Wireless LAN authentication, authorization, and accounting system and method utilizing a telecommunications network

• US 7,242,676 B2
• Filed: 10/17/2002
• Issued: 07/10/2007
• Est. Priority Date: 10/17/2002
• Status: Active Grant

• Current Assignee: Far Eastone Telecommunications Company Limited
• Original Assignee: Far Eastone Telecommunications Company Limited
• Inventors: Hsu, Ching-Hsiang, Hung, Jung Nan, Rao, Herman
• Primary Examiner(s): Pezzlo; John
• Application Number:
  US10/274,938
• Publication Number:
  US 20040076128A1
• Time in Patent Office: 1,727 Days
• Field of Search: 370/338, 370/329, 370/386, 370/469, 370/252, 380/247, 709/229, 455/406, 705/40
• US Class Current: 370/338
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1414 in real-time
• CPC Class Codes: H04L 12/1439 time-based
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 2215/2033 WLAN
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The invention provides an authentication, authorization and accounting (AAA) a system and method for a plurality of wireless local area networks (WLANs) operated by a plurality of WLAN operators comprising a mobile communications device connecting to a terminal comprising an Internet access application program for accessing the Internet, a personal identification number (PIN) application program, and a unique identifier application program. An Internet access session is requested from the mobile device by activating the Internet access application program in the terminal. Entry of a PIN is requested by activating the PIN application program in the terminal, wherein the PIN is authenticated. If the PIN is authenticated, a unique identifier is retrieved from the mobile device by activating the unique identifier application program in the terminal wherein the unique identifier is accepted by all of the plurality of WLANs operated by the WLAN operators, wherein the unique identifier is sent to an authentication server for WLAN authentication. If the authentication server authenticates the unique identifier, the authentication server instructs an access server that the unique identifier has been authenticated wherein the access server instructs an accounting server to begin access fee calculation. If the access server determines that the Internet access session has ended, the access fee calculation is ended at the accounting server and a total fee is calculated from the ended access fee calculation.

Claims

1. An authentication, authorization and accounting (AAA) method for a plurality of wireless local area networks (WLANs) operated by a plurality of WLAN operators comprising the steps of:

(a) connecting a mobile communications device to a terminal having an Internet access application program for accessing the Internet, a personal identification number (PIN) application program, and a subscriber identity module (SIM) application program;

(b) requesting an Internet access session from said mobile device by activating said Internet access application program in said terminal;

(c) requesting entry of a PIN by activating said PIN application program in said terminal;

(d) authenticating said PIN;

(e) if said PIN is authenticated in step (d),

(f) retrieving an international mobile subscriber identity (IMSI) number from said mobile device by activating said SIM application program in said terminal wherein said IMSI number is accepted by all of said plurality of WLANs operated by said WLAN operators;

(g) sending said IMSI number to an authentication server for WLAN authentication;

(h) authenticating said IMSI number at said authentication server;

(i) if said IMSI number is authenticated in step (h),

(j) instructing an access server that said IMSI number is authenticated;

(k) providing said Internet access session to said mobile device;

(l) instructing an accounting server from said access server to begin access fee calculation;

(m) performing said access fee calculation at said accounting server;

(n) determining if said Internet access session has ended at said access server;

(o) if it is determined in step (n) that said Internet access session has ended,

(p) ending said access fee calculation at said accounting server;

(q) calculating a total fee from said access fee calculation ended in step (p).

2. The method of claim 1 further comprising the step of displaying said total fee at said mobile device.

3. The method of claim 1 further comprising the step of:

if said PIN is not authenticated in step (d), repeating steps (c) and (d).

4. The method of claim 3 further comprising the step of:

if step (c) is repeated more than three times, denying Internet access by said mobile device.

5. The method of claim 1 further comprising the step of:

if said PIN is not authenticated in step (d), denying Internet access by said mobile device.

6. The method of claim 1 further comprising the steps of:

if said PIN is not authenticated in step (d),

(r) denying Internet access by said mobile device;

(s) displaying denied access at said mobile device; and

(t) logging said denied access at said authentication server.

7. The method of claim 1 further comprising the steps of:

if said PIN is not authenticated in step (d),

(u) denying Internet access by said mobile device;

(v) displaying denied access at said mobile device; and

(w) displaying option of pre-paid access at said mobile device.

8. The method of claim 7 further comprising the steps of:

(x) requesting a credit card charge for said pre-paid access at said mobile device;

(y) performing said credit card charge;

(z) providing a new PIN for Internet access;

(aa) requesting entry of said new PIN at said mobile device; and

(bb) authenticating said new PIN.

9. The method of claim 8 further comprising the step of:

if said new PIN is authenticated in step (bb), repeating steps (f), (g), (h), (i), (j), (k), (l), (m), (n), (o), (p) and (q).

10. The method of claim 1 wherein step (e) further comprises the steps of:

(cc) sending an unstructured supplementary service data (USSD) code from said terminal to said authentication server by activating a USSD application program at said terminal wherein said USSD code is accepted by all of said plurality of WLANs operated by said WLAN operators; and

(dd) retrieving said IMSI number for said mobile device from said USSD code.

11. The method of claim 1 further comprising the step of:

if said IMSI number is not authenticated in step (h), denying Internet access by said mobile device.

12. The method of claim 1 further comprising the steps of:

if said IMSI number is not authenticated in step (h),

(ee) denying Internet access by said mobile device;

(ff) displaying denied access at said mobile device; and

(gg) logging said denied access at said authentication server.

13. The method of claim 1 further comprising the steps of:

if said IMSI number is not authenticated in step (h),

(hh) denying Internet access by said mobile device;

(ii) displaying denied access at said mobile device; and

(jj) displaying option of pre-paid access at said mobile device.

14. The method of claim 13 further comprising the steps of:

(kk) requesting a credit card charge for said pre-paid access at said mobile device;

(ll) performing said credit card charge;

(mm) authenticating said IMSI number;

(nn) repeating steps (f), (g), (h), (i), (j), (k), (l), (m), (n), (o), (p) and (q).

15. The method of claim 1 wherein said mobile device is one selected from the group consisting of a mobile telephone, mobile handset, palmtop computer and personal digital assistant (PDA);

wherein said terminal is one selected from the group consisting of a personal computer (PC), notebook computer, palmtop computer and personal digital assistant (PDA).

16. An authentication, authorization and accounting (AAA) method for a plurality of wireless local area networks (WLANs) operated by a plurality of WLAN operators comprising the steps of:

(1) connecting a mobile communications device to a terminal having an Internet access application program for accessing the Internet, a personal identification number (PIN) application program, and a unique identifier application program;

(2) requesting an Internet access session from said mobile device by activating said Internet access application program in said terminal;

(3) requesting entry of a PIN by activating said PIN application program in said terminal;

(4) authenticating said PIN;

(5) if said PIN is authenticated in step (4),

(6) retrieving a unique identifier from said mobile device by activating said unique identifier application program in said terminal wherein said unique identifier is accepted by all of said plurality of WLANs operated by said WLAN operators;

(7) sending said unique identifier to an authentication server for WLAN authentication;

(8) authenticating said unique identifier at said authentication server;

(9) if said unique identifier is authenticated in step (8),

(10) instructing an access server that said unique identifier is authenticated;

(11) instructing an accounting server from said access server to begin access fee calculation;

(12) performing said access fee calculation at said accounting server;

(13) determining if said Internet access session has ended at said access server;

(14) if it is determined in step (13) that said Internet access session has ended,

(15) ending said access fee calculation at said accounting server; and

(16) calculating a total fee from said access fee calculation ended in step (15).

17. The method of claim 16 wherein said unique identifier is an international mobile subscriber identity (IMSI) number and said unique identifier application program is a subscriber identity module (SIM) application program.

18. The method of claim 17 wherein step (5) further comprises the steps of:

(17) sending an unstructured supplementary service data (USSD) code from said terminal to said authentication server by activating a USSD application program at said terminal wherein said USSD code is accepted by all of said plurality of WLANs operated by said WLAN operators; and

(18) retrieving said IMSI number for said mobile device from said USSD code.

19. The method of claim 16 further comprising the step of displaying said total fee at said mobile device.

20. The method of claim 16 further comprising the step of:

if said PIN is not authenticated in step (4), repeating steps (3) and (4).

21. The method of claim 20 further comprising the step of:

if step (3) is repeated more than three times, denying Internet access by said mobile device.

22. The method of claim 16 further comprising the step of:

if said PIN is not authenticated in step (4), denying Internet access by said mobile device.

23. The method of claim 16 further comprising the steps of:

if said PIN is not authenticated in step (4),

(19) denying Internet access by said mobile device;

(20) displaying denied access at said mobile device; and

(21) logging said denied access at said authentication server.

24. The method of claim 16 further comprising the steps of:

if said PIN is not authenticated in step (4),

(22) denying Internet access by said mobile device;

(23) displaying denied access at said mobile device; and

(24) displaying option of pre-paid access at said mobile device.

25. The method of claim 24 further comprising the steps of:

(25) requesting a credit card charge for said pre-paid access at said mobile device;

(26) performing said credit card charge;

(27) providing a new PIN for Internet access;

(28) requesting entry of said new PIN at said mobile device; and

(29) authenticating said new PIN.

26. The method of claim 25 further comprising the step of:

if said new PIN is authenticated in step (29), repeating steps (6), (7), (8), (9), (10), (11), (12), (13), (14), (15) and (16).

27. The method of claim 16 further comprising the step of:

if said unique identifier is not authenticated in step (8), denying Internet access by said mobile device.

28. The method of claim 16 further comprising the steps of:

if said unique identifier is not authenticated in step (8),

(30) denying Internet access by said mobile device;

(31) displaying denied access at said mobile device; and

(32) logging said denied access at said authentication server.

29. The method of claim 16 further comprising the steps of:

if said unique identifier is not authenticated in step (8),

(33) denying Internet access by said mobile device;

(34) displaying denied access at said mobile device; and

(35) displaying option of pre-paid access at said mobile device.

30. The method of claim 29 further comprising the steps of:

(36) requesting a credit card charge for said pre-paid access at said mobile device;

(37) performing said credit card charge;

(38) authenticating said unique identifier;

(39) repeating steps (6), (7), (8), (9), (10), (11), (12), (13), (14), (15) and (16).

31. The method of claim 16 wherein said mobile device is one selected from the group consisting of a mobile telephone, mobile handset, palmtop computer and personal digital assistant (PDA).

32. The method of claim 16 wherein said terminal is one selected from the group consisting of a personal computer (PC), notebook computer, palmtop computer and personal digital assistant (PDA).

33. The method of claim 16 wherein said steps (1) through (16) are transparent to said WLAN operators.

34. An authentication, authorization and accounting (AAA) system for a plurality of wireless local area networks (WLANs) operated by a plurality of WLAN operators comprising:

a mobile communications device connecting to a terminal comprising an Internet access application program for accessing the Internet, a personal identification number (PIN) application program, and a unique identifier application program;

wherein an Internet access session is requested from said mobile device by activating said Internet access application program in said terminal;

wherein entry of a PIN is requested by activating said PIN application program in said terminal;

wherein said PIN is authenticated;

if said PIN is authenticated, a unique identifier is retrieved from said mobile device by activating said unique identifier application program in said terminal wherein said unique identifier is accepted by all of said plurality of WLANs operated by said WLAN operators;

wherein said unique identifier is sent to an authentication server for WLAN authentication;

if said authentication server authenticates said unique identifier, said authentication server instructs an access server that said unique identifier has been authenticated wherein said access server instructs an accounting server to begin access fee calculation;

if said access server determines that said Internet access session has ended, said access fee calculation is ended at said accounting server and a total fee is calculated from said ended access fee calculation.

35. The system of claim 34 wherein said unique identifier is an international mobile subscriber identity (IMSI) number and said unique identifier application program is a subscriber identity module (SIM) application program.

36. The system of claim 35 wherein said terminal further comprises an unstructured supplementary service data (USSD) application program;

wherein said terminal sends an unstructured supplementary service data (USSD) code to said authentication server by activating said USSD application program;

wherein said IMSI number for said mobile device is retrieved from said USSD code; and

wherein said USSD code is accepted by all of said plurality of WLANs operated by said WLAN operators.

37. The system of claim 34 wherein said total fee is displayed at said mobile device.

38. The system of claim 34 wherein said PIN authentication is repeated.

39. The system of claim 38 wherein Internet access by said mobile device is denied if said PIN authentication is repeated more than three times.

40. The system of claim 34 wherein Internet access by said mobile device is denied if said PIN is not authenticated.

41. The system of claim 34 wherein, if said PIN is not authenticated, Internet access by said mobile device is denied, said mobile device displays said denied access, and said authentication server logs said denied access.

42. The system of claim 34 wherein, if said PIN is not authenticated, Internet access by said mobile device is denied, and said mobile device displays said denied access and option of pre-paid access.

43. The system of claim 42 wherein said mobile device requests a credit card charge is requested for said pre-paid access;

wherein said credit card charge is performed and a new PIN for Internet access is provided;

wherein said mobile device requests entry of said new PIN and said new PIN is authenticated.

44. The system of claim 34 wherein Internet access is denied by said mobile device if said unique identifier is not authenticated.

45. The system of claim 34 wherein, if said unique identifier is not authenticated, Internet access by said mobile device is denied, said mobile device displays said denied access, and said authentication server logs said denied access.

46. The system of claim 34 wherein, if said unique identifier is not authenticated, Internet access by said mobile device is denied, and said mobile device displays said denied access and option of pre-paid access.

47. The system of claim 46 wherein said mobile device requests a credit card charge for said pre-paid access;

wherein said credit card charge is performed and said unique identifier is authenticated.

48. The system of claim 34 wherein said mobile device is one selected from the group consisting of a mobile telephone, mobile handset, palmtop computer and personal digital assistant (PDA).

49. The system of claim 34 wherein said terminal is one selected from the group consisting of a personal computer (PC), notebook computer, palmtop computer and personal digital assistant (PDA).

50. The system of claim 34 further comprising an access point communicable with said terminal and said access server wherein said access point is provided between said terminal and said access server.

51. An authentication, authorization and accounting (AAA) method for a plurality of wireless local area networks (WLANs) operated by a plurality of WLAN operators comprising the steps of:

(i) connecting a mobile communications device having an unstructured supplementary service data (USSD) code to a terminal having an Internet access application program for accessing the Internet and an unstructured supplementary service data (USSD) application program, wherein said USSD code is accepted by all of said plurality of WLANs operated by said WLAN operators;

(ii) requesting an Internet access session from said mobile device by activating said Internet access application program in said terminal;

(iii) requesting entry of a user name and password;

(iv) authenticating said USSD code, user name and password;

(v) sending said USSD code, user name and password to an authentication server for WLAN authentication;

(vi) authenticating said USSD code, user name and password at said authentication server;

(vii) if said USSD code, user name and password are authenticated in step (vi),

(viii) instructing an accounting server from said access server to begin access fee calculation;

(ix) performing said access fee calculation at said accounting server;

(x) determining if said Internet access session has ended at said access server;

(xi) if it is determined in step (x) that said Internet access session has ended,

(xii) ending said access fee calculation at said accounting server; and

(xiii) calculating a total fee from said access fee calculation ended in step (xii).

52. The method of claim 51 further comprising the step of displaying said total fee at said mobile device.

53. The method of claim 51 further comprising the step of:

if said USSD code is not authenticated in step (xi), denying Internet access by said mobile device.

54. The method of claim 51 further comprising the steps of:

if said USSD code are not authenticated in step (xi),

(xiv) denying Internet access by said mobile device;

(xv) displaying denied access at said mobile device; and

(xvi) logging said denied access at said authentication server.

55. The method of claim 51 further comprising the steps of:

if said user name and password are not authenticated in step (xi),

(xvii) denying Internet access by said mobile device;

(xviii) displaying denied access at said mobile device; and

(xix) logging said denied access at said authentication server.

56. The method of claim 55 further comprising the steps of:

(xx) requesting a credit card charge for said pre-paid access at said mobile device;

(xxi) performing said credit card charge;

(xxii) authenticating said user name and password; and

(xxiii) repeating steps (viii), (ix), (x), (xi), (xii) and (xiii).

57. The method of claim 51 wherein said mobile device is one selected from the group consisting of a mobile telephone, mobile handset, palmtop computer and personal digital assistant (PDA).

58. The method of claim 51 wherein said terminal is one selected from the group consisting of a personal computer (PC), notebook computer, palmtop computer and personal digital assistant (PDA).

59. The method of claim 51 wherein said steps (i) through (xiii) are transparent to said WLAN operators.

60. The method of claim 51 further comprising the step of providing an access point between said terminal and said access server wherein said access point is communicable with said terminal and said access server.