Method and system for wireless connecting a mobile device to a service provider through a hosting wireless access node

• US 8,428,264 B2
• Filed: 04/30/2009
• Issued: 04/23/2013
• Est. Priority Date: 04/30/2009
• Status: Active Grant

• Current Assignee: PeerTribe SA
• Original Assignee: PeerTribe SA
• Inventors: Maestrini, Angelo, de Vito, Fabio, Lenzarini, Davide
• Primary Examiner(s): Yalew, Fikremariam A
• Application Number:
  US13/318,061
• Publication Number:
  US 20120045060A1
• Time in Patent Office: 1,454 Days
• Field of Search: None
• US Class Current: 380/274
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/1466 Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 76/12 Setup of transport tunnels
• CPC Class Codes: H04W 88/02 Terminal devices
• CPC Class Codes: H04W 88/04 adapted for relaying to or from another terminal or user

Abstract

A method and system for commissioning a wireless connection with a related authentication and the eventual encryption to a remote relay node, whereto an electronic mobile device is connected to a hosting wireless access node for transmitting/receiving data to/from a service provider available on the Internet by means of a commissioned relay access node selected by an authentication and commissioning manager. The data transfer between the mobile device and the service provider is encapsulated into the tunnel between the hosting wireless access node and the commissioned relay access node and is finally forwarded by the commissioned relay access node to the service provider. The service provider thereby is exchanging data with the commissioned relay access node and not directly with the hosting wireless access node.

Claims

1. A method for commissioning a wireless connection with a related authentication to a remote relay node, whereto an electronic mobile device is connected through at least one wireless communication module to a hosting wireless access node for transferring data with respect to a service provider available on the Internet by means of a commissioned relay access node selected by an authentication and commissioning manager, the method comprising:

initiating an association phase by the mobile device wireless communication module to establish a connection with at least one wireless communication module of the hosting wireless access node, the association phase to be performed at OSI layer 2;

initiating an identification phase by an authentication module of the hosting wireless access node to retrieve from a client authentication module of the mobile device at least its authentication credentials provided by an authentication credentials module, the identification phase to be performed at OSI layer 2;

initiating an access verification phase by the hosting wireless access node authentication module to retrieve from an authentication server of the authentication and commissioning manager the commissioned relay access node to be used;

initiating a commissioned relay access node selection phase by the authentication server to retrieve from a commissioned relay access node selector of the authentication and commissioning manager the commissioned relay access node to be used;

initiating a tunnel creation phase by a tunnel/optimization module of the hosting wireless access node to establish a tunnel with a tunneling/optimization module of the commissioned relay access node;

initiating a transfer of the authentication state phase by the hosting wireless access node authentication module to transfer at least the mobile device authentication credentials to an authentication module of the selected commissioned relay access node, the transfer being encapsulated into the tunnel;

initiating an authentication phase by the commissioned relay access node authentication module to handshake with the mobile device client authentication module the authentication data used to establish a trusted connection between the commissioned relay access node and the mobile device, the authentication phase to be performed at OSI layer 2,

the handshaking, using OSI layer 2 data units, being encapsulated into the tunnel between the commissioned relay access node and the hosting wireless access node; and

initiating a keys negotiation phase by the commissioned relay access node authentication module to handshake with the mobile device client authentication module at least one session key to be used for the data encryption from a cryptography module of the mobile device and a cryptography module of the commissioned relay access node, the keys negotiation phase to be performed at OSI layer 2,

the handshaking, using OSI layer 2 data units, being encapsulated into the tunnel between the commissioned relay access node and the hosting wireless access node;

performing a data transfer phase to transfer data between the mobile device and the service provider,

the data exchanged by the mobile device, contained in OSI layer 2 data units, encrypted by the cryptography module and transmitted on the wireless connection with the hosting wireless access node, being encapsulated into the tunnel between the hosting wireless access node and the commissioned relay access node, and

the data then being extracted from the OSI layer 2 data units, decrypted by the cryptography module and forwarded by the commissioned relay access node to the service provider;

wherein data is thereby exchanged by the service provider with the commissioned relay access node and not directly with the hosting wireless access node.

2. The method according to the claim 1, wherein providing the access verification phase comprises:

sending an access request by the authentication module of the hosting wireless access node to the authentication server of the authentication and commissioning server, the access request containing at least the authentication credentials of the mobile device and at least the access node authentication credentials provided by an authentication credentials module of said hosting wireless access node; and

providing an access response, generated by the authentication server provided by the authentication and commissioning manager, containing at least one IP address and at least one tunnel port to be used by the tunneling/optimization module of the hosting wireless access node to establish a tunnel with the tunneling/optimization module of the commissioned relay access node to be used.

3. The method according to the claim 2, wherein the commissioned relay access node selector selects the commissioned relay access node to be used by the mobile device and its availability, by means of a commissioned relay access node selection phase comprising:

identifying, by the commissioned relay access node selector, of

at least one commissioned relay access node candidate on the basis of a static or dynamic mapping of the mobile device authentication credentials to at least one access node authentication credentials contained in an access nodes repository of the authentication and commissioning manager;

providing an availability request sent by the commissioned relay access node selector to an access nodes availability server, the availability request containing at least the authentication credentials of at least one commissioned relay access node candidate;

providing an availability response generated by the access node availability server, the availability response containing at least one IP address and at least one tunnel port for each commissioned relay access node candidate; and

providing the selection of only one of the available commissioned relay access node candidates to be used by the mobile device.

4. The method according to the claim 3, wherein the access nodes availability server contains a static or dynamic mapping between each access node authentication credentials and at least one IP address and at least one tunnel port on which the access node can be contacted to establish a tunnel.

5. The method according to the claim 3, wherein the access response contains at least a code indicating to the authentication module of the hosting wireless access node that the mobile device authentication process should be aborted in case the mobile device authentication credentials are not mapped to any one of the access node authentication credentials contained in the access nodes repository.

6. The method according to the claim 4, wherein the availability response contains at least a code indicating to the commissioned relay access node selector that no one of the commissioned relay access node candidates is available and so the access response should contain at least a code indicating to the authentication module of the hosting wireless access node that the mobile device authentication process should be aborted.

7. The method according to the claim 4, wherein the access nodes availability server is updated by an availability client module of an access node and by an availability data cleaner of the authentication and commissioning manager.

8. The method according to the claim 7, wherein at least one of the availability client module of said hosting wireless access node or the availability client module of said commissioned relay access node, triggered by a respective timer, sends an availability update message to the access nodes availability server containing

at least the authentication credentials retrieved from at least one of a respective authentication credentials module of said hosting wireless access node or said commissioned relay access node and

at least one respective IP address retrieved from at least one of a WAN communication module of said hosting wireless access node or said commissioned relay access node and

at least one respective tunnel port retrieved from at least one of a tunneling/optimization module of said hosting wireless access node or said commissioned relay access node.

9. The method according to the claim 7, wherein the availability data cleaner, triggered by a timer of the authentication and commissioning manager, retrieves from the access nodes repository at least the list of the access nodes it contains and then sends a request to the access nodes availability server for resetting, on the basis of the age of the entries, the at least one IP address and the at least one tunnel port mapped to the oldest access nodes authentication credentials entries, this data being eventually updated by the availability client module of an access node with an availability update.

10. The method according to the claim 9, wherein each of a plurality of mobile devices is capable of being simultaneously connected to the same hosting wireless access node;

and

wherein the traffic of each of the plurality of mobile devices, if not directly managed, is redirected, encapsulated in tunnels, to the commissioned relay access nodes selected by the commissioned relay access node selector of the authentication and commissioning manager.

11. The method according to the claim 10, wherein a plurality of access nodes is capable of being managed by the same authentication and commissioning manager.

12. A system for commissioning a wireless connection with a related authentication to a remote relay node, whereto an electronic mobile device is able to establish a connection with a hosting wireless access node for transferring data with respect to a service provider available on the Internet by means of a commissioned relay access node selected by an authentication and commissioning manager,

the electronic mobile device comprising:

at least one wireless communication module to establish a connection with the hosting wireless access node;

at least one client authentication module providing

means to authenticate the mobile device connection, by exchanging OSI layer 2 identification requests and responses with an authentication module of the hosting wireless access node and by exchanging OSI Layer 2 authentication requests and responses with an authentication module of the commissioned relay access node, and providing

means to define at least one session key to be used for at least one of an encryption process or a decryption process, by exchanging OSI layer 2 keys negotiation request and responses with an authentication module of the commissioned relay access node;

at least one cryptography module providing means to perform at least one encryption or decryption of the data exchanged with the commissioned relay access node; and

at least one authentication credentials module providing means to univocally identify the mobile device or its user;

the hosting wireless access node comprising;

at least one wireless communication module providing means to manage at least one wireless connection;

at least one WAN communication module providing means to reach the Internet;

at least one authentication module providing means to retrieve at OSI layer 2 from the mobile device client authentication module at least its authentication credentials,

means to retrieve from the authentication and commissioning manager the commissioned relay access node to be used, and

means to transfer to the commissioned relay node the retrieved mobile device authentication credentials; and

at least one tunneling/optimization module providing

means to manage and eventually optimize at least one tunnel connection with a commissioned relay access node,

means to encapsulate and send into this tunnel the mobile device authentication credentials,

means to perform at least one of encapsulation or decapsulation of the OSI Layer 2 authentication requests and responses exchanged between the mobile device and the commissioned relay access node,

means to encapsulate the data, contained in OSI layer 2 data units and received on the wireless connection, sent from the mobile device to the service provider, and

means to decapsulate and forward to the mobile device the data, included in OSI layer 2 data units received from the commissioned relay access node 4, sent from the service provider;

the authentication and commissioning manager comprising;

at least one commissioned relay access node selector providing means to statically or dynamically map each mobile device authentication credentials to at least one access node authentication credentials; and

at least one authentication server providing means to communicate to the hosting wireless access node authentication module the access node to be used to manage the traffic generated by the mobile device;

the commissioned relay access node comprising;

at least one WAN communication module providing means to reach the Internet;

at least one authentication module providing

means to authenticate the connected mobile device in order to obtain a trusted connection, by retrieving the mobile device authentication credentials from the hosting wireless access node authentication module and by

exchanging OSI layer 2 authentication requests and responses with the mobile device client authentication module and

means to define at least one session key to be used for at least one of an encryption process or a decryption process, by exchanging OSI layer 2 keys negotiation requests and responses with the mobile device client authentication module; and

at least one tunneling/optimization module providing means to manage and eventually optimize at least one tunnel connection with a hosting wireless access node,

means to decapsulate the mobile device authentication credentials received and make them available to the authentication module,

means to perform at least one of encapsulation or decapsulation of the OSI layer 2 authentication requests and responses exchanged with the mobile device,

means to encapsulate the data from the service provider, after including it into OSI layer 2 data units, to the mobile device, and

means to decapsulate and forward to the service provider the data sent from the mobile device; and

the commissioned relay access node comprising;

at least one cryptography module providing means to perform at least one of encryption or decryption the data exchanged with the mobile device.

13. The system according to claim 12, wherein the hosting wireless access node comprises at least an authentication credentials module providing means to univocally identify the access node;

wherein the authentication module of the hosting wireless access node provides further means to send to the authentication server of the authentication and commissioning server

at least the authentication credentials of the mobile device and

at least the access node authentication credentials provided by the authentication credentials module; and

wherein the authentication server of the authentication and commissioning manager provides further means to send to the authentication module of the hosting wireless access node

at least the one IP address and at least one tunnel port to be used by the tunneling/optimization module of the hosting wireless access node to establish a tunnel with the tunneling/optimization module of the commissioned relay access node to be used.

14. The system according to the claim 13, wherein the authentication and commissioning manager comprises:

at least one access nodes repository providing means to statically or dynamically store at least the authentication credentials of the access nodes; and

at least one access nodes availability server providing means to identify the available access nodes and means to associate each available access node authentication credentials to at least one IP address and at least one tunnel port on which the access node can be contacted to establish a tunnel; and

wherein the commissioned relay access node selector of the authentication and commissioning manager provides further means to retrieve from the access nodes availability server at least one IP address and at least one tunnel port for each one of the access nodes mapped to the mobile device authentication credentials and further means to select only one commissioned relay access node.

15. The system according to the claim 14, wherein the authentication server of the authentication and commissioning manager provides further means to communicate to the hosting wireless access node authentication module at least a code indicating that the mobile device authentication process should be aborted if the mobile device authentication credentials are not mapped to any one of the access node authentication credentials contained in the access node repository or if no one of the access nodes mapped to the mobile device authentication credentials is identified as available by the access nodes availability server.

16. The system according to the claim 14, wherein at least one of the hosting wireless access node and the commissioned relay access node comprises at least one availability client module providing means to update the access nodes availability server of the authentication and commissioning manager;

and

wherein the authentication and commissioning manager comprises at least one availability data cleaner providing means to update the access nodes availability server.

17. The system according to the claim 16, wherein at least one of the hosting wireless access node and the commissioned relay access node comprises at least one timer to trigger the availability client module of the same access node;

and

wherein the access node availability client module provides further means to collect and to send to the access nodes availability server of the authentication and commissioning manager, once triggered by the timer,

at least the access node authentication credentials retrieved from the access node authentication credentials module and

at least one IP address retrieved from the access node WAN communication module and

at least one tunnel port retrieved from the access node

tunneling/optimization module.

18. The system according to the claim 16, wherein the authentication and commissioning manager comprises at least one timer to trigger the availability data cleaner;

and

wherein the availability data cleaner of the authentication and commissioning manager provides further means to retrieve from the access nodes repository, once triggered by the timer, at least the list of the access nodes it contains and further means to send a request to the access nodes availability server for resetting the at least one IP address and the at least one tunnel port mapped to the oldest access nodes authentication credentials entries, those data being eventually updated by the access nodes availability client modules.

19. The system according to the claim 18, wherein the hosting wireless access node comprises:

means to support a plurality of mobile devices simultaneously connected; and

means to directly manage their traffic or redirect it, encapsulated in tunnels, to the commissioned relay access nodes selected by the commissioned relay access node selector of the authentication and commissioning manager.

20. The system according to the claim 19, wherein the authentication and commissioning manager comprises:

means to support a plurality of access nodes.