Method And System For A Secure Connection In Communication Networks

• US 20080052769A1
• Filed: 05/31/2004
• Published: 02/28/2008
• Est. Priority Date: 05/31/2004
• Status: Active Grant

• Current Assignee: Telecom Italia S.p.A.
• Original Assignee: Telecom Italia S.p.A.
• Inventors: Leone, Manuel, Caprella, Ettore
• Granted Patent: US 8,296,825 B2
• Time in Patent Office: Days
• US Class Current: 726/7
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/166 at the transport layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 92/16 Interfaces between hierarchically similar devices

Abstract

A system for enabling a user to communicate on a virtual private network through a public communication network, the possibility of communicating on the private network depending on the availability to the user of at least one enabling credential sent to the user in encrypted form. The system includes at least one SIM type module available to the user and bearing an encryption mechanism and it is configured to decrypt the enabling credential at the user exploiting the encryption mechanism home by the SIM type module, the SIM type module being able to interact with at least one additional communication network to activate the encryption mechanism.

Claims

1-22. -22. (canceled)

23. A method for enabling a user to communicate on a virtual private network through a public communication network, the possibility of communicating on said virtual private network depending on the availability to said user of at least one enabling credential sent to the user in encrypted form, comprising the steps of:

providing said user with a SIM type module bearing an encryption mechanism; and

decrypting said at least one enabling credential at said user exploiting said encryption mechanism borne by said SIM type module, said SIM type module being able to interact with at least one additional communication network to activate said encryption mechanism.

24. The method as claimed in claim 23, comprising the step of providing said user with a SIM type module comprising a SIM card able to interact with at least one mobile telephony network.

25. The method as claimed in claim 23, comprising the step of providing said user with a user terminal capable of connecting to said public communication network and to said SIM type module.

26. The method as claimed in claim 23, comprising the step of providing said user with a terminal selected from the group of:

PC, notebook, laptop, PDA, and smartphone.

27. The method as claimed in claim 25, comprising the step of providing said user with a user terminal capable of connecting to said SIM type module through at least a communication channel selected from the group of:

a Smart Card reader, a Bluetooth channel, an IrDA channel, a SIM card reader, a cell phone, and a cable.

28. The method as claimed in claim 23, comprising the step of providing encrypted communication modes between said virtual private network and the users who communicate thereon.

29. The method as claimed in claim 28, comprising the step of providing said encrypted communication modes according to protocols selected from SSL, TLS, SSH and IPsec.

30. The method as claimed in claim 28, comprising the step of providing at least one gateway associated with said virtual private network to activate said encrypted communication modes.

31. The method as claimed in claim 23, comprising the step of providing an inter working function co-operating with said at least one additional communication network, said at least one additional communication network being provided with an authentication center.

32. The method as claimed in claim 31, comprising the steps of:

providing said user with a user terminal associated with said SIM type module;

said user terminal for mobile communication being capable of communicating with said authentication center through said inter working function; and

requesting from said authentication center, given the request by said user to communicate on said virtual private network, at least one respective set of authentication data, said authentication data being used to activate said encryption mechanism borne by said SIM type module.

33. The method as claimed in claim 32, wherein said requesting step comprises the transmission of an identifier of said SIM type module to said authentication center.

34. The method as claimed in claim 33, wherein said identifier is the international mobile subscriber identity.

35. The method as claimed in claim 32, wherein said authentication data comprise at least one triplet.

36. The method as claimed in claim 31, comprising the steps of:

registering said at least one gateway and the respective users with said inter working function; and

activating said virtual private network between said users and said at least one gateway.

37. The method as claimed in claim 36, wherein said step of registering said at least one gateway and the respective users with said inter working function entails the step of identifying which ones, in a set of SIM type modules issued, are SIM type modules enabled to communicate on said virtual private network in relation to the specific gateway.

38. The method as claimed in claim 36, wherein said step of registering said at least one gateway and the respective users with said inter working function entails the operation of providing said inter working function with information selected in the group of:

list of SIM type modules capable of accessing the services of said virtual private network through the gateway; and

interconnecting modes between said inter working function and said gateway.

39. The method as claimed in claim 38, wherein said interconnecting modes between said inter working function and said gateway are selected from the group of interconnection on a dedicated link and connection on a public network by means of VPN technologies.

40. The method as claimed in claim 23, comprising the steps of receiving from said user who intends to communicate over said virtual private network, an identifier of said SIM type module with associated information entities selected from the group of:

a set of addresses reachable by said identifier on said virtual private network,

time bands in which said user is allowed to access said virtual private network;

days of the week in which said user is allowed to access said virtual private network; and

enabled protocols for said user.

44. A computer product capable of being loaded into the memory of an electronic computer and comprising portions of software code capable of implementing the method as claimed in claim 23.

41. A system for enabling a user to communicate on a virtual private network through a public communication network, the possibility of communicating on said virtual private network depending on the availability to said user of at least one enabling credential sent to the user in encrypted form, comprising at least one SIM type module available to said user and bearing an encryption mechanism and at least an additional communication network, the system being configured to decrypt said at least one enabling credential with said user exploiting said encryption mechanism borne by said SIM type module, said encryption mechanism being activated by the interaction between said SIM type module and said at least one additional communication network.

42. The system as claimed in claim 41, wherein said at least one additional communication network comprises an authentication center to provide authentication data capable of activating said encryption mechanism.

43. A public communication network configured to enable a user to communicate on a virtual private network through said public communication network, the possibility of communicating on said virtual private network depending on the availability to said user of at least one enabling credential sent to the user in encrypted form, the public network having associated therewith a system according to claim 41.