System and method for wireless access to an application server

• US 20060155822A1
• Filed: 09/29/2005
• Published: 07/13/2006
• Est. Priority Date: 01/11/2005
• Status: Abandoned Application

• Current Assignee: Industrial Technology Research Institute
• Original Assignee: Industrial Technology Research Institute
• Inventors: Yang, Jen-Shun, Wang, Chun-Chieh, Chou, Da-Jiun
• Application Number:
  US11/240,308
• Publication Number:
  US 20060155822A1
• Time in Patent Office: Days
• US Class Current: 709/216
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A communication method, comprising constructing a Virtual Private Network (VPN) tunnel between a mobile device and an Intranet; and performing an Extensible Authentication Protocol-Subscriber Identification Module (EAP-SIM) authentication through the VPN tunnel. Access right of target service can be verified according to information in a SIM card no matter what kind of network access technology the service subscriber is using with the proposed communication method. A system utilizing the method is further provided.

Claims

1. A communication method between a mobile device and a Intranet, comprising:

constructing a Virtual Private Network (VPN) tunnel between the mobile device and the Intranet; and

executing an Extensible Authentication Protocol-Subscriber Identification Module (EAP-SIM) authentication through the VPN tunnel.

2. The communication method of claim 1, wherein the constructing step comprises:

establishing an Internet connection; and

exchanging a VPN negotiation in the Internet connection.

3. The communication method of claim 2, wherein the Internet connection is a security session.

4. The communication method of claim 2, wherein the VPN negotiation is protected by a Tunneling Protocol and a IP Security Protocol.

5. The communication method of claim 4, wherein the VPN negotiation employs aggressive mode in the IP Security Protocol.

6. The communication method of claim 1, wherein the executing step comprises:

sending a first packet from the Intranet to the mobile device;

receiving a second packet with sender identity as an acknowledgement from the mobile device to the Intranet;

transmitting a third packet with an authentication version list from the Intranet to the mobile device;

directing a fourth packet with an authentication version from the mobile device to the Intranet;

transmitting a fifth packet with a randomized Message Authentication Code (MAC) from the Intranet to the mobile device;

receiving a sixth packet with a MAC from the mobile device at the Intranet; and

issuing a seventh packet from the Intranet to the mobile device, if the MAC is confirmed.

7. The communication method of claim 6, wherein the executing step further comprises accepting requested access information from the mobile device at the Intranet.

8. The communication method of claim 1, wherein the mobile device is a wireless electronic device.

9. The communication method of claim 1, further comprises forwarding an user profile of the mobile device, from a Home Location Register/Authentication Center (HLR/AuC) server in the Intranet to an application server in the Intranet, if the EAP-SIM authentication succeeds.

10. The communication method of claim 6, further comprising:

delivering access information of the mobile device, from a HLR/AuC server in the Intranet to an Authentication, Authorization, and Accounting (AAA) server in the Intrenet;

rejecting the EAP-SIM authentication, if the requested access information does not correspond to the access information; and

accepting the EAP-SIM authentication, if the requested access information corresponds to the access information.

11. A communication system, comprising:

a mobile device sending a request; and

an Intranet receiving the request for the application, establishing an Internet connection with the mobile device, constructing a Virtual Private Network (VPN) tunnel in the Internet connection, and executing EAP-SIM authentication therethrough.

12. The communication system of claim 11, wherein the Intranet comprises:

a proxy server coupled to the mobile device through the VPN tunnel;

an Authentication, Authorization, and Accounting (AAA) server coupled to the proxy server, and providing EAP-SIM authentication information to the proxy server;

a Home Location Register/Authentication Center (HLR/AuC) server coupled to the AAA server, and storing access information and user profile; and

an application server coupled to the proxy server, the AAA server, and the HLR/AuC server, receiving the EAP_SIM authentication information from the AAA server, accepting the user profile from the HLR/AuC server, and carrying out an application if EAP_SIM authentication is accepted.

13. The communication system of claim 12, wherein the AAA server accepting access information of the mobile device from the HLR/AuC server.

14. A mobile device for accessing service application in a WLAN, comprises:

a Virtual Private Network (VPN) tunnel module, for establishing a VPN tunnel to the Intranet; and

an EAP-SIM authentication module coupled to the VPN tunnel module, and executing EAP-SIM authentication through the VPN tunnel.

15. The mobile device of claim 14, wherein the VPN tunnel establishing module comprises:

an Internet connection module, establishing an Internet connection; and

a VPN negotiation module, exchanging VPN negotiation via the Internet connection.

16. The mobile device of claim 15, wherein the Internet connection is a security session.

17. The mobile device of claim 15, the VPN negotiation is protected by any Tunneling Protocol and any IP Security Protocol.

18. The mobile device of claim 14, wherein the EAP-SIM authentication module further delivers requested access information to the Intranet.