System and method for access authentication in a mobile wireless network

• US 7,715,562 B2
• Filed: 05/19/2006
• Issued: 05/11/2010
• Est. Priority Date: 03/06/2006
• Status: Active Grant

• Current Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Original Assignee: Cisco Technology, Inc. (Cisco Systems, Inc.)
• Inventors: Iyer, Jayaraman R., Salowey, Joseph A., Oswal, Anand K., Yegani, Parviz
• Primary Examiner(s): Kim; Jung
• Assistant Examiner(s): Lemma; Samson B
• Application Number:
  US11/419,382
• Publication Number:
  US 20070217610A1
• Time in Patent Office: 1,453 Days
• Field of Search: 380/270, 713/168, 713/155, 455/411
• US Class Current: 380/270
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys

Abstract

A system and method is provided for authenticating access in a mobile wireless network. The system and method comprise exchanging an extensible authentication protocol (EAP) packet with an access terminal over a high rate packet data radio link and a signaling interface through a radio access network, encapsulating the EAP packet in an authentication authorization and accounting (AAA) packet, and sending the AAA packet to an authentication server for authentication.

Claims

1. A method for authenticating access in a mobile wireless network, the method comprising:

receiving an extensible authentication protocol (EAP) packet from an access terminal over a high rate packet data radio link and an A11 signaling interface at an IP gateway through a radio access network, the A11 signaling interface having vendor-specific extensions for carrying the EAP packet;

encapsulating the EAP packet in an authentication authorization and accounting (AAA) packet, the encapsulating done by the IP gateway; and

sending the AAA packet from the IP gateway to an authentication server, the authentication server configured to authenticate both the access terminal and a service of the access terminal based on the EAP protocol.

2. The method of claim 1, wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packet.

3. The method of claim 1, further comprising authenticating access based on the EAP packet, and exchanging additional EAP packets with the access terminal over the high rate packet data radio link and the signaling interface to establish a session key.

4. The method of claim 1, further comprising authenticating access based on the EAP packet, and exchanging additional EAP packets with the access terminal over the high rate packet data radio link and the signaling interface to establish a session key, wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packet.

5. The method of claim 1, further comprising authenticating access based on the EAP packet and using a challenge-response protocol, and exchanging additional EAP packets with the access terminal over the high rate packet data radio link and the signaling interface to establish a session key.

6. The method of claim 1, further comprising authenticating access based on the EAP packet and using a challenge-response protocol with shared keys, and exchanging additional EAP packets with the access terminal over the high rate packet data radio link and the signaling interface to establish a session key.

7. The method of claim 1, further comprising authenticating access based on the EAP packet and using a certificate-based protocol, and exchanging additional EAP packets with the access terminal over the high rate packet data radio link and the signaling interface to establish a session key.

8. A gateway system for facilitating authenticating access in a mobile wireless network, the gateway system comprising:

an IP gateway for receiving an extensible authentication protocol (EAP) packet from an access terminal, the EAP packet received through a radio access network over a high rate packet data radio link and an A11 signaling interface having vendor-specific extensions for carrying the EAP packet;

an authenticator of the IP gateway for encapsulating the EAP packet in an authentication authorization and accounting (AAA) packet; and

an IP network interface for sending the AAA packet from the IP gateway to an authentication server, the authentication server configured to authenticate both the access terminal and a service of the access terminal based on the EAP protocol.

9. The gateway system of claim 8, wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packet.

10. The gateway system of claim 8, wherein the IP network interface is further operable to receive a session key from the authentication server, and wherein the radio access network interface is further operable to send an authentication success signal to the access terminal over the high rate packet data radio link and the signaling interface.

11. The gateway system of claim 8, wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packet.

12. A system for authenticating access in a mobile wireless network, the system comprising:

a radio network controller;

an authentication server; and

an IP gateway coupled to the radio network controller and the authentication server;

wherein the IP gateway is operable to exchange an extensible authentication protocol (EAP) packet with an access terminal through the radio network controller over a high rate packet data radio link and an A11 signaling interface having vendor-specific extensions for carrying the EAP packet, encapsulate the EAP packet in an authentication authorization and accounting (AAA) packet, and send the AAA packet to the authentication server, the authentication server configured to authenticate both the access terminal and a service of the access terminal based on the EAP protocol.

13. The system of claim 12, wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packet.

14. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key.

15. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key;

wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packets.

16. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet and using a challenge-response protocol, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key.

17. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet and using a challenge-response protocol with shared keys, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key.

18. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet and using a certificate-based protocol, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key.

19. The system of claim 12, wherein the authentication server is operable to authenticate access based on the EAP packet and using a challenge-response protocol, and to exchange additional EAP packets with the access terminal through the IP gateway and the radio network controller over the high rate packet data radio link and the signaling interface to establish a session key;

wherein the additional EAP packets are encapsulated in AAA packets for transmission between the IP gateway and the authentication server; and

wherein the signaling interface is an A11 signaling interface having vendor-specific extensions for carrying the EAP packets.

20. A system for authenticating access in a mobile wireless network, the system comprising:

means for receiving an extensible authentication protocol (EAP) packet at an IP gateway from an access terminal; and

means for sending the LAP packet from an IP gateway to an authentication server in an authentication authorization and accounting (AAA) packet, the authentication server configured to authenticate both the access terminal and a service of the access terminal based on the EAP protocol.

21. The system of claim 20, further comprising means for authenticating the EAP packet, and means for establishing a session key with the access terminal if authentication is successful.