Title of Invention

"A METHOD OF AUTHENTICATING A MOBILE WIRELESS COMMUNICATION DEVICE IN A COMMUNICATIONS NETWORK"

Abstract

A public wireless LAN (11) permits receipt of non-authentication traffic, such as access information requests, from a mobile wireless communications device (121) prior to device authentication by partially opening a controlled port within an access point (181). The wireless LAN re-directs such non-authentication traffic received at the AP from the mobile wireless communications to a local web server (21). The local web server provides reply to the mobile wireless communications device, enabling a determination by the device whether or not to request access. The device seeks access by way of an access request received at the AP. In response, the AP re-directs the access request through an uncontrolled port in the AP to an access server (26) that authenticates device. Upon successful device authentication, the AP fully opens its controlled port to permit the exchange of traffic through that port with the mobile wireless communications device.

Full Text

SEAMLESS PUBLIC WIRELESS LOCAL AREA NETWORK USER AUTHENTICATION CROSS-REFERENCE TO RELATED APPLICATIONS This is a non-provisional application claiming the benefit under 35 U.S.C. § 119 of provisional application Serial No. 60/376,029, entitled "SEAMLESS PUBLIC WIRELESS LOCAL AREA NETWORK USER AUTHENTICATION", filed on 13 MAY 2002, which is incorporated by reference herein. TECHNICAL FIELD This invention relates to a technique for authenticating a mobile wireless communications device in a public wireless Local Area Network (LAN). BACKGROUND ART Advances in the field of wireless LAN technology have resulted in the emergence of publicly accessible wireless LANs (e.g., "hot spots") at rest stops, cafes, libraries and similar public facilities. Presently, public wireless LANs offer mobile wireless communications device users access to a private data network, such as a Corporate Intranet, or a public data network such as the Internet. The relatively low cost to implement and operate a public wireless LAN, as well as the available high bandwidth (usually in excess of 10 Megabits/second) makes the public wireless LAN an ideal access mechanism through which users can exchange packets with an external entity. When a user travels into a public wireless LAN coverage area, the public wireless LAN first authenticates and authorizes the user prior to granting network access. After authentication, the public wireless LAN Access Point (AP) opens a secure data channel to the mobile wireless communications device to protect the privacy of data exchanged with the device. Presently, many manufacturers of wireless LAN equipment have adopted the IEEE 802.1x protocol for deployed equipment. Hence, the predominant authentication mechanism for wireless LANs utilizes this standard. Unfortunately, the IEEE 802.1x protocol was a safe authentication procedure, but such mechanisms do not permit setting of a Wired Equivalent Privacy (WEP) encryption key in the Web browser. Therefore, data transmitted over wireless LAN after authentication remains unprotected. Thus, there is need for an authentication process for use in a public wireless LAN environment that permits authentication in accordance with the IEEE 802. lx protocol, thus protecting the privacy of exchanged data, while affording customized interaction mechanisms. BRIEF SUMMARY OF THE INVENTION Briefly, in accordance with a preferred embodiment of the present principles, there is provided a method for authenticating the user of a mobile wireless communications device in a public wireless LAN. The method commences upon receipt of a request received from a mobile wireless communications device for non-authentication information, which can include access information, such as the cost of access. In response to such an information request, a controlled port in the public wireless LAN is partially opened to enable transmission of non-authentication (e.g., access) information request through the LAN to a first server that replies with the requested information. Assuming the user of the mobile wireless communications device finds the access terms specified in the reply from the first server acceptable, the user then sends an access request to an authentication server with an authenticating credential. In response to the access request, the authentication server authenticates the user and notifies the public wireless LAN to allow the use of wireless LAN services. Upon successful authentication, the public wireless LAN fully opens the controlled port to permit the exchange of data with the mobile wireless communications device through the controlled port. BRIEF DESCRIPTION OF THE DRAWINGS FIGURE 1 depicts a block schematic diagram of a communications system for practicing the method of the present principles for authenticating the user of a mobile wireless communications device; and FIGURE 2 depicts a timing chart depicting the sequence of events associated authenticating the user of the mobile wireless communications device in the communications system of FIG. 1. DETAILED DESCRIPTION FIGURE 1 depicts a block schematic diagram of a communications network 10 that includes an access arrangement 11 for enabling at least one mobile communication device, and preferably a plurality of mobile communication devices (e.g., mobile communication devices 121, and 122,) to securely access an external data source 14, which can take the form of a server within a network 15, such as a public data network (e.g., the Internet), or a private data network (e.g., a corporate intranet). In a preferred embodiment, the mobile communication device 121 comprises a lap top computer that includes a wireless modem or wireless network access card, whereas the mobile communication device 122 comprises a Personal Data Assistant. The access arrangement 11 can also serve other types of mobile wireless communications devices (not shown). The access arrangement 11 of FIG. 1 includes at least one, and preferably, a plurality of access points (APs), best exemplified by APs 181-184, via which the mobile wireless communication devices 121 and 122 can access a public wireless Local Area Network (LAN) 20. Although shown separately, the APs 181-184 comprise part of the public wireless LAN 20. In the illustrated embodiment, each AP, such as AP 181, includes a wireless transceiver (not shown) for exchanging radio frequency signals with a radio transceiver (not shown) within each mobile wireless communication device. To this end, each of the APs 181-184 employs at least one well-known wireless data exchange protocol, such as the IEEE 802. lx protocol. The access arrangement 11 also includes a server 21, in the form of a local web server that stores non-authentication information. Such non-authentication information can include access information, such as access terms and conditions, including the cost to the user. The local web server 21 enables a device user to obtain such non-authentication information without the need to establish an actual communications session with the public wireless LAN 20 and thus undergo authentication. Although shown separately, the local web server 21 could reside within the public wireless LAN 20. A gateway 22 provides a communication path between the public wireless LAN 20 and a packet data network (PDN) 24 that provides a link to the network 15. The PDN 24 thus permits communications between each mobile wireless communications device and the data source 14. The PDN 24 also links the gateway 22 to an authentication server 26. In practice, the authentication server 26 takes the form of a database containing information about potential users to enable authentication of those seeking access to the wireless LAN 20. Rather than exist as a separate stand-alone entity, the authentication server 26 could reside within the public wireless LAN 20. Further, the PDN 24 provides a link between the public wireless LAN 20 and a billing agent (not shown) to facilitate billing device user for accessing the public wireless LAN. As with the authentication server 24, the functionality of the billing agent could reside within the public wireless LAN 20. In advance of actually establishing an actual authenticated communications session with the public wireless LAN 20, a device user might wish to obtain certain non-authentication information, such as the terms and conditions of access, as well as the cost. Heretofore, the device user could not obtain such non-authentication information from a public wireless LAN whose access points (APs) employ the IEEE 802. lx protocol without establishing an authenticated communications session. The access arrangement 11 of the present principles overcomes this disadvantage by enabling a limited connection with the public wireless LAN 20 to obtain non-authentication information, including access information, prior to actually establishing an authenticated communications session. FIG. 2 depicts the sequence of interactions that occurs over time among a mobile wireless communication device, say device 121, the public wireless LAN 20, the local web server 21, and the authentication server 26 to achieve the desired secure access while permitting receipt of certain information without authentication. Referring to FIG. 2, prior to actually establishing an authenticated communications session, the user of the mobile wireless communications device 121 can obtain non-authentication information by first launching an HTTP information request during step 102. The information request is initially received at one of the APs, such as AP 181 of FIG. 1. When configured with the IEEE 802. lx protocol, the AP 181 of FIG. 1 maintains a controlled port and an un-controlled port through which the AP exchanges information with the mobile wireless communications device 121. The controlled port maintained by the AP 181 serves as the entry way for non-authentication information to pass through the AP between the public wireless LAN 20 and the mobile wireless communications device 121. Ordinarily, the AP 181 keeps its controlled port closed in accordance with the IEEE 802. lx protocol until authentication of the mobile wireless communications device. The AP 181 always maintains the uncontrolled port open to permit the mobile wireless communications device 121 to exchange authentication data with an authentication server, e.g., server 26. To permit the mobile wireless communications device 121 to obtain non-authentication information, and particularly, access information, without authentication in accordance with the present principles, the public wireless LAN 20 causes each AP, such as AP 181 of FIG. 1, to partially open its controlled access port after receiving a request for non-authentication information. Partially opening the controlled port in the AP 181 enables receipt of such a non-authentication information request in the public wireless LAN 20 through the controlled port during step 104. Upon receipt of the information request, the public wireless LAN 20 redirects the request to the local web server 21 during step 106. Regardless of the destination specified in the information request initially made during step 102, the public wireless LAN 20 always directs the request to the web server 21 of FIG. 1 during step 106. The web server 21 responds to the information request by providing the requested information, (e.g., the access terms and conditions as well as the domain name of the authenticating server 26) to the requesting mobile wireless communications device 121 during step 108. Assuming the user of the device finds the terms and condition are acceptable (or the user has negotiated acceptable terms and conditions), the mobile wireless communications device 121 transmits to the AP 181 an acceptance message during step 110. The acceptance message will identify the authentication server 26 by its name or URL. The mobile wireless device 121 will automatically transmit such an acceptance message if the access terms and conditions communicated by the web sever 21 match predefined access criteria stored in the device. In absence of such a match, the user might need to trigger the transmission of an acceptance message. Upon receiving the acceptance message, the AP 181 requests the mobile wireless communications device 121 to identify itself during step 112. Assuming the wireless communication device 121 employs an Extensible Authentication Protocol (EAP) as is well known in the art, the AP 181 will seek identification of the device through an EAP identity request. In response to the EAP identity request, the mobile wireless communications device 121 sends an EAP identity response to the AP 181 during step 114 for redirection and receipt at the authentication server 26 via the public wireless LAN 20 during step 116. As part of the process of identifying the device, the public wireless LAN 20 typically checks whether the device user has a relationship with a billing agent serving the wireless LAN 20. If the user has a relationship, then the user need not do anything further as the billing agent will account for the access charges. In the absence of a relationship with a billing agent, the user will need to establish such a relationship. With the user's assent, the wireless LAN 20 can seek to dynamically establish such a relationship. Upon receipt of the EAP identity response, the AP 181 sends the EAP identity response to the authentication server 26 through the uncontrolled port during step 118. The authentication server 26 replies to the EAP identity response by directing an EAP authentication request to the AP 181 during step 120 for subsequent transmission via the AP 181 to the mobile wireless communications device 121 during step 122. The mobile wireless communications device 121 replies during step 124 with an EAP authentication response that is received through the uncontrolled port in the AP 18i. In turn, the AP 18] forwards the EAP authentication response to the authentication server 26 during step 126. Upon successful authentication of the mobile wireless communications device 121, the authentication server 26 generates an EAP authentication success message during step 128 for receipt in the AP 181- In turn, the AP 181 sets an authentication key, typically a Wired Equivalent Privacy (WEP) encryption key, for transmission to the mobile wireless communications device 121 during step 130. Lastly, the AP 181 fully opens its controlled port to permit an exchange of traffic with the mobile wireless communications device 121 through the controlled port. The foregoing describes a technique for authenticating a mobile wireless communications device in a public wireless LAN that affords the user of the device the opportunity to receive non-authentication information in advance of actually establishing a communications session with the public wireless LAN. AMENDED CLAIM 3 3. The method according to claim 1 wherein the authenticating step comprises the steps of: receiving an acceptance from the mobile wireless communications device responsive to the reply to the moble wireless communications device; transmitting a user identification request to the mobile wireless communications device; receiving a user identification response from the mobile wireless communications device in reply to the user identification request; and re-directing the user identification response to an authentication server. We Claim: 1. A method for authenticating a mobile wireless communications device (12) in a public wireless Local Area Network (LAN) (20), comprising the steps of: receiving a request for non-authentication information; characterized by partially opening a controlled port through which the information request is directed to a first server (21) that responds by providing a reply to the mobile wireless communications device (12); receiving an access request; authenticating the mobile wireless communications device (12) through an uncontrolled port; and fully opening the controlled port to enable the exchange of traffic with the mobile wireless communications device (12) through the controlled port. 2. The method as claimed in claim 1 wherein the request for non-authentication information is directed to the first server (21) irrespective of a destination specified in the request. 3. The method as claimed in claim wherein authenticating step comprises the steps of: receiving an acceptance from the mobile wireless communications device (12) responsive to the reply to the mobile wireless communications device (12); transmitting a user identification request to the mobile wireless communications device (12); receiving a user identification response from the mobile wireless communications device (12) in reply to the user identification request; and re-directing the user identification response to an authentication server (26). 4. The method as claimed in claim 3 wherein the step of transmitting the user identification request comprises the step of transmitting an Extensible Authentication Protocol (EAP) request. 5. The method as claimed in claim 4 wherein the step of receiving the user identification response comprises the step of receiving an EAP identification response. 6. The method as claimed in claim 1 comprising the step of setting an authentication key following authentication. 7. The method as claimed in claim 6 wherein the step of setting an authentication key comprises the step of setting a Wired Equivalent Privacy (WEP) encryption key. 8. A communications network (10) for authenticating a mobile wireless communications device (12), comprising: a first server (21) for storing non-authentication information; a second server (26) for authenticating a mobile wireless communications device(12); at least one access point (AP) (18) characterized in that the access point having (a) controlled port via which the AP(18) partially opens in response to a receipt of a request for non-authentication information from a mobile wireless communications device(12) and for directing the information request to the first server(21) which sends a reply for receipt by the mobile wireless communications device(12), and (b) an uncontrolled port through which the AP (18) directs authentication traffic received from the mobile wireless communications device (12) to the second server (26) which exchanges authentication traffic with the mobile wireless communications device (12); and a public wireless Local Area Network (LAN) (20) coupled to the one AP(18) and said first (21) and second servers (26). 9. The system as claimed in claim 8 wherein the AP (18) utilizes a communication protocol in conformance with IEEE 802. lx. 10. The system as claimed in claim 8 wherein the information stored in the first server (21) includes access costs. 11. The system as claimed in claim 8 wherein the second server (26) authenticates the mobile wireless communications device (12) in accordance with an Extensible Authentication Protocol (EAP). 12. The system as claimed in claim 8 wherein the authentication traffic received at the one AP (18) includes an identification of the authentication server. 13. An access point (AP) (18) for authenticating a mobile wireless communications device (12) characterized in that the AP comprising: (a) controlled port via which the partially opened in response to a receipt of a request for non-authentication information from a mobile wireless communications device (12) and for directing the information request to a first server (21) which sends a reply for receipt by the mobile wireless communications device (12), and (b) an uncontrolled port through which the AP (18) directs authentication traffic received from the mobile wireless communications device (12) to a second server (26), which exchanges authentication traffic with the mobile wireless communications device (12). 14. The access point (AP) as claimed in claim 13 wherein the AP (18) utilizes a communication protocol in conformance with IEEE 802. 1x.

Documents:

3523-DELNP-2004-Abstract-(03-05-2012).pdf

3523-delnp-2004-Abstract-(18-10-2013).pdf

3523-delnp-2004-Abstract-(31-01-2014).pdf

3523-delnp-2004-abstract.pdf

3523-delnp-2004-assignment.pdf

3523-DELNP-2004-Claims-(03-05-2012).pdf

3523-delnp-2004-Claims-(18-10-2013).pdf

3523-delnp-2004-Claims-(31-01-2014).pdf

3523-delnp-2004-claims.pdf

3523-DELNP-2004-Correspondence Others-(03-05-2012).pdf

3523-delnp-2004-Correspondence Others-(07-08-2012).pdf

3523-delnp-2004-Correspondence Others-(18-10-2013).pdf

3523-delnp-2004-Correspondence Others-(31-01-2014).pdf

3523-delnp-2004-Correspondence-Others-(14-09-2012).pdf

3523-delnp-2004-correspondence-others.pdf

3523-delnp-2004-Description (Complete)-(18-10-2013).pdf

3523-delnp-2004-Description (Complete)-(31-01-2014).pdf

3523-delnp-2004-description (complete).pdf

3523-delnp-2004-Drawings-(18-10-2013).pdf

3523-delnp-2004-drawings.pdf

3523-DELNP-2004-Form-1-(03-05-2012).pdf

3523-delnp-2004-Form-1-(18-10-2013).pdf

3523-delnp-2004-form-1.pdf

3523-delnp-2004-form-18.pdf

3523-delnp-2004-Form-2-(03-05-2012).pdf

3523-delnp-2004-Form-2-(18-10-2013).pdf

3523-delnp-2004-Form-2-(31-01-2014).pdf

3523-delnp-2004-form-2.pdf

3523-delnp-2004-form-26.pdf

3523-delnp-2004-Form-3-(07-08-2012).pdf

3523-delnp-2004-form-3.pdf

3523-delnp-2004-form-5.pdf

3523-delnp-2004-GPA-(18-10-2013).pdf

3523-delnp-2004-GPA-(31-01-2014).pdf

3523-delnp-2004-pct-101.pdf

3523-delnp-2004-pct-210.pdf

3523-delnp-2004-pct-216.pdf

3523-delnp-2004-pct-220.pdf

3523-delnp-2004-pct-304.pdf

3523-delnp-2004-pct-409.pdf

3523-delnp-2004-pct-416.pdf

abstract.jpg