Method and apparatus for secure immediate wireless access in a telecommunications network

• US 20030166398A1
• Filed: 04/30/2002
• Published: 09/04/2003
• Est. Priority Date: 03/04/2002
• Status: Active Grant

• Current Assignee: Evolving Systems Labs Incorporated
• Original Assignee: Telespree Communications (CCUR Holdings, Inc.)
• Inventors: Netanel, Eran
• Granted Patent: US 7,197,301 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: G06F 2221/2103 Challenge-response
• CPC Class Codes: H04L 2209/56 Financial cryptography, e.g. electronic payment or e-cash
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 9/3247 involving digital signatures
• CPC Class Codes: H04L 9/3271 using challenge-response
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity

Abstract

A wireless telephone and messaging system provides Secure Immediate Wireless Access (SIWA) to wireless telephones onto existing wireless networks, such as GSM, CDMA, TDMA, and analog (AMPS). The SIWA protocol uses existing wireless network messaging to exchange information between wireless devices and a network server, referred to herein as an Intelligent Service Manager (ISM). The ISM acts as a gateway between wireless devices and wireless service provider, and provides the wireless devices with an immediate limited or unlimited access to the wireless network. The ISM can also deny access to the wireless network from unauthorized wireless devices.

Claims

1. A secure immediate wireless access apparatus that enables at least one wireless device to exchange information via an existing wireless network, comprising:

means for using existing wireless network messaging to exchange said information between said wireless device and a network server;

said network server comprising an intelligent service manager which operates as a trusted gateway between said wireless device and a wireless network to automatically provide said wireless device with mandatory network identifier and security keys;

to provide service to a user without a need for manual provision of accounts;

to provide said wireless device with immediate access to said wireless network; and

to provide access to service offered by said wireless service provider to said user at the time they are needed by said user.

2. The apparatus of claim 1, wherein said intelligent service manager denies access to said wireless network from unauthorized wireless devices.

3. The apparatus of claim 1, wherein said intelligent service manager denies access to said wireless network from authorized, non-provisioned, and non-activated wireless devices.

4. The apparatus of claim 1, wherein said intelligent service manager provides said wireless device with either of limited and unlimited access to said wireless network.

5. The apparatus of claim 4, wherein said intelligent service manager provides said wireless device with limited use access to said wireless network.

6. The apparatus of claim 4, wherein said intelligent service manager provides said wireless device with limited time access to said wireless network.

7. The apparatus of claim 4, wherein said intelligent service manager provides said wireless device with limited duration access to said wireless network.

8. The apparatus of claim 1, wherein said wireless network comprises any of a GSM, CDMA, TDMA, and analog (AMPS) network.

9. The apparatus of claim 1, said intelligent service manager further comprising:

means for allocating a network identification number to said wireless device on a per network access basis.

10. The apparatus of claim 9, said intelligent service manager further comprising:

means for allocating network authentication and encryption keys associated with said network identification number to said wireless device on a per network access basis.

11. The apparatus of claim 9, said intelligent service manager further comprising:

means for allocating a phone number to said wireless device on a per network access basis.

12. The apparatus of claim 9, wherein said network identification number comprises any of an IMSI for the GSM protocol, MIN for the TDMA and analog protocols, and MIN or IMSI for CDMA protocol.

13. The apparatus of claim 10, wherein said authentication and encryption keys comprises any of a Ki for the GSM protocol, [A-Key, SSD-A, SSD-B] for the CDMA, TDMA and analog protocols.

14. The apparatus of claim 11, wherein said phone number comprises any of a MSISDN for the GSM protocol, MIN or MDN for the CDMA, TDMA and analog protocols.

15. The apparatus of claim 1, said means for using existing wireless network messaging comprising:

a secure immediate wireless access abstraction layer that employs a Wireless Session to provide said wireless device with either of a limited or unlimited proof to use a particular service.

16. The apparatus of claim 15, wherein limited proof enables any of time based use, usage based use, content based use, or single use.

17. The apparatus of claim 15, wherein said Wireless Session comprises:

a <

SiwaID, SiwaKey>

pair which uniquely identifies said Wireless Session and proves it is authentic, genuine, and valid.

18. The apparatus of claim 17, wherein said SiwaID is unique among services and identifies those services with which it is associated.

19. The apparatus of claim 17, further comprising:

a bootstrap mechanism for acquiring a Wireless Session.

20. The apparatus of claim 17, further comprising:

a bootstrap mechanism for provision and activation of a Wireless Session.

21. The apparatus of claim 17, wherein any of the following operations are associated with session purchase at first network access:

SessionPromote, which comprises an operation invoked by said intelligent service manager to provide said user with an option to purchase a Wireless Session for a service;

SessionPurchase, which comprises an operation invoked by said user and/or said wireless device to purchase a Wireless Session for a service;

SessionGranted, which comprises an operation invoked by said intelligent service manager to provide said user with a <

SiwaID, SiwaKey>

pair; and

SessionDenied, which comprises an operation invoked by said intelligent service manager to provide said user with a reason for a purchase failure.

22. The apparatus of claim 17, wherein any of the following operations are associated with Wireless Session access:

SessionChallenge, which comprises an operation invoked by said intelligent service manager to ask for authenticity of a SiwaID;

SessionProof, which comprises an operation invoked by said user and/or said wireless device to provide said intelligent service manager with a proof of SiwaID authenticity;

SessionApproved, which comprises an operation invoked by said intelligent service manager to approve said user and/or said wireless device for use of a service;

SessionExpired, which comprises an operation invoked by said intelligent service manager to deny service due to Wireless Session expiration;

SessionDepleted, which comprises an operation invoked by said intelligent service manager to deny services due to Wireless Session depletion; and

SessionFraudulent, which comprises an operation invoked by said intelligent service manager to deny services due to lack of authenticity of Wireless Session.

23. The apparatus of claim 17, wherein any of the following operations are associated with certificate information:

SessionProvideInfo, which comprises an operation invoked by said user and/or said wireless device to provide Wireless Session information, which may include expiration or usage; and

SessionInfo, which comprises an operation invoked by said intelligent service manager to provide said user and/or said wireless device with Wireless Session information, which may also be unsolicited.

24. The apparatus of claim 1, said means for using existing wireless network messaging comprising:

an adaptation layer for effecting mapping of logical operations into an existing wireless network.

25. A bootstrap process for secure immediate wireless access by at least one wireless device for exchange of information via an existing wireless network, comprising the steps of:

after said at least one wireless device is powered on and after scanning available networks, said at least one wireless device optionally interacting with a user to select a desired network, said at least one wireless device then selecting a bootstrap network identity known by said selected network;

using existing wireless network messaging to exchange said information between said wireless device and a network server;

said network server comprising an intelligent service manager which executes the steps of;

operating as a trusted gateway between said wireless device and a wireless network;

providing said wireless device with mandatory network identifier and security keys;

providing service to a user without a need for manual provision of accounts;

providing said wireless device with immediate access to said wireless network; and

providing access to service offered by said wireless service provider to said user at the time they are needed by said.

26. The process of claim 25, further comprising the steps of:

once a wireless device selects a wireless network and before a network access attempt, either registration or call origination, said wireless device checking for a Wireless Session status;

wherein if a non-active Wireless Session status is detected, said wireless device then changes its state to indicate that a bootstrap process is initiated.

27. The process of claim 26, wherein said wireless device selects a bootstrap network identity and remains in a bootstrap state until a SessionGranted message is received;

wherein said SessionGranted message provides said wireless device with a network identity.

28. The process of claim 27, wherein said SessionGranted message returns said bootstrap network identity back to said wireless device for a limited use, which may comprise a one time use, limited time use or limited usage use.

29. The process of claim 27, further comprising the steps of:

said intelligent service manager providing said wireless device with a network identity;

programming said network identity into said wireless device; and

said wireless device re-initiating its network access using its new identity.

30. The process of claim 25, wherein said bootstrap process comprises any of assigning a <

Siwa ID, Siwa Key>

pair;

a network identifier;

one or more security keys assignment; and

a phone number.

31. The process of claim 29, further comprising the step of:

said intelligent service manager invalidating a provided Wireless Session as a result of any of an expiration or usage depletion.

32. The process of claim 29, further comprising the step of:

said wireless device checking Wireless Session status before reinitiating its network access.

33. The process of claim 25, further comprising the step of:

said wireless device selecting a network identification for use during said bootstrap process;

wherein said network identification is allocated from a plurality of bootstrap identification numbers known to said network.

34. The process of claim 25, further comprising the step of:

said wireless device selecting a network identification for use during said bootstrap process;

wherein said network identification is pre-assigned.

35. The process of claim 25, further comprising the step of:

in the case of a network identification collision between two bootstrapping wireless devices, rejection either one of said colliding wireless devices from said network.

36. The process of claim 35, further comprising the step of:

a said rejected wireless device re-select a network identification and access the network using its newly selected network identification.

37. The process of claim 25, wherein said bootstrap process comprises a Wireless Session purchase phase, during which a user is acknowledged with a Wireless Session promotion.

38. The process of claim 37, wherein said Wireless Session is purchased from said wireless device itself after user information is collected.

39. The process of claim 37, wherein said Wireless Session purchase phase includes subscribing the user for postpaid service.

40. The process of claim 38, further comprising the steps of:

said intelligent service manager sending a SessionPromote message to said wireless device;

said wireless device returning a SessionPurchase message with said user information; and

a SessionGranted message acknowledging said purchase in case of a successful purchase;

or

a SessionDenied message indicating a failure.

41. The process of claim 37, wherein a Wireless Session is pre-purchased, and wherein said bootstrap process includes a NULL Wireless Session purchase phase, in which no SessionPromote or SessionPurchase messages are exchanged.

42. The method of claim 25, wherein a SiwaID is embedded as an ESN in an AUTHREQ message.

43. The method of claim 25, wherein a signature is embedded in any of an AUTHR of AUTHREQ or AUTHU of ASREPORT message.

44. The method of claim 25, wherein an MSID is embedded into RANDSSD of either authreq or asreport or AUTHDIR of the SSD update procedure.

45. The method of claim 25, wherein a wireless device ESN is embedded into RANDBS BSCHALL of the SSD update procedure.

46. The method of claim 25, wherein a last unique challenge is used to make sure that both sides are in sync.