Cross access login controller

• US 9,807,098 B2
• Filed: 12/07/2016
• Issued: 10/31/2017
• Est. Priority Date: 11/17/2010
• Status: Active Grant

• Current Assignee: Ruckus IP Holdings LLC
• Original Assignee: Ruckus Wireless, Inc. (CommScope Holding Company, Inc.)
• Inventors: Givoni, Doron, Pogorelik, Oleg
• Primary Examiner(s): To, Baotran N
• Application Number:
  US15/371,797
• Publication Number:
  US 20170085571A1
• Time in Patent Office: 328 Days
• Field of Search: 726 2, 726 3, 726 5
• CPC Class Codes: G06F 2221/2111 Location-sensitive, e.g. geographical location, GPS
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04L 63/0876 based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H05K 999/99 dummy group

Abstract

Systems and methods here may be used for authorizing network access including using by a server computer with a processor and memory, for receiving, through the gateway support node, a request to access the first network associated with the gateway support node from a client device, wherein the request includes a client device identifier, sending a validation request of the client device identifier to the data storage server, receiving a validation response based on previously registered client device identifier information and previously registered credential information from a second network, from the data storage server and sending authorization approval to the gateway support node for the client device access request to the first network.

Claims

1. A method of authorizing network access, comprising:

by a server computer with a processor and memory, the server computer in communication with a data storage server, and a gateway support node associated with a first network, the server computer processor,

receiving, through the gateway support node, a request to access the first network associated with the gateway support node from a client device,

wherein the request includes a client device identifier;

sending a validation request of the client device identifier to the data storage server;

receiving a validation response from the data storage server,

wherein the validation response is based on previously registered client device identifier information and previously registered credential information from a second network;

if the validation response is positive,

receiving the previously registered credentials associated with the client device identifier from the data storage server; and

sending authorization approval to the gateway support node for the client device access request to the first network;

if the validation response is negative,

directing the client device to a login portal for input of new credentials.

2. The method of claim 1 wherein,

if the validation response is negative,

sending the client device a secret code, via the second network;

receiving a transmitted code from the client device; and

if the received transmitted code is the same as the sent secret code,

sending authorization approval to the gateway support node for the client device access to the first network.

3. The method of claim 1 further, by the server computer processor,

receiving, through the login portal, the new credentials;

sending a validation request of the new credentials to an authentication server;

receiving a validation response from the authentication server;

if the validation response is positive,

sending authorization approval to the gateway support node for the client device access request to the first network; and

causing storage of the new credentials in the data storage server and correlation between the new credentials and the client device identifier.

4. The method of claim 2, wherein the second network is a cellular network.

5. The method of claim 4 wherein the sending the client device the secret code is by short message service (SMS).

6. The method of claim 1 wherein the first network is Wi-Fi network.

7. The method of claim 4 wherein the sending the client device the secret code is by email.

8. The method of claim 1 wherein the client device identifier is at least one of, a medium access control (MAC) address, or an internet protocol (IP) number.

9. The method of claim 1 wherein, the previously registered client device identifier information and previously registered credential information from a second network are user registered information associated with a service provider account.

10. The method of claim 1 wherein the data storage server is a distributed database with a centralized interface.

11. The method of claim 1 further, by the server computer processor,

directing the client device to the login portal for re-verification of credentials.

12. The method of claim 1 further, by the server computer processor,

directing the client device to the login portal for update of client details.

13. The method of claim 1 wherein the request to access the first network includes an access elementID.

14. The method of claim 13 further, by the server computer processor,

sending the received access elementID from the first network to a unified location manager;

receiving a location of the client device from unified location manager.

15. The method of claim 14 further, by the server computer processor,

receiving an access elementID from the second network for the client device;

sending the received access elementID from the second network to the unified location manager;

receiving, from the unified location manager a location of the client device based on the elementID from the first network and a location of the client device based on the elementID from the second network;

comparing the two received locations of the client device; and

if the two received locations of the client device are outside a threshold distance, sending an invalidation to the gateway support node for the client device access request to the first network.

16. A non-transitory computer-readable medium having computer-executable instructions thereon for a method of authenticating a client device, the method comprising:

by a server computer with a processor and memory, the server computer in communication with a data storage server, and a gateway support node associated with a first network, the server computer processor,

receiving, through the gateway support node, a request to access the first network associated with the gateway support node from a client device,

wherein the request includes a client device identifier;

sending a validation request of the client device identifier to the data storage server;

receiving a validation response from the data storage server,

wherein the validation response is based on previously registered client device identifier information and previously registered credential information from a second network;

if the validation response is positive,

receiving the previously registered credentials associated with the client device identifier from the data storage server; and

sending authorization approval to the gateway support node for the client device access request to the first network.

17. The non-transitory computer readable medium of claim 16 wherein the first network utilizes a first network protocol and the second network utilizes a second network protocol.

18. The non-transitory computer readable medium of claim 16 wherein the client device identifier is a medium access control (MAC) address.

19. A system for authorizing network access, comprising:

a server computer with a processor and memory, the server computer in communication with a data storage server, and a gateway support node associated with a first network, the server computer processor, the server computer to,

receive, through the gateway support node, a request to access the first network associated with the gateway support node from a client device,

wherein the request includes a client device identifier;

send a validation request of the client device identifier to the data storage server;

receive a validation response from the data storage server,

wherein the validation response is based on previously registered client device identifier information and previously registered credential information from a second network;

if the validation response is positive,

receive the previously registered credentials associated with the client device identifier from the data storage server; and

send authorization approval to the gateway support node for the client device access request to the first network.

20. The system of claim 19 wherein the first network is a Wi-Fi network and the second network is a cellular network.