Fast authentication and access control system for mobile networking

• US 8,065,518 B1
• Filed: 02/01/2005
• Issued: 11/22/2011
• Est. Priority Date: 05/14/2001
• Status: Expired due to Fees

• Current Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Original Assignee: AT&T Intellectual Property II LP (AT&T, Inc.)
• Inventors: Henry, Paul Shala, Jiang, Zhimei, Luo, Hui
• Primary Examiner(s): DADA, BEEMNET W
• Application Number:
  US11/047,905
• Time in Patent Office: 2,485 Days
• Field of Search: 713156-158, 713/168, 713/175, 713/176, 726/2, 726/5, 726/10, 380/247, 380/248
• US Class Current: 713/158
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/108 when the policy decisions are valid for a limited amount of time
• CPC Class Codes: H04L 9/3268 using certificate validation, registration, distribution or revocation, e.g. certificate revocation list [CRL]
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 36/0038 of security context information

Abstract

A fast authentication and access control method of authenticating a network access device to a communications network having an access point communicating with a remote authentication (home AAA) server for the network access device. The method includes the step of receiving an access request having an authentication credential from the network access device at the access point. The authentication credential includes a security certificate having a public key for the network access device and an expiration time. The security certificate is signed with a private key for the remote authentication server. The access point locally validates the authentication credential by accessing the public key of the remote authentication server from a local database, and checking the signature and expiration time of the security certificate. If the authentication credential is validated at the access point, the access point grants the network access device conditional access to the network by sending an access granted message to the network access device. The access granted message includes a session key encrypted with a public key for the network access device. The session key is stored in a database associated with the access point. The access point contacts the remote authentication server to check a revocation status of the security certificate for the network access device. If the access point receives a message from the remote authentication server that the authentication credential for the network access device has been revoked, it suspends network access for the network access device.

Claims

1. A method for authenticating a network access device, comprising:

validating locally at an access point an authentication credential contained in and sent with an access request received from the network access device, wherein the authentication credential is obtained from a business partner database and contains information that is predefined via a business agreement between an access network and a home network of the network access device before the access request is initiated;

granting a conditional network access to the network access device in response to the authentication credential being valid; and

querying a remote authentication server associated with the network access device to determine whether the authentication credential has been revoked prior to a predefined expiration point of the authentication credential.

2. The method of claim 1, further comprising:

terminating the conditional network access in response to a message received from the remote authentication server indicating the authentication credential is revoked.

3. The method of claim 2, wherein the terminating comprises:

destroying a session key of the network access device.

4. The method of claim 1, wherein the authentication credential comprises a security certificate.

5. The method of claim 4, wherein the security certificate of the network access device comprises a public key and the predefined expiration point.

6. The method of claim 1, wherein the validating comprises:

determining whether the authentication credential is valid; and

querying a database to determine whether the authentication credential is revoked prior to the predefined expiration point of the authentication credential.

7. The method of claim 6, wherein the determining comprises:

checking a signature and the predefined expiration point of the authentication credential.

8. The method of claim 1, wherein the granting further comprises:

sending an access-granted message to the network access device, wherein the access-granted message includes a session key that is encrypted using a public key of the network access device.

9. The method of claim 8, further comprising:

storing the session key encrypted with the public key of the network access device in a database.

10. A non-transitory computer readable medium having stored thereon instruction that, when executed by a processor, causing the processor to perform a method for authenticating a network access device, comprising:

validating locally at an access point an authentication credential contained in and sent with an access request received from the network access device, wherein the authentication credential is obtained from a business partner database and contains information that is predefined via a business agreement between an access network and a home network of the network access device before the access request is initiated;

granting a conditional network access to the network access device in response to the authentication credential being valid; and

querying a remote authentication server associated with the network access device to determine whether the authentication credential has been revoked prior to a predefined expiration point of the authentication credential.

11. The non-transitory computer readable medium of claim 10, further comprising:

terminating the conditional network access in response to a message received from the remote authentication server indicating the authentication credential is revoked.

12. The non-transitory computer readable medium of claim 11, wherein the terminating comprises:

destroying a session key of the network access device.

13. The non-transitory computer readable medium of claim 10, wherein the authentication credential comprises a security certificate.

14. The non-transitory computer readable medium of claim 13, wherein the security certificate of the network access device comprises a public key and the predefined expiration point.

15. The non-transitory computer readable medium of claim 10, wherein the validating comprises:

determining whether the authentication credential is valid; and

querying a database to determine whether the authentication credential is revoked prior to the predefined expiration point of the authentication credential.

16. The non-transitory computer readable medium of claim 15, wherein the determining comprises:

checking a signature and the predefined expiration point of the authentication credential.

17. The non-transitory computer readable medium of claim 10, wherein the granting further comprises:

sending an access-granted message to the network access device, wherein the access-granted message includes a session key that is encrypted using a public key of the network access device.

18. The non-transitory computer readable medium of claim 17, further comprising:

storing the session key encrypted with the public key of the network access device in a database.

19. A system for authenticating a network access device, comprising:

means for validating locally at an access point an authentication credential contained in and sent with an access request received from the network access device, wherein the authentication credential is obtained from a business partner database and contains information that is predefined via a business agreement between an access network and a home network of the network access device before the access request is initiated;

means for granting a conditional network access to the network access device in response to the authentication credential being valid; and

means for querying a remote authentication server associated with the network access device to determine whether the authentication credential has been revoked prior to a predefined expiration point of the authentication credential.

20. The system of claim 19, further comprising:

means for terminating the conditional network access in response to a message received from the remote authentication server indicating the authentication credential is revoked.