System and method for secure provisioning of a mobile station from a provisioning server using IWF-based firewall

• US 6,466,779 B1
• Filed: 03/07/2000
• Issued: 10/15/2002
• Est. Priority Date: 03/07/2000
• Status: Expired due to Term

• Current Assignee: Samsung Electronics Co. Ltd. (Samsung Group)
• Original Assignee: Samsung Electronics Co. Ltd. (Samsung Group)
• Inventors: Moles, Bryan J., Herle, Sudhindra P.
• Primary Examiner(s): Hunter, Daniel
• Assistant Examiner(s): TRAN, TUAN A
• Application Number:
  US09/520,757
• Time in Patent Office: 952 Days
• Field of Search: 455/410-412, 455/414, 455/418-419, 709/219, 709/222, 709/225, 709/227, 709/238, 709/223
• US Class Current: 455/410
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04M 3/16 with lock-out or secrecy provision in party-line systems

Abstract

There is disclosed a security apparatus, for use in a wireless network comprising base stations that communicate with mobile stations, for preventing unprovisioned mobile stations from accessing an Internet protocol (IP) data network via the wireless network. The security apparatus comprises a database that stores a first server IP address of a first provisioning server in the wireless network, and a first controller for receiving a first IP data packet transmitted by a first mobile station, wherein the first IP data packet comprises a first source IP address and a first destination IP address. The first controller determines if the first mobile station is provisioned and transmits the first IP data packet to the IP data network if the first mobile station is provisioned. If the first mobile station is unprovisioned, the first controller transmits the first IP data packet to the IP data network if the first destination IP address matches the first server IP address and prevents transmission of the first IP data packet to the IP data network if the first destination IP address does not match the first server IP address.

Claims

1. For use in a wireless network comprising a plurality of base stations capable of communicating with a plurality of mobile stations, a security apparatus for preventing unprovisioned mobile stations from accessing an Internet protocol (IP) data network via said wireless network, said security apparatus comprising:

a database capable of storing a first server IP address of a first provisioning server associated with said wireless network; and

a first controller capable of receiving a first IP data packet transmitted by a first one of said plurality of mobile stations, said first IP data packet comprising a first source IP address and a first destination IP address, wherein said first controller is capable of

     1) determining if said first mobile station is provisioned,

     2) transmitting said first IP data packet to said IP data network if said first mobile station is provisioned, and

     3) if said first mobile station is unprovisioned, one of;

a) transmitting said first IP data packet to said IP data network if said first destination IP address matches said first server IP address and b) preventing transmission of said first IP data packet to said IP data network if said first destination IP address does not match said first server IP address.

2. The security apparatus as set forth in claim 1 wherein said security apparatus is disposed in an interworking function unit capable of transferring data between said wireless network and IP data network coupled to said wireless network.

3. The security apparatus as set forth in claim 1 wherein said first controller determines whether said first mobile station is provisioned by comparing said first source IP address to a plurality of IP addresses of provisioned mobile stations stored in said database.

4. The security apparatus as set forth in claim 1 wherein said first controller determines whether said first mobile station is provisioned by comparing said first source IP address to a plurality of IP addresses of unprovisioned mobile stations stored in said database.

5. The security apparatus as set forth in claim 1 wherein said first controller is capable of comparing said first destination IP address to a plurality of server IP addresses stored in said database.

6. The security apparatus as set forth in claim 5 wherein said first controller transmitting said first IP data packet to said IP data network if said first destination IP address matches any one of said plurality of server IP addresses.

7. The security apparatus as set forth in claim 5 wherein said first controller prevents transmission of said first IP data packet to said IP data network if said first destination IP address does not match any of said plurality of server IP addresses.

8. The security apparatus as forth in claim 1 wherein said first controller is further capable of receiving from said IP data network a second IP data packet directed to a second one of said plurality of mobile stations, said second IP data packet comprising a second source IP address and a second destination IP address, wherein said first controller is capable of 1) determining if said second mobile station is provisioned, 2) transmitting said second IP data packet to said second mobile station if said second mobile station is provisioned, and 3) if said second mobile station is unprovisioned, one of:

a) transmitting said second IP data packet to said second mobile station if said second source IP address matches said first server IP address and b) preventing transmission of said second IP data packet to said second mobile station if said second source IP address does not match said first server IP address.

9. The security apparatus as set forth in claim 8 wherein said first controller determines whether said second mobile station is provisioned by comparing said second destination IP address to a plurality of IP addresses of provisioned mobile stations stored in said database.

10. The security apparatus as set forth in claim 8 wherein said first controller determines whether said second mobile station is provisioned by comparing said second destination IP address to a plurality of IP addresses of unprovisioned mobile stations stored in said database.

11. A wireless network comprising:

a plurality of base stations capable of communicating with a plurality of mobile stations; and

a security apparatus for preventing unprovisioned mobile stations from accessing an Internet protocol (IP) data network via said wireless network, said security apparatus comprising;

a database capable of storing a first server IP address of a first provisioning server associated with said wireless network; and

a first controller capable of receiving a first IP data packet transmitted by a first one of said plurality of mobile stations, said first IP data packet comprising a first source IP address and a first destination IP address, wherein said first controller is capable of

     1) determining if said first mobile station is provisioned,

     2) transmitting said first IP data packet to said IP data network if said first mobile station is provisioned, and

     3) if said first mobile station is unprovisioned, one of;

a) transmitting said first IP data packet to said IP data network if said first destination IP address matches said first server IP address and b) preventing transmission of said first IP data packet to said IP data network if said first destination IP address does not match said first server IP address.

12. The wireless network as set forth in claim 11 wherein said security apparatus is disposed in an interworking function unit capable of transferring data between said wireless network and IP data network coupled to said wireless network.

13. The wireless network as set forth in claim 11 wherein said first controller determines whether said first mobile station is provisioned by comparing said first source IP address to a plurality of IP addresses of provisioned mobile stations stored in said database.

14. The wireless network as set forth in claim 11 wherein said first controller determines whether said first mobile station is provisioned by comparing said first source IP address to a plurality of IP addresses of unprovisioned mobile stations stored in said database.

15. The wireless network as set forth in claim 11 wherein said first controller is capable of comparing said first destination IP address to a plurality of server IP addresses stored in said database.

16. The wireless network as set forth in claim 15 wherein said first controller transmitting said first IP data packet to said IP data network if said first destination IP address matches any one of said plurality of server IP addresses.

17. The wireless network as set forth in claim 15 wherein said first controller prevents transmission of said first IP data packet to said IP data network if said first destination IP address does not match any of said plurality of server IP addresses.

18. The wireless network as forth in claim 11 wherein said first controller is further capable of receiving from said IP data network a second IP data packet directed to a second one of said plurality of mobile stations, said second IP data packet comprising a second source IP address and a second destination IP address, wherein said first controller is capable of 1) determining if said second mobile station is provisioned, 2) transmitting said second IP data packet to said second mobile station if said second mobile station is provisioned, and 3) if said second mobile station is unprovisioned, one of:

a) transmitting said second IP data packet to said second mobile station if said second source IP address matches said first server IP address and b) preventing transmission of said second IP data packet to said second mobile station if said second source IP address does not match said first server IP address.

19. The wireless network as set forth in claim 18 wherein said first controller determines whether said second mobile station is provisioned by comparing said second destination IP address to a plurality of IP addresses of provisioned mobile stations stored in said database.

20. The wireless network as set forth in claim 18 wherein said first controller determines whether said second mobile station is provisioned by comparing said second destination IP address to a plurality of IP addresses of unprovisioned mobile stations stored in said database.

21. For use in a wireless network comprising a plurality of base stations capable of communicating with a plurality of mobile stations, a method of preventing unprovisioned mobile stations from accessing an Internet protocol (IP) data network via the wireless network, the method comprising the steps of:

storing in a database a first server IP address of a first provisioning server associated with the wireless network;

receiving a first IP data packet transmitted by a first one of the plurality of mobile stations, the first IP data packet comprising a first source IP address and a first destination IP address;

determining if the first mobile station is provisioned;

if the first mobile station is provisioned, transmitting the first IP data packet to the IP data network; and

if the first mobile station is unprovisioned, one of;

transmitting the first IP data packet to the IP data network if the first destination IP address matches the first server IP address; and

preventing transmission of the first IP data packet to the IP data network if the first destination IP address does not match the first server IP address.

22. The method as set forth in claim 21 wherein the step of determining whether the first mobile station is provisioned comprises the substep of comparing the first source IP address to a plurality of IP addresses of provisioned mobile stations stored in the database.

23. The method as set forth in claim 21 wherein the step of determining whether the first mobile station is provisioned comprises the substep of comparing the first source IP address to a plurality of IP addresses of unprovisioned mobile stations stored in the database.

24. The method as set forth in claim 21 further including the step of comparing the first destination IP address to a plurality of server IP addresses stored in the database.

25. The method as forth in claim 21 further comprising the steps of:

receiving from the IP data network a second IP data packet directed to a second one of the plurality of mobile stations, the second IP data packet comprising a second source IP address and a second destination IP address;

determining if the second mobile station is provisioned;

if the second mobile station is provisioned, transmitting the second IP data packet to the second mobile station; and

if the second mobile station is unprovisioned, one of;

transmitting the second IP data packet to the second mobile station if the second source IP address matches the first server IP address; and

preventing transmission of the second IP data packet to the second mobile station if the second source IP address does not match the first server IP address.

26. The method as set forth in claim 25 wherein the step of determining whether the second mobile station is provisioned comprises the substep of comparing the second destination IP address to a plurality of IP addresses of provisioned mobile stations stored in the database.

27. The method as set forth in claim 25 wherein the step of determining whether the second mobile station is provisioned comprises the substep of comparing the second destination IP address to a plurality of IP addresses of unprovisioned mobile stations stored in the database.