Techniques for offering seamless accesses in enterprise hot spots for both guest users and local users

• US 8,085,740 B2
• Filed: 03/08/2004
• Issued: 12/27/2011
• Est. Priority Date: 04/15/2003
• Status: Active Grant

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: Thomson Licensing (Vantiva SA)
• Inventors: Zhang, Junbiao, Ramaswamy, Kumar
• Primary Examiner(s): MILLER, BRANDON J
• Application Number:
  US10/553,648
• Publication Number:
  US 20070025302A1
• Time in Patent Office: 2,850 Days
• Field of Search: 370/338, 370/328, 370/310, 370/329, 455410-411, 455/435.2, 455/41.2, 455/41.3, 455/426.1, 455/432.1, 455/435.1, 455418-420
• US Class Current: 370/338
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A wireless Local Area Network (LAN 11) capable of providing “enterprise guest” hosting includes at least one an e-open wireless LAN access point (15) that provides access to both guests and local users. Upon receipt of a request for access, the access point forwards the request to an authentication proxy. The authentication proxy then authenticates the party requesting access in accordance with that party'"'"'s status (that is, whether the party is a local user or guest). Upon successful authentication, the network routes the traffic from a local user differently as compared to that for a guest. For example traffic from guests goes to gateway for receipt in an external network such as the Internet, whereas traffic from the local user goes to a local network, e.g., a corporate intranet. In this way, the Wireless LAN 11, after ascertaining the status of the party requesting access, can limit guest traffic according to the guest access policy.

Claims

1. A method for offering wireless network access to both guests and local users, comprising:

sending a guest credential to a guest user;

receiving at a common wireless network access point a request for access from one of a guest and local user, said request for access from said guest user including said guest credential;

determining at the common wireless network access point whether the access request was received from local user or guest, said determining including examining a user domain of a party seeking access to determine whether such user domain designates a guest domain;

authenticating the request for access received at the common wireless network access point depending on whether the request was received from the guest or local user, wherein the authenticating step further comprises the step of communicating a request for authentication to one or more authentication servers, the authentication being performed differently depending on whether the party seeking access is a local user or a guest;

if such authentication is successful, then routing traffic from the local user differently from the guest; and

limiting traffic from said guest according to a guest access policy.

2. The method according to claim 1 wherein the authenticating step further comprises the step of communicating a request for authentication to a single authentication server which performs authentication using different credentials for local users and guests.

3. The method according to claim 1 wherein the authenticating step further comprises the step of ascertaining whether the request for access was received in an IEEE 802.1x format.

4. The method according to claim 3, further comprising:

providing web browser based authentication if the request for access was not received in the IEEE 802.1x format.

5. The method according to claim 1 wherein the routing step further comprises the step of routing traffic from a guest to an external network.

6. The method according to claim 1 wherein the routing step further comprises the step of routing traffic from a local user to a corporate intranet.

7. A wireless local area network for offering wireless network access to both guests and local users, comprising:

at least one common wireless network access point offering access to both guests and local users in response to a request for access, the at least one common wireless network access point receiving a request for access from one of a guest and local user, wherein the request for access from the guest user includes a guest credential, the at least one common wireless network access point determining whether the access request was received from a local user or a guest by examining if a user domain received with the access request indicates a guest domain, and the at least one common wireless network access point communicating a request for authentication to at least one server;

the at least one server coupled to the at least one common wireless network access point for authenticating the request for access differently depending on whether the request was received from the guest or local user, and the at least one server also for receiving the request for authentication;

means for routing traffic from the local user differently from the guest to limit traffic from said guest according to a guest access policy.

8. The network according to claim 7 wherein the authentication server performs authentication using different credentials for local users and guests.

9. The network according to claim 7 wherein the at least one wireless network access point ascertains whether the request for access was received in an IEEE 802.1x format or was received in a web-browser format.

10. The network according to claim 9, wherein the at least one common wireless network access point is further configured for providing web browser based authentication if the request for access was not received in the IEEE 802.1x format.

11. The network according to claim 7 wherein the traffic from the guest is routed through a firewall.