Method for providing single step log-on access to a differentiated computer network

• US 6,643,782 B1
• Filed: 06/14/2001
• Issued: 11/04/2003
• Est. Priority Date: 08/03/1998
• Status: Expired due to Fees

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Jin, Jane Jiaying, Xu, Xi, Chu, Jie, Lou, Shuxian, Dos Santos, Maria Alice, Zhang, Shujin
• Primary Examiner(s): Hayes, Gail
• Assistant Examiner(s): Revak, Christopher A.
• Application Number:
  US09/882,256
• Time in Patent Office: 873 Days
• Field of Search: 713/200, 713/201, 713/202, 709/223, 709/224, 709/225, 709/227, 709/228, 709/238
• US Class Current: 726/3
• CPC Class Codes: G06F 21/41 where a single sign-on provides access to a plurality of computers
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations

Abstract

A method for providing single step log-on access for a subscriber to a computer network. The computer network is differentiated into public and private areas. Secure access to the private areas is provided by a Service Selection Gateway (SSG) Server, introduced between a conventional Network Access Server (NAS) and an Authentication Authorization and Accounting (AAA) Server. The SSG Server intercepts and manipulates packets of data exchanged between the NAS and the AAA Server to obtain all the information it needs to automatically log the user on when the user logs on to the NAS. An authorized user is thus spared the task of having to re-enter username and password data or launch a separate application in order to gain secure access to private areas of the network.

Claims

1. A method for providing single step log-on access to a subscriber of a computer network having first and second area, said method including the steps of:

linking a Service Selection Gateway (SSG) Server to a Network Access Server (NAS), said NAS providing said subscriber with access to said first area, and said SSG Server providing said subscriber with access to said second area;

linking said SSG Server to an Authentication Authorization and Accounting (AAA) Server;

intercepting and forwarding with the SSG Server packets of data sent between said NAS and the AAA Server so that the packets of data sent to the AAA Server by the NAS are intercepted and forwarded by the SSG Server and packets of data sent by the AAA Server to the NAS are intercepted and forwarded by the SSG Server; and

manipulating information in the packets of data to allow the SSG Server to automatically log the subscriber on the SSG Server when the subscriber logs on to the NAS, without requiring the subscriber to re-enter data already entered or launch a separate application.

2. A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area, access to which is controlled by the NAS, and to the second area access to which is controlled by the SSG server;

sending, from the SSG server to an Authentication Authorization and Accounting (AAA), server, an authorization request packet derived from the intercepted log-on request packet;

receiving at the SSG server, from the AAA server, an authorization packet responsive to the authorization request packet; and

processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber on to the SSG server for access to the second area when the subscriber logs on to the NAS.

3. A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);

routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

receiving and processing an access-reply received from the AAA server at the SSG and based thereon providing log-on access for the subscriber to the second area; and

routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

4. A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;

utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;

routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

receiving and processing an access-reply received from the AAA server at the SSG and, based thereon, providing log-on access for the subscriber to the second area; and

routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

5. A method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said method comprising:

receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;

forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;

receiving a responsive access-reply at the SSG from the AAA server;

checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;

if the access-reply contains an assigned IP address, then;

logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

if the access-reply does not contain an assigned IP address, then;

logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;

receiving from the NAS at the SSG an accounting-start request identifying the NAS-assigned IP address and the user identification;

replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

forwarding the accounting-start request from the SSG to the AAA server.

6. A method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said method comprising:

receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;

forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;

receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;

checking the access-reply packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;

if the access-reply packet contains an assigned IP address, then;

logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;

forwarding the access-reply packet to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply packet and the user identification to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

logging the subscriber onto the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply packet and the user identification to the NAS;

receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying a NAS-assigned IP address and the user identification;

replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

forwarding the accounting-start request packet from the SSG to the AAA server.

7. A method in accordance with claim 6, wherein the communications protocol includes the Remote Authentication Dial-In User Service (RADIUS) protocol.

8. A method in accordance with claim 7, further comprising writing the user identification into the access-reply packet as a RADIUS attribute.

9. A method in accordance with claim 8, wherein the RADIUS attribute is a RADIUS class attribute.

10. A method in accordance with claim 6, wherein the user identification is the temporary IP address.

11. An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said apparatus comprising:

means for intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area, access to which is controlled by the NAS, and to the second area, access to which is controlled by the SSG server;

means for sending, from the SSG server to an Authentication Authorization and Accounting (AAA) server, an authorization request packet derived from the intercepted log-on request packet;

means for receiving at the SSG server, from the AAA server, an authorization packet responsive to the authorization request packet; and

means for processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber on to the SSG server for access to the second area when the subscriber logs on to the NAS.

12. An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said apparatus comprising:

means for intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);

means for routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

means for receiving and processing an access-reply received from the AAA server at the SSG and, based thereon, providing log-on access for the subscriber to the second area; and

means for routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

13. An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

means for intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;

means for utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;

routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

means for receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area; and

means for routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

14. An apparatus for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said apparatus comprising:

means for receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;

means for forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;

means for receiving a responsive access-reply at the SSG from the AAA server;

means for checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;

if the access-reply contains an assigned IP address, then;

means for logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

means for forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

if the access-reply does not contain an assigned IP address, then;

means for logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;

means for assigning a user identification to the subscriber at the SSG;

means for forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;

means for receiving from the NAS at the SSG an accounting-start request identifying a NAS-assigned IP address and the user identification;

means for replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

means for forwarding the accounting-start request from the SSG to the AAA server.

15. An apparatus for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said apparatus comprising:

means for receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;

means for forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;

means for receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;

means for checking the access-reply packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;

if the access-reply packet contains an assigned IP address, then;

means for logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;

means for forwarding the access-reply packet to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

means for logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

means for assigning a user identification to the subscriber at the SSG;

means for forwarding the access-reply packet and the user identification to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

means for logging the subscriber onto the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

means for assigning a user identification to the subscriber at the SSG;

means for forwarding the access-reply packet and the user identification to the NAS;

means for receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying a NAS-assigned IP address and the user identification;

means for replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

means for forwarding the accounting-start request packet from the SSG to the AAA server.

16. An apparatus in accordance with claim 15 wherein the communications protocol includes the Remote Authentication Dial-In User Service (RADIUS) protocol.

17. An apparatus in accordance with claim 16 further comprising writing the user identification into the access-reply packet as a RADIUS attribute.

18. An apparatus in accordance with claim 17 wherein the RADIUS attribute is a RADIUS class attribute.

19. An apparatus in accordance with claim 15 wherein the user identification is the temporary IP address.

20. An apparatus for providing a single step log-on access for a subscriber of a computer network having a first area and a second area, said computer network including at least one Network Access Server (NAS) and at least one Authentication Authorization and Accounting (AAA) Server, said NAS providing access for the subscriber to said first area, said apparatus comprising:

a Service Selection Gateway (SSG) Server providing access for the subscriber to the second area, said SSG Server connected between the NAS and the AAA Server, said SSG Server;

(1) receiving an access-request packet from the NAS when the subscriber connects the NAS, (2) forwarding said access-request packet to the AAA Server, (3) receiving an access-reply packet from the AAA Server in response to said access-request packet, and (4) forwarding said access-reply packet to the NAS; and

processing information in said access-reply packet for enabling said SSG Server to automatically log the subscriber onto said SSG Server when the subscriber logs onto the NAS.

21. A system for providing a single step log-on access for a subscriber of a computer network having a first area and a second area, said system comprising:

a Network Access Server (NAS) for providing access for the subscriber to the first area, said NAS sending an access-request packet when the subscriber connects to said NAS according to a communications protocol;

an Authentication Authorization and Accounting (AAA) Server for receiving said access-request packet and sending an access-reply packet in response; and

a Service Selection Gateway (SSG) Server for providing access for the subscriber to the second area, said SSG Server connected between said NAS and said AAA Server, said SSG Server receiving said access-request packet from said NAS, forwarding said access-request packet to said AAA Server, receiving said access-reply packet in from said AAA Server, and forwarding said access-reply packet to said NAS.

22. A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access to a subscriber of a computer network having a first area and a second area, said method comprising:

linking a Service Selection Gateway (SSG) to a Network Access Server (NAS), the NAS providing the subscriber with access to the first area, and said SSG providing the subscriber with access to the second area, wherein the subscriber supplies data packets to log-on to the NAS in order to obtain access to the first area;

linking the SSG to an Authentication Authorization and Accounting (AAA) Server;

intercepting and forwarding with the SSG the data packets sent between the NAS and the AAA server with the SSG; and

processing information in the data packets with the SSG for enabling the SSG to automatically log the subscriber on to the SSG when the subscriber logs on to the NAS.

23. A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access for a subscriber of a computer network having a first area and a second separate area, said method comprising:

receiving access-request packets from a Network Access Server (NAS) at a Service Selection Gateway (SSG);

utilizing at the SSG information in said access-request packets to initiate log-on for said subscriber to the second area;

routing said access-request packets from said SSG to an Authentication Authorization and Accounting (AAA) Server to initiate log-on for the subscriber to the first area; and

routing access-reply packets responsive to said access-request packets received at said SSG from said AAA Server to said NAS to complete log-on for the subscriber to the first area.

24. A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access to a subscriber of a computer network, said computer network differentiated into a plurality of areas, said method comprising:

receiving an access-request packet from a Network Access Server (NAS) at a Service Selection Gateway (SSG) when the subscriber connects to the NAS, in accordance with a communications protocol;

forwarding said access-request packet to an Authentication Authorization and Accounting (AAA) Server;

receiving an access-reply packet from the AAA Server at the SSG in accordance with the protocol;

determining if said access-reply packet contains an Internet Protocol (IP) address for the subscriber, the IP address assigned by the AAA Server;

if the access-reply packet contains an AAA-assigned IP address, then;

logging the subscriber on to the SSG Server with said AAA-signed IP address, if said access-reply packet contains authorization from said AAA Server;

forwarding the access-reply packet to the NAS; and

logging the subscriber on to the NAS with the AAA-assigned IP address, if the access-reply packet contains authorization from the AAA Server;

or

if the access-reply packet does to contain an AAA-assigned IP address, then;

logging the subscriber on to the SSG server with a temporary IP address, if said access-reply packet contains authorization from the AAA Server;

assigning a user identification to the subscriber;

forwarding the access-reply packet and the user identification to the NAS;

logging the subscriber on to the NAS with a NAS-assigned IP address, if the access-reply packet contains authorization from the AAA Server;

receiving an accounting-start packet from said NAS at the SSG said accounting-start packet containing a NAS-assigned IP address and the user identification;

reading accounting-start packet to determine the NAS-assigned IP address of the subscriber;

replacing the temporary IP address with the NAS-assigned IP address on the SSG; and

forwarding the accounting-start packet to the AAA Server.

25. The programmable storage device of claim 24, wherein the communications protocol is a Remote Authentication Dial-In User Service (RADIUS) protocol.

26. The programmable storage device of claim 25, wherein said first forwarding step further comprises:

writing the user identification into the access-reply packet as a RADIUS Attribute.

27. The programmable storage device of claim 26, wherein said RADIUS Attribute is written as a RADIUS Class Attribute.

28. The programmable storage device of claim 24, wherein said user identification number is the temporary IP address.

29. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area and to the second area;

sending, from the SSG server to an Authentication Authorization and Accounting (AAA), server, an authorization request packet derived from the received log-on request packet;

receiving, from the AAA server, an authorization packet responsive to the authorization request packet; and

processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber onto the SSG server for access to the second area when the subscriber logs onto the NAS.

30. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);

routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area; and

routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

31. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;

utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;

routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;

receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area; and

routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

32. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, the method comprising:

receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;

forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;

receiving a responsive access-reply at the SSG from the AAA server;

checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;

if the access-reply contains an assigned IP address, then;

logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;

if the access-reply does not contain an assigned IP address, then;

logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;

receiving from the NAS at the SSG an accounting-start request identifying a NAS-assigned IP address and the user identification;

replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

forwarding the accounting-start request from the SSG to the AAA server.

33. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, the method comprising:

receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;

forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;

receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;

checking the access-replay packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;

if the access-reply packet contains an assigned IP address, then;

logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;

forwarding the access-reply packet to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply packet and the user identification to the NAS;

if the access-reply packet does not contain an assigned IP address, then;

logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;

assigning a user identification to the subscriber at the SSG;

forwarding the access-reply packet and the user identification to the NAS;

receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying the NAS-assigned IP address and the user identification;

replacing the temporary IP address with the NAS-assigned IP address at the SSG; and

forwarding the accounting-start request packet from the SSG to the AAA server.

37. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing in accordance with claim 33, wherein the user identification is the temporary IP address.

34. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing in accordance with claim 39, wherein the communications protocol includes the Remote Authentication Dial-In User Service (RADIUS) protocol.

35. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing in accordance with claim 34, further comprising writing the user identification into the access-reply packet as a RADIUS attribute.

36. A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing in accordance with claim 35, wherein the RADIUS attribute is a RADIUS class attribute.