Network Access

• US 20120054844A1
• Filed: 08/31/2010
• Published: 03/01/2012
• Est. Priority Date: 08/31/2010
• Status: Active Grant

• Current Assignee: Malikie Innovations Limited (Key Patent Innovations Limited)
• Original Assignee: Blackberry Limited
• Inventors: Montemurro, Michael, Bender, Christopher Lyle, Oerton, Kevin John
• Granted Patent: US 8,607,316 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for network access is provided. The method includes establishing a secure link between a user equipment (UE) and a wireless local area network (WLAN) when an authentication and authorization server determines that credentials provided by the UE to the authentication and authorization server allow the UE secure access to the WLAN. The method further includes establishing a secure link between the UE and an application access server via the WLAN when the application access server, using the same credentials, determines that the UE is allowed secure access to the application access server.

Claims

1. A method for network access, comprising:

establishing a secure link between a user equipment (UE) and a wireless local area network (WLAN) when an authentication and authorization server determines that credentials provided by the UE to the authentication and authorization server allow the UE secure access to the WLAN; and

establishing a secure link between the UE and an application access server via the WLAN when the application access server, using the same credentials, determines that the UE is allowed secure access to the application access server.

2. The method of claim 1, wherein the determination by the authentication and authorization server that the credentials allow the UE secure access to the WLAN comprises the authentication and authorization server communicating with the application access server to determine that the credentials are valid.

3. The method of claim 1, wherein the application access server is a BlackBerry Enterprise Server.

4. The method of claim 1, wherein an authentication method is defined that allows a routing protocol between the application access server and the authentication and authorization server to be used for network access.

5. The method of claim 4, wherein the authentication method is an Extensible Authentication Protocol (EAP) method.

6. The method of claim 5, wherein the authentication method is used as an inner authentication method for an existing authentication tunnel.

7. The method of claim 6, wherein the UE establishes an outer EAP tunnel with an EAP peer on the authentication and authorization server before using the authentication method as the inner authentication method for the existing authentication tunnel.

8. The method of claim 5, wherein the routing protocol allows EAP peers on the UE and on the authentication and authorization server to generate keying material.

9. A user equipment (UE), comprising:

a processor configured such that the UE provides credentials to an authentication and authorization server, wherein a secure link is established between the UE and a wireless local area network (WLAN) when the authentication and authorization server determines that the credentials allow the UE secure access to the WLAN, and wherein the processor is further configured such that the UE sends the same credentials to an application access server, wherein a secure link is established between the UE and the application access server via the WLAN when the application access server, based on the credentials, determines that the UE is allowed secure access to the application access server.

10. The UE of claim 9, wherein the determination by the authentication and authorization server that the credentials allow the UE secure access to the WLAN comprises the authentication and authorization server communicating with the application access server to determine that the credentials are valid.

11. The UE of claim 9, wherein the application access server is a BlackBerry Enterprise Server.

12. The UE of claim 9, wherein the UE uses an authentication method that allows a routing protocol between the application access server and the authentication and authorization server to be used by the UE for network access.

13. The UE of claim 12, wherein the authentication method is an Extensible Authentication Protocol (EAP) method.

14. The UE of claim 13, wherein the UE uses the authentication method as an inner authentication method for an existing authentication tunnel.

15. The UE of claim 14, wherein the UE establishes an outer EAP tunnel with an EAP peer on the authentication and authorization server before using the authentication method as the inner authentication method for the existing authentication tunnel.

16. The UE of claim 13, wherein the routing protocol allows EAP peers on the UE and on the authentication and authorization server to generate keying material.

17. An application access server, comprising:

a processor configured such that the application access server promotes the establishment of a secure link between a user equipment (UE) and a wireless local area network (WLAN) when the application access server determines that credentials provided by the UE allow the UE secure access to the WLAN, and wherein the processor is further configured such that the application access server promotes the establishment of a secure link between the UE and the application access server via the WLAN when the application access server determines that the same credentials allow the UE secure access to the application access server.

18. The application access server of claim 17, wherein the secure link is established between the UE and the WLAN when the application access server verifies to an authentication and authorization server that the credentials are valid, the credentials having been provided to the application access server by the authentication and authorization server after having been provided to the authentication and authorization server by the UE.

19. The application access server of claim 17, wherein the application access server is a BlackBerry Enterprise Server.

20. The application access server of claim 18, wherein an authentication method is defined that allows a routing protocol between the application access server and the authentication and authorization server to be used for network access.

21. The application access server of claim 20, wherein the authentication method is an Extensible Authentication Protocol (EAP) method.

22. The application access server of claim 21, wherein the authentication method can be used as an inner authentication method for an existing authentication tunnel.

23. The application access server of claim 22, wherein an outer EAP tunnel is established with an EAP peer on the authentication and authorization server before the authentication method is used as the inner authentication method for the existing authentication tunnel.

24. The application access server of claim 21, wherein the routing protocol allows EAP peers on the UE and on the authentication and authorization server to generate keying material.