Method and arrangement to secure access to a communications network

• US 20040054794A1
• Filed: 07/14/2003
• Published: 03/18/2004
• Est. Priority Date: 06/29/2000
• Status: Active Grant

• Current Assignee: Birdstep Technology AB (Smith Micro Software Incorporated)
• Original Assignee: Birdstep Technology AB (Smith Micro Software Incorporated)
• Inventors: Lantto, Jorgen, Ensuque, Guilhem
• Granted Patent: US 7,152,160 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 12/1425 involving dedicated fields in the data packet for billing purposes
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The present invention relates to a method and an arrangement in a data communications system in Internet Protocol (IP) environments. The object of the invention is to achieve a simple way of remote and secure access of a computer to a private data communications network. The solution according to the invention is a Remote Access Login system profiled for accessing the private data communications network via a so-called Pseudo-Connectionless Technology (PCT) device.

Claims

1. A method for setting-up a remote and secure access session from a computer (401) to a data communications network (440), via a so-called Pseudo-Connectionless Technology (PCT) device (403), e.g. General Packet Radio Service (GPRS) device, the computer comprising a Remote Access Login (RAL) system, the method comprises the following steps:

a user of the computer (401) performing (301) one single connect activity, which automatically triggers the RAL system within the computer (401) to perform the following steps;

defining (302) a PCT Packet Data Protocol (PDP) session context, comprising pseudo-connectionless characteristics of a PCT session and

passing (303) said session context on to the PCT device (403) in a message;

triggering (304) setting-up of a dial-up connection;

triggering (305) establishing of a secure Virtual Private Network (VPN) session between the computer (401) and a VPN gateway within the data communications network (440).

2. The method according to claim 1, wherein the RAL system comprises a Graphical User Interface (GUI), said single connect activity is performed by a cursor clicking on an icon of said GUI or pressing the enter button on a keypad acting on said computer.

3. The method according to the claim 2, comprising the further step to be taken before the step of performing (301) the single connect activity:

configuring PCT session profiles by accessing, in a single window in said GUI, all the necessary Information Elements (IE) required for setting-up an end-to-end secure networking session.

4. The method according to any of the claims 1-3, wherein the PCT device constitutes a GPRS device, wherein the step of passing (303) said session context on to the PCT device (403) in a message is performed by using a standard AT command.

5. The method according to any of the claims 1-4, wherein the step of triggering (304) setting-up of a dial-up connection comprises the step of:

calling the dial-up capabilities of the operating system the RAL system resides on.

6. The method according to claim 5, wherein said operating system is Windows™

98, NT or 2000, said dial-up capabilities making use of functions provided by the Remote Access Service (RAS).

7. The method according to any of the claims 5-6, wherein the step of triggering (304) setting-up of a dial-up connection comprises the further step taken by the RAL system:

storing dial-up parameters in a system-file.

8. The method according to claim 7, wherein the step of triggering (304) setting-up of a dial-up connection comprises the further step taken by the RAL system:

indicating to the RAS in which file said stored dial-up parameters are readable.

9. The method according to claim 8, wherein the step of triggering (304) setting-up of a dial-up connection comprises the further step taken by RAS:

reading said dial-up parameters in said system file when performing a dial-up connection procedure.

10. The method according to any of the claims 1-9, wherein the step of triggering (304) setting-up of a dial-up connection comprises the further step taken by the RAL system:

storing authentication information in a RAM memory location.

11. The method according to claim 10, wherein the step of triggering (304) setting-up of a dial-up connection comprises the further step taken by the RAL system:

passing to the RAS, a pointer, where to retrieve said stored authentication credentials.

12. The method according to any of the claims 1-11, wherein the step of triggering (305) the establishment of a secure VPN session comprises the further step to be taken by the RAL system:

selecting a VPN device based on user configuration parameters stored in the RAL system.

13. The method according to claim 12, wherein the step of triggering (305) the establishment of a secure VPN session comprises the further step to be taken by RAL system:

passing on, to the VPN device, additional parameters required for establishing said secure VPN session.

14. The method according to any of the claims 1-11, wherein the step of triggering (305) the establishment of a secure VPN session is optional.

15. The method according to any of the claims 1-14, wherein the RAL system comprises at least one separate stand alone plugin module (229), the method comprising the further step to be taken by said module:

performing value add functions by using the PCT connection.

16. The method according to claim 15, wherein said plugin module (229) constitutes a meter, the method comprising the further step of:

recording the volume of data transferred; and

translating it into the cost that the PCT operator will charge the user.

17. The method according to claim 16, comprising the further step of:

displaying said cost in real-time towards the user via a GUI.

18. A computer program product directly loadable into the internal memory of a digital computer, comprising the software code portions for performing the method according to any of the claims 1-17, when said product is run on a computer.

19. A computer program product stored on a computer usable medium, comprising readable program for causing a computer, to control an execution of the method according to any of the claims 1-17.

20. A Remote Access Login (RAL) system (201) acting in a computer for setting-up a remote and secure access session from the computer to a data communications network via a so-called Pseudo-Connection-less Technology (PCT) device, e.g. General Packet Radio Service (GPRS), said computer comprising communication capabilities,

characterised in that the RAL system comprises:

a Graphical User Interface (GUI) (228) comprising means for a user to perform a single connect activity;

a processing core (227) that translates user input taken from the GUI into signals to appropriate underlying components,

the processing core (227) also co-ordinates the procedures for defining a PCT session Packet Data Protocol (PDP) context, passing the session context on to the PCT device, setting up a dial-up connection and establishing a secure Virtual Private Network (VPN) session between the computer (401) and a VPN gateway within the data communications network (440).

21. The RAL system (201) according to claim 20, characterised in that said single connect activity is performed by a click by the cursor on an icon of said GUI or by press the enter button on a keypad acting on said computer.

22. The RAL system (201) according to claim 21, characterised in that said GUI comprises a single window to access all the Information Elements (IEs) that are necessary for configure PCT profiles.

23. The RAL system (201) according to any of the claims 20-22, characterised in that it comprises an Application Programming Interface (API) to PCT (220), that enables to abstract a genetic behaviour of PCT devices, that are non-standard for an operation system, for upper software components.

25. The RAL system (201) according to any of the claims 20-24, characterised in that it comprises a set of Remote Access Server (RAS) functions (224) that enables to perform specific session set-up procedures.

26. The RAL system (201) according to any of the claims 20-25, characterised in that it comprises a user profiles database (225) for storing all the data relevant to the end-to-end chain of configuration data that is required by the different software components outside the RAL system to set-up a secure data connection to a private data communications network.

27. The RAL system (201) according to any of the claims 20-26, characterised in that it comprises at least one generic API (226) for providing support for at least one operational system platform.

28. The RAL system (201) according to any of the claims 20-27, characterised in that it comprises at least one separate stand alone plugin module (229) that performs value add functions using the PCT connection.

29. The RAL system (201) according to the claims 27 and 28, characterised in that said plugin module (229) has means for communicating with said at least one generic API (226) for performing said value add functions.

30. The RAL system (201) according to claim 29, characterised in that said plugin module (229) constitutes a meter that records the volume of data transferred and translates it into the cost that the PCT operator will charge the user.

31. The RAL system (201) according to the claim 30, characterised in that said cost is displayed in real-time towards the user via a GUI.

24. The RAL system (201) according to any of the claims 2023, characterised in that it comprises an API to VPN (221), that enables to abstract a generic behaviour of VPN devices, that are non-standard for an operation system, for upper software components.