Abstract:
A method for improving the security of a mobile terminal in a first communications network environment by redirecting the browser request, embedding a session identification inside an HTTP request and matching two HTTP sessions using such a session identification in the authentication server. The access point processes the web request from the mobile terminal such that a session identification becomes embedded in the universal resource locator. Additionally a mapping between this session identification and the media access control address or the internet protocol address of the mobile terminal is maintained in the WLAN. When the authentication server notifies the access point about the authentication result, the session identification is used to uniquely identify the mobile terminal. All these operations are transparent to the mobile terminal.

Description:
RELATED APPLICATION  
       [0001]     This application claims the benefit of U.S. Provisional Application No. 60/453,329, filed Mar. 10, 2003 and is incorporated herein by reference. 
     
    
     1. FIELD OF THE INVENTION  
       [0002]     The invention provides an apparatus and a method to improve the security and access control over a wireless local area network (“WLAN”) by embedding session identification within an authentication request and matching two sessions using the identification in a security process within the authentication server.  
       2. DESCRIPTION OF RELATED ART  
       [0003]     The context of the present invention is the family of wireless local area networks or (WLAN) employing the IEEE 802.1x architecture having an access point (AP) that provides access for mobile devices and to other networks, such as hard wired local area and global networks, such as the Internet. Advancements in WLAN technology have resulted in the publicly accessible hotspots at rest stops, cafes, libraries and similar public facilities. Presently, public WLANs offer mobile communication device users access to a private data network, such as a corporate intranet, or a public data network such as the Internet, peer to peer communication and live wireless TV broadcasting. The relatively low cost to implement and operate a public WLAN, as well as the available high bandwidth (usually in excess of 10 Megabits/second) makes the public WLAN an ideal access mechanism through which mobile wireless communications device users can exchange packets with an external entity, however as will be discussed below, such open deployment may compromise security unless adequate means for identification and authentication exists.  
         [0004]     When a user attempts to access service within a public WLAN coverage area, the WLAN first authenticates and authorizes the user, prior to granting network access. After authentication, the public WLAN opens a secure data channel to the mobile communications device to protect the privacy of data passing between the WLAN and the device. Presently, many manufacturers of WLAN equipment have adopted the IEEE 802.1x standard for deployed equipment. Hence, this standard is the predominant authentication mechanism utilized by WLANs. Unfortunately, the IEEE 802.1x standard was designed with private LAN access as its usage model. Hence, the IEEE 802.1x standard does not provide certain features that would improve the security in a public WLAN environment.  
         [0005]      FIG. 1  illustrates the relationships among three entities typically involved in an authentication in a public WLAN environment: a mobile terminal (MT), a WLAN accesses point (AP), and the authentication server (AS), which may be associated with a particular service provider, or virtual operator. The trust relationships are as follows: the MT has an account with AS and thus they mutually share a trust relationship, the WLAN operator and the operator owning the AS (referred to as “virtual operator” thereafter) have a business relationship, thus the AP and the AS have a trust relationship. The objective of the authentication procedure is to establish a trust relationship between the MT and the AP by taking advantage of the two existing trust relationships.  
         [0006]     In a web browser based authentication method, the MT directly authenticates with the AS, using the web browser through an Hyper Text Transfer Protocol Secured Sockets (HTTPS) protocol and ensures that the AP (and anyone on the path between the MT and the AS) cannot trespass upon or steal confidential user information. While the channel is secure, the AP cannot determine the result of the authentication unless explicitly notified by the AS. However, the only information the AS has related to the MT is its Internet protocol or IP address at the other end of the HTTPS session. When firewalls, NAT servers, or web proxies are electronically situated between the MT and the AS, which is normally the case with the virtual operator configuration, such information cannot be employed to identify the MT.  
         [0007]     Most existing WLAN hot spot wireless providers use web browser based solution for user authentication and access control, which proves convenient to the user and does not require any software download on the user device. In such a solution, the user is securely authenticated through HTTPS by a server, which in turn notifies the wireless AP to grant access to the user. Such an authentication server AS may be owned by the WLAN operator or any third party providers, such as Independent Service Providers (ISPs), pre-paid card providers or cellular operators, referred to as more broadly virtual operators.  
         [0008]     In the prior art, the authentication is achieved through a communication between the user and the authentication server, through a secure tunnel. As such the AP does not translate the communication between the user and the authentication server. Consequently, a separate communication referred to as authorization information between the AP and the authentication server AS must be established so that the AP receives the authorization information.  
         [0009]     Access control in the AP is based on MAC addresses or IP addresses, and therefore, the authentication server AS can use the mobile terminal MT IP address (the source address of the HTTPS tunnel) as the identifier when it returns the authentication result to the AP. This approach succeeds, if neither a firewall nor a Network Address Translation (NAT) between the AP and the authentication server AS exists, such as illustrated by firewall FW and the local server LS. In general and when virtual operators are present, the authentication server is located outside of the wireless access network domain, and thus outside of the firewall FW, and often the HTTPS connection used for authentication actually goes through a web proxy. The source address that the authentication server AS receives would be the web proxy&#39;s address, which cannot be used to identify the mobile terminal MT user device and therefore cannot be used by the AP in assuring a secure connection.  
         [0010]     In the current web browser based authentication solutions, the WLAN and the authentication server AS are part of the same entity, thus the foregoing problem may not be an issue. However, as the virtual operator concept becomes more widely deployed for hot spot WLAN access, the problem of identifying authentication sessions without solely relying on source IP address becomes more pressing, because the potential for hacking into computers would rise accordingly.  
       SUMMARY OF THE INVENTION  
       [0011]     The invention provides a method for improving the security and access control of a mobile terminal in a WLAN environment to overcome the problems noted above. The method according the invention includes embedding session identification (session ID) inside an HTTP request and matching two HTTP sessions using such a session ID in the authentication server to thereby uniquely identify the mobile terminal associated with an authentication message. An access request may be redirect to a server in the WLAN that provides the session identification, stores mapping data that maps the session identification to the mobile terminal, and generates a web page having the session ID embedded therein, that is transmitted to the mobile terminal.  
         [0012]     The access point processes the web request from the mobile terminal such that a session ID is embedded in the universal resource locator (URL). Additionally the access point maintains a mapping between this session ID and the MAC address of the MT. When the authorization server notifies the access point that it has received the authentication result, the session ID is thereafter used to uniquely identify the mobile terminal.  
         [0013]     In one embodiment of the invention, the method for controlling access to a wireless local area network (“WLAN”), comprises the steps of: receiving a request to access the WLAN from a mobile terminal disposed within a coverage area of the WLAN; associating a session ID with an identifier associated with the mobile terminal, and storing data mapping the session ID to the identifier associated with the mobile terminal; transmitting an authentication request, which includes the session ID, to an appropriate authentication server; receiving an authentication message, which includes the session ID, concerning the mobile terminal from the appropriate authentication server; correlating the received authentication message to the mobile terminal in response to the stored mapping data; and controlling access by the mobile terminal to the WLAN in response to the received authentication message.  
         [0014]     The identifier may be any parameter or characteristic of the mobile terminal that can be used to uniquely identify the mobile terminal. The identifier associated with the mobile terminal may comprise the MAC address associated with the mobile terminal or an IP address associated with the mobile terminal. The session ID may be embedded in a web page generated by the WLAN, e.g., in the universal resource locator associated with the submit button to the HTTPS session with the authentication server. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0015]     The invention is best understood from the following detailed description when read in connection with the accompanying drawing. The various features of the drawings are not specified exhaustively. On the contrary, the various features may be arbitrarily expanded or reduced for clarity. Included in the drawings are the following figures:  
         [0016]      FIG. 1  is a block diagram of a communications system for practicing the method of the present principles for authenticating a mobile wireless communications device.  
         [0017]      FIG. 2  is a flow diagram of the method of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0018]     In the figures to be discussed the circuits and associated blocks and arrows represent functions of the method according to the present invention which may be implemented as electrical circuits and associated wires or data busses, which transport electrical signals. Alternatively, one or more associated arrows may represent communication (e.g., data flow) between software routines, particularly when the present method or apparatus of the present invention is implemented as a digital process.  
         [0019]     In accordance with  FIG. 1 , one or more mobile terminals represented by  140   1  through  140   n  communicates through an access point  130   1  through  130   n  and associated computers  120  with an authentication server  150 , typically for purposes of accessing a secured data base or other resource that requires a high degree of security from unauthorized entities, such as would be hackers.  
         [0020]     As further illustrated in  FIG. 1 , the IEEE 802.1x architecture encompasses several components and services that interact to provide station mobility transparent to the higher layers of a network stack. The IEEE 802.1x network defines AP stations such as access points  130   1−n  and mobile terminals  140   1−n  as the components that connect to the wireless medium and contain the functionality of the IEEE 802.1x protocols, that being MAC (Medium Access Control)  134   1−n , and corresponding PHY (Physical Layer) (not shown), and a connection  127  to the wireless media. Typically, the IEEE 802.1x functions are implemented in the hardware and software of a wireless modem or a network access or interface card. This invention proposes a method for implementing an identification means in the communication stream such that an access point  130   1−n  compatible with the IEEE 802.1x WLAN MAC layers for downlink traffic (i.e. from the an authentication server to the mobile terminal such as a laptop) may participate in the authentication of one or more wireless mobile devices  140   1−n , a local server  120  and a virtual operator, which includes an authentication server  150 .  
         [0021]     In accordance with the present principles, an access  160  enables each mobile terminal  140   1−n , to securely access a WLAN  124 , which includes the plurality of access points and local server  120 , by authenticating both the mobile terminal itself, as well as its communication stream in accordance with the IEEE 802.1x protocol. The manner in which the access  160  enables such secure access can best be understood by reference to  FIG. 2 , which depicts the sequence of interactions that occurs over time among a mobile wireless communication device, say mobile terminal  140   n , the public WLAN  124 , the local web server  120 , and the authentication server  150   n . When configured with the IEEE 802.1x protocol, the access point  130   n  of  FIG. 1  maintains a controlled port and an un-controlled port, through which the access point exchanges information, with the mobile terminals  140   −n . The controlled port maintained by the access point  130   n  serves as the entryway for non-authentication information, such as data traffic to pass through the access point between the WLAN  124  and the mobile terminals  140   −n . Ordinarily, the access point  130   −n  keeps the respective controlled port closed in accordance with the IEEE 802.1x protocol until authentication of the mobile wireless communications device. The access points  130   −n  always maintain the respective uncontrolled port open to permit the mobile terminals  140   −n  to exchange authentication data with the authentication server  150   n .  
         [0022]     With reference to  FIG. 2 , a method in accordance with the present invention for improving the security of a mobile terminal in  140   n  in a WLAN  124  is generally accomplished by redirecting  210  a HTTP browser request  205 , embedding a session ID  215  inside the HTTP request  205  and matching two HTTP sessions using such a session ID  215  in the authentication server  150   n .  
         [0023]     More particularly, the method of the present invention processes an access request from a mobile terminal  140   n  through the WLAN  124 , access point  130   n  (web request  205  from the mobile terminal  140   n  ), by embedding in the (URL) the session ID  215 .  
         [0024]     With reference to  FIG. 2 , a method in accordance with the present invention for improving the security of a mobile terminal in  140   n  in a WLAN environment  124  redirects  220  the browser request to the local web server  120 . The local server  120  obtains the MAC address  138   n  associated with the mobile terminal  140   n , generates a session ID  215 , and stores a mapping associating the MAC address  138   n  and the session ID  215 . The WLAN  124  maintains a mapping between the session ID  215  and a MAC address  138   n  of the mobile terminal  140   n . The local server  120  generates a web page, requesting a user of the mobile terminal  140  to select a virtual operator, thereby selecting an appropriate authentication server  150 , embedding the session ID  215  into a web page  237  for transmission. The local server  120  also returns  230  the MAC address  138   n  having an associated session ID  215  embedded in the URL address.  
         [0025]     The mobile terminal responds by embedding the URL associated with a submit button to start an HTTPS session with an authentication server  150 , whereby the WLAN  124  sends the authorization request  240  having the session ID  215  embedded in the request, through HTTPS to the authentication server  150   n . Thereafter, the authentication server  150   n  processes the session ID  215  and communicates to the access point  130   n  via the WLAN  124 , the session ID  215  confirming  250  a successful authentication. The process also includes the step of receiving by the access point the MAC address associated with the session ID  215  one or more changes an access control filter and thereby allowing all communications having the MAC address to be received by the mobile terminal  140   n . The foregoing process allows encrypting the communication between the access point  130   n  and the mobile terminal  140   n  to insure a more secure access control.  
         [0026]     When the access point  130   n  and the authentication server  150   n  are separated by firewall  122 , or NAT servers, it is not possible for the authentication server  150   n  to directly communicate with the access points  130   1−n . This problem can be solved by having the access point  130   n  first contact the authentication server  150   n  to establish a communication context. When the access point  130   n  detects that one of the mobile terminal  140   1−n  starts the HTTPS communication with the authentication server  150   n  the associated access point  140   n  sends the authentication server  150   n  a message with the associated session ID  215  indicating that the authentication server  150   n  return the authentication result for that session.  
         [0027]     The access point  140   n  has several options available in establishing contact with the authentication server  150   n . By way of example, it may utilize HTTPS with the added benefit of the access point  140   n  and the authentication server  150   n  utilizing an existing protocol to mutually authenticate each other and secure the communication between them. One disadvantage in this approach is that HTTPS is carried over Telecommunication Control Protocol (TCP), thus it requires that the TCP connection remain open, until the mobile terminal  140   n  is authenticated. This may put resources into a queue on the access point  140   n .  
         [0028]     By way of example, another alternative is to utilize the RADIUS protocol, which is based on UDP, for the communication between the access point  130   n  and the authentication server  150 . The benefit of this approach is that no connections need to be maintained between the access point  130   n  and the authentication server  150 , while the mobile terminal  140   n  is being authenticated. This approach may not work in all firewall  122  configurations, because particular firewalls only permit HTTP, HTTPS, FTP, and TELNET to pass through.  
         [0029]     It is to be understood that the form of this invention as shown is merely a preferred embodiment. Various changes may be made in the function and arrangement of parts; equivalent means may be substituted for those illustrated and described; and certain features may be used independently from others without departing from the spirit and scope of the invention as defined in the following claims.