# US 8,782,751 B2 · Systems and methods for user access authentication based on network access point > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 8,782,751 B2 - Document ID: US8782751B2 - Status: Granted - Kind: B2 - Application number: 13/423,953 - Filed: 2012-03-19 - Published: 2012-08-09 - Granted: 2014-07-15 - Earliest claimed: 2006-05-16 - Assignees: A10 Networks, Inc. - Applicants: Lee Chen; John Chiong; Yang Yu - Inventors: Lee Chen; John Chiong; Yang Yu - Web page: https://patentgrep.com/patent/US8782751B2 ## CPC - H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)} - H04W 12/06: Authentication - G11C 7/24: Memory cell safety or protection circuits, e.g. arrangements for preventing inadvertent reading or writing; Status cells; Test cells - H04L 63/107: {wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals} - H04W 12/08: Access security - H04W 12/72: Subscriber identity - H04W 12/73: Access point logical identity - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G11C: STATIC STORES (semiconductor memory devices H10B) ## Abstract Systems and methods of authenticating user access based on an access point to a secure data network include a secure data network having a plurality of a network access points serving as entry points for a user to access the secure data network using a user device. The user is associated with a user identity, each network access point with a network access point identity. The user uses a user device to send an access request, requesting access to the secure data network, to the network access point, which then sends an authentication request to an identity server. The identity server processes the authentication request, by validating the combination of the user identity and the network access point identity, and responds with an authentication response, granting or denying access, as communicated to the user device via an access response. ## Claims ### Claim 1 A method of user access authentication, the method comprising: receiving by a first network access point a first authentication request from a second network access point based on a user device access request for accessing a secure data network; sending a second authentication request based on the first authentication request to an identity server wherein the second authentication request is associated with the second network access point; obtaining from the user device access request a first network access point identity of the first network access point and a second network access point identity of the second network access point; determining at the identity server whether to grant a user device access to the secure data network by comparing a user identity and the first and second access point identities to a stored plurality of user identities and corresponding validated pairs of network access point identities; and granting access to the secure data network when the user identity and the access point identities obtained match with one of the stored plurality of user identities and its corresponding validated pair of network point identities. ### Claim 2 (depends on 1) The method of claim 1 further comprising maintaining a log of communication paths which tracks at least one of the first and second network access point identities. ### Claim 3 (depends on 2) The method of claim 2 wherein the second authentication request logs at least a portion of the communication paths. ### Claim 4 (depends on 2) The method of claim 2 comprising logging the first network access point identity and the second network access point identity. ### Claim 5 (depends on 1) The method of claim 1 wherein the secure data network comprises an application level secure data network. ### Claim 6 (depends on 5) The method of claim 5 wherein the access request seeks access to a network application, and the access request comprises a Transport Control Protocol (TCP) access request. ### Claim 7 (depends on 6) The method of claim 6 further comprising determining that access to the network application is sought, wherein the first network access point determines that access to the network application is sought. ### Claim 8 (depends on 6) The method of claim 6 wherein the network application comprises one or more of an enterprise application, an employee benefit application, a human resources application, an inventory information application, a library system, a conference workshop application, a live concert webcast, a hotel television over IP application, or a web application. ### Claim 9 A system for user access authentication, the system comprising: a secure data network comprising at least a first network access point and a second network access point, the first network access point that receives a first authentication request from the second network access point based on a user device access request for accessing the secure data network; and an identity server in communication with the secure data network via one of the network access points, wherein the identity server receives a second authentication request associated with the second network access point; wherein the identity server obtains from the user device access request a first network access point identity of the first network access point and a second network access point identity of the second network access point; determines whether to grant a user device access to the secure data network by comparing a user identity and the first and second access point identities to a stored plurality of user identities and corresponding validated pairs of network access point identities; and grants access to the secure data network when the user identity and the access point identities obtained match with one of the stored plurality of user identities and its corresponding validated pair of network point identities. ### Claim 10 (depends on 9) The system of claim 9 further comprising a log of communication paths which tracks at least one of the first and second network access point identities. ### Claim 11 (depends on 10) The system of claim 10 wherein the second authentication request logs at least a portion of the communication paths. ### Claim 12 (depends on 10) The system of claim 10 wherein the log comprises at least the first network access point identity and second network access point identity. ### Claim 13 (depends on 9) The system of claim 9 wherein the secure data network comprises an application level secure data network. ### Claim 14 (depends on 13) The system of claim 13 wherein the access request comprises a Transport Control Protocol (TCP) and seeks access to a network application. ### Claim 15 (depends on 14) The system of claim 14 wherein the first network access point determines that access to the network application is being sought. ### Claim 16 (depends on 14) The system of claim 14 wherein the network application comprises one or more of an enterprise application, an employee benefit application, a human resources application, an inventory information application, a library system, a conference workshop application, a live concert web cast, a hotel television over IP application, and a web application. ### Claim 17 A method of user access authentication, the method comprising: receiving at a first network access point an access request to a secure data network from a user device; generating an authentication request in response to receiving the access request wherein the authentication request comprises a log of a communication path; sending the authentication request from the first network access point via a second network access point to an identity server for processing; obtaining from the user device access request a first network access point identity of the first network access point and a second network access point identity of the second network access point; determining at the identity server whether to grant a user device access to the secure data network by comparing a user identity and the first and second access point identities to a stored plurality of user identities and corresponding validated pairs of network access point identities; and granting access to the secure data network when the user identity and the access point identities obtained match with one of the stored plurality of user identities and its corresponding validated pair of network point identities. ### Claim 18 (depends on 17) The method of claim 17 wherein the log of the communication path comprises the second network access point when the authentication request passes through the second network access point. ### Claim 19 (depends on 17) The method of claim 17 comprising sending an access response to the user device. ### Claim 20 (depends on 17) The method of claim 17 wherein the access request comprises the user identity and the authentication request comprises the user identity. ### Claim 21 (depends on 20) The method of claim 20 wherein the user identity comprises at least one of a user name, an identity of user device, a Media Access Control (MAC) address, an Internet Protocol (IP) address and port number, a device serial number, subscriber information in a subscriber identity module (SIM) card, subscriber information in a Universal Subscriber Identity Module (USIM) card, a telephone number, security information, a password, a security code, a secret answer to a security question, biometric characteristics, fingerprint data, eye retinal data, eye iris data voice pattern recognition data and signature recognition data. ### Claim 22 (depends on 17) The method of claim 17 comprising the identity server determining whether to grant the access request based on the user identity, a first network access identity of the first network access point and a second network access identity of the second network access point. ### Claim 23 (depends on 17) The method of claim 17 wherein the secure data network comprises an application level secure data network. ### Claim 24 (depends on 23) The method of claim 23 wherein the access request seeks access to a network application, and the access request comprises a Transport Control Protocol (TCP) access request. ### Claim 25 (depends on 24) The method of claim 24 further comprising determining that access to the network application is sought, wherein the first network access point determines that access to the network application is sought. ### Claim 26 (depends on 24) The method of claim 24 wherein the network application comprises one or more of an enterprise application, an employee benefit application, a human resources application, an inventory information application, a library system, a conference workshop application, a live concert web cast, a hotel television over IP application, or a web application. ### Claim 27 (depends on 17) The method of claim 17 wherein the secure data network comprises at least one of an Internet Protocol (IP) network, a Local Area Network (LAN), a Wide Area Network (WAN), a wireless network, a WiFi network, a General Packet Radio Service (GPRS) network, a public IP network, and a private IP network; wherein the user device comprises at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network; wherein the first network access point and/or the second network access point comprises at least one of a firewall, a wireless access point, a Dynamic Host Configuration Protocol (DHCP) server, a Remote Access Server (RAS), a Broadband Remote Access Server (BRAS), a web server, a secure web server, a virtual private network (VPN) server, a termination point of an access tunnel, a termination point of a virtual private network (VPN) tunnel, a termination point of a Generic Routing Encapsulation (GRE) tunnel, and a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and wherein the first network access point identity and/or the second network access point identity comprises at least one of a network access point name, an IP address, a port number, security information, a password, a security code, a device name, a machine identity, a serial number, an identity of an access tunnel termination point, and an Access Point Name (APN). ### Claim 28 A system for user access authentication comprising: a secure data network comprising at least a first network access point and a second network access point, and an identity server, wherein the first network access point receives an access request to the secure data network from a user device; wherein the system generates an authentication request in response to receiving the access request, the authentication request comprising a log of a communication path; sends the authentication request from the first network access point via the second network access point to an identity server for processings; obtains from the user device access request a first network access point identity of the first network access point and a second network access point identity of the second network access point; determines at the identity server whether to grant a user device access to the secure data network by comparing a user identity and the first and second access point identities to a stored plurality of user identities and corresponding validated pairs of network access point identities; and grants access to the secure data network when the user identity and the access point identities obtained match with one of the stored plurality of user identities and its corresponding validated pair of network point identities. ### Claim 29 (depends on 28) The system of claim 28 wherein the log of communication path comprises the second network access point when the authentication request passes through the second network access point. ### Claim 30 (depends on 28) The system of claim 28 wherein the identity server determines whether to grant the access request based on a user identity, a first network access identity of the first network access point, and a second network access identity of the second network access point. ### Claim 31 (depends on 28) The system of claim 28 wherein the secure data network comprises at least one of an Internet Protocol (IP) network, a Local Area Network (LAN), a Wide Area Network (WAN), a wireless network, a WiFi network, a General Packet Radio Service (GPRS) network, a public IP network, and a private IP network; wherein the user device comprises at least one of a desktop personal computer, a laptop personal computer, a personal data assistance (PDA), a cellular phone, a smart-phone, and a device having a computing unit connectable to a network; wherein the first network access point and/or the second network access point comprises at least one of a firewall, a wireless access point, a Dynamic Host Configuration Protocol (DHCP) server, a Remote Access Server (RAS), a Broadband Remote Access Server (BRAS), a web server, a secure web server, a virtual private network (VPN) server, a termination point of an access tunnel, a termination point of a virtual private network (VPN) tunnel, a termination point of a Generic Routing Encapsulation (GRE) tunnel, and a termination point of a Layer-2 Tunnel Protocol (L2TP) tunnel; and wherein the first network access point identity and/or the second network access point identity comprises at least one of a network access point name, an IP address, a port number, security information, a password, a security code, a device name, a machine identity, a serial number, an identity of an access tunnel termination point, and an Access Point Name (APN). ### Claim 32 (depends on 28) The system of claim 28 wherein the access request comprises a user identity which comprises at least one of a user name, an identity of user device, a Media Access Control (MAC) address, an Internet Protocol (IP) address and port number, a device serial number, subscriber information in a subscriber identity module (SIM) card, subscriber information in a Universal Subscriber Identity Module (USIM) card, a telephone number, security information, a password, a security code, a secret answer to a security question, biometric characteristics, fingerprint data, eye retinal data, eye iris data, voice pattern recognition data and signature recognition data.