System and Method for Authenticating an Element in a Network Environment

• US 20080081592A1
• Filed: 12/03/2007
• Published: 04/03/2008
• Est. Priority Date: 12/17/2002
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Wright, Michael, Salowey, Joseph, Das, Amitava, Gossman, William
• Granted Patent: US 7,940,656 B2
• Time in Patent Office: Days
• US Class Current: 455/406
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/14 Backbone network devices
• CPC Class Codes: H04W 88/16 Gateway arrangements

Abstract

A method for authenticating an element in a network environment is provided that includes receiving a request for one or more triplets. One or more of the triplets may be associated with an authentication communications protocol that may be executed in order to facilitate a communication session. The method further includes returning one or more of the triplets in response to the request and initiating the communication session in response to the triplets after proper authentication of an entity associated with the request.

Claims

1-31. -31. (canceled)

32. An apparatus for authenticating an element in a network environment, comprising:

an authentication, authorization, and accounting (AAA) server operable to receive a request for one or more triplets from a wireless local area network (WLAN) element, one or more of the triplets being associated with an authentication communications protocol that may be executed in order to facilitate a communication session via the WLAN element, the AAA server being operable to return one or more of the triplets to the WLAN element such that the communication session is facilitated after proper authentication of an entity associated with the request, and wherein a mobile application part (MAP) gateway is operable to receive a request from the AAA server when the AAA server cannot communicate one or more requested triplets to the WLAN element, the MAP gateway being operable to in order to return one or more triplets to the WLAN element in response to the request from the AAA server.

33. The apparatus of claim 32, wherein either the MAP gateway or the AAA server is accessed to locally cache the triplets such that a home location register (HLR) is not initially involved in an authentication process for the communication session.

34. The apparatus of claim 32, wherein the MAP gateway and the AAA server are connected through an IP network and the communication session occurs in a Global System for Mobile (GSM) environment.

35. The apparatus of claim 32, wherein both the MAP gateway and the AAA server include a caching algorithm that addresses handling of the triplets, the algorithm providing direction on what is needed and what can be cached for a given access request.

36. The apparatus of claim 35, wherein the algorithm can recognize and account for a staleness parameter, which addresses security, in the given access request.

37. The apparatus of claim 32, wherein each of the AAA server and the MAP gateway include a caching algorithm operable to select one or more triplets to be communicated to the WLAN element based on criteria communicated by the WLAN element and included in the request.

38. The apparatus of claim 32, wherein the AAA server includes a cache table operable to store one or more triplets, and wherein selected triplets may be communicated to the WLAN element based on criteria included within the request for one or more of the triplets from the WLAN element, the criteria being based on parameters associated with the entity.

39. The apparatus of claim 38, wherein each of the cache tables are populated by one or more access requests received by the AAA server and the MAP gateway, the access requests being included within RADIUS flows propagating to the AAA server and the MAP gateway.

40. The apparatus of claim 32, further comprising:

a home location register (HLR) that includes a cache table, the HLR being operable to receive a request for one or more triplets from the MAP gateway when the AAA server and the MAP gateway cannot satisfy the request communicated by the WLAN element.

41. The apparatus of claim 39, wherein the HLR includes an authentication center operable to verify an identification element that is included in the request for one or more triplets from the WLAN element, the authentication center being operable to authorize communication of requested triplets when an authentication of the entity is valid.

42. A method for enlisting one or more end users in a network environment, comprising:

enlisting one or more end users in a billing plan associated with network communications;

generating a bill associated with one or more of the end users, the bill being based on the billing plan; and

facilitating network communications for one or more of the end users in response to the end users being enlisted in the billing plan, whereby the network communications includes an apparatus for authenticating an element in the network environment, comprising;

an authentication, authorization, and accounting (AAA) server operable to receive a request for one or more triplets from a wireless local area network (WLAN) element, one or more of the triplets being associated with an authentication communications protocol that may be executed in order to facilitate a communication session via the WLAN element, the AAA server being operable to return one or more of the triplets to the WLAN element such that the communication session is facilitated after proper authentication of an entity associated with the request, and wherein a mobile application part (MAP) gateway is operable to receive a request from the AAA server when the AAA server cannot communicate one or more requested triplets to the WLAN element, the MAP gateway being operable to in order to return one or more triplets to the WLAN element in response to the request from the AAA server.

43. The method of claim 42, wherein either the MAP gateway or the AAA server is accessed to locally cache the triplets such that a home location register (HLR) is not initially involved in an authentication process for the communication session.

44. The method of claim 42, wherein the MAP gateway and the AAA server are connected through an IP network and the communication session occurs in a Global System for Mobile (GSM) environment.

45. The method of claim 42, wherein both the MAP gateway and the AAA server include a caching algorithm that addresses handling of the triplets, the algorithm providing direction on what is needed and what can be cached for a given access request.

46. The method of claim 45, wherein the algorithm can recognize and account for a staleness parameter, which addresses security, in the given access request.

47. The method of claim 42, wherein each of the AAA server and the MAP gateway include a caching algorithm operable to select one or more triplets to be communicated to the WLAN element based on criteria communicated by the WLAN element and included in the request.

48. The method of claim 42, wherein the AAA server includes a cache table operable to store one or more triplets, and wherein selected triplets may be communicated to the WLAN element based on criteria included within the request for one or more of the triplets from the WLAN element, the criteria being based on parameters associated with the entity.

49. The method of claim 48, wherein each of the cache tables are populated by one or more access requests received by the AAA server and the MAP gateway, the access requests being included within RADIUS flows propagating to the AAA server and the MAP gateway.

50. The method of claim 42, further comprising:

a home location register (HLR) that includes a cache table, the HLR being operable to receive a request for one or more triplets from the MAP gateway when the AAA server and the MAP gateway cannot satisfy the request communicated by the WLAN element.

51. The method of claim 50, wherein the HLR includes an authentication center operable to verify an identification element that is included in the request for one or more triplets from the WLAN element, the authentication center being operable to authorize communication of requested triplets when an authentication of the entity is valid.

52. The method of claim 42, further comprising:

allocating bandwidth to one or more of the end users based on the billing plan.