Method and apparatus for passpoint EAP session tracking

#In recent years, Wireless Fidelity (Wi-Fi) networks have been increasingly deployed in urban areas, office buildings, and college campuses, as well as public venues such as airports, stadiums, and coffee shops. In response to such increased Wi-Fi network deployment, broadband service providers have sought to provide their mobile subscribers with the capability of accessing Wi-Fi networks in a manner that is easy, quick, and seamless. By providing easy, quick, and seamless access to Wi-Fi networks, such broadband service providers can assure that their mobile subscribers can have convenient access to the Internet from virtually any Wi-Fi-enabled device in a wide range of mobile environments.

#In a typical scenario, a mobile subscriber with a Wi-Fi-enabled device (e.g., a Wi-Fi-enabled smartphone, tablet computer, or laptop computer) can enter a communication range of a wireless access point within a Wi-Fi network. For example, such a wireless access point may include a Wi-Fi controller configured to support Hotspot 2.0, which is a technology based on the Institute of Electrical and Electronic Engineers (IEEE) 802.11u, 802.11i, and 802.1x standards and generally known as Wi-Fi-certified Passpoint™. Having entered the communication range of the wireless access point, the Wi-Fi-enabled device can receive, from the wireless access point, a beacon message indicating that the wireless access point is configured to support Hotspot 2.0. If the Wi-Fi-enabled device is also configured to support Hotspot 2.0, then the Wi-Fi-enabled device can send, using the Access Network Query Protocol (ANQP) defined in the IEEE 802.11u standard, an ANQP query message to the wireless access point to determine what authentication types and/or protocols are supported within the Wi-Fi network. The wireless access point can receive the ANQP query message from the Wi-Fi-enabled device, and forward the ANQP query message to an ANQP server configured to provide ANQP service for the Wi-Fi network.

#In response to the ANQP query message, the ANQP server can provide, in an ANQP response message, a list of supported authentication types and/or protocols to the wireless access point, which can forward the list of supported authentication types and/or protocols to the Wi-Fi-enabled device. For example, such authentication types and/or protocols supported within the Wi-Fi network may be based on the Extensible Authentication Protocol (EAP), and may include the EAP-Transport Layer Security (EAP-TLS), the EAP-Tunneled Transport Layer Security (EAP-TTLS), the EAP for GSM Subscriber Identity Module (EAP-SIM), the EAP Method for Universal Mobile Telecommunications System (UMTS) Authentication and Key Agreement (EAP-AKA), and/or any other suitable authentication types and/or protocols. The ANQP server can also provide, in an ANQP response message, a list of domain names of supported roaming service providers to the wireless access point, which can forward the list of domain names to the Wi-Fi-enabled device. Such a list of domain names can include the domain name of the mobile subscriber's broadband service provider.

#The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate one or more embodiments described herein, and, together with the Detailed Description, explain these embodiments. In the drawings:

#FIG. 1 is a block diagram illustrating an exemplary system for performing authentication sessions between Wi-Fi-enabled devices and authentication servers via a wireless access point within a Wi-Fi network;

#FIG. 2 is signaling diagram illustrating a conventional approach to performing an authentication session between a Wi-Fi-enabled device and an authentication server via a wireless access point within a Wi-Fi network;

#Systems and methods of tracking authentication sessions performed between Wireless Fidelity (Wi-Fi)-enabled devices and authentication servers via wireless access points within Wi-Fi networks are disclosed that allow authentication messages to be easily correlated for determining the authentication sessions to which the respective authentication messages belong. The disclosed systems and methods employ a tracking tag that an authentication server can insert into each authentication message that it sends to a Wi-Fi-enabled device via a wireless access point in an authentication session. By having the wireless access point echo the same tracking tag in each subsequent authentication message that it forwards to the authentication server in the authentication session, and storing each authentication message exchanged between the authentication server and the wireless access device with its tracking tag in a database, the authentication messages stored in the database can be correlated using their tracking tags to identify the authentication session to which the respective authentication messages belong, thereby facilitating subsequent troubleshooting of the authentication session in the event of an unexpected failure.

#FIG. 1 depicts an illustrative embodiment of an exemplary system 100 for tracking an authentication session performed between a Wi-Fi-enabled device and an authentication server via a wireless access point within a Wi-Fi network. As shown in FIG. 1, the system 100 can include a wireless access point 102, at least one Wi-Fi-enabled device 104, a local Access Network Query Protocol (ANQP) server 106, and a remote ANQP server 114. The wireless access point 102 can include an antenna 113, a Wi-Fi controller 110, and data storage such as a database (DB) 112. The remote ANQP server 114 can likewise include data storage, such as a DB 118. In one embodiment, the wireless access point 102 can be deployed within a wireless local area network (WLAN) such as a Wi-Fi network 108 that conforms to one or more of the Institute of Electrical and Electronic Engineers (IEEE) 802.11 series of standards, and can be communicably coupleable to the remote ANQP server 114 over a communications network 116 such as the Internet. The Wi-Fi-enabled device 104 can be a Wi-Fi-enabled smartphone, tablet computer, laptop computer, or any other suitable Wi-Fi-enabled device. Further, the Wi-Fi controller 110 can be configured to support Hotspot 2.0, which is a technology based on the IEEE 802.11u, 802.11i, and 802.1x standards and generally known as Wi-Fi-certified Passpoint™, or any other suitable wireless hotspot technology. In addition, the local and remote ANQP servers 106, 114 can each be configured to conform to the Remote Authentication Dial-In User Service (RADIUS) protocol defined in RFC 2865 Remote Authentication Dial In User Service (RADIUS), June 2000 or latest revision, or any other suitable protocol. The system 100 can further include a client computer 115 that is communicably coupleable (such as over the network 116) to the wireless access point 102 and/or the remote ANQP server 114.

#In an exemplary mode of operation, a user of the Wi-Fi-enabled device 104 can enter a communication range of the wireless access point 102 within the Wi-Fi network 108. For example, the user of the Wi-Fi-enabled device 104 may be a mobile subscriber of a broadband service provider. Having entered the communication range of the wireless access point 102, the Wi-Fi-enabled device 104 can receive, from the wireless access point 102, a beacon message indicating that the wireless access point 102 is configured to support Hotspot 2.0. If the Wi-Fi-enabled device 104 is also configured to support Hotspot 2.0, then the Wi-Fi-enabled device 104 can send, using the Access Network Query Protocol (ANQP) defined in the IEEE 802.11u standard, an ANQP query message to the wireless access point 102 to determine what authentication types and/or protocols are supported within the Wi-Fi network 108. The wireless access point 102 can receive the ANQP query message from the Wi-Fi-enabled device 104, and forward the ANQP query message to an authentication server such as the local ANQP server 106, which is configured to provide ANQP service for the Wi-Fi network 108.