User and Device Authentication in Broadband Networks

• US 20110173678A1
• Filed: 08/28/2008
• Published: 07/14/2011
• Est. Priority Date: 02/13/2008
• Status: Active Grant

• Current Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Original Assignee: Futurewei Technologies Incorporated (Huawei Investment & Holding Co., Ltd.)
• Inventors: Xia, Yangsong, Kaippallimalil, John
• Granted Patent: US 9,112,909 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: G06F 2221/2105 Dual mode as a secondary aspect
• CPC Class Codes: G06F 2221/2129 Authenticate client device independently of the user
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: H04L 41/0896 Bandwidth or capacity management, i.e. automatically increasing or decreasing capacities flow or congestion control using dynamic resource allocation, e.g. in-call renegotiation, H04L47/76
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/105 Multiple levels of security
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security

Abstract

A network component comprising at least one processor configured to implement a method comprising granting a user restricted access at a reduced rate without authenticating the user, attempting to authenticate the user, and granting the user unrestricted access at a full rate if the user authentication is successful. Included is a method comprising authenticating a user device, a user line, or both using a first communication, and authenticating a user using a second communication separate from the first communication. Also included is an apparatus comprising an access node (AN) configured to couple to an access network and communicate with a user equipment (UE) via the access network, wherein the UE is authenticated using either line authentication or device authentication based on the access network.

Claims

1. A network component comprising:

at least one processor configured to implement a method comprising;

granting a user restricted access at a reduced rate without authenticating the user;

attempting to authenticate the user; and

granting the user unrestricted access at a full rate if the user authentication is successful.

2. The network component of claim 1, wherein granting the user restricted access comprises authenticating a user device, a user line, or both.

3. The network component of claim 2, wherein granting the user restricted access further comprises granting the user a network subsequent to authenticating the user device, the user line, or both.

4. The network component of claim 1, wherein the user is authenticated using a protocol for carrying authentication for network access (PANA).

5. The network component of claim 4, wherein granting the user restricted access comprises granting the user a temporary or reserved network address.

6. The network component of claim 1, wherein the restricted access is limited to at least one server, at least one protocol, or both.

7. The network component of claim 1, wherein the restricted access comprises access to an emergency service network.

8. The network component of claim 1, wherein the reduced rate and the full rate are defined by a quality of service (QoS), a priority level, a bandwidth rate, a tolerated latency, a tolerated jitter, or combinations thereof.

9. The network component of claim 1, wherein the reduced rate and the full rate are controlled by a multi-rate access filter.

10. A method comprising:

authenticating a user device, a user line, or both using a first communication; and

authenticating a user using a second communication separate from the first communication.

11. The method of claim 10, wherein authenticating the user device, the user line, or both does not comprise an Authentication, Authorization and Accounting (AAA) lookup.

12. The method of claim 10, wherein authenticating the user comprises an Authentication, Authorization and Accounting (AAA) lookup.

13. The method of claim 10 further comprising initiating a user session, wherein the user session is an Internet Protocol (IP) session, and wherein the user is authenticated at a Broadband Network Gateway (BNG).

14. The method of claim 10 further comprising initiating a user session, wherein the user session is a Layer Two Virtual Private Network (L2 VPN) session, and wherein the user is authenticated at an access node (AN).

15. The method of claim 10, wherein the user device, the user line, or both and the user are authenticated at separate network layers.

16. An apparatus comprising:

an access node (AN) configured to couple to an access network and communicate with a user equipment (UE) via the access network,

wherein the UE is authenticated using either line authentication or device authentication based on the access network.

17. The apparatus of claim 16, wherein the access network is a Digital Subscriber Line (DSL) network, a Passive Optical Network (PON), or a non-wireless access network, wherein the UE communicates with the access network via a residential gateway (RG), and wherein the RG is authenticated with the AN.

18. The apparatus of claim 17, wherein the UE communicates with the RG via a trusted link and is authenticated using line authentication.

19. The apparatus of claim 17, wherein the UE communicates with the RG via a non-trusted link and is authenticated using device authentication.

20. The apparatus of claim 16, wherein the access network is a Worldwide Interoperability for Microwave Access (WiMAX) network, an Institute of Electrical and Electronics Engineers (IEEE) 802.11 network, a Wireless Local Area Network (WLAN), or a wireless access network, and wherein the UE is authenticated using device authentication.