Systems and methods for user access authentication based on network access point

• US 8,151,322 B2
• Filed: 05/16/2006
• Issued: 04/03/2012
• Est. Priority Date: 05/16/2006
• Status: Active Grant

• Current Assignee: A10 Networks Incorporated
• Original Assignee: A10 Networks Incorporated
• Inventors: Chen, Lee, Chiong, John, Yu, Yang
• Primary Examiner(s): Shiferaw, Eleni
• Assistant Examiner(s): VU, PHY ANH TRAN
• Application Number:
  US11/435,043
• Publication Number:
  US 20070271598A1
• Time in Patent Office: 2,149 Days
• Field of Search: 726/4, 726 27- 30, 713168-189
• US Class Current: 726/4
• CPC Class Codes: G11C 7/24 Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 12/73 Access point logical identity

Abstract

Systems and methods of authenticating user access based on an access point to a secure data network include a secure data network having a plurality of a network access points serving as entry points for a user to access the secure data network using a user device. The user is associated with a user identity, each network access point with a network access point identity. The user uses a user device to send an access request, requesting access to the secure data network, to the network access point, which then sends an authentication request to an identity server. The identity server processes the authentication request, by validating the combination of the user identity and the network access point identity, and responds with an authentication response, granting or denying access, as communicated to the user device via an access response. The secure data network may comprise an application level secure data network, in which the user uses the user device to request access to a network application. Furthermore, the identity server may validate the combined user identity and network access point identity data in conjunction with time information, access allowance data, and/or traffic volume data.

Claims

1. A method of user access authentication, the method comprising:

receiving an authentication request;

determining whether to grant a user device access to a secure data network via a plurality of network access points, the plurality of network access points including a first network access point and a second network access point; and

,

responding to the authentication request with an authentication response indicating whether the user device is granted access to the secure data network via the plurality of network access points;

wherein;

the authentication request travels along a communication path including the first network access point and the second network access point; and

whether to grant the user device access is determined based on at least three data points, the at least three data points comprising a user identity provided by the user device, a first network access point identity associated with the first network access point, and a second network access point identity associated with the second network access point;

wherein the combination of the user identity, the first network access point identity and the second network access point identity results in at least one of;

(i) not granting the user device access to the secure data network; and

(ii) granting the user device access to the secure data network,

wherein the secure data network includes at least one of an Internet Protocol (IP) network;

a Local Area Network (LAN);

a Wide Area Network (WAN);

a wireless network;

a WiFi network;

a General Packet Radio Service (GPRS) network;

a public IP network; and

a private IP network;

wherein the user device includes at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network;

wherein the user identity includes at least one of a user name;

an identity of user device;

a Media Access Control (MAC) address;

an Internet Protocol (IP) address and port number;

a device serial number;

subscriber information in a subscriber identity module (SIM) card;

subscriber information in a Universal Subscriber Identity Module (USIM) card;

a telephone number;

security information;

a password;

a security code;

a secret answer to a security question;

biometric characteristics;

fingerprint data, eye retinal data, eye iris data voice pattern recognition data and signature recognition data;

wherein the first network access point and/or the second network access point includes at least one of a firewall;

a wireless access point a Dynamic Host Configuration Protocol (DHCP) server;

a Remote Access Server (RAS);

a Broadband Remote Access Server (BRAS);

a web server;

a secure web server;

a virtual private network (VPN) server;

a termination point of an access tunnel;

a termination point of a virtual private network (VPN) tunnel;

a termination point of a Generic Routing Encapsulation (GRE) tunnel; and

a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and

wherein the first network access point identity and/or the second network access point identity includes at least one of a network access point name;

an IP address;

a port number;

security information;

a password;

a security code;

a device name;

a machine identity;

a serial number;

an identity of an access tunnel termination point and an Access Point Name (APN).

2. The method of claim 1 further comprising:

receiving at the first network access point an access request from the user device;

generating the authentication request in response to receiving the access request;

sending the authentication request from the first network access point to an identity server for processing;

processing the authentication request to determine whether to grant the user device access to the secure data network via the first and the second network access points; and

sending the authentication response from the identity server to the first network access point.

3. The method of claim 2 further comprising:

sending an access response from the first network access point to the user device.

4. The method of claim 2:

wherein the access request includes the user identity; and

wherein the first network access point obtains the user identity from the access request.

5. The method of claim 2 wherein:

the first network access point obtains the user identity from a source other than the access request.

6. The method of claim 1:

wherein the authentication request includes the user identity; and

wherein the determining is done by an identity server obtaining the user identity from the authentication request.

7. The method of claim 1:

wherein the authentication request includes the first and second network access point identities; and

wherein the determining is done by an identity server obtaining the first and second network access point identities from the authentication request.

8. The method of claim 1 wherein:

the determining is done by an identity server obtaining the first and second network access point identities from a source other than the authentication request.

9. The method of claim 1 wherein:

the determining is done by an identity server including a datastore having information corresponding to a plurality of valid combinations of user identity and network access point identity entries.

10. The method of claim 9 wherein:

processing the authentication request includes attempting to match the user identity and the first and second network access point identities with one of the plurality of valid combinations of user identity and network access point identity entries.

11. The method of claim 10 wherein:

the authentication response indicates that the user device is granted access to the secure data network via the first and second network access points if the identity server matches the user identity and the first and second network access point identities with one of the plurality of valid combinations of user identity and network access point identity entries.

12. The method of claim 1 wherein:

the secure data network includes an application level secure data network.

13. The method of claim 12 wherein:

the access request seeks access to a network application, and the access request includes a Transport Control Protocol (TCP) access request.

14. The method of claim 13 further comprising:

determining that access to the network application is sought, wherein the first network access point determines that access to the network application is sought.

15. The method of claim 13 wherein:

the network application includes an enterprise application;

an employee benefit application;

a human resources application;

an inventory information application;

a library system;

a conference workshop application;

a live concert webcast;

a hotel television over IP application;

or a web application.

16. The method of claim 1:

wherein the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application; and

wherein the user identity combined with the second network access point identity results in a determination not to grant the user device access to the network application.

17. The method of claim 16:

wherein the authentication request logs the first network access point identity;

wherein the authentication request logs the second network access point identity;

and

wherein the user identity combined with the first network access point identity and the second network access point identity results in a determination not to grant the user device access to the network application.

18. The method of claim 1 wherein:

the at least three data points further comprise at least one additional data point.

19. The method of claim 18 wherein:

the at least one additional data point includes at least one of a time data point, an access allowance data point, and a traffic volume data point.

20. The method of claim 1, wherein:

the authentication request logs the first network access point identity and the second network access point identity;

the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application;

the user identity combined with the second network access point identity results in a determination to grant the user device access to the network application; and

the user identity combined with the first network access point identity and the second network access point identity results in a determination to grant the user device access to the network application.

21. The method of claim 1, wherein the authentication request maintains a log of the communication path and tracks identities of network nodes, including the first and second access points, encountered while traversing the communication path to reach a destination.

22. A system of user access authentication, the system comprising:

a secure data network having a plurality of network access points;

a first network access point selected from the plurality of network access points;

an identity server in communication with the secure data network via the first network access point,

wherein;

the identity server processes an authentication request, sent by the first network access point, based on an access request that travels along a communication path including the first network access point and a second network access point and is received by the first network access point from a user device controlled by a user;

the identity server determines whether to grant the user device access to the secure data network via the first network access point and the second network access point based on at least three data points, the at least three data points comprising a user identity associated with the user, a first network access point identity associated with the first network access point, and a second network access point identity associated with the second network access point;

wherein the combination of the user identity, the first network access point identity and the second network access point identity results in at least one of;

(i) not granting the user device access to the secure data network; and

(ii) granting the user device access to the secure data network; and

,

the identity server responds to the authentication request with an authentication response sent to the first network access point indicating whether the user device is granted access to the secure data network via the first network access point and the second network access point wherein the secure data network includes at least one of an Internet Protocol (IP) network;

a Local Area Network (LAN);

a Wide Area Network (WAN);

a wireless network;

a WiFi network;

a General Packet Radio Service (GPRS) network;

a public IP network; and

a private IP network;

wherein the user device includes at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network;

wherein the user identity includes at least one of a user name;

an identity of user device;

a Media Access Control (MAC) address;

an Internet Protocol (IP) address and port number;

a device serial number;

subscriber information in a subscriber identity module (SIM) card;

subscriber information in a Universal Subscriber Identity Module (USIM) card;

a telephone number;

security information;

a password;

a security code;

a secret answer to a security question;

biometric characteristics;

fingerprint data, eye retinal data, eye iris data voice pattern recognition data; and

signature recognition data;

wherein the first network access point and/or the second network access point includes at least one of a firewall;

a wireless access point;

a Dynamic Host Configuration Protocol (DHCP) server;

a Remote Access Server (RAS);

a Broadband Remote Access Server (BRAS);

a web server;

a secure web server;

a virtual private network (VPN) server;

a termination point of an access tunnel;

a termination point of a virtual private network (VPN) tunnel;

a termination point of a Generic Routing Encapsulation (GRE) tunnel; and

a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and

wherein the first network access point identity and/or the second network access point identity includes at least one of a network access point name;

an IP address;

a port number;

security information;

a password;

a security code;

a device name;

a machine identity;

a serial number;

an identity of an access tunnel termination point; and

an Access Point Name (APN).

23. The system of claim 22, further comprising:

an authentication request engine at the first network access point, the authentication request engine capable of generating the authentication request based on the access request received by the first network access point; and

an access response engine at the first network access point, the access response engine capable of generating the access response based on the authentication response received by the first network access point.

24. The system of claim 22, wherein:

the identity server includes a datastore and a validation matching engine; and

wherein the datastore includes information corresponding to a plurality of valid combinations of user identity and network access point identity entries;

wherein the validation matching engine attempts to match the user identity and the first and second network access point identities with one of the plurality of valid combinations of user identity and network access point identity entries; and

,

wherein the authentication request indicates that the user device is granted access to the secure data network via the first network access point and the second network access point if the identity server matches the user identity and the first and second network access point identities with one of the plurality of valid combinations of user identity and network access point identity entries.

25. The system of claim 22 wherein:

the secure data network includes an application level secure data network.

26. The system of claim 25 wherein:

the access request seeks access to a network application, and the access request includes a Transport Control Protocol (TCP) access request.

27. The system of claim 26 wherein:

the first network access point determines that access to the network application is sought.

28. The system of claim 27 wherein:

the network application includes an enterprise application;

an employee benefit application;

a human resources application;

an inventory information application;

a library system;

a conference workshop application;

a live concert webcast;

a hotel television over IP application;

or a web application.

29. The system of claim 22:

wherein the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application; and

wherein the user identity combined with the second network access point identity results in a determination not to grant the user device access to the network application.

30. The system of claim 29:

wherein the authentication request logs the first network access point identity;

wherein the authentication request logs the second network access point identity;

and

wherein the user identity combined with the first network access point identity and the second network access point identity results in a determination not to grant the user device access to the network application.

31. The system of claim 22 wherein:

the at least three data points further comprise at least one additional data point.

32. The system of claim 22, wherein:

the authentication request logs the first network access point identity and the second network access point identity;

the user identity combined with the first network access point identity results in a determination to grant the user device access to the network application;

the user identity combined with the second network access point identity results in a determination to grant the user device access to the network application; and

the user identity combined with the first network access point identity and the second network access point identity results in a determination to grant the user device access to the network application.

33. A method of user access authentication, the method comprising:

receiving an authentication request;

determining whether to grant a user device access to a secure data network via a plurality of network access points, the plurality of network access points including a first network access point and a second network access point; and

,

responding to the authentication request with an authentication response indicating whether the user device is granted access to the secure data network via the plurality of network access points;

wherein;

the authentication request travels along a communication path including the first network access point and the second network access point; and

whether to grant the user device access is determined based on at least three data points, the at least three data points comprising a user identity provided by the user device, a first network access point identity associated with the first network access point, and a second network access point identity associated with the second network access point;

wherein the combination of the user identity, the first network access point identity and the second network access point identity results in at least one of;

(i) not granting the user device access to the secure data network; and

(ii) granting the user device access to the secure data network, wherein the authentication request maintains a log of the communication path and tracks identities of network nodes, including the first and second access points, encountered while traversing the communication path to reach a destination.