Cross access login controller

• US 9,548,983 B2
• Filed: 06/08/2015
• Issued: 01/17/2017
• Est. Priority Date: 11/17/2010
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: Ruckus Wireless, Inc. (CommScope Holding Company, Inc.)
• Inventors: Givoni, Doron, Pogorelik, Oleg
• Primary Examiner(s): To, Baotran N
• Application Number:
  US14/733,333
• Publication Number:
  US 20150271182A1
• Time in Patent Office: 589 Days
• Field of Search: 726/2, 726/3, 726/5
• US Class Current: 1/1
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H05K 999/99 dummy group

Abstract

Systems and methods here may be used for authorizing network access including using a flow controller server in communication with a first gateway associated with a first network, a second gateway associated with a second gateway, and a repository, the flow controller server configured to, receive a first client device request to access the first network via the first gateway, receive a second client device request to access the second network via the second gateways, retrieve a validation response from the repository, wherein the validation response includes correlated client device identifier with client device credentials for the first network and second network.

Claims

1. A system for authorizing network access, the system comprising,

a flow controller server having a processor and a memory in communication with a gateway, the gateway associated with a network, and a repository, the processor of the flow controller server configured to,

receive a request from a client device via the gateway to access the network, the request including credentials and a client device identifier;

send a validation request to the repository;

receive a validation response from the repository;

if the validation response is positive,

cause storage, in the repository, of the credentials;

cause correlation of the credentials and a previously stored credentials of the client device from a different network in the repository with a stored client device identifier; and

send authorization approval to the gateway for the client device access request to the network.

2. The system of claim 1 wherein the flow controller server is further in communication with a Unified Location Manager (ULM), the ULM being configured to store information about network access elements and geographic locations.

3. The system of claim 2 wherein the network access geographic locations includes geographical locations of transmitters of the respective network and different network.

4. The system of claim 2 wherein the ULM is further configured to locate a geographical location of the client device upon receipt of a request to access a network.

5. The system of claim 4 wherein the ULM location of the client device includes comparing a first position of the client device received from the network and a second position of the client device received from the different network.

6. The system of claim 5 wherein the ULM is further configured to send a validation message to the flow controller server if the comparison of the first position from the network and the second position from the different network is within a validation threshold.

7. The system of claim 2 wherein the access request includes an access element identification used by the ULM to determine a client device location.

8. The system of claim 1 wherein the client identification is at least one of, a medium access control (MAC) address, an internet protocol (IP) number, a port number, and a mobile station international subscriber directory number (MSISDN).

9. The system of claim 1 wherein, if the validation response is negative,

send the client device a secret code, via the different network;

receive a transmitted code from the client device; and

if the received transmitted code is the same as the sent secret code,

send authorization approval to the gateway for the client device access to the network; and

cause storage, in the repository, of the credentials and the identifier of the client device.

10. The system of claim 9 wherein the sending of the secret code is via short message service (SMS).

11. The system of claim 9 wherein the sending of the secret code is via email.

12. The system of claim 9 wherein the received code is received via an authentication portal.

13. The system of claim 1 wherein the network utilizes a first network protocol and the different network utilizes a second network protocol.

14. The system of claim 13 wherein the first network protocol is a Wifi network protocol.

15. The system of claim 13 wherein the second network protocol is a cellular based network protocol.

16. A method for authorizing network access, the method comprising,

via a flow controller server in communication with a gateway, the gateway associated with a network, and a repository,

receiving a request from the client device via the gateway to access the network, the request including credentials and a client device identifier;

sending a validation request to the repository;

receiving a validation response from the repository;

if the validation response is positive,

causing storage, in the repository, of the credentials;

causing correlation of the credentials and a previously stored credentials of the client device from a different network in the repository with a stored client device identifier; and

sending authorization approval to the gateway for the client device access request to the network.

17. The method of claim 16 wherein, if the validation response is negative,

sending the client device a secret code, via the different network;

receiving a code via the different network; and

if the received code is the same as the sent secret code,

sending authorization approval to the gateway for the client device access to the network; and

causing storage, in the repository, of the credentials and the identifier of the client device.

18. The method of claim 17 wherein the sending of the secret code is via short message service (SMS).

19. The method of claim 17 wherein the sending of the secret code is via email.

20. The method of claim 17 wherein the received code is received via an authentication portal.

21. The system of claim 16 wherein the network utilizes a first network protocol and the different network utilizes a second network protocol.

22. The system of claim 21 wherein the second network protocol is a cellular based network protocol.

23. The system of claim 21 wherein the first network protocol is a WiFi network protocol.

24. A method for authorizing network access, the method comprising,

via a flow controller server in communication with a first gateway associated with a first network, a second gateway associated with a second network, and a repository,

receiving a first request, from a client device via the first gateway, to access the first network, the first request including first credentials and a client device identifier;

sending a first validation request of the first credentials to the repository;

receiving a first validation response of the first credentials from the repository;

if the first validation response is positive,

causing storage, in the repository, of the first credentials and the client device identifier; and

sending authorization approval to the first gateway for the client device access request to the first network; and

receiving a second request from the client device via the second gateway to access the second network, the second request including second credentials and the client device identifier;

sending a second validation request of the second credentials to the repository;

receiving a second validation response of the second credentials from the repository;

if the second validation response is positive,

causing storage, in the repository, of the second credentials;

causing correlation of the first credentials and the second credentials in the repository with the stored client device identifier; and

sending authorization approval to the second gateway for the client device access request to the second network.