Session key management for public wireless LAN supporting multiple virtual operators

• US 7,239,864 B2
• Filed: 08/13/2003
• Issued: 07/03/2007
• Est. Priority Date: 08/14/2002
• Status: Expired due to Term

• Current Assignee: InterDigital Patent Holdings, Inc. (InterDigital, Inc.)
• Original Assignee: Thomson Licensing (Vantiva SA)
• Inventors: Zhang, Junbiao
• Primary Examiner(s): Feild; Joseph
• Assistant Examiner(s): Nguyen; Huy D
• Application Number:
  US10/524,188
• Publication Number:
  US 20060161771A1
• Time in Patent Office: 1,420 Days
• Field of Search: 455/411, 455/410, 455/426.1, 455/426.2, 455/435.1, 455/41.2, 455/419, 713/171, 713/168
• US Class Current: 455/411
• CPC Class Codes: H04L 2209/80 Wireless network architectures or network communication protocols for wireless network security H04W12/00
• CPC Class Codes: H04L 63/06 for supporting key management in a packet data network cryptographic mechanisms or cryptographic arrangements for key management H04L9/08
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/18 using different networks or channels, e.g. using out of band channels cryptographic mechanisms or cryptographic arrangements for key distribution involving distinctive intermediate devices or communication paths H04L9/0827; cryptographic mechanisms or cryptographic arrangements for authentication using a plurality of channels H04L9/3215
• CPC Class Codes: H04L 9/0844 with user authentication or key authentication, e.g. ElGamal, MTI, MQV-Menezes-Qu-Vanstone protocol or Diffie-Hellman protocols using implicitly-certified keys
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 48/18 Selecting a network or a communication service
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/08 Access point devices

Abstract

A method and apparatus for managing a session key for allowing a mobile terminal to access a wireless local area network (WLAN). The invention provides for establishing a first secure channel between an access point and a virtual operator, and suggesting a session key to the virtual operator from the access point. A second secure channel is established between the virtual operator and a user, and the session key is sent to the user via the second secure channel upon successful user authentication. The mobile terminal accesses the WLAN using the session key.

Claims

1. A method for managing a session key used for enabling communications between a mobile terminal and an access point in a wireless local area network (“

WLAN”

), comprising the steps of;

receiving a request for access to the WLAN from the mobile terminal;

determining a virtual operator associated with the access request;

establishing a first secure channel between the access point and the virtual operator;

requesting user authentication from the virtual operator via the first secure channel, wherein the virtual operator communicates with the mobile terminal via a second secure channel to authenticate the mobile terminal;

selecting a session key and sending the session key to the virtual operator via the first secure channel, wherein the virtual operator sends the session key to the mobile terminal via the second secure channel; and

communicating with the mobile terminal using the session key;

wherein the step of requesting user authentication is performed in parallel with the step of selecting and sending the session key.

2. The method according to claim 1, wherein the communicating step comprises communicating with the mobile terminal using the session key upon receiving notification of successful user authentication from the virtual operator.

3. The method according to claim 1, wherein the step of selecting a session key comprises placing the session key on hold until notification of successful user authentication from the virtual operator, and upon notification removing the session key from on hold and sending the session key to the virtual operator.

4. The method according to claim 3, further comprising the step of removing the session key from on hold if the authentication is successful.

5. The method according to claim 1, wherein the virtual operator includes one of an Internet Service Provider, a cellular provider and a credit card provider.

6. A method for managing a session key used for enabling communications between a mobile terminal and an access point in a wireless local area network (“

WLAN”

), comprising the steps of;

receiving a request for access to the WLAN from the mobile terminal;

determining a virtual operator associated with the access request;

establishing a first secure channel between the access point and the virtual operator;

requesting user authentication from the virtual operator via the first secure channel, wherein the virtual operator communicates with the mobile terminal via a second secure channel to authenticate the mobile terminal;

selecting a session key and sending the session key to the virtual operator via the first secure channel, wherein the virtual operator sends the session key to the mobile terminal via the second secure channel; and

communicating with the mobile terminal using the session key;

wherein the step of selecting a session key and sending the session key to the virtual operator via the first secure channel is performed only after receiving notification of successful user authentication from the virtual operator.

7. An apparatus for managing a session key used for enabling communications between a mobile terminal and a wireless local area network (“

WLAN”

), comprising;

means for receiving a request for access to the WLAN from the mobile terminal;

means for determining a virtual operator associated with the access request;

first means for communicating with the virtual operator via a first secure channel, the first communicating means requesting user authentication from the virtual operator via the first secure channel, wherein the virtual operator communicates with the mobile terminal via a second secure channel to authenticate the mobile terminal;

means, coupled to the first communicating means, for selecting a session key and sending the session key to the virtual operator via the first secure channel, wherein the virtual operator sends the session key to the mobile terminal via the second secure channel; and

second means for communicating with the mobile terminal using the session key;

wherein the first communicating means requests user authentication in parallel with selecting means selecting and sending the session key.

8. The apparatus according to claim 7, wherein the second communicating means communicates with the mobile terminal using the session key upon receiving notification of successful user authentication from the virtual operator.

9. The apparatus according to claim 7, wherein the selecting means places the session key on hold until notification of successful user authentication from the virtual operator, and upon notification removes the session key from on hold and sends the session key to the virtual operator.

10. The apparatus according to claim 9 wherein the selecting means removes the session key from on hold if the authentication is successful.

11. The apparatus according to claim 7, wherein the virtual operator includes one of an Internet Service Provider, a cellular provider and a credit card provider.

12. An apparatus for managing a session key used for enabling communications between a mobile terminal and a wireless local area network (“

WLAN”

), comprising;

means for receiving a request for access to the WLAN from the mobile terminal;

means for determining a virtual operator associated with the access request;

first means for communicating with the virtual operator via a first secure channel, the first communicating means requesting user authentication from the virtual operator via the first secure channel, wherein the virtual operator communicates with the mobile terminal via a second secure channel to authenticate the mobile terminal;

means, coupled to the first communicating means, for selecting a session key and sending the session key to the virtual operator via the first secure channel, wherein the virtual operator sends the session key to the mobile terminal via the second secure channel; and

second means for communicating with the mobile terminal using the session key

wherein the selecting means selects a session key and sends the session key to the virtual operator via the first secure channel only after receiving notification of successful user authentication from the virtual operator.