Network system and method for providing an ad-hoc access environment

• US 8,411,562 B2
• Filed: 05/26/2005
• Issued: 04/02/2013
• Est. Priority Date: 05/26/2004
• Status: Expired due to Fees

• Current Assignee: Sovereign Peak Ventures, LLC (Dominion Harbor Enterprises, LLC)
• Original Assignee: Panasonic Corporation (Panasonic Holdings Corporation)
• Inventors: Chia, Pei Yen, Tan, Pek Yew
• Primary Examiner(s): Pezzlo, John
• Application Number:
  US11/569,413
• Publication Number:
  US 20120039326A1
• Time in Patent Office: 2,868 Days
• Field of Search: 370/252, 370/230, 370/329, 370/401
• US Class Current: 370/230
• CPC Class Codes: H04L 63/04 for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 8/02 Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

Network system and method for providing an ad-hoc access environment. A network system capable of providing an ad-hoc access environment comprises a controller unit connected to the network for receiving access requests from a device; and an authority unit for providing an authorization assertion to the controller unit; wherein the controller unit carries out an authorization process based on an access control policy including at least one rule based on which the controller unit contacts the authority unit and the authority unit provides an authorization assertion.

Claims

1. A network system capable of providing an ad-hoc access environment, the network system comprising:

a controller unit connected to a network for receiving access requests from a device; and

an authority unit for providing an authorisation assertion to the controller unit;

wherein the controller unit carries out an authorisation process based on an access control policy including at least one rule based on which the controller unit contacts the authority unit and the authority unit provides an authorisation assertion; and

wherein the authority unit resides on a mobile device accessible to a user with administrator rights.

2. The network system as claimed in claim 1, wherein the authority unit requires an assertion from the user with administrator rights for providing the authorisation assertion to the controller unit.

3. The network system as claimed in claim 1, wherein the device requesting access to the network is not registered with the network.

4. The network system as claimed in claim 1, wherein the device requesting access to the network is registered with the network, and the access request comprises a request for a service for which the registered device does not have access rights.

5. The network system as claimed in claim 1, wherein the controller unit comprises a database for storing user registration information and a state table for storing current state information of each device residing in the network.

6. The network system as claimed in claim 1, further comprising one or more service devices residing in the network for providing respective services.

7. The network system as claimed in claim 1, wherein the controller unit comprises a registration program for registering the device to the network.

8. The network system as claimed in claim 7, wherein the registration program is activated based on an administrator key recognised by the controller unit as associated with administrator rights.

9. The network system as claimed in claim 8, wherein the administrator key is received from a storage device external to the controller unit.

10. The network system as claimed in claim 8, wherein the registration program instructs the controller unit to request user registration information from the device requesting to register, to generate a verification including a registration key based on the received user registration information, and to provide the verification including the registration key to the device.

11. The network system as claimed in claim 10, wherein the registration program further instructs the controller unit to provide a temporary key to the device for encrypt the user registration information, and to decrypt the received encrypted user registration information.

12. The network system as claimed in claim 10, wherein the registration program further instructs the controller unit to hash the user registration information and to store the hashed user registration information in a secure database of the network system.

13. The network system as claimed in claim 7, wherein the registration program is configured to have the device registered to the registration program, to configure the device with rights to host the authority unit, and to configure the controller unit to contact the device when an authorisation assertion is required.

14. The network system as claimed in claim 7, wherein the registration program instructs the controller unit to provide an access token to the registered device, and the registered device sends a future access request together with the access token for verification.

15. The network system as claimed in claim 14, wherein the controller unit issues a new access token after each successful login by the registered device.

16. The network system as claimed in claim 1, wherein the controller unit receives user information together with the access request, checks the user information, sends an authorisation assertion query to the authority unit, and grants or denies access based on the authorisation assertion received from the authority unit.

17. The network system as claimed in claim 1, wherein the controller unit receives user information together with the access request, checks the user information, and grants or denies access based on information stored in a database accessible to the controller unit.

18. The network system as claimed in claim 1, wherein the controller unit contacts the authority unit for an authorisation assertion based on the access control policy, and determines whether an access request is received without a valid token indicative of ad-hoc access rights.

19. The network system as claimed in claim 1, wherein the controller unit contacts the authority unit for an authorisation assertion based on the access control policy, and determines whether an access request is received from a registered device without access rights to a device specified in the access request.

20. The network system as claimed in claim 1, wherein the access control policy comprises rules depending on a current location of the authority unit.

21. The network system as claimed in claim 20, wherein the controller unit sends a control message to a network protocol access layer of the network to enable a local port, and receives an acknowledgement from the network protocol access layer indicating whether the local port is enabled or disabled.

22. The network system as claimed in claim 21, wherein the access control policy comprises a rule such that access to the network requested by a nonregistered device is granted only if the authority unit is present in the network.

23. The network system as claimed in claim 1, wherein the authority unit sends a message to the controller unit based on input from a user with administrator rights indicating revocation of access rights of the device.

24. The network system as claimed in claim 23, wherein the controller unit removes a table entry of the device and terminates an ongoing session of the device.

25. The network system as claimed in claim 23, wherein the device is a registered device, and the controller deletes a registration entry of the registered device, invalidates an access token of the de-registered device, and denies a future access request by the de-registered device.

26. The network system as claimed in claim 1, wherein the network comprises an access network with protocol processing entities capable of network connectivities using different or similar network protocol stacks, and the device requesting the access comprises one of the network protocol stacks.

27. The network system as claimed in claim 26, wherein a format for control messages between the controller unit and a network access protocol unit of the access network comprises one or more of a group consisting of network type for identifying a network interface, network address for identifying the network address of a network entity seeking network connectivity, enable/disable flag to indicate enable or disable network connectivity by enabling or disabling the network protocol stack controlling the network connectivity as identified by the network type, passphrase during the active session between the protocol stack of the network type and the controller unit of the authority unit.

28. The network system as claimed in claim 27, wherein the passphrase is accompanied with a token key identifying the authority unit or the controller unit to the network protocol stack, and req/ack which is a request of an action within a session.

29. A method of providing an ad-hoc access environment in a network, the method comprising:

receiving access requests from a device utilising a controller unit of the network; and

providing an authorisation assertion to the controller unit utilising an authority unit of the network;

wherein the controller unit carries out an authorisation process based on an access control policy including at least one rule based on which the controller unit contacts the authority unit and the authority unit provides an authorisation assertion; and

wherein the authority unit resides on a mobile device accessible to a user with administrator rights.

30. The method as claimed in claim 29, wherein the authority unit requires an assertion from the user with administrator rights for providing the authorisation assertion to the controller unit.

31. The method as claimed in claim 29, wherein the device requesting access to the network is not registered with the network.

32. The method as claimed in claim 29, wherein the device requesting access to the network is registered with the network, and the access request comprises a request for a service for which the registered device does not have access rights.

33. The method as claimed in claim 29, wherein the controller unit comprises a database for storing user registration information and a state table for storing current state information of each device residing in the network.

34. The method as claimed in claim 29, wherein the controller unit comprises a registration program for registering the device to the network.

35. The method as claimed in claim 34, wherein the registration program is activated based on an administrator key recognised by the controller unit as associated with administrator rights.

36. The method as claimed in claim 35, wherein the administrator key is received from a storage device external to the controller unit.

37. The method as claimed in claim 35, wherein the registration program instructs the controller unit to request user registration information from the device requesting to register, to generate a verification including a registration key based on the received user registration information, and to provide the verification including the registration key to the device.

38. The method as claimed in claim 37, wherein the registration program further instructs the controller unit to provide a temporary key to the device to encrypt the user registration information, and to decrypt the received encrypted user registration information.

39. The method as claimed in claim 37, wherein the registration program further instructs the controller unit to hash the user registration information and to store the hashed user registration information in a secure database of the network.

40. The method as claimed in claim 34, wherein the registration program is configured to have the device registered to the registration program, to configure the device with rights to host the authority unit, and to configure the controller unit to contact the device when an authorisation assertion is required.

41. The method as claimed in claim 34, wherein the registration program instructs the controller unit to provide an access token to the registered device, and the registered device sends a future access request together with the access token for verification.

42. The method as claimed in claim 41, wherein the controller unit issues a new access token after each successful login by the registered device.

43. The method as claimed in claim 29, wherein the controller unit receives user information together with the access request, checks the user information, sends an authorisation assertion query to the authority unit, and grants or denies access based on the authorisation assertion received from the authority unit.

44. The method as claimed in claim 29, wherein the controller unit receives user information together with the access request, checks the user information, and grants or denies access based on information stored in a database accessible to the controller unit.

45. The method as claimed in claim 29, wherein the controller unit contacts the authority unit for an authorisation assertion based on the access control policy, and determines whether an access request is received without a valid token indicative of ad-hoc access rights.

46. The method as claimed in claim 29, wherein the controller unit contacts the authority unit for an authorisation assertion based on the access control policy, and determines whether an access request is received from a registered device without access rights to a device specified in the access request.

47. The method as claimed in claim 29, wherein the access control policy comprises rules depending on a current location of the authority unit.

48. The method as claimed in claim 47, wherein the controller unit sends a control message to a network protocol access layer of the network to enable a local port, and receives an acknowledgement from the network protocol access layer indicating whether the local port is enabled or disabled.

49. The method as claimed in claim 48, wherein the access control policy comprises a rule such that access to the network requested by a non-registered device is granted only if the authority unit is present in the network.

50. The network as claimed in claim 29, wherein the authority unit sends a message to the controller unit based on input from a user with administrator rights indicating revocation of access rights of the device.

51. The method as claimed in claim 50, wherein the controller unit removes a table entry of the device and terminates an ongoing session of the device.

52. The method as claimed in claim 50, wherein the device is a registered device, and the controller deletes a registration entry of the registered device, invalidates an access token of the de-registered device, and denies a future access request by the de-registered device.

53. The method as claimed in claim 29, wherein the network comprises an access network with protocol processing entities capable of network connectivities using different or similar network protocol stacks, and the device requesting the access comprises one of the network protocol stacks.

54. The method as claimed in claim 53, wherein a format for control messages between the controller unit and a network access protocol unit of the access network comprises one or more of a group consisting of network type for identifying a network interface, network address for identifying the network address of a network entity seeking network connectivity, enable/disable flag to indicate enable or disable network connectivity by enabling or disabling the network protocol stack controlling the network connectivity as identified by the network type, passphrase during the active session between the protocol stack of the network type and the controller unit of the authority unit.

55. The method as claimed in claim 54, wherein the passphrase is accompanied with a token key identifying the authority unit or the controller unit to the network protocol stack, and req/ack which is a request of an action within a session.