US 8,621,572 B2Granted

Method, apparatus and system for updating authentication, authorization and accounting session

AssigneeHuawei Technologies Co., Ltd.

InventorsYungui Wang, Jinwei Xia

Life of this patent

Estimating the term…

Loading patent…

Abstract

The present disclosure relates to a method, an apparatus and a system for updating an Authentication, Authorization and Accounting AAA session. The method includes: receiving an AAA session request sent by a second network access server, where the AAA session request includes a second session identifier and an ERP message; and updating a session according to the second session identifier and a stored first session identifier after successful user authentication that is performed according to the ERP message, where the first session identifier and the second session identifier correspond to the same user. As the session is updated according to the second session identifier and the stored first session identifier, synchronization of session information is ensured, thereby resolving an abnormal session problem that occurs when a home AAA server initiates a session or the network access server uses a session after re-authentication.

Claims9

Dependent claims

A method for updating an Authentication, Authorization and Accounting (AAA) session in a network system comprising a first and second network access servers, comprising:

receiving an AAA session request sent by the second network access server, wherein the AAA session request comprises a second session identifier and an EAP Re-authentication Protocol (ERP) message;
and
updating a session according to the second session identifier and a stored first session identifier after successful user authentication that is performed according to the ERP message, wherein the first session identifier and the second session identifier correspond to a same user;
wherein updating the session according to the second session identifier and the stored first session identifier comprises:
associating the first session identifier with the second session identifier;
and
performing session identifier replacement on a received session according to the association between the first session identifier and the second session identifier;
wherein before receiving the AAA session request carrying the second session identifier, the method further comprises:
when a user is attached to the first network access server, receiving an AAA session request sent by the first network access server to the home AAA server, wherein the AAA session request comprises a third session identifier and an EAP message;
storing the third session identifier;
creating a first session having a session identifier being the first session identifier, and associating the first session identifier with the third session identifier;
and
using the first session identifier to replace the third session identifier in the AAA session request sent by the first network access server, and forwarding, to the AAA server, the AAA session request on which session identifier replacement is performed, so that the home AAA server stores the first session identifier after successful user authentication that is performed according to the EAP message.

10 more elements

A server for updating a session identifier of an Authentication, Authorization, and Accounting (AAA) session request, the server comprising:

a non-transitory memory storage;
one or more processors accessible to the non-transitory memory storage;
and
one or more modules stored in the non-transitory memory storage and configured for execution by the one or more processors, the one or more modules including instructions:
to receive an AAA session request sent by the second network access server, wherein the AAA session request comprises a second session identifier and an EAP Re-authentication Protocol (ERP) message;
and
to update a session according to the second session identifier and a stored first session identifier after successful user authentication that is performed according to the ERP message, wherein the first session identifier and the second session identifier correspond to a same user;
wherein to update the session according to the second session identifier and the stored first session identifier comprises:
to associate the first session identifier with the second session identifier;
and
to perform session identifier replacement on a received session according to the association between the first session identifier and the second session identifier;
wherein to perform session identifier replacement on the received session according to the association between the first session identifier and the second session identifier comprises:
to receive an AAA session request sent by a home AAA server, wherein the AAA session request sent by the home AAA server carries the first session identifier;
to search for the second session identifier associated with the first session identifier according to the first session identifier;
and
to use the second session identifier to replace the first session identifier in the AAA session request sent by the home AAA server, and to forward, to the second network access server, the AAA session request on which session identifier replacement is performed;
wherein before to receive the AAA session request carrying the second session identifier, the modules stored in the memory further comprises instructions:
when a user is attached to the first network access server, to receive an AAA session request sent by the first network access server to the home AAA server, wherein the AAA session request comprises a third session identifier and an EAP message;
to store the third session identifier;
to create a first session having a session identifier being the first session identifier, and to associate the first session identifier with the third session identifier;
and
to use the first session identifier to replace the third session identifier in the AAA session request sent by the first network access server, and to forward, to the AAA server, the AAA session request on which session identifier replacement is performed, so that the home AAA server stores the first session identifier after successful user authentication that is performed according to the EAP message.

19 more elements

Dependencies are inferred from the claim text.

Facts

Application: 13/406,110Filed 27 Feb 2012 · continuation
Priority: CN 2009 1 01900437 Sep 2009
Published: US 2012/0159576 A121 Jun 2012
Granted: 31 Dec 2013
Term ends: Not estimatedThe source records don’t support an estimate.

Classification6 codes

H04L 12/6418
Hybrid switching systems: hybrid transport
H04L 63/20
Network architectures or network communication protocols for network security: for managing network security; network security policies in general
H04W 12/069
Authentication: using certificates or pre-shared keys
H04W 88/12
Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices: access point controller devices