Method for controlling access to a network by a wireless client

• US 7,571,308 B1
• Filed: 06/28/2000
• Issued: 08/04/2009
• Est. Priority Date: 06/28/2000
• Status: Expired due to Fees

• Current Assignee: Microsoft Technology Licensing LLC (Microsoft Corporation)
• Original Assignee: Microsoft Corporation
• Inventors: Moore, Timothy M., Bahl, Pradeep
• Primary Examiner(s): Dada; Beemnet W
• Application Number:
  US09/607,195
• Time in Patent Office: 3,324 Days
• Field of Search: 713/151, 713/153, 713/200, 713/201, 713/168, 713/150, 713/152, 710/200, 709/227, 709/225, 709/229, 380/271, 380/270, 380/272, 370/354, 370/356, 455/433, 455/410, 455/411
• US Class Current: 713/151
• CPC Class Codes: H04L 61/5014 using dynamic host configuration protocol [DHCP] or bootstrap protocol [BOOTP]
• CPC Class Codes: H04L 61/5053 Lease time; Renewal aspects
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/61 Time-dependent
• CPC Class Codes: H04W 92/10 between terminal device and access point, i.e. wireless air interface

Abstract

In a method for controlling access to a network by a wireless client and a network, an access point on the network receives a request for a network address broadcast by the wireless client. The request is passed to an address server, which assigns a temporary address to the wireless client and provides the address of the access point. The wireless client then initiates a secure link with the access point based on the network address assigned by the address server and the address of the access point. If the secure link is not established before the temporary address expires, then wireless client is denied access to the network.

Claims

1. A method for controlling access to a network by a wireless client, the method comprising:

assigning a network address to the wireless client, wherein the network address has a lease period;

sending the assigned network address to the wireless client prior to establishing a secure link;

establishing the secure link using the assigned network address;

sending an address of a wireless access point to the wireless client, wherein the wireless access point is adapted to handle the secure link established by the wireless client; and

wherein the lease period is based upon a time expected for setting up the secure link.

2. The method of claim 1, wherein the assigned network address and the wireless access point address are sent to the wireless client in a DHCP offer packet.

3. The method of claim 1, wherein the secure link is an IPSEC tunnel.

4. The method of claim 1, wherein the assigned network address is sent to the wireless client via the wireless access point.

5. The method of claim 1, wherein the address of the wireless access point that is sent to the wireless client comprises an IP address and a MAC address.

6. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 1.

7. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 2.

8. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 3.

9. The method according to claim 1 wherein the assigned network address having the lease period is sent to the wireless client prior to authentication of the wireless client.

10. The method according to claim 1 wherein the lease period is of a duration that is sufficient for the wireless client to establish a secure link with the wireless access point and send a renewal request of the assigned address via the secure link.

11. The method according to claim 1 further comprising the step of extending the lease period of the assigned network address to a predefined duration if the wireless client establishes a secure link with the wireless access point and requests a renewal of the assigned address via the secure link.

12. A method for controlling access to a network by a wireless client, the method comprising:

receiving a request for a network address from the wireless client at a network access point;

attaching at the network access point information to the request to indicate that the request originated from a wireless client;

relaying the request to the address server;

receiving an assignment of an address from the address server, the address having a lease time;

relaying the assignment of the address to the wireless client;

negotiating the establishment of a secure link with the wireless client using the assigned address;

using the assigned address to communicate with clients via a wireless access point; and

wherein the lease time is based upon a time expected for setting up the secure link.

13. The method of claim 12, further comprising:

broadcasting an ARP packet to check whether there are any other clients having the same assigned address of the wireless client; and

if a response to the ARP packet is received, terminating the negotiation, thereby denying the wireless client access to the network.

14. The method of claim 12, further comprising:

in response to the negotiation, creating an ARP entry that maps the assigned address of the wireless client to a MAC address of the wireless client.

15. The method of claim 12, wherein the request is a DHCP discover packet, the method further comprising:

inserting data into an optional field of the packet to indicate that the packet was received from a wireless client; and

relaying the packet to the address server.

16. The method of claim 12, further comprising:

receiving a renewal request packet having a request for a renewal of the lease time from the wireless client;

if the secure link is successfully negotiated with the wireless client, inserting data into an optional field of the renewal request packet to indicate that the renewal request packet was received from a wireless client; and

relaying the renewal request packet to the address server.

17. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 12.

18. A computer-readable medium having stored thereon computer-executable instructions for performing the method of claim 13.