Sim based authentication as payment method in public ISP access networks

• US 7,313,381 B1
• Filed: 05/03/1999
• Issued: 12/25/2007
• Est. Priority Date: 05/03/1999
• Status: Expired due to Fees

• Current Assignee: III Holdings 3, LLC
• Original Assignee: Nokia Corporation
• Inventors: Lemiläinen, Jussi, Ekberg, Jan-Erik
• Primary Examiner(s): Abdi, Kambiz
• Application Number:
  US09/303,424
• Time in Patent Office: 3,158 Days
• Field of Search: 705/79, 705/64, 705/14, 705/74, 705/44, 380/23, 380/25, 380/49, 380/30, 380/24, 370/60, 370/236, 713/150, 713/236, 455405-409
• US Class Current: 455/405
• CPC Class Codes: G06Q 20/027 involving a payment switch or gateway
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 30/018 Certifying business or products
• CPC Class Codes: G06Q 50/06 Energy or water supply
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234

Abstract

The invention is a method and system for obtaining connection to a packet data network (14). The invention includes inputting a user request to a first network (10) which requests that the user (12) be authorized for connection to the packet data network through a second network; transmitting from the first network to the second network the user request and an authorization of payment to the second network by the first network for the user'"'"'s use of the packet data network; transmitting from the second network to the first network authentication information granting the user authentication through the second network to the packet data network; and transmitting the authentication information from the first network to the user which informs the user that authentication to obtain connection to the packet data network has been granted.

Claims

1. A method of obtaining connection by a user through a first network and through a second network to a packet data network with the connection being paid for by the first network making payment to the second network comprising:

inputting a user request to the first network which requests that the user be authorized for connection to the packet data network through the second network, wherein the first network receives a quantification of the connectivity the user requests;

transmitting from the first network to the second network the user request and an authorization of payment to the second network by the first network for the use by the user of the packet data network;

transmitting from the second network to the first network authentication information granting the user authentication to obtain connection through the second network to the packet data network; and

transmitting the authentication information from the first network to the user which informs the user that authentication to obtain connection to the packet data network has been obtained; and

wherein

requesting to make the payment for the connection to the packet data network is the result of communications which first originate with the user request to the first network, the user is anonymous and there is no roaming agreement or contract with the packet data network for the user to obtain the connection thereto.

2. A method in accordance with claim 1, wherein:

the user request includes the quantification of connectivity which the user requests to the packet data network.

3. A method in accordance with claim 2 wherein:

the quantification comprises at least one service unit with each service unit being encoded with a random number.

4. A method in accordance with claim 3 wherein:

each service unit is encoded with a different random number.

5. A method in accordance with claim 1 wherein:

the authentication information comprises a shared key which may be used to create secure communications between the user and the packet data network.

6. A method in accordance with claim 5 wherein:

authentication information is a subscriber identification module SIM comprising a number n of service units with each service unit comprising a different random access number uniquely identifying each service unit, a signed response SRES and the shared key Kc.

7. A method in accordance with claim 2 wherein:

the authentication information comprises a shared key which may be used to create secure communications between the user and the packet data network.

8. A method in accordance with claim 7 wherein:

authentication information is a subscriber identification module SIM comprising a number n of service units with each service unit comprising a different random access number uniquely identifying each service unit, a signed response SIRES and the shared key Kc.

9. A method in accordance with claim 3 wherein:

the authentication information comprises a shared key which may be used to create secure communications between the user and the packet data network.

10. A method in accordance with claim 5 wherein:

the second network computes a subscriber identification module SIM comprising the number of service units with each service unit comprising a different random access number uniquely identifying each service unit, a signed response and the shared key Kc.

11. A method in accordance with claim 4 wherein:

the authentication information comprises a shared key which may be used to create secure communications between the user and the packet data network.

12. A method in accordance with claim 11 wherein:

authentication information is a subscriber identification module SIM comprising the number of service units with each service comprising a different random access number uniquely identify each service unit, a signed response and the shared key.

13. A method in accordance with claim 1 wherein:

the inputting of the user request to the first network, the transmitting of the user request and an authorization of payment to the second network, and the transmitting of the authentication information from the second network to the first network and to the user are by secure communications.

14. A method in accordance with claim 2 wherein:

the inputting of the user request to the first network, the transmitting of the user request and an authorization of payment to the second network, and the transmitting of the authentication information from the second network to the first network and to the user are by secure communications.

15. A method in accordance with claim 3 wherein:

the inputting of the user request to the first network, the transmitting of the user request and an authorization of payment to the second network, and the transmitting of the authentication information from the second network to the first network and to the user are by secure communications.

16. A method in accordance with claim 4 wherein:

the inputting of the user request to the first network, the transmitting of the user request and an authorization of payment to the second network, and the transmitting of the authentication information from the second network to the first network and to the user are by secure communications.

17. A method in accordance with claim 5 wherein:

the inputting of the user request to the first network, the transmitting of the user request and an authorization of payment to the second network, and the transmitting of the authentication information from the second network to the first network and to the user are by secure communications.

18. A method in accordance with claim 3 wherein:

after the user is informed that authentication to obtain connection to the packet data network has been obtained, the user transmits to the second network at least one request for consumption of at least one service unit comprising a random number RAND and a signed response SRES;

the second network compares the random number RAND and signed response SIRES of each request for consumption of at least one service unit received from the user with stored random numbers RAND and signed responses SIRES to determine if a match exists; and

if a match exists, the second network permits data packets to pass through the second network between the user and the packet network.

19. A method in accordance with claim 18 wherein:

the second network debits from a stored value of service units which have been granted to the user a number of consumed service units which are identified in each request for consumption of at least one service unit until the number of consumed service units equals the number of granted service units.

20. A method in accordance with claim 19 wherein:

each unused service unit is stored in the second network in a hash table and each used service unit is stored in the second network in a hash table.

21. A system comprising:

a user;

a first network connected to the user;

a second network connected to the first network and to the user; and

a packet data network connected to the second network; and

wherein

the first network, in response to a user request to the first network that the user be authorized for connection to the packet data network through the second network wherein the connection is paid for by the first network making payment to the second network and wherein the first network receives a quantification of the connectivity the user requests, transmits to the second network the user request and an authorization of payment by the first network for the use by the user of the packet data network, the second network transmits to the first network authentication information granting the user authentication to obtain connection through the second network to the packet data network, and the first network transmits to the user authentication information which informs the user that authentication to obtain connection to the packet data network has been obtained; and

wherein

requesting to make the payment is the result of communications which first originate with the user request to the first network, the user is anonymous and there is no roaming agreement or contract with the packet data network for the user to obtain the connection thereto.

22. A method of obtaining connection by a user through a first network and through a second network to a packet data network with the connection being paid for by the first network making payment to the second network comprising:

inputting a user request to the first network which requests that the user be authorized for connection to the packet data network through the second network, wherein the first network receives a quantification of the connectivity the user requests;

transmitting from the first network to the second network the user request and an authorization of the payment to the second network by the first network for the use by the user of the packet data network;

transmitting from the second network to the first network authentication information granting the user authentication to obtain connection through the second network to the packet data network;

transmitting the authentication information from the first network to the user which informs the user that authentication to obtain connection to the packet data network has been obtained; and

after the user is informed that authentication to obtain connection to the packet data network has been obtained, the user transmits to the second network at least one request for consumption of at least one service unit and the second network debits from a stored value of service units which are granted to the user a consumed number of service units; and

wherein

requesting to make the payment for the connection to the packet data network is the result of communications which first originate with the user request to the first network, the user is anonymous and there is no roaming agreement or contract with the packet data network for the user to obtain the connection thereto.

23. A method in accordance with claim 22 wherein:

the number of consumed service units are identified in each request for consumption of at least one service unit until the number of consumed service units equals a number of granted units.

24. A system comprising:

a user;

a first network connected to the user;

a second network connected to the first network and to the user; and

a packet data network connected to the second network; and

wherein

the first network, in response to a user request to the first network that the user be authorized for connection to the packet data network through the second network wherein the connection is paid for by the first network making payment to the second network and wherein the first network receives a quantification of the connectivity the user requests, transmits to the second network the user request and an authorization of the payment by the first network for the use by the user of the packet data network, the second network transmits to the first network authentication information granting the user authentication to obtain connection through the second network to the packet data network, and the first network transmits to the user authentication information which informs the user that authentication to obtain connection to the packet data network has been obtained; and

after the user is informed that authentication to obtain connection to the packet data network has been obtained, the user transmits to the second network at least one request for consumption of at least one service unit and the second network debits from a stored value of service units which are granted to the user a consumed number of service units; and

wherein requesting to make the payment for the connection to the packet data network is the result of communications which first originate with the user request to the first network, the user is anonymous and there is no roaming agreement or contract with the packet data network for the user to obtain the connection thereto.

25. A system in accordance with claim 24 wherein:

the number of consumed service units are identified in each request for consumption of at least one service unit until the number of consumed service units equals a number of granted units.

26. A method of obtaining connection by a user through a first network and through a second network to a packet data network with the connection being paid for by the first network making payment to the second network comprising:

connection to the packet data network through the second network;

transmitting from the first network to the second network the user request and an authorization of the payment to the second network by the first network for the use by the user of the packet data network, wherein the first network receives a quantification of the connectivity the user requests;

transmitting from the second network to the first network authentication information granting the user authentication to obtain connection through the second network to the packet data network;

transmitting the authentication information from the first network to the user which informs the user that authentication to obtain connection to the packet data network has been obtained;

the user roams to the second network;

the user requests connection to the packet data network while roaming in the second network; and

the second network grants connection to the packet data network while roaming in the second network based upon the authorization of payment received by the second network; and

wherein

requesting to make the payment for the connection to the packet data network is the result of communications which first originate with the user request to the first network, the user is anonymous and there is no roaming agreement or contract with the packet data network for the user to obtain the connection thereto.

27. A method in accordance with claim 26, wherein:

the authorization of payment quantifies an amount of payment that the first network will pay to the second network for connection of the user to the packet data network when the user roams in the second network; and

payment for the connection of the user while roaming in the second network for connection to the packet data network is charged against the authorization.

28. A method in accordance with claim 26 wherein:

the authentication information comprises a shared key which may be used to create secure communications between the user and the packet data network.

29. A method in accordance with claim 28 wherein:

the authentication information is a subscriber identification module SIM comprising a number n of service units with each service unit comprising a different random access number uniquely identifying each service unit, a signed response SIRES and the shared key Kc.

30. A method in accordance with claim 26 wherein:

the user request includes a quantification of connectivity which the user requests to the packet data network; and

the quantification comprises at least one service unit with each service unit being encoded with a random number.

31. A method in accordance with claim 30 wherein:

each service unit is encoded with a different random number.

32. A method in accordance with claim 27 wherein:

the user request includes a quantification of connectivity which the user requests to the packet data network; and

the quantification comprises at least one service unit with each service unit being encoded with a random number.

33. A method in accordance with claim 32 wherein:

each service unit is encoded with a different random number.

34. A method in accordance with claim 26 wherein:

after the user is informed that authentication to obtain connection to the packet data network has been obtained, the user transmits to the second network at least one request for consumption of at least one service unit comprising a random number RAND and a signed response SRES;

the second network compares the random number RAND and signed response SRES of each request for consumption of at least one service unit received from the user with stored random numbers RAND and signed responses SRES to determine if a match exists; and

if a match exists, the second network permits data packets to pass through the second network between the user and the packet network.

35. A method in accordance with claim 27 wherein:

after the user is informed that authentication to obtain connection to the packet data network has been obtained, the user transmits to the second network at least one request for consumption of at least one service unit comprising a random number RAND and a signed response SIRES;

the second network compares the random number RAND and signed response SIRES of each request for consumption of at least one service unit received from the user with stored random numbers RAND and signed responses SRES to determine if a match exists; and

if a match exists, the second network permits data packets to pass through the second network between the user and the packet network.