"APPARATUS FOR PROVIDING A SECURE COMMUNICATIONS SESSION BETWEEN A DEVICE AND A WIRELESS NETWORK"

Alternatively, one or more associated arrows may represent communication (e.g., data flow) between software routines, particularly when the present method or apparatus of the present invention is implemented as a digital process.
When a user operating a terminal incorporating the IEEE 802.1x protocol ("client terminal" or simply"IEEE 802.1x client") attempts to access a public WLAN at a hot spot, the IEEE 802.1x client terminal would begin the authentication process according to its current machine configuration. Often the user terminal is not configured for access at a particular hot spot (e.g. it could be configured for office use, or the user may not have an account that permits access to a particular hot spot). The user opens its browser and attempts to access the network. With a modified behavior of the WLAN access point in accordance with the present invention, the user requests are redirected to a local web server, also referred to as an HTTP server. The web server in response sends the terminal various requirements that must be fulfilled to establish access to the network. If the user fulfills the requirements the web server authorizes access.
The typical sequence proceeds with the web server providing a greeting page that contains a list of service providers that the user may desire to use for authentication and charging. Selecting one of the providers would activate the ActiveX control/plug-in on the user's terminal. When the required parameters are specified by the terminal the user will be successfully authenticated by the service provider. Using these parameters, the ActiveX control/plug-in configures the IEEE 802.1x client and restarts the authentication process. The user is thereafter successfully authenticated and the WLAN AP fully opens access to the user. If the user does not have any existing accounts that would permit authentication, the greeting page also allows the user to create a new account. Upon creation of the account, the ActiveX control/plug-is activated to allow the reconfiguration of the terminal to proceed.
In accordance with FIG. 1, one or more mobile terminals represented by 140 through 140n communicate over a wireless medium 124 through an access point (AP) through 130n, local computer 120, which may be utilized as the HTTP server 120 (FIG. 2), in association with firewalls 122 and one or more virtual operators 1501-n, such as authentication server 150n Communication from terminals 1401-n typically require accessing a secured data base or other resources, utilizing the Internet 110 and associated communication paths 154 and 152 that require a high degree of security from unauthorized entities, such as would be hackers.
As further illustrated in FIG. 1, the WLAN architecture encompasses several components and services that interact to provide station mobility transparent to the higher layers of a network stack. The AP stations such as access points 1301-n and mobile terminals 140 1-n as the components connect to the wireless medium and typically contain the functionality of the IEEE 802. 1x protocols, that being MAC (Medium Access Control) 1341-n, and corresponding PHY (Physical Layer) (unshown), and a connection 127 to the wireless media. Communication functions and protocols are implemented in the hardware and software of a wireless modem or a network access or interface card. This invention proposes a method for implementing a means in the communication stream, such that an access point 130n improves the authentication of a terminal device in a WLAN environment, and remain within the compatibility requirements of a IEEE 802. 1x WLAN MAC layers for downlink traffic (i.e. from the an authentication server to the mobile terminal such as a laptop) as it may participate in the authentication of one or more wireless mobile devices 1401-n, and local server 120 and a virtual operator such as the server 150.
In accordance with the principles of the present invention, an access 160 enables each mobile terminals 1401-n, to securely access a WLAN 115 by authenticating both the mobile terminal itself, as well as its communication stream in accordance with the IEEE 802. 1 x protocol or other optional protocol as the terminal 140n may choose. The manner in which the access 160 enables such secure access can best be understood by reference to FIG. 2, which depicts the sequence of interactions that occurs among a mobile wireless communication device, say mobile terminal 140n, the public WLAN
115, and a HTTP server 120n. When configured with the IEEE 802.1 x protocols, the access point 130n of FIG. 1 maintains a controlled port and an un-controlled port, through which the access point exchanges information with the mobile terminal 140n. The controlled port maintained by the access point 130n serves as the entryway for non-authentication information, such as data traffic, to pass through the access point 130n between the WLAN 124 and the mobile terminals 140n. Ordinarily, the access point 130-n keeps the respective controlled port closed in accordance with the IEEE 802. 1 x protocol, until authentication of the mobile wireless communications device. The access points 130n always maintains the respective uncontrolled port open to permit the mobile terminals 140n to exchange authentication data with the local server 150n.
The access point includes an IEEE 802. 1X engine 325, which is a module that implements the IEEE 802. 1X protocol with the determining means necessary to carry out the steps of the present invention. The WLAN 115 system must maintain proper state information for the system to function properly. Such state information will be provided by the access point 130n IEEE 802. 1x engine, which is used by, among other things, the packet filtering function 330 and the HTTP server 120. With reference to FIG. 2, a further embodiment of the present invention is the utilization of the access point 130n to create several operational states. Following a Response-Identity EAP packet 220 a state lx_progress 340 indicates that the mobile terminal 140n is an IEEE 802. 1x client and the IEEE 802. 1x authentication process is ongoing. Such means to select from one or more available security protocols is well known by those skilled in the art of programming and engineering in a WLAN environment. The IEEE 802. 1X engine 325 is therefore responsible for client detection and providing the client capability information to other modules of the system. In addition it also implements RADIUS client functionality to convert EAP messages to RADIUS messages, forwarding such messages in the form of a radius access request 230 and responding to radius access reject messages 240. The packet filter module 330 is responsible for filtering packets based on the criteria set by other modules.
In the event, a EAP-Response-Identity packet 220 results in a state lx_failure 350 because, as by way of example, the client is not properly
configured, the client would be redirected to the local HTTP server 120 to attempt a reconfiguration of the client. More particularly, FIG. 2 illustrates an embodiment of the method of the present invention wherein the access point 130n detects that the mobile terminal 140n is not an authenticated IEEE 802. 1 x client, and a redirected client 335 moves the process to thereby configure through an IP packet filter module 330 and move the process to the HTTP server 120 via a web request redirect 345. Alternatively, mobile terminal 140n may send a direct web access request 355, which is redirected by the packet filter module 330 to the HTTP server 120. When the HTTP server 120 receives a web redirect request 345 it responds by presenting the mobile terminal 140n with information 360, such as a provider list web page, specifically related to the browser based authentication.
In the case where the access point 130n detects that the terminal device is an IEEE 802. 1x client, it permits normal IEEE 802. 1x protocol communication exchanges to proceed through the access point 13 On and sets up appropriate IP packet filtering through IP filter module 330 and requisite state information for the HTTP server 120 to control the mobile terminal 140n user access during and after the IEEE 802. 1 x based authentication process.
The invention herein provides a method for automatically configuring a IEEE 802. 1x client terminal to provide secure access in a wireless local area network 115 comprising the steps of an access point 130n filtering traffic 330 associated with an HTTP request form the client terminal for access to the wireless network redirecting the HTTP to a designated web server 120, and issuing a request from the designated web server to the client terminal 140n for information 360 required to establish an authorized communication. Thereafter the client terminal 140n provides the web server information 365 such as the provider selected, to establish an authorized communication. In the course of the communication the web server 120 indicates to the client terminal 140n information corresponding to such parameters as transmission rates, user account creation information, authentication method selection information, new account creation procedures, access user terms and conditions of acceptance, all typically required to establish an authorized communication. The client terminal 140n user responds 365, accordingly communicating web server 120 access rate information, web server user
account creation information, user access authentication method selection information, and user access terms and conditions of acceptance information required to establish an authorized communication. The HTTP server 120 invokes 370 a plug-in such as an ActiveX control plug to assist the terminal 140n in reconfiguring 375 the terminal 140n.
In referring to FIG. 3, the present invention also includes an apparatus for providing a secure communications session between a client terminal 140n and a WLAN 115. The client terminal 140n requests through means 445 access to the WLAN 115 through the access point 130n receiver 415, which processes the request through means 418 and sends the request to a packet filter 420 that redirects the client to a designated web server via transmit means 424.
The web server responds to the client terminal 140n by providing provider list web pages, which are processed by means 448 where the user inputs its selection through a means 448 and sends the client terminal 140n access information through transmit means 470. The web server responds by sending an ActiveX Control to configure the client terminal 140n utilizing a means 465 for activating, in response to the information received from the client terminal, a software module that reconfigures the client terminal and establish an authorized communication. Thereafter the client access means 480 permits authenticated access to pass through the WLAN 115. The access point 130nprovides a means for authenticating the reconfigured client terminal and allows access to the WLAN in response to the authentication using appropriate parameters associated with a configuration arrangement selected by a user.
The access point 130n for providing a secure communications session between the client terminal a 140n and the WLAN 115, comprises a means for receiving an access request 418 from the terminal 140n; a means for redirecting the access request 420,422 to a local web server. In response to the access request the terminal 140n, information required to establish terminal 140n access to the WLAN115; the terminal 140n is provided web page options. The client terminal select through means 448 the desired configuration.
In response to the information received from the client terminal 140n, the web server sends a configuration and the client terminal processes the configuration utilizing a means for activating 465, comprising a software
module that reconfigures the client terminal 140n for authentication, using appropriate parameters associated with a configuration arrangement selected by a user; and a means for authenticating 425 the reconfigured client terminal 140n and allowing access to the WLAN 115 in response to the authentication. It is to be understood that the form of this invention as shown is merely a preferred embodiment. Various changes may be made in the function and arrangement of parts; equivalent means may be substituted for those illustrated and described; and certain features may be used independently from others without departing from the spirit and scope of the invention as defined in the following claims.









We Claim:
1. Apparatus for providing a secure communications session between a device
(140) and a wireless network, comprising means (150) for receiving an access request from
the device (140); characterized in that
means (345) for redirecting the access request to a local web server for allowing a reconfigured access to the wireless network via a packet traffic filter means (330);
means (120) for activating, in response to the information received from the device (140), a module that reconfigures the device (140) for authentication using appropriate parameters associated with a configuration arrangement selected by a user; and
means (160) for authenticating the reconfigured device (140) and allowing access to the wireless network in response to the authentication.
2. The apparatus as claimed in claim 1, wherein said packet traffic filter means (330) receives wireless local area network state information from a plurality of operation states created by said apparatus.
3. The appratus as claimed in claim 1, wherein the activating comprises activating an Active X control/plug-in previously installed on the device.
4. The apparatus as claimed in claim 1, wherein the activating comprises downloading to, and activating in, the device an Active X control/plug-in.
5. The apparatus as claimed in claim 1, wherein said means (345) for redirecting filter traffic associated with an HTTP request from the device (140) for access to the wireless network and redirect the HTTP request to a designated web server, via said packet traffic filter means (330) for filtering packet trafficf and issuing a request from the designated web server to the device (140) for information required to establish an authorized communication.
6. The apparatus as claimed in claim 5, wherein the device (140) provides the designated web server information required to establish the authorized communication.