Method for post-authenticating user equipment, controller and network system

• US 9,532,304 B1
• Filed: 12/28/2015
• Issued: 12/27/2016
• Est. Priority Date: 06/24/2015
• Status: Active Grant

• Current Assignee: National Chiao Tung University (Government of The Republic of China), Industrial Technology Research Institute
• Original Assignee: National Chiao Tung University (Government of The Republic of China), Industrial Technology Research Institute
• Inventors: Lin, Yi-Hao, Ou, Shang-Chun, Chen, Jyh-Cheng, Yang, Jen-Shun
• Primary Examiner(s): Alam, Fayyaz
• Application Number:
  US14/979,565
• Publication Number:
  US 20160381625A1
• Time in Patent Office: 365 Days
• Field of Search: 455/432.1, 455435-4561
• US Class Current: 1/1
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 48/16 Discovering, processing access restriction or access information
• CPC Class Codes: H04W 60/04 using triggered events
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method for post-authenticating user equipment (UE), a controller and a network system are disclosed. The method includes: determining whether an external channel quality of at least one gateway is higher than a threshold when UE connects to an access point (AP) routed by the gateway; when the external channel quality is not higher than the threshold, authenticating the UE incompletely and controlling the AP to limit a network capability providing to the UE; estimating a future channel capacity of the gateway; calculating a priority weight of each UE; selecting candidate UE from the UEs according to the future channel capacity and the priority weight of each UE; arranging an authenticating mechanism for completely authenticating the candidate UE at a timing point corresponding to the future channel capacity.

Claims

1. A method for post-authenticating at least one user equipment, adapted to a controller connected to at least one gateway, comprising:

the at least one user equipment is connected to at least an access point, determining whether an external channel quality of the at least one gateway is higher than a threshold;

incompletely authenticating the at least one user equipment, and controlling the at least one access point to provide the at least one user equipment with a limited network access ability, wherein the external channel quality is not higher than the threshold;

estimating a future channel capacity of the at least one gateway;

calculating a priority weight of each user equipment of the at least one user equipment according to the user equipment'"'"'s an authentication waiting time, a number of authentication failures and at least one hop count between the at least one access point and the at least one gateway; and

selecting at least one candidate user equipment from the at least one user equipment based on the future channel capacity and the priority weight of the at least one candidate user equipment, and arranging a corresponding authentication mechanism for completely authenticating the at least one candidate user equipment at a time corresponding to the future channel capacity.

2. The method for post-authenticating the at least one user equipment of claim 1, wherein

the controller is a software-defined networking controller, and the controller, the at least one access point and the at least one gateway are configured on a train having a plurality of cars and a predictable traveling route.

3. The method for post-authenticating the at least one user equipment of claim 1, wherein estimating the future channel capacity of the at least one gateway further includes:

establishing a channel quality estimation model based on the at least one gateway and a car individual history information;

getting a current moving information of a car and estimating a future moving information of the car based on the current moving information;

estimating a future channel quality of the at least one gateway according to the future moving information and the channel quality estimation model; and

estimating the future channel capacity of the at least one gateway according to the future channel quality.

4. The method for post-authenticating the at least one user equipment of claim 1, wherein the future channel capacity at time i is:

C(i)=B×

log₂(1+SNR_i)

wherein B is a frequency range of the at least one gateway, and SNRi is a signal to noise ratio at time i.

5. The method for post-authenticating the at least one user equipment of claim 1, wherein the priority weight of an n-th user equipment of the at least one user equipment is characterized by:

P(n)=w₁×

WT+(1−

w₂^h)+(1−

w₃×

FT)

wherein w₁ to w₃ are weight values, WT is the authentication waiting time of the n-th user equipment, h is the at least one hop count between the at least one access point and the at least one gateway serving for the n-th user equipment, FT is the number of the authentication failures for the n-th user equipment.

6. The method for post-authenticating the at least one user equipment of claim 1, wherein selecting the at least one candidate user equipment from the at least one user equipment based on the future channel capacity and the priority weight of the at least one candidate user equipment further includes:

sorting the at least one user equipment in a descending order according to the priority weight of the each user equipment;

calculating a specific number based on the future channel capacity and an authentication information size, wherein the specific number is the future channel capacity divided by the authentication information size; and

selecting the specific number of at least one user equipment having a higher priority weight as that of the at least one candidate user equipment.

7. The method for post-authenticating the at least one user equipment of claim 1, wherein the at least access point further includes a first port connecting to the at least one user equipment incompletely authenticated, and the first port provides the limited network access ability to the at least one user equipment incompletely authenticated.

8. The method for post-authenticating the at least one user equipment of claim 7, wherein the at least one access point further includes a second port connected to an authentication server, and arranging the corresponding authentication mechanism for completely authenticating the at least one candidate user equipment at the time corresponding to the future channel capacity further includes:

switching the connecting from the first port to the second port at the time i by a control protocol, and the authentication server completely authenticates the at least one candidate user equipment through the second port.

9. The method for post-authenticating the at least one user equipment of claim 1, wherein the at least one access point includes a specific access point having a first port, and the first port provides the limited network access ability to the at least one user equipment which is incompletely authenticated and connected to the first port.

10. The method for post-authenticating the at least one user equipment of claim 9, wherein the specific access point further includes a second port connected to an authentication server, and arranging the corresponding authentication mechanism for completely authenticating the at least one candidate user equipment at the time corresponding to the future channel capacity further includes:

switching the connecting from the first port to the second port at the time, and the authentication server completely authenticates the at least one candidate user equipment through the second port.

11. The method for post-authenticating the at least one user equipment of claim 1, wherein arranging the corresponding authentication mechanism for completely authenticating the at least one candidate user equipment further includes:

wherein authenticating the at least one candidate user equipment is finished, and the at least one access point provides an unlimited network access capability to the at least one candidate user equipment.

12. A controller, comprising:

a storage unit, storing multiple modules; and

a processing unit, connected to the storage unit, accessing and executing the multiple modules, the multiple modules include;

a determining module, determining whether an external channel quality of at least one gateway is higher than a threshold, wherein at least one user equipment is connected to at least one access point through the at least one gateway;

a controlling module, incompletely authenticating the at least one user equipment, wherein the external channel quality is not higher than the threshold, and controlling the at least one access point to provide the at least one user equipment with a limited network access ability;

an estimating module, estimating a future channel capacity of the at least one gateway;

a calculating module, calculating a priority weight of each user equipment of the at least one user equipment according to the user equipment'"'"'s an authentication waiting time, a number of authentication failures and at least one hop count between the at least one access point and at least one gateway; and

a selecting module, selecting at least one candidate user equipment from the at least one user equipment based on the future channel capacity and the priority weight of the at least one candidate user equipment, and arranging a corresponding authentication mechanism for completely authenticating the at least one candidate user equipment at a time corresponding to the future channel capacity.

13. The controller of claim 12, wherein the controller is a software-defined networking controller, and the controller, the at least one access point and the at least one gateway are configured on a train having a plurality of cars and a predictable traveling route.

14. The controller of claim 12, wherein the estimating module further includes:

to establish a channel quality estimation model based on the at least one gateway and a car individual history information;

to get a current moving information of a car and estimating a future moving information of the car based on the current moving information;

to estimate a future channel quality of the at least one gateway according to the future moving information and the channel quality estimation model; and

to estimate the future channel capacity of the at least one gateway according to the future channel quality.

15. The controller of claim 12, wherein the future channel capacity at time i is:

C(i)=B×

log₂(1+SNR_i)

wherein B is a frequency range of the at least one gateway, and SNRi is a signal to noise ratio at time i.

16. The controller of claim 12, wherein the priority weight of an n-th user equipment of the at least one user equipment is characterized by:

P(n)=w₁×

WT+(1−

w₂^h)+(1−

w₃×

FT)

wherein w₁ to w₃ are weight values, WT is the authentication waiting time of the n-th user equipment, h is the at least one hop count between the at least one access point and the at least one gateway serving for the n-th user equipment, FT is the number of the authentication failures for the n-th user equipment.

17. The controller of claim 12, wherein the controller module further includes:

to sort the at least one user equipment in a descending order according to the priority weight of the each user equipment;

to calculate a specific number based on the future channel capacity and an authentication information size, wherein the specific number is the future channel capacity divided by the authentication information size; and

to select the specific number of at least one user equipment having a higher priority weight as that of the at least one candidate user equipment.

18. The controller of claim 12, wherein the at least access point further includes a first port connecting the at least one user equipment incompletely authenticated, and the first port provides the limited network access ability to the at least one user equipment incompletely authenticated.

19. The controller of claim 18, wherein the at least one access point further includes a second port connected to an authentication server, and the selecting module is configured to:

switch the connecting from the first port to the second port at the time by a control protocol, and the authentication server completely authenticates the at least one candidate user equipment through the second port.

20. The controller of claim 12, wherein the at least one access point includes a specific access point having a first port, and the first port provides the limited network access ability to the at least one user equipment incompletely authenticated and connecting the first port.

21. The controller of claim 20, wherein the specific access point further include a second port connected to an authentication server, and the selecting module is configured to:

switch the connecting from the first port to the second port at the time, and the authentication server authenticates the at least one candidate user equipment completely through the second port.

22. The controller of claim 12, wherein the selecting module is further configured to:

provide, by the at least one access point, an unlimited network access capability to the at least one candidate user equipment, wherein authenticating the at least one candidate user equipment is finished.

23. A network system, comprising:

at least one gateway;

at least one access point, connected to the at least one gateway to access a network; and

a controller, connected to the at least one gateway and the at least one access point, wherein at least one user equipment is connected to the at least one access point through the at least one gateway, and the controller further including;

to determine whether an external channel quality of the at least one gateway is higher than a threshold;

to incompletely authenticate the at least one user equipment, and control the at least one access point to provide the at least one user equipment with a limited network access ability, wherein the external channel quality is not higher than the threshold;

to estimate a future channel capacity of the at least one gateway;

to calculate a priority weight of each user equipment of the at least one user equipment according to the user equipment'"'"'s an authentication waiting time, a number of authentication failures and at least one hop count between the at least one access point and at least one gateway; and

to select at least one candidate user equipment from the at least one user equipment based on the future channel capacity and the priority weight of the at least one candidate user equipment, and to arrange a corresponding authentication mechanism for completely authenticating the at least one candidate user equipment at a time corresponding to the future channel capacity.

24. The network system of claim 23, wherein the controller is a software-defined networking controller, and the controller, the at least one access point and the at least one gateway are configured on a train having a plurality of cars and a predictable traveling route.

25. The network system of claim 23, wherein the controller includes:

to establish a channel quality estimation model based on the at least one gateway and a car individual history information;

to get a current moving information of a car and estimating a future moving information of the car based on the current moving information;

to estimate to estimate a future channel quality of the at least one gateway according to the future moving information and the channel quality estimation model; and

to estimate the future channel capacity of the at least one gateway according to the future channel quality.

26. The network system of claim 23, wherein the future channel capacity at time i is:

C(i)=B×

log₂(1+SNR_i)

wherein B is a frequency range of the at least one gateway, and SNRi is a signal to noise ratio at time i.

27. The network system of claim 23, wherein the priority weight of an n-th user equipment of the at least one user equipment is characterized by:

P(n)=w₁×

WT+(1−

w₂^h)+(1−

w₃×

FT)

wherein w₁ to w₃ are weight values, WT is the authentication waiting time of the n-th user equipment, h is the at least one hop count between the at least one access point and the at least one gateway serving for the n-th user equipment, FT is the number of the authentication failures for the n-th user equipment.

28. The network system of claim 23, wherein the controller further includes:

to sort the at least one user equipment in a descending order according to the priority weight of the each user equipment;

to calculate a specific number based on the future channel capacity and an authentication information size, wherein the specific number is the future channel capacity divided by the authentication information size; and

to select the specific number of at least one user equipment having a higher priority weight as that of the at least one candidate user equipment.

29. The network system of claim 23, wherein the at least access point further includes a first port connecting the at least one user equipment incompletely authenticated, and the first port provides the limited network access ability to the at least one user equipment incompletely authenticated.

30. The network system of claim 29, wherein the at least one access point further includes a second port connected to an authentication server, and the controller is configured to:

switch the connecting from the first port to the second port at the time by a control protocol, and the authentication server completely authenticates the at least one candidate user equipment through the second port.

31. The network system of claim 23, wherein the at least one access point includes a specific access point having a first port, and the first port provides the limited network access ability to the at least one user equipment incompletely authenticated and connecting the first port.

32. The network system of claim 31, wherein the specific access point further include a second port connected to an authentication server, and the controller is configured to:

switch the connecting from the first port to the second port at the time, wherein the authentication server completely authenticates the at least one candidate user equipment through the second port.

33. The network system of claim 23, wherein the controller is configured to:

provide, by the at least one access points, an unlimited network access capability to the at least one candidate user equipment, wherein authenticating the at least one candidate user equipment is finished.