Flexible wlan access point architecture capable of accommodating different user devices

• US 20060179475A1
• Filed: 03/12/2004
• Published: 08/10/2006
• Est. Priority Date: 03/14/2003
• Status: Active Grant

• Current Assignee: Tranquility IP LLC (IP Edge LLC)
• Original Assignee: Thomson Licensing SA (Vantiva SA)
• Inventors: Mathur, Saurabh, Zhang, Junbiao
• Granted Patent: US 8,272,037 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/205 involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved negotiation of communication capabilities H04L69/24
• CPC Class Codes: H04L 67/02 based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/303 Terminal profiles
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04L 69/08 Protocols for interworking; Protocol conversion
• CPC Class Codes: H04L 69/18 Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 48/14 using user query or user detection
• CPC Class Codes: H04W 80/00 Wireless network protocols or protocol adaptations to wireless operation
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/10 adapted for operation in multiple networks, e.g. multi-mode access points

Abstract

The invention provides an apparatus and a method for improving the control of access by a terminal device in a WLAN environment having an access point for determining whether the device utilizes an IEEE 802.1x protocol by the access point communicating to the device, a packet, whereby if the devices utilizes a IEEE 802.1x protocol the device appropriately responds and otherwise the access point determines that the terminal device protocol does not employ a IEEE 802.1x protocol and selects an authentication mechanism compatible with the terminal device. If the device is not an IEEE 802.1x client, an IP packet filtering is configured to redirect a user HTTP request to a local server, and when the HTTP requests are thereby redirected, the HTTP server presents the terminal device with information specifically related to the browser based authentication.

Claims

1. A method for controlling access by a user terminal to a communications network comprising the steps of:

receiving from the user terminal a request to access the communications network;

transmitting to the user terminal an identity request message;

receiving from the user terminal, if the user terminal utilizes a predetermined authentication protocol, a response to the identity request message;

determining whether the user terminal uses the predetermined authentication protocol in response to the response to the identity request message;

selecting an authentication mechanism compatible with the user terminal upon determining the user terminal is not compatible with the predetermined authentication protocol, for allowing user terminal access to the communications.

2. The method according to claim 1, wherein the user terminal comprises a mobile terminal and the communications network comprises a wireless local area network wireless local area network that complies with the IEEE 802.11 standards.

3. The method according to claim 2, wherein the selecting step includes selecting an appropriate authentication server coupled to the wireless local area network in response to the determination.

4. A method for controlling mobile terminal access to a wireless local area network, comprising the steps of:

receiving from the mobile terminal a request to access the wireless local area network;

transmitting to the mobile terminal an identity request message;

receiving from the mobile terminal, if the mobile terminal utilizes an IEEE 802.1x protocol, a response to the identity request message;

determining whether the mobile terminal is IEEE 802.1x compliant in response to the response to the identity request message; and

selecting an authentication mechanism, compatible with the mobile terminal in response to the determination, for allowing user mobile terminal access to the wireless local area network.

5. The method according to claim 4, further comprising the steps of, if the mobile terminal is IEEE 802.1x compliant, transmitting an authentication request to an authentication server and receiving an authentication response utilizing the IEEE 802.1x protocol, and controlling mobile terminal access to the wireless local area network in response to the authentication response.

6. The method according to claim 4, further comprising the steps of, if the mobile terminal is not IEEE 802.1x compliant, redirecting an authentication request to an HTTP server for utilizing a browser based authentication.

7. The method according to claim 6, further comprising the step of configuring a packet filtering module to redirect the authentication request to the HTTP server.

8. The method according to claim 7, further comprising the step of maintaining state information in the wireless local area network for use by the packet filtering module and the HTTP server.

9. The method according to claim 8, wherein the state information includes one of a first state indicative of ongoing authentication process, a second state indicative of authentication failure, a third state indicative of authentication success, and a fourth state indicative of a non IEEE 802.1x mobile terminal.

10. An access point in communication with a terminal device in a wireless local area network, comprising:

a means to determine whether the terminal device utilizes an IEEE 802.1x protocol and, if the terminal does not utilize said protocol, then the access point employing an authentication means compatible with the terminal device otherwise the access point employing an IEEE 802.1x protocol.

11. The access point in claim 10, wherein the means to determine includes communicating to the terminal device a Request-Identity extensible authentication protocol packet and if the mobile terminal utilizes the IEEE 802.1x protocol the access receives a Response-Identity extensible authentication protocol packet.

12. The access point in claim 11, further comprises the means to configure an internet protocol packet filtering to redirect the device HTTP request to a local server if the terminal device does not utilize said protocol.

13. The access point in claim 10, further comprises means to communicate IEEE 802.1x protocol exchanges and means to establish internet protocol packet filtering through an internet protocol filter module and state information for the HTTP server to control the terminal device access during and after IEEE 802.1x based authentication process if the access point detects that the terminal device is an IEEE 802.1x client.

14. A method for controlling access by a terminal device in a wireless local area network by determining whether the terminal device utilizes an IEEE 802.1x protocol comprising the steps of:

an access point communicating to the mobile terminal a request to identify, and if the terminal device utilizes an IEEE 802.1x protocol, acknowledging the request to identify, otherwise the access point determining that the terminal is not IEEE 802.1x compliant and selecting an authentication mechanism compatible with the mobile terminal.

15. The method according to claim 14, wherein the access point determines that the terminal is not IEEE 802.1x compliant when it does not receive an extensible authentication protocol identity response packet after a timeout value.

16. The method according to claim 15, further comprising the step of access point detecting that if the terminal device is not IEEE 802.1x compliant, then configuring an internet protocol packet filter and redirecting a user HTTP request to a local server.

17. The method according to claim 16, further comprising the step of the local server communicating to the terminal device information specifically related to a browser based authentication.

18. The method according to claim 17, further comprising the step of the access point transitioning to a state if the terminal device utilizes the IEEE 802.1x protocol that indicates that the terminal device is IEEE 802.1x compliant and thereafter processing all communication utilizing the IEEE 802.1x protocol.

19. The method according to claim 17, further comprising the step of the access point transitioning to a state corresponding to browser based authentication if the authentication process fails.

20. The method according to claim 14, further comprising the step of the access point transitioning to a state corresponding to browser based authentication if the terminal device is not IEEE 802.1x compliant.

21. A method for controlling access of a terminal device in a wireless local area network by determining whether the terminal device utilizes an IEEE 802.1x protocol comprising the steps of:

communicating through the an access point to the mobile terminal a request to identify, and if the terminal device utilizes an IEEE 802.1x protocol, acknowledging the request to identify, otherwise determining by the access point that the terminal is not IEEE 802.1x compliant and selecting an authentication mechanism compatible with the terminal.

22. The method according to claim 21, further comprising the step of deter-mining in the access point that terminal is not IEEE 802.1x compliant if it does not receive an extensible authentication protocol identity response packet after a preset time.

23. The method according to claim 21, further comprising the step of detecting in the access point that if the terminal device is not IEEE 802.1x compliant, then configuring an internet protocol packet filter and redirecting a user HTTP request to a local server.

24. The method according to claim 23, further comprising the step of communicating from the local server to the terminal device, information specifically related to a browser based authentication.

25. The method according to claim 21, further comprising the step of transitioning to a state in the access point if the terminal device utilizes the IEEE 802.1x protocol that indicates that the terminal device is IEEE 802.1x compliant and thereafter processing all communication utilizing the IEEE 802.1x protocol.

26. The method according to claim 25, further comprising the step of transitioning to a state in the access point corresponding to browser based authentication if the authentication process fails.

27. The method according to claim 21, further comprising the step of transitioning to a state in the access point corresponding to browser based authentication if the terminal device is not IEEE 802.1x compliant.