System and method for connection handover in a virtual private network

• US 20060176852A1
• Filed: 09/09/2005
• Published: 08/10/2006
• Est. Priority Date: 02/04/2005
• Status: Abandoned Application

• Current Assignee: Industrial Technology Research Institute
• Original Assignee: Industrial Technology Research Institute
• Inventors: Wu, Ko-Ching, Yang, Jen-Shun, Lin, Chen-Hau
• Application Number:
  US11/221,790
• Publication Number:
  US 20060176852A1
• Time in Patent Office: Days
• US Class Current: 370/331
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 36/0016 Hand-off preparation specially adapted for end-to-end data sessions
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

A method and system of connection handover from a first wireless server to a second wireless server in a connection between a mobile device and an intranet. The method comprises employing a SIM-based pre-authentication with a mobile agent of the mobile device prior to handing over the connection to the second wireless server, and handing over the connection to the second wireless server upon a predetermined condition.

Claims

1. A method of handover from a first wireless server to a second wireless server among neighboring wireless servers in a connection between a mobile device and a border gateway of an intranet, comprising:

employing a SIM-based pre-authentication with a mobile agent of the mobile device prior to handing over the connection to the second wireless server; and

handing over the connection to the second wireless server upon a predetermined condition.

2. The method of claim 1, wherein the employing step comprises:

providing number of the neighboring wireless server to the border gateway;

sending the mobile agent to the neighboring wireless server; and

processing SIM-based authentication via the mobile agent.

3. The method of claim 2, further comprising:

updating SIM-based authenticated wireless server to a binding list at the border gateway; and

directing downlink data to the wireless servers based on the binding list.

4. The method of claim 1, wherein the predetermined condition is signal strength from the first wireless server being less than a first predetermined value, and signal strength from the second wireless server exceeding a second predetermined value.

5. The method of claim 2, further comprising:

receiving an authentication result of the second wireless server at the mobile device from the mobile agent;

stopping the connection if the authentication result is authentication rejection; and

updating the second wireless server to the binding list if the authentication result is authentication acceptance.

6. The method of claim 1, further comprising:

establishing a Virtual Private Network (VPN) tunnel between the second wireless server and the border gateway; and

transferring data with identical mobile device address throughout the connection via the VPN tunnel.

7. A wireless server in a connection of a mobile device and a border gateway of an intranet, comprising:

a processor;

a port, coupled with the processor; and

program storage memory coupled with the processor, comprising program adapted to;

first code, employing an SIM-based pre-authentication with a mobile agent of the mobile device prior to handing over the connection to the wireless server; and

second code, taking over the connection from a first wireless server upon a predetermined condition.

8. The wireless server of claim 7, wherein the first code comprises:

accepting the mobile agent at the wireless server; and

processing SIM-based authentication via the mobile agent.

9. The wireless server of claim 8, wherein the first code further comprises receiving data at the wireless server based on a binding list storing information of SIM-based authenticated wireless server.

10. The wireless server of claim 8, wherein the program further comprises third code, transmitting an authentication report from the mobile agent to the mobile device.

11. The wireless server of claim 7, wherein the predetermined condition comprises the mobile device receiving signal strength from a remote wireless server being less than a first predetermined value and receiving signal strength from the wireless server exceeding a second predetermined value.

12. The wireless server of claim 7, wherein the program is further adapted to a fourth code:

establishing a VPN tunnel between the wireless server and the border gateway; and

transferring data with an identical mobile device address throughout the connection via the VPN tunnel.

13. A mobile device having a connection with a border gateway of an intranet via a first wireless server, comprising:

a processor;

a port, coupled with the processor and the border gateway; and

program storage memory coupled with the processor, comprising program adapted to;

first code, employing an SIM-based pre-authentication with a mobile agent of the mobile device prior to handing over the connection to a second wireless server among a neighboring wireless server; and

second code, handing over the connection to the second wireless server upon a predetermined condition.

14. The mobile device of claim 13, wherein the first code comprising:

providing number of the neighboring wireless server to the border gateway;

transferring the mobile agent to the neighboring wireless server; and

processing SIM-based authentication via the mobile agent.

15. The mobile device of claim 14, wherein the first code further comprises receiving downlink data at the mobile device based on a binding list storing information of SIM-based authenticated wireless servers.

16. The mobile device of claim 13, wherein the program further comprises third code:

receiving an authentication report from the mobile agent at the mobile device;

stopping the connection if the authentication report is rejected; and

updating the second wireless server to the binding list at the border gateway if the authentication report is accepted.

17. The mobile device of claim 13, wherein the predetermined condition comprises signal strength from the first wireless server being less than a first predetermined value and signal strength from the second wireless server exceeding a second predetermined value.

18. The mobile device of claim 13, wherein the program further comprises fourth code, transferring data with an identical mobile device address throughout the connection via the VPN tunnel established between the second wireless server and the border gateway.

19. A system comprising:

a mobile device, participating in a connection;

an intranet, coupled to the mobile device during the connection;

a first wireless server, coupled to the mobile device and a border gateway of the intranet prior to connection handover; and

a second wireless server, coupled to the mobile device and the border gateway upon the connection handover, employing an SIM-based pre-authentication with a mobile agent of the mobile device prior to taking over the connection upon a predetermined condition.

20. The system of claim 19, wherein the SIM-based pre-authentication comprises:

detecting the second wireless server among at least one neighboring wireless server neighboring the first wireless server;

providing number of the at least one neighboring wireless server to the border gateway;

sending the mobile agent to the second wireless server; and

processing SIM-based authentication via the mobile agent.

21. The system of claim 20, wherein the SIM-based pre-authentication further comprises:

updating the SIM-based authenticated wireless server to a binding list at the border gateway; and

directing downlink data to wireless servers based on the binding list.

22. The system of claim 20, wherein the second wireless server further comprises transferring an authentication report from the mobile agent to the mobile device.

23. The system of claim 19, wherein the predetermined condition comprises signal strength from the first wireless server being less than a first predetermined value, and signal strength from the second wireless server exceeding a second predetermined value.

24. The system of claim 19, wherein the second wireless server further comprises:

establishing a VPN tunnel between the second wireless server and the intranet; and

transferring data with an identical mobile device address throughout the connection via the VPN tunnel.