Methods, systems, and computer readable media for providing access network protocol interworking and authentication proxying

• US 9,668,134 B2
• Filed: 08/14/2015
• Issued: 05/30/2017
• Est. Priority Date: 08/14/2015
• Status: Active Grant

• Current Assignee: Oracle International Corporation (Oracle Corporation)
• Original Assignee: Oracle International Corporation (Oracle Corporation)
• Inventors: McCann, Thomas Matthew
• Primary Examiner(s): Patel, Nimesh
• Application Number:
  US14/827,015
• Publication Number:
  US 20170048703A1
• Time in Patent Office: 655 Days
• CPC Class Codes: H04L 61/503 using an authentication, authorisation and accounting [AAA] protocol, e.g. remote authentication dial-in user service [RADIUS] or Diameter
• CPC Class Codes: H04L 63/0884 by delegation of authentication, e.g. a proxy authenticates an entity to be authenticated on behalf of this entity vis-à-vis an authentication entity
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems

Abstract

The subject matter described herein includes methods, systems, and computer readable media for access network protocol interworking and authentication proxying. One method includes receiving an authentication request from a node in an access network for authenticating a user using cellular network authentication. The method further includes, in response to the request, using a native protocol of the cellular network to obtain an authentication challenge from a node in the cellular network. The method further includes communicating the authentication challenge to the node in the access network. The method further includes receiving a response to the authentication challenge from the node in the access network. The method further includes determining whether the response matches an expected response. The method further includes, in response to determining that the response matches the expected response, communicating an indication of successful authentication to the node in the access network.

Claims

1. A method for access network protocol interworking and authentication proxying comprising:

in a Diameter signaling router (DSR) including at least one processor;

receiving, from a remote authentication dial in user service (RADIUS) client in an access network that supports extensible authentication protocol (EAP) authentication, a RADIUS access request message with an EAP payload;

using a native protocol of a cellular network to obtain authentication challenge information from the cellular network, wherein the native protocol comprises Diameter and wherein using the native protocol comprises sending a first Diameter message to a home subscriber server (HSS) supporting Diameter authentication;

receiving, from the HSS, a second Diameter message including the authentication challenge information;

storing state information for determining an expected response to the authentication challenge information;

communicating the authentication challenge information to the RADIUS client in the access network by transmitting a RADIUS access challenge message to the RADIUS client;

receiving an authentication response from the RADIUS client in the access network;

determining whether the authentication response matches the expected response using the stored state information; and

in response to determining that the authentication response matches the expected response, sending a message to the RADIUS client in the access network indicating successful authentication.

2. The method of claim 1 wherein the first Diameter message comprises a Diameter S6a message.

3. The method of claim 1 wherein the first Diameter message comprises a Diameter SWx message.

4. A system for interworking and authentication proxying, the system comprising:

a Diameter signaling router (DSR) including at least one message processor;

an authentication and internetworking proxy implemented by the at least one message processor and configured for;

receiving, from a remote authentication dial in user service (RADIUS) client in an access network that supports extensible authentication protocol (EAP) authentication, a RADIUS access request message with an EAP payload;

using a native protocol of a cellular network to obtain authentication challenge information from the cellular network, wherein the native protocol comprises Diameter and wherein using the native protocol comprises sending a first Diameter message to a home subscriber server (HSS) supporting Diameter authentication;

receiving, from the HSS, a second Diameter message including the authentication challenge information;

storing state information for determining an expected response to the authentication challenge information;

communicating the authentication challenge information to the RADIUS client in the access network by transmitting a RADIUS access challenge message to the RADIUS client;

receiving an authentication response from the RADIUS client in the access network;

determining whether the authentication response matches the expected response using the stored state information; and

in response to determining that the authentication response matches the expected response, sending a message to the RADIUS client in the access network indicating successful authentication.

5. The system of claim 4 wherein the Diameter message comprises a Diameter S6a message.

6. The system of claim 4 wherein the Diameter message comprises a Diameter SWx message.

7. A non-transitory computer readable medium having stored thereon executable instructions that when executed by the processor on a computer control the computer to perform steps comprising:

receiving, from a remote authentication dial in user service (RADIUS) client in an access network that supports extensible authentication protocol (EAP) authentication, a RADIUS access request message with an EAP payload;

using a native protocol of a cellular network to obtain authentication challenge information from the cellular network, wherein the native protocol comprises Diameter and wherein using the native protocol comprises sending a first Diameter message to a home subscriber server (HSS) supporting Diameter authentication;

receiving, from the HSS, a second Diameter message including the authentication challenge information;

storing state information for determining an expected response to the authentication challenge information;

communicating the authentication challenge information to the RADIUS client in the access network by transmitting a RADIUS access challenge message to the RADIUS client;

receiving an authentication response from the RADIUS client in the access network;

determining whether the authentication response matches the expected response using the stored state information; and

in response to determining that the authentication response matches the expected response, sending a message to the RADIUS client in the access network indicating successful authentication.