Method for providing single step log-on access to a differentiated computer network

A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

• intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area, access to which is controlled by the NAS, and to the second area access to which is controlled by the SSG server;
• sending, from the SSG server to an Authentication Authorization and Accounting (AAA), server, an authorization request packet derived from the intercepted log-on request packet;
• receiving at the SSG server, from the AAA server, an authorization packet responsive to the authorization request packet;
• and
• processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber on to the SSG server for access to the second area when the subscriber logs on to the NAS.

A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

• intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);
• routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• receiving and processing an access-reply received from the AAA server at the SSG and based thereon providing log-on access for the subscriber to the second area;
• and
• routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

A method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

• intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;
• utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;
• routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• receiving and processing an access-reply received from the AAA server at the SSG and, based thereon, providing log-on access for the subscriber to the second area;
• and
• routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

A method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said method comprising:

• receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;
• forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• receiving a responsive access-reply at the SSG from the AAA server;
• checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;
• if the access-reply contains an assigned IP address, then:
• logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• if the access-reply does not contain an assigned IP address, then:
• logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;
• receiving from the NAS at the SSG an accounting-start request identifying the NAS-assigned IP address and the user identification;
• replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• forwarding the accounting-start request from the SSG to the AAA server.

A method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said method comprising:

• receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;
• forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;
• checking the access-reply packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;
• if the access-reply packet contains an assigned IP address, then:
• logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;
• forwarding the access-reply packet to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply packet and the user identification to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• logging the subscriber onto the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply packet and the user identification to the NAS;
• receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying a NAS-assigned IP address and the user identification;
• replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• forwarding the accounting-start request packet from the SSG to the AAA server.

An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said apparatus comprising:

• means for intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area, access to which is controlled by the NAS, and to the second area, access to which is controlled by the SSG server;
• means for sending, from the SSG server to an Authentication Authorization and Accounting (AAA) server, an authorization request packet derived from the intercepted log-on request packet;
• means for receiving at the SSG server, from the AAA server, an authorization packet responsive to the authorization request packet;
• and
• means for processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber on to the SSG server for access to the second area when the subscriber logs on to the NAS.

An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said apparatus comprising:

• means for intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);
• means for routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• means for receiving and processing an access-reply received from the AAA server at the SSG and, based thereon, providing log-on access for the subscriber to the second area;
• and
• means for routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

An apparatus for providing a subscriber with single step log-on access to a computer network having a first area and a second area, said method comprising:

• means for intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;
• means for utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;
• routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• means for receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area;
• and
• means for routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

An apparatus for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said apparatus comprising:

• means for receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;
• means for forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• means for receiving a responsive access-reply at the SSG from the AAA server;
• means for checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;
• if the access-reply contains an assigned IP address, then:
• means for logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• means for forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• if the access-reply does not contain an assigned IP address, then:
• means for logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;
• means for assigning a user identification to the subscriber at the SSG;
• means for forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;
• means for receiving from the NAS at the SSG an accounting-start request identifying a NAS-assigned IP address and the user identification;
• means for replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• means for forwarding the accounting-start request from the SSG to the AAA server.

An apparatus for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, said apparatus comprising:

• means for receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;
• means for forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• means for receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;
• means for checking the access-reply packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;
• if the access-reply packet contains an assigned IP address, then:
• means for logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;
• means for forwarding the access-reply packet to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• means for logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• means for assigning a user identification to the subscriber at the SSG;
• means for forwarding the access-reply packet and the user identification to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• means for logging the subscriber onto the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• means for assigning a user identification to the subscriber at the SSG;
• means for forwarding the access-reply packet and the user identification to the NAS;
• means for receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying a NAS-assigned IP address and the user identification;
• means for replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• means for forwarding the accounting-start request packet from the SSG to the AAA server.

An apparatus for providing a single step log-on access for a subscriber of a computer network having a first area and a second area, said computer network including at least one Network Access Server (NAS) and at least one Authentication Authorization and Accounting (AAA) Server, said NAS providing access for the subscriber to said first area, said apparatus comprising:

• a Service Selection Gateway (SSG) Server providing access for the subscriber to the second area, said SSG Server connected between the NAS and the AAA Server, said SSG Server:
• (1) receiving an access-request packet from the NAS when the subscriber connects the NAS, (2) forwarding said access-request packet to the AAA Server, (3) receiving an access-reply packet from the AAA Server in response to said access-request packet, and (4) forwarding said access-reply packet to the NAS;
• and
• processing information in said access-reply packet for enabling said SSG Server to automatically log the subscriber onto said SSG Server when the subscriber logs onto the NAS.

A system for providing a single step log-on access for a subscriber of a computer network having a first area and a second area, said system comprising:

• a Network Access Server (NAS) for providing access for the subscriber to the first area, said NAS sending an access-request packet when the subscriber connects to said NAS according to a communications protocol;
• an Authentication Authorization and Accounting (AAA) Server for receiving said access-request packet and sending an access-reply packet in response;
• and
• a Service Selection Gateway (SSG) Server for providing access for the subscriber to the second area, said SSG Server connected between said NAS and said AAA Server, said SSG Server receiving said access-request packet from said NAS, forwarding said access-request packet to said AAA Server, receiving said access-reply packet in from said AAA Server, and forwarding said access-reply packet to said NAS.

A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access to a subscriber of a computer network having a first area and a second area, said method comprising:

• linking a Service Selection Gateway (SSG) to a Network Access Server (NAS), the NAS providing the subscriber with access to the first area, and said SSG providing the subscriber with access to the second area, wherein the subscriber supplies data packets to log-on to the NAS in order to obtain access to the first area;
• linking the SSG to an Authentication Authorization and Accounting (AAA) Server;
• intercepting and forwarding with the SSG the data packets sent between the NAS and the AAA server with the SSG;
• and
• processing information in the data packets with the SSG for enabling the SSG to automatically log the subscriber on to the SSG when the subscriber logs on to the NAS.

A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access for a subscriber of a computer network having a first area and a second separate area, said method comprising:

• receiving access-request packets from a Network Access Server (NAS) at a Service Selection Gateway (SSG);
• utilizing at the SSG information in said access-request packets to initiate log-on for said subscriber to the second area;
• routing said access-request packets from said SSG to an Authentication Authorization and Accounting (AAA) Server to initiate log-on for the subscriber to the first area;
• and
• routing access-reply packets responsive to said access-request packets received at said SSG from said AAA Server to said NAS to complete log-on for the subscriber to the first area.

A programmable storage device readable by a machine tangibly embodying a program of instructions executable by the machine to perform method steps for providing single step log-on access to a subscriber of a computer network, said computer network differentiated into a plurality of areas, said method comprising:

• receiving an access-request packet from a Network Access Server (NAS) at a Service Selection Gateway (SSG) when the subscriber connects to the NAS, in accordance with a communications protocol;
• forwarding said access-request packet to an Authentication Authorization and Accounting (AAA) Server;
• receiving an access-reply packet from the AAA Server at the SSG in accordance with the protocol;
• determining if said access-reply packet contains an Internet Protocol (IP) address for the subscriber, the IP address assigned by the AAA Server;
• if the access-reply packet contains an AAA-assigned IP address, then:
• logging the subscriber on to the SSG Server with said AAA-signed IP address, if said access-reply packet contains authorization from said AAA Server;
• forwarding the access-reply packet to the NAS;
• and
• logging the subscriber on to the NAS with the AAA-assigned IP address, if the access-reply packet contains authorization from the AAA Server;
• or
• if the access-reply packet does to contain an AAA-assigned IP address, then:
• logging the subscriber on to the SSG server with a temporary IP address, if said access-reply packet contains authorization from the AAA Server;
• assigning a user identification to the subscriber;
• forwarding the access-reply packet and the user identification to the NAS;
• logging the subscriber on to the NAS with a NAS-assigned IP address, if the access-reply packet contains authorization from the AAA Server;
• receiving an accounting-start packet from said NAS at the SSG said accounting-start packet containing a NAS-assigned IP address and the user identification;
• reading accounting-start packet to determine the NAS-assigned IP address of the subscriber;
• replacing the temporary IP address with the NAS-assigned IP address on the SSG;
• and
• forwarding the accounting-start packet to the AAA Server.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

• intercepting at a service selection gateway (SSG) server, from a Network Access Server (NAS), a log-on request packet initiated by a user seeking to gain access to the first area and to the second area;
• sending, from the SSG server to an Authentication Authorization and Accounting (AAA), server, an authorization request packet derived from the received log-on request packet;
• receiving, from the AAA server, an authorization packet responsive to the authorization request packet;
• and
• processing, at the SSG server, the log-on request packet and the authorization packet for enabling the SSG server to automatically log the subscriber onto the SSG server for access to the second area when the subscriber logs onto the NAS.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

• intercepting a log-on request initiated by the subscriber at a Service Selection Gateway (SSG);
• routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area;
• and
• routing the access-reply received from the AAA server responsive to the log-on request to a Network Access Server (NAS) to complete log-on for the subscriber to the first area.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on access to a computer network having a first area and a second area, the method comprising:

• intercepting, at a Service Selection Gateway (SSG), a log-on request received from a network access server (NAS) and initiated by the subscriber;
• utilizing at the SSG information contained in the log-on request to initiate log-on for the subscriber to the second area;
• routing the log-on request from the SSG to an Authentication, Authorization and Accounting (AAA) server to initiate log-on for the subscriber to the first area;
• receiving and processing an access-reply received from the AAA Server at the SSG and, based thereon, providing log-on access for the subscriber to the second area;
• and
• routing an access-reply received from the AAA server at the SSG to the NAS to complete log-on for the subscriber to the first area.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, the method comprising:

• receiving from a Network Access Server (NAS) at a Service Selection Gateway (SSG) an access-request;
• forwarding the access-request from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• receiving a responsive access-reply at the SSG from the AAA server;
• checking the access-reply at the SSG to determine if it contains an Internet Protocol (IP) address assigned by the AAA server to the subscriber;
• if the access-reply contains an assigned IP address, then:
• logging the subscriber on to the SSG with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• forwarding the access-reply to the NAS so that the subscriber may log-on to the NAS with the assigned IP address if the access-reply contains authorization to do so from the AAA server;
• if the access-reply does not contain an assigned IP address, then:
• logging the subscriber on to the SSG with a temporary IP address if the access-reply contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply and the user identification to the NAS so that subscriber may log-on to the NAS with a NAS-assigned IP address if the access-reply contains authorization to do so from the AAA server;
• receiving from the NAS at the SSG an accounting-start request identifying a NAS-assigned IP address and the user identification;
• replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• forwarding the accounting-start request from the SSG to the AAA server.

A program storage device readable by a machine, tangibly embodying a program of instructions executable by the machine to perform a method for providing a subscriber with single step log-on to a computer network differentiated into a plurality of areas, the method comprising:

• receiving from a network access server (NAS) at a service selection gateway (SSG) an access-request packet in accordance with a communications protocol;
• forwarding the access-request packet from the SSG to an Authentication, Authorization and Accounting (AAA) server;
• receiving a responsive access-reply packet in accordance with the communications protocol at the SSG from the AAA server;
• checking the access-replay packet at the SSG to determine if it contains an Internet Protocol (IP) address assigned to the subscriber by the AAA server;
• if the access-reply packet contains an assigned IP address, then:
• logging the subscriber on to the SSG with the assigned IP address if the access-reply packet contains authorization to do so from the AAA server;
• forwarding the access-reply packet to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply packet and the user identification to the NAS;
• if the access-reply packet does not contain an assigned IP address, then:
• logging the subscriber on to the SSG with a temporary IP address if the access-reply packet contains authorization to do so from the AAA server;
• assigning a user identification to the subscriber at the SSG;
• forwarding the access-reply packet and the user identification to the NAS;
• receiving from the NAS at the SSG an accounting-start request packet in accordance with the communications protocol, the accounting-start request packet identifying the NAS-assigned IP address and the user identification;
• replacing the temporary IP address with the NAS-assigned IP address at the SSG;
• and
• forwarding the accounting-start request packet from the SSG to the AAA server.