is further configured to store the association information between the authentication server and the DPF.

17. The network system of claim 15, wherein:

the DPF is further configured to receive an authentication trigger message sent from the host in the case of re-authentication and forward the authentication trigger message to an authentication server selected by the DPF to trigger authentication, wherein the authentication trigger message carries an address of an old authentication server or an initial Media Access Control (MAC) address indicating the address of the old authentication server.

18. The network system of claim 15, wherein:

the DPF is further configured to receive an authentication trigger message sent from the host in the case of re-authentication, change a destination address in the authentication trigger message from an address of an old authentication server to an address of a migrated authentication server, and send the authentication trigger message to the migrated authentication server;

change a source address in an authentication response message returned by the migrated authentication server to the address of the old authentication server, and send the authentication response message to the host.

19. A Gateway Mobile Station (G-MS), comprising a receiving unit and a sending unit, wherein:

the receiving unit is configured to receive an authentication trigger message from a host; and

the sending unit is configured to send the authentication trigger message received by the receiving unit to an authentication server through an Ethernet Convergence Sublayer (Eth-CS).

20. A Data Path Function (DPF), comprising a receiving unit, a data filtering unit, and a sending unit, wherein:

the receiving unit is configured to receive a message borne by an Ethernet Convergence Sublayer (Eth-CS);

the data filtering unit is configured to;

filter the message received by the receiving unit, and instruct the sending unit to send the authentication trigger message if the received message is an authentication trigger message or knowing in advance that the message transmitted on a service flow is an authentication trigger message; and

the sending unit is configured to send the authentication trigger message to an authentication server.

21. The DPF of claim 20, further comprising:

a storing unit, configured to store association information between the DPF and the authentication server.