Network access authentication and authorization using a blockchain network

Patent metadata

Field	Value
Publication number	US-11558379-B2
Application number	US-201916511808-A
Country	US
Kind code	B2
Filing date	Jul 15, 2019
Priority date	Jul 15, 2019
Publication date	Jan 17, 2023
Grant date	Jan 17, 2023

Abstract

Some implementations of the disclosure are directed to receiving, at an authentication server system, a distributed ledger address transmitted by a client device to identify itself during an authentication process for accessing a network, where the distributed ledger address corresponds to a distributed ledger network; transmitting an authentication challenge message from the authentication server to the client device; in response to transmitting the authentication challenge message from the authentication server to the client device, receiving at the authentication server, a response to the challenge message including a signature; and using at least the distributed ledger network to determine if the signature used to sign the response to the challenge message is associated with the distributed ledger address transmitted by the client device.

First claim

What is claimed is:

1. A method, comprising:
receiving, at an authentication server system, a distributed ledger address transmitted by a client device to identify itself during an authentication process for accessing a network, wherein the distributed ledger address corresponds to a distributed ledger network;
transmitting an authentication challenge message from the authentication server to the client device;
in response to transmitting the authentication challenge message from the authentication server to the client device, receiving at the authentication server, a response to the challenge message including a signature,
wherein the signature is created using a private key to apply a hash function to a randomly generated string, and
wherein the response includes the signature and the randomly generated string; and
using at least the distributed ledger network to determine if the signature used to sign the response to the challenge message is associated with the distributed ledger address transmitted by the client device.

2. The method of claim 1 , wherein using at least the distributed ledger network to determine if the signature used to sign the response to the challenge message is associated with the distributed ledger address transmitted by the client device, comprises: attempting to verify the signature using a public key corresponding to the distributed ledger address, wherein the public key is retrieved from the distributed ledger network.

3. The method of claim 2 , further comprising:
if the signature is verified using the public key, the authentication server system providing the client device access to the network; and
if the signature is not verified using the public key, the authentication server system denying the client device access to the network.

4. The method of claim 3 , further comprising: after authentication:
receiving a request from the client device to access a network service; and
verifying at the authentication server that credentials provided by the client device during authentication are linked with the distributed ledger address in a smart contract deployed on the distributed ledger network.

5. The method of claim 4 , further comprising: the authentication server system querying the smart contract to determine whether the network access service requested by the client device associated with the credentials and distributed ledger address can be provided to the client device.

6. The method of claim 5 , wherein the smart contract comprises data including an amount of cryptocurrency pledged by a user of the client device, wherein in response to the query from the authentication server system, the smart contract determines whether a sufficient amount of the pledged cryptocurrency is available to provide the requested network access service.

7. The method of claim 6 , further comprising:
the authentication server system querying the smart contract to deduct the amount of cryptocurrency required to provide the requested network access service; and
the authentication server system providing the requested network access service to the client device.

8. The method of claim 1 , wherein the operations of receiving the distributed ledger address, transmitting the authentication challenge message, and receiving the response to the challenge message are performed using a network access device as an intermediary for communications between the client device and the authentication server system.

9. The method of claim 8 , wherein the authentication server system is a Remote Authentication Dial-In User Service (RADIUS) server and wherein the network access device is a RADIUS client.

10. A non-transitory computer readable medium having instructions stored thereon, that when executed by a processor, perform operations of:
transmitting an authentication challenge message from the authentication server to the client device;
in response to transmitting the authentication challenge message from the authentication server to the client device, receiving at the authentication server, a response to the challenge message including a signature,
wherein the signature is created using a private key to apply a hash function to a randomly generated string, and
wherein the response includes the signature and the randomly generated string; and
using at least the distributed ledger network to determine if the signature used to sign the response to the challenge message is associated with the distributed ledger address transmitted by the client device.

11. The non-transitory computer readable medium of claim 10 , wherein using at least the distributed ledger network to determine if the signature used to sign the response to the challenge message is associated with the distributed ledger address transmitted by the client device, comprises: attempting to verify the signature using a public key corresponding to the distributed ledger address, wherein the public key is retrieved from the distributed ledger network.

12. The non-transitory computer readable medium of claim 11 , wherein the instructions, when executed by the processor, further perform operations of:
if the signature is verified using the public key, the authentication server system providing the client device access to the network; and
if the signature is not verified using the public key, the authentication server system denying the client device access to the network.

13. The non-transitory computer readable medium of claim 12 , wherein the instructions, when executed by the processor, further perform operations of:
receiving a request from the client device to access a network service; and
verifying at the authentication server that credentials provided by the client device during authentication are linked with the distributed ledger address in a smart contract deployed on the distributed ledger network.

14. The non-transitory computer readable medium of claim 13 , wherein the instructions, when executed by the processor, further perform operations of: the authentication server system querying the smart contract to determine whether the network access service requested by the client device associated with the credentials and distributed ledger address can be provided to the client device.

15. The non-transitory computer readable medium of claim 14 , wherein the smart contract comprises data including an amount of cryptocurrency pledged by a user of the client device, wherein in response to the query from the authentication server system, the smart contract determines whether a sufficient amount of the pledged cryptocurrency is available to provide the requested network access service.

16. The non-transitory computer readable medium of claim 15 , wherein the instructions, when executed by the processor, further perform operations of:
the authentication server system querying the smart contract to deduct the amount of cryptocurrency required to provide the requested network access service; and
the authentication server system providing the requested network access service to the client device.

17. A non-transitory computer readable medium having instructions stored thereon, that when executed by a processor, perform operations of:
authenticating a client device using an authentication server system, wherein during authentication, the client device provides user credentials and a distributed ledger address belonging to a user of the client device,
wherein the authentication further comprises a response from the client device with a signature that is created using a private key to apply a hash functi

Assignees

• Hewlett Packard Entpr Dev Lp

Inventors

• Salman Mohammed
• Prasad Nittur Rajarao Bhagya
• Tripathi Ram
• Goyal Mohit
• Ganapathy Achari Rajesh Kumar

Classifications

• G06Q20/3829

  involving key management · CPC title

• G06Q20/389

  Keeping log of transactions for guaranteeing non-repudiation of a transaction · CPC title

• H04L63/0823

  using certificates (cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263) · CPC title

• H04L63/0892

  by using authentication-authorization-accounting [AAA] servers or protocols · CPC title

• H04L2209/56

  Financial cryptography, e.g. electronic payment or e-cash · CPC title