Patent ID: 9009778
Filing Date: 2015-04-14
Classification: H04L

Abstract:
1. An authentication and authorization method to determine access rights of a user on a network in response to receipt of an authentication protocol request message sent by an authenticator comprising the steps of: determining, based on said authentication protocol request message, a type of network access of said user of a plurality of types of network access; locating for said authenticator an access service category associated with said authentication protocol request message based on said type of network access, said access service category being one of a plurality of access service categories, each access service category being associated with a respective type of network access of said plurality of types of network access, each said access service category having each of a respective credential validation policy and a respective authorization policy associated therewith, each said authorization policy having at least one respective rule and further having a respective provisioning policy associated therewith, said at least one respective rule identifying at least one attribute value and a corresponding comparison operator; validating credentials for said user contained in said authentication protocol request message in accordance with said credential validation policy, said user being authenticated in the event said credentials are validated; determining that said user is authorized on said network in accordance with said at least one respective rule of said respective authorization policy based on a comparison of said at least one attribute value to an attribute value associated with one of said user and said authenticator in accordance with said corresponding comparison operator; locating said provisioning policy associated with said authorization policy and determining at least one provisioning setting associated with said provisioning policy in response to said user being authorized; and sending an access allowed message to said authenticator upon completion of said locating step indicating that said user is allowed a connection to said network and including said at least one provisioning setting to be associated with said connection.