MULTI-ISP CONTROLLED ACCESS TO IP NETWORKS, BASED ON THIRD-PARTY OPERATED UNTRUSTED ACCESS STATIONS

• US 20120072727A1
• Filed: 11/28/2011
• Published: 03/22/2012
• Est. Priority Date: 03/26/2001
• Status: Abandoned Application

• Current Assignee: NEC Corporation
• Original Assignee: NEC Corporation
• Inventors: Redlich, Jens-Peter, Kuehnel, Thomas, Mueller, Wolf
• Application Number:
  US13/305,395
• Publication Number:
  US 20120072727A1
• Time in Patent Office: Days
• US Class Current: 713/168
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 12/2898 Subscriber equipments DSL modems H04M11/062; cable modems H04L12/2801
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/062 for key distribution, e.g. centrally by trusted party cryptographic mechanisms or cryptographic arrangements for key distribution involving a central third party H04L9/0819
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273

Abstract

A mechanism that allows sharing of an existing infrastructure for access to public or private IP networks, such as the public Internet or private LANs is provided. Specifically, infrastructure owners lease the infrastructure resources on a short-term basis to different Internet Service Providers (ISPs). An ISP uses these resources to provide Internet services to subscribing customers or users. The ISP controls all aspects of the Internet service provided to the subscriber, including billing, bandwidth management, and e-mail. The ISP also ensures privacy for the subscriber by means of encryption. Leasing network resources from an existing network infrastructure frees the ISP from building an expensive access infrastructure itself while the infrastructure owner is given an opportunity to generate additional revenue from infrastructure. Importantly, neither the user, nor the ISP need to trust the access station (i.e.: the access station is untrusted) through which the access to the IP network is accomplished.

Claims

1. A method for performing mutual authentication and authorization of a user'"'"'s terminal device (U) and an Internet Service Provider (P) in order to establish secure communication between the terminal (U) and a trusted network element (T) to the Internet via an untrusted access station (A) comprising:

establishing an association between a terminal (U) and an untrusted access station (A);

transmitting an ISP authentication packet from terminal (U) to ISP (P) via the untrusted access station (A);

sending a user authentication packet from said ISP (P) to said terminal (U) via said untrusted access station (A);

upon authentication of said terminal (U) and said ISP (P), said ISP performs the following;

generating a session key;

distributing said session key to said terminal (U) and a trusted network element (T), wherein said session key is used to encrypt traffic between the terminal (U) and the trusted network element (T);

establishing a secure tunnel such that the terminal (U) may communicate with the Internet via said trusted network element (T);

wherein said secure tunnel emulates a physical link between the terminal (U) and the trusted network element (T) such that traffic transmitted between the terminal (U) and said Internet via said trusted network element (T) is secure from modification or eavesdropping by said untrusted access station (A),

wherein a connection is established between the terminal and the ISP for trusted network services without providing the terminal with direct access to the Internet.

2. The method for performing mutual authentication and authorization of a terminal (U) and an Internet Service Provider (P) in order to establish a secure tunnel between the terminal (U) and a trusted network element to the Internet (T) via an untrusted access station (A) of claim 1, wherein the ISP (P) authentication packet contains an authentication challenge (CH_U) from terminal (U) to ISP (P) to authenticate the identity of ISP (P).

3. The method for performing mutual authentication and authorization of a terminal (U) and an Internet Service Provider (P) in order to establish a secure tunnel between the terminal (U) and a trusted network element to the Internet (T) via an untrusted access station (A) of claim 1, wherein the user authentication packet contains an authentication challenge (CH_P) from ISP (P) to the terminal (U) to authenticate the identity of user (U).