Authentication methods and systems for accessing networks authentication methods and systems for accessing the internet

• US 7,089,415 B2
• Filed: 10/27/2004
• Issued: 08/08/2006
• Est. Priority Date: 02/22/2000
• Status: Expired due to Term

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Bahl, Paramvir, Venkatachary, Srinivasan, Balachandran, Anand
• Primary Examiner(s): Louis-Jacques, Jacques
• Assistant Examiner(s): HENEGHAN, MATTHEW E
• Application Number:
  US10/974,191
• Publication Number:
  US 20050138358A1
• Time in Patent Office: 650 Days
• Field of Search: 713/156, 713/175, 709/225, 726/3
• US Class Current: 713/156
• CPC Class Codes: G06Q 30/02 Marketing; Price estimation or determination; Fundraising
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/102 Entity profiles

Abstract

Systems and methods for providing network access, e.g. Internet access, are described. An architecture includes a host organization network through which network access is provided. The host organization network can be advantageously deployed in public areas such as airports and shopping malls. An authentication/negotiation component is provided for authenticating various users and negotiating for services with service providers on behalf of the system users. The authentication/negotiation component can include one or more specialized servers and a policy manager that contains policies that govern user access to the Internet. An authentication database is provided and authenticates various users of the system. An access module is provided through which individual client computing devices can access the Internet. In one embodiment, the access module comprises individual wireless access points that permit the client computing devices to wirelessly communicate data packets that are intended for the Internet. In one aspect, users are given a variety of choices of different service levels that they can use for accessing the Internet. The service levels can vary in such things as bandwidth allocation and security measures. The various service levels can be purchased by the users using their computing devices.

Claims

1. An authentication system comprising:

host network means configured to provide access to the Internet from a public location;

means associated with the host network means, for enabling authentication of individual users so that they can access the Internet through the host network, authentication being configured to take place in a manner that is independent of any user affiliation with any Internet Service Providers (ISPs);

means for enabling a user to access the host network; and

means for containing user information that can be used to authenticate a user.

2. The system of claim 1, wherein the means for containing comprises a globally accessible authentication database.

3. The system of claim 2, wherein the user authenticates directly with the authentication database.

4. The system of claim 3, wherein the means associated with the host network means is configured to link a user directly to the authentication database.

5. The system of claim 3, wherein the means associated with the host network means is not privy to any authentication information that passes between the user and the authentication database.

6. The system of claim 3, wherein authentication takes place between the user and the means for containing in a secure manner.

7. The system of claim 6, wherein the authentication takes place using secure socket link (SSL) techniques.

8. The system of claim 3, wherein the means for containing is configured to notify the means associated with the host network means when a user has been properly authenticated.

9. The system of claim 8, wherein the means for containing is configured to provide user information to the means associated with the host network means after the user has been authenticated.

10. The system of claim 9, wherein the user information that is provided by the means for containing comprises billing information.

11. The system of claim 1, wherein the means for containing comprises a locally accessible authentication database.

12. The system of claim 1, wherein the means associated with the host network means is configured to issue a unique token to each user once the user is authenticated by the means for containing, the unique token being provided for use with data packets that can be transmitted from each user.

13. The system of claim 1, wherein the means for enabling is configured to enable the user to wirelessly access the host network means.

14. An authentication system for providing authentication for users who desire to access the Internet, the system comprising:

at least one host organization network means configured to access the Internet, the host organization network means comprising one or more subnets each of which comprising;

means for receiving data packets from individual client computing devices and transmitting the data packets to the Internet; and

public means for receiving wireless communication from a user that is using a client computing device to wirelessly transmit data packets that are intended for the Internet and providing the wirelessly transmitted data packets to the means for receiving before the data packets are transmitted to the Internet; and

globally accessible authentication means for containing information that can be used by the authentication means to authenticate a user without requiring the user to be affiliated with at least one Internet Service Provider (ISP).

15. The system of claim 14, wherein the user authenticates directly with the globally accessible authentication means.

16. The system of claim 14, wherein the means for receiving is not privy to authentication information that is passed between the client computing device and the globally accessible authentication means.

17. The system of claim 14, wherein authentication takes place between the client computing device and the globally accessible authentication means in an end-to-end secure manner.

18. The system of claim 17, wherein the secure manner comprises secure socket layer (SSL) techniques.

19. The system of claim 14, wherein the globally accessible authentication means is configured to notify the means for receiving when a user has been authenticated.

20. The system of claim 19, wherein the globally accessible authentication means is configured to provide user information to the means for receiving when the user has been authenticated.

21. The system of claim 20, wherein the user information that is provided to the means for receiving by the globally accessible authentication means comprises billing information.

22. The system of claim 14, wherein the user is unaffiliated with any Internet Service Providers (ISPs).

23. An authentication system for providing authentication for users who desire to access the Internet, the system comprising:

wireless node means through which the Internet can be accessed;

access point means with which the wireless node means can communicate;

server means configured to receive wireless communication from the access point means, the server means configured to enable authentication of various users; and

global authentication database means that contains user information that can be used to authenticate the users without requiring the users to be affiliated with at least one Internet Service Provider (ISP).

24. The system of claim 23, wherein the server means is configured to enable a user to log directly onto the one global authentication database means.

25. The system of claim 24, wherein the server means is configured to present a web page having a link to the one global authentication database means.

26. The system of claim 24, wherein the server means is not privy to any of the authentication information that gets passed between the user and the one global authentication database means.

27. The system of claim 24, wherein the one global authentication database means is configured to notify the server means after the user has been authenticated.

28. The system of claim 27, wherein the one global authentication database means is configured to provide user information to the server means after the user has been authenticated by the global authentication database means.

29. The system of claim 23, wherein the server means is configured to issue a unique token to the user after the user is authenticated.

30. The system of claim 29, wherein the server means encrypts the unique token before issuing it to the user.

31. The system of claim 23, wherein the access point means are arranged to define a wireless subnet.

32. The system of claim 23, wherein the access point means are deployed in a publicly accessible area.

33. The system of claim 23, wherein the wireless node means comprise mobile computing devices.

34. A system comprising:

means for establishing a communication link between a mobile computing device and a server that is configured to provide Internet access;

means for contacting a global authentication database that contains user information that can be used to authenticate one or more users;

means for authenticating a user using the information that is contained in the global authentication database, independent of any user affiliation with any Internet Service Providers (ISPs);

means for notifying the server that the user has been authenticated; and

means for issuing a unique token to the user for use when sending data packets to the server for transmission to the Internet.

35. The system of claim 34, wherein the communication link comprises at least one wireless link.

36. The system of claim 34, wherein the communication link comprises a wireless link that includes the mobile computing device.

37. The system of claim 34, wherein the communication link comprises a wireless link that includes the server.

38. The system of claim 34, wherein the communication link comprises a wireless link that includes both the mobile computing device and the server.

39. The system of claim 34, wherein said means for authenticating comprises means for authenticating the user using a secure protocol.

40. The system of claim 39, wherein the server is not privy to any authentication information that passes between the user and the authentication database.

41. The system of claim 34, wherein the server comprises part of a publicly deployed and accessible host network.

42. A system comprising:

means for configuring multiple access points to receive wireless communication from multiple wireless nodes through which the Internet can be accessed, the multiple wireless nodes being capable of communicating data packets that are intended for transmission to the Internet;

means for configuring a server to wirelessly receive the data packets that are communicated to the multiple access points; and

means for configuring a globally accessible database that includes information that can be used to authenticate one or more users that desire to access the Internet, authentication taking place in a manner that does not require the one or more users to be affiliated with at least one Internet Service Provider (ISP).

43. The system of claim 42 further comprising means for using the globally accessible database to authenticate one or more users.

44. The system of claim 43, wherein said means for using comprises means for linking the user directly to the globally accessible database.

45. The system of claim 43, wherein said means for using comprises means for linking the user directly to the globally accessible database and means for authenticating the user outside of the purview of the server.

46. The system of claim 43, wherein said means for using comprises means for linking the user directly to the globally accessible database and means for notifying the server when the user has been authenticated.

47. The system of claim 43 further comprising means for issuing a user, once authenticated, a unique token that uniquely identifies that user.

48. The system of claim 42, wherein at least some of the wireless nodes comprise mobile computing devices.