Fast re-authentication with dynamic credentials
First Claim
1. An apparatus, comprising:
- a proxy authentication server configured to be in communication with a network access server and an authentication server;
wherein the proxy authentication server is configured to intercept a first authentication request from the network access server for a supplicant;
wherein the proxy authentication server is configured to forward the first authentication request to the authentication server responsive to determining the proxy authentication server does not have authentication data for the supplicant;
wherein the proxy authentication server is configured to intercept a response to the first authentication request from the authentication server, the response comprising authentication data for the client;
wherein the proxy authentication server is configured to store the authentication data for the supplicant and to forward the authentication data for the supplicant to the network access server;
wherein the proxy authentication server is configured to intercept a second authentication request for the supplicant from a second network access server; and
wherein the proxy authentication server is configured to authenticate the second authentication request with the stored authentication data and reply to the second network access server responsive to determining the proxy authentication server has the authentication data for the supplicant.
0 Assignments
0 Petitions
Accused Products
Abstract
A proxy server that is inserted between a plurality of network access servers, typically an access points, and an authentication server. When an original authentication request is received by a network access server, the network access server forwards the request to the proxy server which forwards the request to an authentication server. The authentication server then sends the session information to the proxy server which stores the keying material as a dynamic credentials. When the client re-authenticates with one of the plurality of access servers, the re-authentication request is handled by the proxy server using the dynamic credentials. The proxy server may re-authenticate the client using a different method than the method that was originally used. For example, the original authentication may be by Extensible Authentication Protocol—Transport Layer Security (EAP-TLS) and subsequent re-authentications may use Wi-Fi Protected Access (WPA).
-
Citations
16 Claims
-
1. An apparatus, comprising:
-
a proxy authentication server configured to be in communication with a network access server and an authentication server; wherein the proxy authentication server is configured to intercept a first authentication request from the network access server for a supplicant; wherein the proxy authentication server is configured to forward the first authentication request to the authentication server responsive to determining the proxy authentication server does not have authentication data for the supplicant; wherein the proxy authentication server is configured to intercept a response to the first authentication request from the authentication server, the response comprising authentication data for the client; wherein the proxy authentication server is configured to store the authentication data for the supplicant and to forward the authentication data for the supplicant to the network access server; wherein the proxy authentication server is configured to intercept a second authentication request for the supplicant from a second network access server; and wherein the proxy authentication server is configured to authenticate the second authentication request with the stored authentication data and reply to the second network access server responsive to determining the proxy authentication server has the authentication data for the supplicant. - View Dependent Claims (2, 3, 4, 5, 6, 7, 8)
-
-
9. A method, comprising:
-
intercepting by a proxy authentication server a first request to authenticate a supplicant from a first network access server; determining by the proxy authentication server whether authentication credentials are available for the supplicant; forwarding by the proxy authentication server the first request to authenticate a supplicant from to an authentication server responsive to determining authentication credentials are not available for the supplicant; intercepting by the proxy authentication server a response to the first request to authenticate from the authentication server, the response comprising authentication data; storing the authentication data at the proxy authentication server; forwarding by the proxy authentication server the response to the first request to the first network access server; intercepting by the proxy authentication server a second request to authenticate the supplicant from a second network access server; determining by the proxy authentication server whether authentication credentials are available for the supplicant; and authenticating by the proxy authentication server the second request to authenticate and sending a reply to the second network access server responsive to determining that authentication credentials are available for the supplicant. - View Dependent Claims (10, 11, 12, 13)
-
-
14. An apparatus, comprising:
-
a proxy authentication server configured to be in communication with a network access server and an authentication server; wherein the proxy authentication server is configured to receive a first authentication request from the network access server for a supplicant; wherein the proxy authentication server is configured to forward the first authentication request to the authentication server responsive to determining the proxy authentication server does not have authentication data for the supplicant; wherein the proxy authentication server is configured to receive a response to the first authentication request from the authentication server, the response comprising authentication data for the client; wherein the proxy authentication server is configured to store the authentication data for the supplicant and to forward the authentication data for the supplicant to the network access server; wherein the proxy authentication server is configured to receive a second authentication request from a second network access server for the supplicant for the supplicant; and wherein the proxy authentication server is configured to authenticate the second authentication request with the stored authentication data and reply to the second network access server responsive to determining the proxy authentication server has the authentication data for the supplicant.
-
-
15. A method, comprising:
-
receiving by a proxy authentication server a first request to authenticate a supplicant from a first network access server; determining by the proxy authentication server whether authentication credentials are available for the supplicant; forwarding by the proxy authentication server the first request to authenticate a supplicant from to an authentication server responsive to determining authentication credentials are not available for the supplicant; receiving by the proxy authentication server a response to the first request to authenticate from the authentication server, the response comprising authentication data; storing the authentication data at the proxy authentication server; forwarding by the proxy authentication server the response to the first request to the first network access server; receiving a second request by the proxy authentication server to authenticate the supplicant from a second network access server; determining by the proxy authentication server whether authentication credentials are available for the supplicant; and authenticating the second request to authenticate by the proxy authentication server with the stored authentication credentials and sending a reply to the second network access server responsive to determining that authentication credentials are available for the supplicant. - View Dependent Claims (16)
-
Specification