Access to plmn networks for non-plmn devices, and to issues arising in interfaces in general between plmn and non-plmn networks

• US 20060291455A1
• Filed: 05/16/2002
• Published: 12/28/2006
• Est. Priority Date: 05/16/2001
• Status: Active Grant

• Current Assignee: Flash Networks, Ltd. (Constellation Software Incorporated)
• Original Assignee: Flash Networks, Ltd. (Constellation Software Incorporated)
• Inventors: Jeffery, Stuart, Karmi, Yair, Kolkowitz, Dan, Katz, Eyal, Ben-Noon, Gil, Zorman, Ilan
• Granted Patent: US 8,086,855 B2
• Time in Patent Office: Days
• US Class Current: 370/355
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 67/04 specially adapted for terminals or networks with limited capabilities; specially adapted for terminal portability
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 36/0011 for data sessions of end-to-end connection
• CPC Class Codes: H04W 36/14 Reselecting a network or an air interface
• CPC Class Codes: H04W 36/142 over the same radio air interface technology
• CPC Class Codes: H04W 84/042 Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: H04W 92/02 Inter-networking arrangements

Abstract

Interface device for interfacing between a PLMN network and a non-PLMN network, the PLMN network being configured to recognize cellular base stations as nodes thereof through which to mediate connections to cellular mobile devices, the non-PLMN networks each comprising a plurality of access points for mediating connections to network compatible mobile devices, and for which the network compatible mobile devices are not required to be cellular devices. The interface device is configured as a node of the PLMN network to appear to the PLMN network as a standard cellular base station, and comprises functionality to make non-cellular devices connecting to the non-PLMN network and attempting to access the PLMN network through the non-PLMN network appear as cellular devices to the PLMN network.

Claims

1. Interface device for interfacing between a PLMN network and a non-PLMN network, said PLMN network being configured to recognize cellular base stations as nodes thereof through which to mediate connections to cellular mobile devices, said non-PLMN networks each comprising a plurality of access points for mediating connections to network compatible mobile devices, said network compatible mobile devices not being required to be cellular devices, said interface device being configured as a node of said PLMN network to appear to said PLMN network as a base station thereof and comprising functionality to make non-cellular devices connecting to said non-PLMN network and attempting to access said PLMN network therethrough appear as cellular devices to said PLMN network.

2. The interface device of claim 1, comprising a circuit-switched interface for telephony and a packet interface for data and control.

3. The interface device of claim 1, wherein said PLMN network is a GSM network having an A interface or a Gb interface and wherein said circuit-switched interface is operable to use said A interface and said packet interface is operable to use said Gb interface.

4. The interface device of claim 1, wherein said PLMN network is a UMTS network having an IuCS interface and an IuPS interface and wherein said circuit switch interface is operable to use said IuCS interface and said packet interface is operable to use said IuPS interface.

5. The interface device of claim 1, comprising a simulated cellular identity gateway associated with a security layer of said non-PLMN network and operable to determine that a connecting device has been authenticated by said non-PLMN network, and to respond to a PLMN network authentication query to indicate that said authentication has been successful.

6. The interface of claim 5, wherein said simulated cellular identity gateway is a simulated SIM gateway and said PLMN network is a GSM network.

7. The interface of claim 6, wherein said simulated cellular identity gateway is a simulated ESN gateway and said PLMN network is a CDMA network.

8. The interface of claim 5, wherein said non-PLMN security layer is one of a group comprising SSL, Ipsec, TLS, SRP, and SSH, and wherein an authentication of said one of said group is required to permit said simulated SIM gateway to provide said authentication response to said PLMN network.

9. The interface of claim 8, wherein said security layer is configurable to set a desired security level.

10. The interface of claim 1, further comprising a vocoder for receiving voice signals from said non-PLMN network for vocoding, and receiving vocoded voice signals from said PLMN network for decoding.

11. The interface of claim 1, further comprising a vocoder for receiving partly vocoded signals from said non-PLMN network for vocoding, and receiving vocoded voice signals from said PLMN network for part decoding.

12. The interface of claim 1, configured to appear to said PLMN network as both a serving GPRS support node (SGSN) for packet data and as a base station for circuit switched data.

13. The interface of claim 12, further comprising functionality to authenticate a device connecting to said non-PLMN network.

14. The interface of claim 13, further comprising functionality to register a device connecting to said non-PLMN network.

15. The interface of claim 12, further comprising functionality to update the location of a device connecting to said non-PLMN network.

16. The interface of claim 12, further comprising support functionality for allowing a device connecting to said non-PLMN network to generate service requests.

17. The interface of claim 1, further comprising functionality to provide said PLMN network with connection control data formatted for said PLMN network to be able to integrate corresponding activity into a consolidated bill.

18. The interface of claim 12, configured to operate together with a connection management unit of said non-PLMN network, thereby to obtain from said non-PLMN network details of connecting parties and quantity of data exchanged.

19. The interface of claim 18, further comprising functionality to format said details obtained into a PLMN compatible format.

20. An access card for a wireless LAN, comprising a cellular identity module associated therewith for providing PLMN security functionality, thereby to allow access via said wireless LAN to a PLMN network.

21. The access card of claim 20, wherein said cellular identity module is mounted on said access card.

22. The access card of claim 20, wherein said cellular identity module is reversibly mounted on said access card.

23. The access card of claim 20, wherein said cellular identity module is a SIM.

24. The access card of claim 23, comprising both a SIM carrier and a SIM reader.

25. The access card of claim 20, wherein said cellular identity module is a virtual cellular identity module.

26. The access card of claim 25, wherein said virtual cellular identity module is a virtual module comprising SIM functionality.

27. The access card of claim 20, comprising functionality to exchange authentication signals with a LAN gateway, thereby to achieve network authorization.

28. The access card of claim 27, wherein said authentication signals are formatted to be transferable between said LAN gateway and said PLMN network, thereby to obtain PLMN authorization.

29. A method of accessing a PLMN network via a non-PLMN network using a non-PLMN device, comprising:

providing said non-PLMN device with an access card suitable for said non_PLMN network,

providing said access card with a cellular identification module,

providing said non-PLMN network with gateway functionality to relay cellular identification signals between said non-PLMN device and said PLMN network.

30. A method of accessing a PLMN network via a non-PLMN network using a non-PLMN device, comprising:

providing said non-PLMN network with a secure authentication unit for authentication of said non-PLMN device,

providing said non-PLMN network with gateway functionality, associated with said secure authentication unit, to operate said authentication unit and to relay cellular identification signals to said PLMN network in response to authentication of said non-PLMN device.

31. A method of operating a secure gateway between a PLMN network and a non-PLMN network such that a non-PLMN device is authenticatable for a PLMN connection, the method comprising:

authenticating said non-PLMN network via a first authentication protocol, and

exchanging signals with said PLMN network via a cellular authentication protocol, comprising indicating device authentication following authentication via said first protocol.

32. A method of operating a secure gateway between a PLMN network and a non PLMN network, such that a non-PLMN device is authenticatable for a PLMN connection, the method comprising:

exchanging signals with said PLMN network via a cellular authentication protocol thereby to authorize said non-PLMN network to connect to said device.

33. Handoff manager for managing handoff of a mobile unit communicating using an identifiable session between a first mobile network access point and a second mobile network access point, wherein said first access point belongs to a first network, and said second access point belongs to a second network, said manager being commonly accessible to each network and comprising

a mobile unit matcher for performing matching between mobile units having disconnected from one network and mobile units having connected to other networks, and

a session maintainer associated with said mobile unit matcher for transferring sessions between units thus matched, thereby to handoff between networks.

34. The handoff manager of claim 33, comprising a unit at a single location.

35. The handoff manager of claim 33, comprising distributed functionality located at a plurality of intra-network or inter-network nodes.

36. The handoff manager of claim 33, wherein one of said networks is a PLMN network.

37. The handoff manager of claim 33, wherein one of said networks is a wireless LAN network.

38. The handoff manager of claim 36, wherein one of said networks is a wireless LAN network.

39. The handoff manager of claim 33, further comprising a session active management unit for determining from a currently used network when connection quality threshold is not being met, for instructing said mobile unit to search for surrounding networks and determine connection parameters thereof, to identify from said parameters a best network and to instruct said mobile unit to connect to said best network.

40. The handoff manager of claim 39, wherein said session active management unit is associated with said mobile unit matcher, thereby to use said instruction to assist with said matching.

41. The handoff manager of claim 39, wherein said session active management unit is operable to determine whether said instructed match has succeeded and, in the absence of a successful connection, is operable to instruct said mobile unit to connect to a next best network.

42. The handoff manager of claim 41, wherein said session active management unit is operable to continue to instruct said mobile unit to connect to a next best unit until a successful connection is indicated.

43. The handoff manager of claim 33, further comprising a session passive management unit for determining from said mobile unit when connection quality threshold is not being met, for instructing said mobile unit to search for surrounding networks and determine connection parameters thereof, to identify from said parameters a best network and to instruct said mobile unit to connect to said best network.

44. The handoff manager of claim 33, further being operable to instruct said mobile unit to disconnect from a first network and subsequently to connect to a best network.

45. The handoff manager of claim 33, further being operable to instruct said mobile unit to connect to a best network and subsequently to disconnect from a current network.

46. The handoff manager of claim 33, operable to reduce a connection quality level at a current network, thereby to force said mobile unit to disconnect therefrom and find another network.

47. The handoff manager of claim 33, operable, following a selection of to a best network for reconnection, to reduce a connection quality at a current network, and to send an instruction to said mobile unit to connect to said selected best network.

48. The handoff manager of claim 33, further operable to provide to said mobile unit identification of potentially available networks.

49. The handoff manager of claim 33, further operable to provide to said mobile unit network parameters of a potentially available network.

50. The handoff manager of claim 49, wherein said parameters include any one of a group comprising:

preferred access channels for a respective PLMN network, identity of proxy IP'"'"'s for Internet access which are capable of supporting a better distributed SCC architecture, loading conditions of said potentially available networks, general availability parameters of said potentially available networks, network access numbers for Internet access, and information on expected loading conditions of said potentially available network.

51. The handoff manager of claim 33, wherein said first mobile network and said second mobile network are respectively wireless LANs of a single hotspot.

52. The handoff manager of claim 51, wherein said first and said second networks are overlapping networks and a mobile unit for handoff is located at a point of overlap between said networks.

53. The handoff manager of claim 33, wherein said first and said second networks respectively use a same network protocol.

54. The handoff manager of claim 33, wherein said first and said second networks respectively use a different network protocol.

55. The handoff manager of claim 51, wherein said first and said second networks are non-overlapping.

56. The handoff manager of claim 33, wherein said first network and said second network are respectively of different Hot Spots.

57. The handoff manager of claim 56, wherein said different hotspots have a region of overlap and where a mobile device for handoff is located in said region of overlap.

58. The handoff manager of claim 56, wherein said hotspots utilize a single communication protocol.

59. The handoff manager of claim 56, wherein said hotspots utilize respectively different communication protocols.

60. The handoff manager of claim 33, wherein said first network and said second network are respectively PLMN networks.

61. The handoff manager of claim 60, wherein said first PLMN and said second PLMN network utilize a single communication protocol.

62. The handoff manager of claim 60, wherein said first and said second PLMN network utilize respectively different communication protocols.

63. The handoff manager of claim 60, wherein said first and said second communication network have a region of overlap and wherein a mobile device for handoff is located in said region of overlap.

64. The handoff manager of claim 33, wherein said first network is a wireless local network and said second network is a PLMN network.

65. The handoff manager of claim 64, wherein said wireless local network is located within a region of coverage of said PLMN network.

66. The handoff manager of claim 65, comprising a priority unit for setting said wireless local network as a higher priority than said PLMN network such that a mobile unit is automatically handed off to said wireless local network when in range thereof.

67. A method of handoff of a mobile device, communicating in a communication session, said handoff being between access points of a first and a second wireless network respectively, the method comprising:

providing a control point at a location common to both said networks,

at said control point determining identities of mobile devices whose connections have been terminated and obtaining data of respective sessions thereof,

at said control point determining identities of new connections formed with mobile devices,

at said control point matching said identities, thereby to match an existing session with a mobile device that has terminated its connection at a first access point and has reconnected at a second access point.

68. Authentication apparatus comprising:

a communicator for communicating with an authenticatable mobile device,

a verifier associated with said authenticatable mobile device to verify that the communication is with an intended one of authenticatable devices, and

an associator for associating the verification with an activity request via a non authenticatable device, thereby to authenticate the activity request of the non-authenticatable device.

69. The apparatus of claim 68, wherein said authenticable device is a GSM device and said authenticatable link is a GSM link.

70. The apparatus of claim 68, wherein said authenticatable device is a CDMA device and said authenticatable link is a CDMA link.

71. The apparatus of claim 68, wherein said authenticatable device is a PDC device and said authenticatable link is a PDC link.

72. The apparatus of claim 68, wherein said authenticatable device is an EDGE device and said authenticatable link is an EDGE link.

73. The apparatus of claim 68, wherein said authenticatable device is a WCDMA device and said authenticatable link is a WCDMA link.

74. The apparatus of claim 68, wherein said authenticatable device is a GPRS device and said authenticatable link is a GPRS link.

75. The apparatus of claim 68, wherein said authenticatable device is an Iridium device and said authenticatable link is an Iridium link.

76. The apparatus of claim 68, wherein said secure link involves a subscriber identity module located at said secure mobile device.

77. The apparatus of claim 68, wherein said authenticatable link is a secure link utilizing a subscriber identity module located at said authenticatable device.

78. The apparatus of claim 68, wherein said authenticatable device is a mobile telephone.

79. The apparatus of claim 68, wherein said communication comprises an electronic data communication.

80. The apparatus of claim 79, wherein said electronic data communication comprises electronic messaging.

81. The apparatus of claim 80, wherein said electronic messaging comprises SMS messaging.

82. The apparatus of claim 80, wherein said electronic messaging comprises WAP.

83. The apparatus of claim 80, wherein said electronic messaging comprises email.

84. The apparatus of claim 80, wherein said electronic messaging comprises EMS.

85. The apparatus of claim 80, wherein said electronic messaging comprises MMS.

86. The apparatus of claim 80, wherein said communicator comprises functionality to initiate said communication by sending an initial message to said authenticatable device and functionality to receive a reply to said initial message from said authenticatable device, therewith to authorize said activity request.

87. The apparatus of claim 80, wherein said communicator comprises functionality to receive an initializing communication from either one of said authenticatable device and said non-authenticatable device, and functionality to send a reply to said initial message, therewith to authorize said activity request.

88. The apparatus of claim 80, wherein said communicator comprises functionality to receive an initializing communication from an external device and functionality to establish a link between said authenticatable device and said non-authenticatable device, therewith to authorize said activity request.

89. The apparatus of claim 80, wherein said communicator involves functionality to receive a message from said authenticatable device and functionality to complete said communication by sending a response thereto to said secure authenticatable device, thereby to authorize said activity request.

90. The apparatus of claim 86, wherein said communicator comprises functionality to insert an identifier into said reply for a requesting party to enter via said non-authenticatable device, and wherein said verifier further comprises functionality to determine whether said identifier have been received via said non-authenticatable device.

91. The apparatus of claim 68, wherein said communicator is operable to use an automatic voice for communicating with said authenticatable device.

92. The apparatus of claim 68, wherein said authenticatable device is associated with a payment account, said apparatus further comprising functionality to charge said requested activity to said payment account.

93. The apparatus of claim 68, wherein said requested activity is an Internet browsing activity or a point of sale activity.

94. The apparatus of claim 68, wherein said requested activity is access to a network.

95. The apparatus of claim 68, operable to connect to said non-authenticable device via Bluetooth access points.

96. The apparatus of claim 68, operable to connect to said non-authenticatable device via at least one WLAN access point.

97. The apparatus of claim 68, being connectable to said non-authenticatable device via a TCP/IP link.

98. The apparatus of claim 68, wherein said communicator is operable to obtain a telephone number for communicating with said authenticatable device, from said non-authenticatable device.

99. The apparatus of claim 68, wherein said communicator is operable to obtain identification data, from said non-authenticable device, for forming said association.

100. The apparatus of claim 68, wherein said non-authenticatable device is any one of a group comprising a credit card, a smart card, an infra-red device, a Bluetooth device, a PDA, a mobile computer, a fixed computer, and a network of computers.

101. The apparatus of claim 68, further comprising a counter for timing said communication to fail said authorization if said communication is not completed by a predetermined time limit.

102. The apparatus of claim 68, further comprising a log-in functionality for logging in the non-authenticatable device.

103. The apparatus of claim 68, wherein said associator is connected to an authenticator for indicating that said activity request is approved.

104. The apparatus of claim 103, wherein said authentication communicator is operable to communicate said authentication to an external gateway associated with said non-authenticatable device.

105. The apparatus of claim 103, wherein said authentication communicator is operable to communicate said authentication to a server associated with said requested activity.

106. The apparatus of claim 103, wherein said authentication communicator is operable to communicate said authentication by applying a change to a routing table on a router.

107. A personal transaction card compatible with ATM machines, comprising, in ATM readable format, an ATM routing number and a mobile telephone number, said mobile telephone number being associated with an owner of said personal transaction card.

108. The personal transaction card of claim 107, wherein said numbers are stored on a magnetic strip.

109. The personal transaction card of claim 107, wherein said numbers are stored in an internal integrated circuit.

110. Authentication method comprising:

communicating via a secure link with an authenticatable device,

verifying that the communication is with an intended one of authenticatable devices, and

associating the verification with an activity request via a non-authenticatable device, thereby to authenticate the activity request of the non-authenticatable device.

111. The method of claim 110, wherein said authenticatable device is a GSM device and said authenticatable link is a GSM link.

112. The method of claim 110, wherein said authenticatable device is a CDMA device and said authenticatable link is a CDMA link.

113. The method of claim 110, wherein said authenticatable device is a PDC device and said authenticatable link is a PDC link.

114. The method of claim 110, wherein said authenticatable device is an edge device and said authenticatable link is an edge link.

115. The method of claim 110, wherein said authenticatable device is a WCDMA device and said authenticatable link is a WCDMA link.

116. The method of claim 110, wherein said authenticatable device is a GPRS device and said authenticatable link is a GPRS link.

117. The method of claim 110, wherein said authenticatable device is an Iridium device and said authenticatable link is Iridium link.

118. The method of claim 110, wherein said authenticatable link comprises a secure link involving a subscriber identity module located at said authenticatable device.

119. The method of claim 111, wherein said secure link involves a subscriber identity module located at said authenticatable device.

120. The method of claim 110, wherein said authenticatable device is a mobile telephone.

121. The method of claim 110, wherein said communication comprises electronic data communication.

122. The method of claim 121, wherein said electronic data communication comprises electronic messaging or SMS messaging.

123. The method of claim 122 comprising initiating said communication by sending an initial message to said authenticatable device and functionality to receive a reply to said initial message from said authenticatable device, therewith to authorize said activity request.

124. The method of claim 123, wherein said communicating involves receiving a message from said authenticatable device and completing said communication by sending a response thereto to said authenticatable device, thereby to authorize said activity request.

125. The method of claim 124, comprising inserting a password into said reply for a requesting party to enter via said non-authenticatable device, and determining whether said password has been received via said non-authenticatable device.

126. The method of claim 110, comprising using an automatic voice for communicating with said authenticatable device.

127. The method of claim 110, wherein said authenticatable device is associated with a payment account, said method further comprising charging said requested activity to said payment account.

128. The method of claim 110, wherein said requested activity is one of a group comprising an Internet browsing activity, a point of sale activity and accessing a network.

129. The method of claim 110, comprising using one of infra-red and bluetooth.

130. The method of claim 110, said non-authenticatable device being a TCP/IP link.

131. The method of claim 110, comprising obtaining a telephone number for communicating with said authenticatable device, from said non-authenticatable device.

132. The method of claim 110, wherein said non-authenticatable device is any one of a group comprising a credit card, a smart card, an infra-red device, a Bluetooth device, a PDA, a mobile computer, a fixed computer, and a network of computers.

133. The method of claim 110, further comprising timing said communication to fail said authorization if said communication is not completed by a predetermined time limit.

134. The method of claim 110, further comprising a logging in procedure for logging in the non-authenticatable device.

135. The method of claim 110, comprising outputting an indication that said activity request is approved.

136. The method of claim 135, wherein said indication is output to an external gateway associated with said non-authenticatable device.

137. The method of claim 135, wherein said indication is output to a server associated with said requested activity.

138. The method of claim 135, wherein said indication is output by applying a change to a routing table on a router.