Fast authentication and access control method for mobile networking

• US 7,174,456 B1
• Filed: 05/14/2002
• Issued: 02/06/2007
• Est. Priority Date: 05/14/2001
• Status: Active Grant

• Current Assignee: AT&T Corporation (AT&T, Inc.)
• Original Assignee: AT&T Corporation (AT&T, Inc.)
• Inventors: Henry, Paul Shala, Jiang, Zhimei, Luo, Hui
• Primary Examiner(s): Vu, Kim
• Assistant Examiner(s): Dada, Beemnet W
• Application Number:
  US10/146,383
• Time in Patent Office: 1,729 Days
• Field of Search: 726/2, 726/5, 726/10, 726/3, 713155-158, 713/168, 713/175, 713/176, 380/247, 380/248
• US Class Current: 713/158
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

A fast authentication and access control method of authenticating a network access device to a communications network having an access point communicating with a remote authentication (home AAA) server for the network access device. The method includes the step of receiving an access request having an authentication credential from the network access device at the access point. The authentication credential includes a security certificate having a public key for the network access device and an expiration time. The security certificate is signed with a private key for the remote authentication server. The access point locally validates the authentication credential by accessing the public key of the remote authentication server from a local database, and checking the signature and expiration time of the security certificate. If the authentication credential is validated at the access point, the access point grants the network access device conditional access to the network by sending an access granted message to the network access device. The access granted message includes a session key encrypted with a public key for the network access device. The session key is stored in a database associated with the access point. The access point contacts the remote authentication server to check a revocation status of the security certificate for the network access device. If the access point receives a message from the remote authentication server that the authentication credential for the network access device has been revoked, it suspends network access for the network access device.

Claims

1. A method of authenticating a network access device to a communications network having an access point communicating with a remote authentication server for the network access device, comprising the steps of:

receiving an access request including an authentication credential from the network access device at the access point;

locally validating the authentication credential at the access point;

if the authentication credential is validated at the access point, granting the network access device conditional access to the network;

contacting the remote authentication server to verify a status of the authentication credential for the network access device;

suspending network access for the network access device in response to a message received from the remote authentication server that the authentication credential for the network access device has been revoked.

2. The method recited in claim 1, wherein the authentication credential for the network access device includes a security certificate.

3. The method recited in claim 2, wherein the security certificate includes a public key for the network access device and an expiration time, and the security certificate is signed with a private key for the remote authentication server.

4. The method recited in claim 3, wherein the step of the access point locally validating the network access device includes the additional steps of:

accessing the public key of the remote authentication server from a database, and checking the signature and expiration time of the security certificate.

5. The method recited in claim 4, wherein the step of the access point granting conditional access to the network access device includes the additional steps of:

sending an access granted message to the network access device, the access granted message including a session key encrypted with a public key for the network access device; and

storing the session key in a database.

6. The method recited in claim 4, wherein the step of contacting the remote authentication server to verify the status of the authentication credential includes a request to the remote authentication server to check the revocation status of the security certificate for the network access device.

7. The method recited in claim 4, wherein the step of suspending network access for the network access device includes destroying the session key.

8. A method of authenticating a network access device to a communications network having an access point communicating with a remote authentication server for the network access device, comprising the steps of:

receiving an access request including an authentication credential from the network access device at the access point, the authentication credential comprising a security certificate including a public key for the network access device and an expiration time, the security certificate being signed with a private key for the remote authentication server;

locally validating the authentication credential at the access point by accessing the public key of the remote authentication server from a database, and checking the signature and expiration time of the security certificate;

if the authentication credential is validated at the access point, granting the network access device conditional access to the network by sending an access granted message to the network access device, the access granted message including a session key encrypted with a public key for the network access device and storing the session key in a database;

contacting the remote authentication server to check a revocation status of the security certificate for the network access device; and

suspending network access for the network access device in response to a message received from the remote authentication server that the authentication credential for the network access device has been revoked, the step of suspending network access including destroying the session key for the network access device.

9. A method of authenticating a network access device to a communications network having an access point communicating with a remote authentication server for the network access device, where the access point receives an access request including an authentication credential from the network access device at the access point and locally validates the authentication credential at the access point to grant the network access device conditional access to the network, the remote authentication server capable of verifying the status of the authentication credential to either confirm or deny access, comprising the steps of:

receiving at the remote authentication server, a query message from the access point as to a status of the authentication credential for the network access device;

determining the status of the authentication credential for the network access device; and

if the authentication credential is revoked, sending the access point a message to suspend network access for the network access device.

10. The method recited in claim 9, wherein the step of determining the status of the authentication credential includes checking a subscriber database containing the security certificate.