Method and apparatus for secure immediate wireless access in a telecommunications network

• US 8,046,581 B2
• Filed: 03/26/2007
• Issued: 10/25/2011
• Est. Priority Date: 03/04/2002
• Status: Expired due to Fees

• Current Assignee: Evolving Systems Labs Incorporated
• Original Assignee: Telespree Communications (CCUR Holdings, Inc.)
• Inventors: Netanel, Eran
• Primary Examiner(s): Desir; Pierre-Louis
• Assistant Examiner(s): SCHWARTZ, JOSHUA L
• Application Number:
  US11/691,388
• Publication Number:
  US 20080026740A1
• Time in Patent Office: 1,674 Days
• Field of Search: 455/411, 455/558, 455/557, 455/456, 455/414, 455/419, 455/566, 455/418, 455/452, 455/527, 455/524, 455/410, 709/221, 709/245, 709/219, 709/230, 709/218, 713/200, 713/169, 713/2, 713/171, 705/64
• US Class Current: 713/168
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04M 1/66 with means for preventing unauthorised or fraudulent calling verifying user identity or authority in secret or secure digital communications H04L9/32
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/50 Service provisioning or reconfiguring
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 8/265 for initial activation of new user

Abstract

A wireless telephone and messaging system provides Secure Immediate Wireless Access (SIWA) to wireless telephones onto existing wireless networks. The SIWA protocol uses existing wireless network messaging to exchange information between wireless devices and a network server, referred to herein as an Intelligent Service Manager (ISM). The ISM acts as a gateway between wireless devices and wireless service provider, and provides the wireless devices with an immediate limited or unlimited access to the wireless network. The ISM can also deny access to the wireless network from unauthorized wireless devices.

Claims

1. A bootstrap process for secure immediate wireless access by at least one non-active wireless device for exchange of information via one or more existing networks, comprising the steps of:

upon being powered on, at least one wireless device checking its state;

responsive to detection of a non-active state, said at least one non-active wireless device automatically requesting access to a wireless network, and, if said access request is accepted, being issued a limited profile from an enrollment server on said wireless network;

using said limited profile, said at least one non-active wireless device automatically registering on said wireless network;

from said wireless network said at least one wireless device automatically requesting access to an IP (internet protocol) network, wherein said at least one wireless device is assigned an IP address and granted access to said IP network, wherein said access to said IP network is limited to an activation realm for said non-active wireless device;

said non-active wireless device having limited access to said activation realm automatically initiating contact with an enrollment server on said activation realm; and

during an interaction with said enrollment server, assigning and programming device parameters to said wireless device;

wherein when said assigning and programming are complete, said at least one non-active wireless device is activated;

wherein the step of said at least one non-active wireless device requesting access to said wireless network and being issued a limited profile from a server on said wireless network comprises the steps of requesting a terminal identifier by said at least one non-active wireless device from an access node base station, and receiving said terminal identifier;

said at least one non-active wireless device and said access node base station negotiating a data link;

said access node base station issuing an authentication challenge to said at least one non-active wireless device;

said at least one non-active wireless device responding to said to said challenge with a password and a Bootstrap Network Access Identifier (BNAI), wherein said BNAI is constructed using a unique device identifier, activation session information and an activation realm;

said access node base station relaying said challenge response to an authentication server in an access request, wherein the authentication server recognizes the activation realm of the at least one non-active wireless device and proxies the access request to an activation server;

said activation server extracting said unique device identifier and said activation session information from said BNAI, ensuring that the at least one non-active wireless device is entitled to activation, and, if said password is what it is expected to be, returning an access-accept message wherein a mobile node identifier (MN ID) is assigned to said least one non-active wireless device, wherein said MN ID is mapped to a Bootstrap Mobile Subscriber Identifier (BMSID); and

receiving said access-accept message by said authentication server and relaying said access-accept message to the access node base station.

2. The process of claim 1, wherein said step of said at least one non-active wireless device automatically registering on said wireless network using said limited profile comprises the steps of;

optionally, said access node base station requesting a hardware ID from said at least one non-active wireless device, wherein said wireless device responds with a message containing the wireless device'"'"'s electronic serial number (ESN);

said access node base station directing a setup message including the BMSID and, optionally, the ESN to a packet control function (PCF), whereupon said PCF directs a registration request to a Packet Data Switching Node (PDSN);

if it accepts said registration request, said PDSN directing a registration reply to said PCF, whereupon said PCF returns a connect message to the access base station, wherein a PPP connection is established between the at least one non-active wireless device and said PDSN.

3. The process of claim 1, wherein said step of said at least one wireless device automatically requesting access to an IP (internet protocol) network from said wireless network comprises the steps of:

one or more mobility agents (BCS/PDSN/FA) directing at least one MIP (mobile IP) agent advertisement to said at least one non-active wireless device, wherein said wireless device receives the at least one MIP agent advertisements and determines its point of attachment to said IP network;

said at least one non-active wireless device automatically directing a MIP registration request message including said BNAI activation realm to a BCS/PDSN/FA;

said BCS/PDSN/FA directing an access request including said BNAI activation realm to an Authentication/Authorization and Accounting server (AAA) on said IP network;

upon receipt of the access request, said AAA validating said BNAI activation realm and returning an access accept message to said BCS/PDSN/FA;

said BCS/PDSN/FA routing a MIP registration request to a Home Agent (HA);

said HA recognizing said BNAI activation realm and assigning an Access Control list (ACL) to restrict traffic from the at least one non-active wireless device to the activation realm only; and

said HA directing a MIP registration reply to the BCS/PDSN/FA;

the BCSIPDSNIFA in turn routing the MIP registration reply to the at least one non-active wireless device;

wherein the at least one non-active wireless device, having been assigned an IP address, is granted limited access to said IP network within said activation realm.

4. The process of claim 3, further comprising the step of:

said AAA optionally assigning a HA IP address for the MIP session.

5. The process of claim 3, further comprising the steps of:

the BSC/PDSN/FA monitoring activity related to the assigned IP address by generating Usage Detail Records (UDRs) of the IP address; and

directing an Accounting-Request-Start to the AAA.

6. The method of claim 1, wherein said step of said at least one non-active wireless device having limited access to said activation realm automatically initiating contact with an enrollment server on said activation realm comprises the step of:

said at least one non-active wireless device and said enrollment server mutually authenticating each other.

7. The process of claim 6, wherein said step of said at least one non-active wireless device and said enrollment server mutually authenticating each other comprises the steps of:

said at least one non-active wireless device issuing a server challenge including a Secure Instant Wireless Access ID (Siwa. ID) and the BMSID;

said enrollment server calculating a server response and generating a device challenge, including a session ID, server response and client challenge;

said at least one non-active wireless device checking said server challenge and calculating a device response and directing a device response challenge to the enrollment server; and

said enrollment server validating said device response, whereupon said wireless device is authenticated on said enrollment server.

8. The process of claim 7, further comprising the steps of:

said enrollment server optionally instructing said at least one non-active wireless device to launch a client application providing URL of an enrollment application;

said device receiving said instruction and launching a client application and directing said client application to said enrollment application.

9. The process of claim 8, wherein said client application comprises a browser.

10. The process of claim 1, wherein said step of assigning and programming device parameters to said wireless device during an interaction with said enrollment server comprises the steps of:

directing a request to said enrollment server to program device parameters to said at least one non-active wireless device;

said enrollment server sending a program request to said at least one non-active wireless device including parameters to program;

said device programming itself with said included parameters to program and returning a programming response to said enrollment server; and

said server validating said programming response and indicating activation completion to a self-service signup application.

11. The process of claim 10, further comprising the steps of:

said enrollment server optionally instructing said at least one non-active wireless device to direct a user of said device to said self-service signup application, wherein said enrollment server may select a self-service signup application from a set of enrollment applications;

said user interacting with said self-service signup application to perform tasks related to session purchase; and

said at least one non-active wireless device and said enrollment server exchanging a heartbeat at regular intervals during the user interaction.

12. The process of claim 10, wherein said at least one non-active wireless device is assigned any of:

a Network Access Identifier (NAI);

an AAA (Authentication-Authorization-Accounting) secret;

a Mobile Device Number (MDN); and

a Mobile Subscriber Identifier (MSID).

13. The process of claim 1, wherein said activation session information comprises a Bootstrap Mobile Subscriber Identifier (BMSID) required by said network for mobility and billing purposes.

14. The process of claim 1, wherein said wireless network comprises any of a EV-DO (Evolution-Data Optimized), WiFi (Wireless Fidelity) and WIMAX (Worldwide Interoperability for Microwave Access).

15. The process of claim 1, wherein a network protocol for interaction with said IP network comprises any of SIP (simple IP) and MIP (mobile IP).

16. The process of claim 1, wherein said at least one non-activated wireless device is provided either of limited and unlimited access to said wireless network after activation.

17. The process of claim 1, further comprising any of the steps of:

providing service to a user without a need for manual provision of accounts;

providing said wireless device with immediate access to said wireless network; and

providing access to services offered by a wireless service provider to said user at the time they are needed by said user.

18. The process of claim 1, further comprising the steps of:

said non-active wireless device selecting a wireless network before a network access attempt;

responsive to detection of a non-active state, said non-active wireless device changing its state to indicate that a bootstrap process is initiated.

19. The process of claim 1, wherein said at least one non-active wireless device remains in a bootstrap state until a network identity is granted.

20. The process of claim 19, wherein said network identity grants user limited use which comprises any of:

a one time use, limited time use and limited usage use.

21. The process of claim 19, further comprising the step of:

said activated wireless device re-initiating its network access using its new identity.