Systems and methods for user access authentication based on network access point

• US 20070271598A1
• Filed: 05/16/2006
• Published: 11/22/2007
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Yu, Yang, Chiong, John
• Granted Patent: US 8,151,322 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G11C 7/24 Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 12/73 Access point logical identity

Abstract

Systems and methods of authenticating user access based on an access point to a secure data network include a secure data network having a plurality of a network access points serving as entry points for a user to access the secure data network using a user device. The user is associated with a user identity, each network access point with a network access point identity. The user uses a user device to send an access request, requesting access to the secure data network, to the network access point, which then sends an authentication request to an identity server. The identity server processes the authentication request, by validating the combination of the user identity and the network access point identity, and responds with an authentication response, granting or denying access, as communicated to the user device via an access response. The secure data network may comprise an application level secure data network, in which the user uses the user device to request access to a network application. Furthermore, the identity server may validate the combined user identity and network access point identity data in conjunction with time information, access allowance data, and/or traffic volume data.

Claims

1. A method of user access authentication, the method comprising:

receiving an authentication request;

determining whether to grant a user device access to a secure data network via a network access point; and

,

responding to the authentication request with an authentication response indicating whether the user device is granted access to the secure data network via the network access point;

wherein whether to grant the user device access is determined in light of at least two data points, the at least two data points comprising a user identity provided by the user device and a network access point identity associated with the network access point; and

wherein the network access point is one of a plurality of network access points.

2. The method of claim 1 further comprising:

receiving at the network access point an access request from the user device;

generating the authentication request in response to receiving the access request;

sending the authentication request from the network access point to an identity server for processing;

processing the authentication request to determine whether to grant the user device access to a secure data network via the network access point; and

sending the authentication response from the identity server to the network access point.

3. The method of claim 2 further comprising:

sending an access response from the network access point to the user device.

4. The method of claim 2:

wherein the access request includes the user identity; and

wherein the network access point obtains the user identity from the access request.

5. The method of claim 2 wherein:

the network access point obtains the user identity from a source other than the access request.

6. The method of claim 1:

wherein the authentication request includes the user identity; and

wherein the determining is done by an identity server obtaining the user identity from the authentication request.

7. The method of claim 1:

wherein the authentication request includes the network access point identity; and

wherein the determining is done by an identity server obtaining the network access point identity from the authentication request.

8. The method of claim 1 wherein:

the determining is done by an identity server obtaining the network access point identity from a source other than the authentication request.

9. The method of claim 1 wherein:

the determining is done by an identity server including a datastore having information corresponding to a plurality of valid pairs of user identity and network access point identity entries.

10. The method of claim 9 wherein:

processing the authentication request includes attempting to match the user identity and the network access point identity with one of the plurality of valid pairs of user identity and network access point identity entries.

11. The method of claim 10 wherein:

the authentication response indicates that the user device is granted access to the secure data network via the network access point if the identity server matches the user identity and the network access point identity with one of the plurality of valid pairs of user identity and network access point identity entries.

12. The method of claim 1 wherein:

the secure data network includes an application level secure data network.

13. The method of claim 12 wherein:

the access request seeks access to a network application.

14. The method of claim 13 further comprising:

determining that access to the network application is sought.

wherein the network access point determines that access to the network application is sought.

15. The method of claim 13 wherein:

the network application includes an enterprise application;

an employee benefit application;

a human resources application;

an inventory information application;

a library system;

a conference workshop application;

a live concert webcast;

a hotel television over IP application;

or a web application.

16. The method of claim 1:

wherein the plurality of network access points includes a first network access point and a second network access point;

wherein the network access point identity is one of a plurality of network access point identities including a first network access point identity and a second network access point identity;

wherein the first network access point is associated with the first network access point identity, and the second network access point is associated with second network access point identity;

wherein the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application; and

wherein the user identity combined with the second network access point identity results in a determination not to grant the user device access to the network application.

17. The method of claim 16:

wherein the authentication request travels along a communication path including the first network access point and the second network access point;

wherein the authentication request logs the first network access point identity;

wherein the authentication request logs the second network access point identity;

wherein the at least two data points further comprise the first network access point identity and the second network access point identity; and

wherein the user identity combined with the first network access point identity and the second network access point identity results in a determination not to grant the user device access to the network application.

18. The method of claim 1 wherein:

the at least two data points further comprise at least one additional data point.

19. The method of claim 18 wherein:

the at least one additional data point includes at least one of a time data point, an access allowance data point, and a traffic volume data point.

20. The method of claim 1:

wherein the secure data network includes at least one of an Internet Protocol (IP) network;

a Local Area Network (LAN);

a Wide Area Network (WAN);

a wireless network;

a WiFi network;

a General Packet Radio Service (GPRS) network;

a public IP network; and

a private IP network;

wherein the user device includes at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network;

wherein the user identity includes at least one of a user name;

an identity of user device;

a Media Access Control (MAC) address;

an Internet Protocol (IP) address and port number;

a device serial number;

subscriber information in a subscriber identity module (SIM) card;

subscriber information in a Universal Subscriber Identity Module (USIM) card;

a telephone number;

security information;

a password;

a security code;

a secret answer to a security question;

biometric characteristics;

fingerprint data, eye retinal data, eye iris data voice pattern recognition data; and

signature recognition data;

wherein the network access point includes at least one of a firewall;

a wireless access point;

a Dynamic Host Configuration Protocol (DHCP) server;

a Remote Access Server (RAS);

a Broadband Remote Access Server (BRAS);

a web server;

a secure web server;

a virtual private network (VPN) server;

a termination point of an access tunnel;

a termination point of a virtual private network (VPN) tunnel;

a termination point of a Generic Routing Encapsulation (GRE) tunnel; and

a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and

wherein the network access point identity includes at least one of a network access point name;

an IP address;

a port number;

security information;

a password;

a security code;

a device name;

a machine identity;

a serial number;

an identity of an access tunnel termination point; and

an Access Point Name (APN).

21. A system of user access authentication, the system comprising:

a secure data network having a plurality of network access points;

a network access point selected from the plurality of network access points;

an identity server in communication with the secure data network via the network access point,

wherein the identity server processes an authentication request, sent by the network access point, based on an access request received by the network access point from a user device controlled by a user;

wherein the identity server determines whether to grant the user device access to the secure data network via the network access point in light of at least two data points, the at least two data points comprising a user identity associated with the user and a network access point identity associated with the network access point; and

,

wherein the identity server responds to the authentication request with an authentication response sent to the network access point indicating whether the user device is granted access to the secure data network via the network access point;

22. The system of claim 21, further comprising:

an authentication request engine at the network access point, the authentication request engine capable of generating the authentication request based on the access request received by the network access point; and

an access response engine at the network access point, the access response engine capable of generating the access response based on the authentication response received by the network access point.

23. The system of claim 21, wherein:

the identity server includes a datastore and a validation matching engine; and

wherein the datastore includes information corresponding to a plurality of valid pairs of user identity and network access point identity entries;

wherein the validation matching engine attempts to match the user identity and the network access point identity with one of the plurality of valid pairs of user identity and network access point identity entries; and

,

wherein the authentication request indicates that the user device is granted access to the secure data network via the network access point if the identity server matches the user identity and the network access point identity with one of the plurality of valid pairs of user identity and network access point identity entries.

24. The system of claim 21 wherein:

the secure data network includes an application level secure data network.

25. The system of claim 24 wherein:

the access request seeks access to a network application.

26. The system of claim 25 wherein:

the network access point determines that access to the network application is sought.

27. The system of claim 26 wherein:

the network application includes an enterprise application;

an employee benefit application;

a human resources application;

an inventory information application;

a library system;

a conference workshop application;

a live concert webcast;

a hotel television over IP application;

or a web application.

28. The system of claim 21:

wherein the plurality of network access points including a first network access point and a second network access point;

wherein the network access point identity is one of a plurality of network access point identities including a first network access point identity and a second network access point identity;

wherein the first network access point is associated with the first network access point identity, and the second network access point is associated with second network access point identity;

wherein the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application; and

wherein the user identity combined with the second network access point identity results in a determination not to grant the user device access to the network application.

29. The system of claim 28:

wherein the authentication request travels along a communication path including the first network access point and the second network access point;

wherein the authentication request logs the first network access point identity;

wherein the authentication request logs the second network access point identity;

wherein the at least two data points further comprise the first network access point identity and the second network access point identity; and

wherein the user identity combined with the first network access point identity and the second network access point identity results in a determination not to grant the user device access to the network application.

30. The system of claim 21 wherein:

the at least two data points further comprise at least one additional data point.

31. The system of claim 30 wherein:

the at least one additional data point includes at least one of a time data point, an access allowance data point, and a traffic volume data point.

32. The system of claim 21:

wherein the secure data network includes at least one of an Internet Protocol (IP) network;

a Local Area Network (LAN);

a Wide Area Network (WAN);

a wireless network;

a WiFi network;

a General Packet Radio Service (GPRS) network;

a public IP network; and

a private IP network;

wherein the user device includes at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network;

wherein the user identity includes at least one of a user name;

an identity of user device;

a Media Access Control (MAC) address;

an Internet Protocol (IP) address and port number;

a device serial number;

subscriber information in a subscriber identity module (SIM) card;

subscriber information in a Universal Subscriber Identity Module (USIM) card;

a telephone number;

security information;

a password;

a security code;

a secret answer to a security question;

biometric characteristics;

fingerprint data, eye retinal data, eye iris data voice pattern recognition data; and

signature recognition data;

wherein the network access point includes at least one of a firewall;

a wireless access point;

a Dynamic Host Configuration Protocol (DHCP) server;

a Remote Access Server (RAS);

a Broadband Remote Access Server (BRAS);

a web server;

a secure web server;

a virtual private network (VPN) server;

a termination point of an access tunnel;

a termination point of a virtual private network (VPN) tunnel;

a termination point of a Generic Routing Encapsulation (GRE) tunnel; and

a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and

wherein the network access point identity includes at least one of a network access point name;

an IP address;

a port number;

security information;

a password;

a security code;

a device name;

a machine identity;

a serial number;

an identity of an access tunnel termination point; and

an Access Point Name (APN).