METHOD AND A NETWORK NODE FOR CONNECTING A USER DEVICE TO A WIRELESS LOCAL AREA NETWORK

The present invention relates to a method and a network node (6) for connecting a user device (2) to a wireless local area network, WLAN (4), when there has been a rejection during a first attempt to connect the user device (2) to the WLAN (2). The method intercepts the rejection in the network node (6) and sends a first authentication success message from the network node (6) to the user device (2). The user device (2) is redirected to an authentication web portal (10), where the user device (2) is prompted for authentication data. The network node (6) then receives a second authentication success message from the authentication web portal (10) and grants the user device (2) access to the WLAN (4), the extent of access being authentication defined by the service subscription of the user device (2).

DETAILED DESCRIPTION

FIG. 1is a schematic view illustrating an exemplary environment, in which a user device may connect to a WLAN. The environment comprises the user device2itself, an access point4of the WLAN, a network node6, which is connectable to the WLAN and which further may be connected to a home server8and to a web portal10. The user device2may be a mobile telephone, a laptop, a smart phone, a tablets PC or any other mobile user device connectable to the WLAN.

FIG. 1only shows one access point4, but it should be noted that a WLAN usually has many different access points4and thatFIG. 1only shows the principal that the user device2is connectable to the WLAN through any access point4, which is readily understood by a person skilled in the art. Thus, below the reference numeral4can denote the WLAN as a whole and not only the access point or points. The network node6, which is closer depicted inFIG. 2, comprises a processing unit16, a control unit14etc., capable of executing a computer program comprising computer program code. The computer program may be stored in some type of storage device12such as any combination of a Random Access Memory (RAM) and a Read Only Memory (ROM). The memory may also comprise persistent storage, which, for example, can be any single one or combination of magnetic memory, optical memory, or solid state memory or even remotely mounted memory.

As is evident inFIG. 1the different devices may be interconnected to each other in different ways. It lies within the skills of a person skilled in the art to set up servers, different network nodes, WLANs in order to adapt the environment such that the user device is connectable thereto.

With reference toFIG. 3a flow sequence describing how the user device2is connecting to the WLAN4, in the environment depicted inFIG. 1, will now be described in detail. It should be understood that the connection itself of the user device2to the WLAN4is done by using the 802.1x, which is an enhanced security implementation based on a subset of the IEEE P802.11 Standard. This standard and its signaling are known to a person skilled in the art and are therefore not explained in detail here. Thus, the flow sequence starts, in step302, with that the user device2finds the access point and is registered in the WLAN4to which the access point belongs. The user device2then sends an access request, in step304, to the network node6. The access request needs to be authenticated, in step306, before the user device2is allowed to access the WLAN4. The authentication may according to some embodiments be done in the network node6itself or as is shown in the embodiment ofFIG. 3in the home server8of the user device2.

If this first access request attempt is successful a connection between the user device2and the WLAN is established and the connection process is terminated. This case with a first successful connection is not what the present invention is concerned with. The present invention is instead focused on the cases when there has been a rejection during a first attempt to connect the user device2to the WLAN4. Such rejection may be the result if the credentials in the user device2for some reason are not properly configured. The user device2may also be rejected if the WLAN4belongs to a service provider that does not have a roaming agreement with the service provider of the user device2. Under such circumstances the user device2has hitherto not been able to connect the WLAN4. Various embodiments of the present invention address this problem.

Thus, if the first access request attempt is unsuccessful the home server8or the network node6, depending on where the authentication is made, will return an access denied message in step308, i.e. an rejection to access the WLAN4. According to some embodiments of the present invention this rejection is intercepted by the network node6, instead of being sent directly to the user device2, as in prior art. Thus, the network node6keeps the rejection result for itself and instead sends a first authentication success message, in step310, to the user device2. In a preferred embodiment of the present invention the first authentication success message also comprises data that enforces the user device into an un-authenticated subscriber management mode in which all network nodes are informed that the user device has not yet been authenticated. During this un-authenticated subscriber management mode the user device2is forced to connect to the web portal10, in steps312and314. The web portal10returns an authentication portal page, in step316, to the user device2, in which the subscriber has to enter his login data, such as username and password. The login data is sent to the web portal10in step318. If the login data is correct, the network node6will get noticed, in step320, that the user device2now has been authenticated and grant access, in step322, to the user device2. In some preferred embodiments of the present invention granted access may trigger the start of accounting, in step324, such that the home server8of the user device2gets notified and registers the connection time of the user device.

It should be noted that in context of the present application the home server8is the server of the service provider of the user device2.

The method according to the present invention will now be described closer with reference toFIG. 4. As mentioned above the method for connecting the user device2to the WLAN4is triggered when there has been a rejection during a first attempt to connect the user device2to the WLAN4. Such rejection is intercepted by the network node6in a first step402of the method. In a second step404the network node6sends the first authentication success message to the user device2. The first authentication success message may, as mentioned above comprise data that forces the user device2into the un-authenticated subscriber management mode. In this mode all network nodes of the WLAN4are informed that the user device2has not yet been authenticated. The first authentication success message also comprises data that, in a third step406of the method redirects the user device2to an authentication web portal10. At this web portal10the user device2is prompted for authentication data or login data. Such data may be a username and a password or identification number of a prepaid voucher that the service provider of the present WLAN4has issued.

If the authentication is successful the network node6will, in a fourth step408of the method, receive a second authentication success message from the authentication web portal10. After this, the network node6will grant the user device2access to the WLAN4in a fifth step410. The extent of access to the WLAN4may be defined by the service subscription of the user device2or by the prepaid voucher that was used to get access to the WLAN4.

In a preferred embodiment the network node6may after intercepting the rejection proceed with generating security keys which will allow encryption or ciphering.

According to some embodiments of the present invention the method steps described above are to a large extent performed in the network node6when there has been a rejection during a first attempt to connect the user device2to the WLAN4. The network node6is configured to perform the steps of intercepting the rejection and sending a first authentication success message to the user device2. The network node6then redirects the user device2to an authentication web portal10, where the user device2is prompted for authentication data or login data. Such data may, as mentioned above, be a username and a password or identification number of a prepaid voucher that the service provider of the present WLAN4has issued. The network node6is then receives the second authentication success message from the authentication web portal10and grants the user device2access to the WLAN4, the extent of access being defined by the service subscription of the user devices2.

In a preferred embodiment of the present invention the network node6may further be configured to enforce the user device2into an un-authenticated subscriber management mode in which all network nodes are informed that the user device2has not yet been authenticated.

In yet another preferred embodiment of the present invention the network node6may be configured to, after intercepting the rejection, proceed with generating security keys which will allow encryption or ciphering.

It should be understood that the network node6may be any network node in an environment as depicted inFIG. 1as long as it is configured to perform the above mentioned functionality. In preferred embodiments of the present invention the network node6may be an Authentication, Authorization and Accounting (AAA) server, an AAA proxy or a broadband network gateway.

Turning now toFIG. 5, which schematically shows one example of a computer program product40comprising computer readable means41. On this computer readable means41, a computer program can be stored, which computer program, when run on the processing unit16of the network node6, can cause the network node to execute the method according to various embodiments described in the present disclosure. In this example, the computer program product is an optical disc, such as a CD (compact disc), a DVD (digital versatile disc) or a blue-ray. The computer-readable means can also be a solid state memory, such as flash memory or a software package (also sometimes referred to as software application, application or APP) distributed over a network, such as the Internet.

Thus, with embodiments of the method and the network described above it will be relatively easy to connect the user device to the WLAN despite that fact that the user device already has been rejected one time from connecting to the WLAN. This means that rejections that may be the result of not properly configured credentials in the user device or of a WLAN that does not have a roaming agreement with the service provider of the user device are no longer an obstacle for connecting to the WLAN. The present method will give the user device a second chance using a second approach to authenticating the user device via a web portal but without the hassle of having to use of two SSIDs for one and the same WLAN.

Although the present invention has been described above with reference to specific embodiments, it is not intended to be limited to the specific form set forth herein. Rather, the invention is limited only by the accompanying claims and, other embodiments that the specific above are equally possible within the scope of the appended claims.

In the claims, the term “comprise/comprises” does not exclude the presence of other elements or steps. Furthermore, although individual features may be included in different claims, these may possibly advantageously be combined, and the inclusion of different claims does not imply that a combination of features is not feasible and/or advantageous. In addition, singular references do not exclude a plurality. Reference signs in the claims are provided merely as a clarifying example and should not be construed as limiting the scope.