System and method for managing network service access and enrollment

• US 7,114,175 B2
• Filed: 08/03/2001
• Issued: 09/26/2006
• Est. Priority Date: 08/03/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Lähteenmäki, Markku
• Primary Examiner(s): Moise, Emmanuel L.
• Assistant Examiner(s): NGUYEN, MINH DIEU T
• Application Number:
  US09/922,440
• Publication Number:
  US 20030028805A1
• Time in Patent Office: 1,880 Days
• Field of Search: 713/201, 455/435.1, 709/229, 726 3- 4, 726 26- 29, 705/67, 380/270
• US Class Current: 726/4
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 74/00 Wireless channel access

Abstract

A system and method for automatically switching network connections to an appropriate network entity based on access rights possessed by a user of a wireless terminal. A switch recognizes the certificate provided by a terminal, and directs the connection to the service provider hosting a targeted secure service if the certificate proves to have the appropriate access rights. The switch directs the connection to an enrollment module if the certificate does not correspond to the service provider'"'"'s required certificate, where the user can attempt to obtain the appropriate certificate from the enrollment module to ultimately access the targeted secure service.

Claims

1. A method for automatically directing network connections based on access rights possessed by a user of a wireless terminal, the method comprising:

receiving a certificate, having security information indicative of the access rights possessed by the user, from the wireless terminal;

determining whether the received certificate corresponds to a service provider authentication certificate which identifies access rights for a targeted service;

directing the network connection to the targeted service if the received certificate corresponds to the service provider authentication certificate;

directing the network connection to an enrollment module to register for the service provider authentication certificate using a user identity and a private key, if the received certificate does not correspond to the service provider authentication certificate; and

enrolling the user with the targeted service via the enrollment module when the network connection is directed to the enrollment module; and

automatically directing the network connection to the targeted service in response to the enrollment.

2. The method of claim 1, further comprising providing a list of one or more available predetermined certificates to the wireless terminal.

3. The method of claim 2, further comprising providing the list of available predetermined certificates to the wireless terminal in a predetermined order in which selection at the wireless terminal is to be effected.

4. The method of claim 3, further comprising selecting, at the wireless terminal, a locally-stored certificate corresponding to the highest order predetermined certificate that matches the locally-stored certificate.

5. The method of claim 4, further comprising establishing the network connection using the selected locally-stored certificate, wherein the selected certificate is the certificate received from the wireless terminal having security information indicative of the access rights possessed by the user.

6. The method of claim 3, further comprising allowing the wireless terminal to establish the network connection utilizing a locally-stored certificate corresponding to the predetermined certificate that is highest in the predetermined order that matches the locally-stored certificate.

7. The method of claim 1, wherein receiving a certificate comprises receiving the certificate via a client certificate message issued by the wireless terminal.

8. The method of claim 1, further comprising providing the service provider authentication certificate back to the wireless terminal in response to enrolling the user with the targeted service.

9. The method of claim 1, wherein the access rights possessed by the user are stored as local certificates on a Wireless Identity Module (WIM).

10. The method of claim 1, further comprising supplying the wireless terminal with a list of available authentication certificates from which the wireless terminal may use to establish the connection.

11. The method of claim 10, further comprising supplying the wireless terminal with the list of available authentication certificates in a preferred order from which the wireless terminal must utilize a highest preference authentication certificate possessed at the wireless terminal in establishing the connection.

12. The method of claim 11, wherein the highest preference authentication certificate listed is the service provider authentication certificate.

13. The method of claim 10, wherein determining whether the received certificate corresponds to a service provider authentication certificate comprises comparing the received certificate to the list of available authentication certificates.

14. The method of claim 1, wherein determining whether the received certificate corresponds to a service provider authentication certificate comprises comparing the received certificate to the service provider authentication certificate.

15. A system for managing access and enrollment for a secure service available to a user via a wireless terminal, comprising:

a service module from which a service provider avails the secure service to the user of the wireless terminal;

an enrollment manager to effect user registration to the secure service using a user identity and a private key; and

a switch module coupled to receive a security certificate utilized by the wireless terminal in establishing a connection therewith, wherein the switch module directs the connection to either the service module or the enrollment manager depending on the security certificate utilized in establishing the connection, wherein the enrollment manager is configured to issue authentication certificates upon successful registration, including a service provider authentication certificate required for use with the secure service, and wherein at least one of the switch module or the enrollment module automatically directs the network connection to the service module in response to the registration.

16. The system as in claim 15, wherein the switch module determines which security certificate is utilized in establishing the connection, and directs the connection to either the service module or the enrollment manager depending on the utilized security certificate.

17. The system as in claim 16, wherein the security certificate is digitally signed by the service provider indicating that the user is registered with the service provider for use of the secure service, thereby directing the connection to the service module.

18. The system as in claim 16, wherein the security certificate is not digitally signed by the service provider, indicating that the user is not registered with the service provider for use of the secure service, thereby directing the connection to the enrollment manager.

19. The system as in claim 16, wherein the security certificate is digitally signed by a trusted authority that is trusted by the service provider, indicating that the user may obtain registration through the trusted authority, thereby directing the connection to the enrollment manager.

20. The system as in claim 15, wherein the security certificate comprises an authentication certificate.

21. The system as in claim 20, wherein the authentication certificate comprises at least one of an identity verification authentication certificate, an authorization certificate, and a non-repudiation certificate.

22. The system as in claim 15, wherein the switch module comprises a list of potential authentication certificates listed in a preferred order of use, and wherein the switch module provides the list of potential authentication certificates to the wireless terminal to allow the wireless terminal to establish the connection using a highest order authentication certificate in accordance with the preferred order of use.

23. The system as in claim 22, wherein the switch comprises a compare module to compare at least one of the predetermined authentication certificates to the authentication certificate used by the wireless terminal.

24. The system as in claim 23, wherein:

(a) the compare module compares a service provider'"'"'s authentication certificate to the authentication certificate used by the wireless terminal in establishing the connection;

(b) if a match is found, the switch module directs the user to the service module to use the secure service; and

(c) if a match is not found, the switch module directs the user to the enrollment manager to effect user registration to the secure service.

25. The system as in claim 23, wherein:

(a) the compare module compares each of the predetermined authentication certificates to the authentication certificate used by the wireless terminal; and

(b) the switch module directs the user to the service module or the enrollment manager depending on the results of the comparison.

26. A system for managing user access and enrollment for a secure service available on a network, comprising:

a wireless network including a plurality of wireless terminals operable therein;

a network of computing systems wherein at least one of the computing systems comprises a server computing system hosting a secure service targeted by at least one of the wireless terminals, and wherein at least one of the computing systems comprises an enrollment server to effect user registration to the secure service using a user identity and a private key;

a gateway computing system configured to bridge communications between the wireless network and the network of computing systems; and

a network switch coupled to receive an authentication certificate utilized by a wireless terminal in establishing a connection with the network of computing systems, wherein the network switch switches the connection to the server computing system or the enrollment server depending on the authentication certificate utilized by the wireless terminal in establishing the connection, wherein the wireless terminal is enrolled with the secure service via the enrollment server when the network connection is directed to the enrollment server, and wherein at least one of the network switch or the enrollment server automatically directs the network connection to the service module in response to the enrollment.

27. The system as in claim 26, wherein the gateway computing system comprises a Wireless Application Protocol (WAP) gateway, and at least the wireless terminal establishing the connection with the network of computing systems comprises a WAP-compliant terminal.

28. The system as in claim 27, wherein the WAP-compliant terminal comprises one of a wireless telephone, personal digital assistant, wireless pager, and wireless laptop computer.

29. The system as in claim 26, wherein the network of computing systems comprises the Internet, and wherein the Wireless Application Protocol (WAP) is used to communicate between the wireless terminal and the Internet.

30. A system for automatically routing network connections based on access rights possessed by a user of a wireless terminal, comprising:

means for receiving a certificate, having security information indicative of the access rights possessed by the user, from the wireless terminal;

means for determining whether the received certificate corresponds to a service provider authentication certificate which identifies access rights for a targeted service;

means for directing the network connection to the targeted service if the received certificate corresponds to the service provider authentication certificate, and for directing the network connection to an enrollment module to register for the service provider authentication certificate using a user identity and a private key if the received certificate does not correspond to the service provider authentication; and

means for enrolling the user with the targeted service based on the network connection being directed to the enrollment module; and

means for automatically directing the network connection to the targeted service in response to the enrollment.

31. A computer-readable program storage medium tangibly embodying a program of instructions executable by a computing system to manage user access and enrollment for secure network services by performing steps comprising:

receiving a certificate, having security information indicative of the access rights possessed by the user, from the wireless terminal;

determining whether the received certificate corresponds to a service provider authentication certificate which identifies access rights for a targeted service;

directing the network connection to the targeted service if the received certificate corresponds to the service provider authentication certificate;

directing the network connection to an enrollment module to register for the service provider authentication certificate using a user identity and a private key, if the received certificate does not correspond to the service provider authentication certificate; and

facilitating enrollment of the user with the targeted service via the enrollment module when the network connection is directed to the enrollment module; and

facilitating automatic redirection of the network connection to the targeted service in response to the enrollment.

32. A network switching module operable in a network for facilitating the management of access and enrollment to at least one secure service available to a user of a wireless terminal, the network switching module comprising:

an authentication certificate identification module configured to store a plurality of authentication certificates associated with the secure service, and to deliver the plurality of authentication certificates to the wireless terminal with a preferred order indication identifying a preferred order of use for connecting to the secure service; and

a compare module coupled to receive an authentication certificate from the wireless terminal corresponding to the highest order authentication certificate available at the wireless terminal based on the preferred order indication, wherein the compare module is configured to compare the received authentication certificate with the plurality of authentication certificates and to direct the connection to either the secure service or an enrollment manager to register for the secure service using a user identity and a private key based on the result of the comparison, wherein at least one of the compare module or the enrollment manager automatically directs the connection to the secure service in response to the enrollment.

33. The network switching module as in claim 32, wherein the compare module is configured to direct the connection to the secure service if the result of the comparison indicates that the received authentication certificate is of sufficiently high order to access the secure service.

34. The network switching module as in claim 32, wherein the compare module is configured to direct the connection to the enrollment manager to effect user registration to the secure service if the result of the comparison indicates the received authentication certificate is not of sufficiently high order to access the secure service.