Method of and system for utilizing a first network authentication result for a second network

• US 9,716,999 B2
• Filed: 03/27/2012
• Issued: 07/25/2017
• Est. Priority Date: 04/18/2011
• Status: Active Grant

• Current Assignee: Syniverse Communications LLC
• Original Assignee: Syniverse Communications, Inc. (Syniverse Corp.)
• Inventors: Zhang, David Xining, Xu, Huiyue, Li, Bing
• Primary Examiner(s): Ho, Huy C
• Application Number:
  US13/431,822
• Publication Number:
  US 20120264402A1
• Time in Patent Office: 1,946 Days
• Field of Search: 4554351
• CPC Class Codes: H04L 63/0815 providing single-sign-on or federations
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals

Abstract

A method and system for completing the authentication process in a second communication network (such as Wi-Fi or WiMAX) utilizes a user credential of a first communication network, such as GSM, UMTS, CDMA, or LTE. Preferably, the user credential is a SIM card, a USIM card, a R-UIM card, or a functionally similar component. The system includes a client and an authentication platform that retrieves Service State information of the user credential in the first communication network and passes the information to the authentication platform of the second communication network. The client is granted access to the second communication network after the authentication platform validates the client'"'"'s service and subscription status with the first communication network.

Claims

1. A method of granting a mobile device access to a second wireless network comprising:

authenticating a mobile device on a first wireless network using a user credential;

registering the mobile device on the first wireless network;

responsive to a successful registration of the mobile device on the first wireless network, changing a service state value of the mobile device to correspond to an “

in service”

status, wherein the service state value is selected from a set of constant values each indicating a service status of the mobile device on the first wireless network;

retrieving the service state value by a client, the client comprising a set of instructions stored on a non-transitory medium and being executed by a processor, or the client comprising one or more application specific integrated circuits;

the client automatically transmitting the service state value to a second wireless network thereby transferring an authentication result of the mobile device on the first network to the second network to pass authentication requirements of the second network, wherein the second wireless network is a Wi-Fi network; and

granting the mobile device access to the second wireless network responsive to the service state value corresponding to the “

in service”

status indicating that the mobile device is registered on the first wireless network, whereby the mobile device must be authenticated with the first wireless network in order to gain access to the second wireless network.

2. The method of claim 1, wherein access rights for the first wireless network are mapped to access rights for the second wireless network.

3. The method of claim 1, wherein the user credential is a component of the mobile device and uniquely identifies the mobile device among other mobile devices supported by a mobile phone subscriber.

4. The method of claim 3, wherein the component comprises a Subscriber Identity Module card, a Universal Subscriber Identity Module card, or a Removable User Identity Module card.

5. The method of claim 1, wherein the first wireless network comprises a Global System for Mobile Communications (GSM) network, a Universal Mobile Telecommunications System (UMTS) network, a Code Division Multiple Access (CDMA) network, a Long Term Evolution (LTE) network, or any combination thereof.

6. The method of claim 1, wherein granting the mobile device access to the second wireless network automatically occurs when the mobile device roams into a communication range of the second wireless network.

7. The method of claim 1, wherein granting the mobile device access to the second wireless network comprises issuing a single-use combination of a username and a password for logging into the second wireless network.

8. The method of claim 1, wherein granting the mobile device access to the second wireless network comprises issuing to the mobile device a single-use user token for logging into the second wireless network.

9. The method of claim 1, wherein the service status is received at the second wireless network using a secure transmission.

10. A method of accessing a network using a mobile device comprising:

authenticating a mobile device on a first wireless network using a user credential;

registering the mobile device on the first wireless network;

responsive to a successful registration of the mobile device on the first wireless network, changing a service state value of the mobile device to correspond to an “

in service”

status;

automatically retrieving from a mobile device a service status of the mobile device for accessing a first network, wherein the service status comprises a service state, the service status is determined by authenticating a user credential of the mobile device, and a value of the service state is selected from a set of constant values each indicating a different state of the mobile device on the first network, the different service states comprise “

in service” and

“

out of service”

; and

accessing the second network using a registration protocol of the second network after the service status value corresponding to the “

in service”

status has been automatically transferred to the second network by a client, whereby the mobile device must be authenticated with the first wireless network in order to gain access to the second wireless network, the client comprising a set of instructions stored on a non-transitory medium and being executed by a processor, or the client comprising one or more application specific integrated circuits, wherein the second network is a Wi-Fi network.

11. The method of claim 10, further comprising a first authentication server on the first network, wherein the first authentication server is configured to validate a subscription status of the mobile device for using the second network.

12. The method of claim 11, wherein the subscription status determines whether the mobile device is allowed to access the second network.

13. The method of claim 10, wherein the second network comprises an authentication server.

14. The method of claim 10, wherein the service status of the mobile device is accessed through an application programming interface of an operating system executing on the mobile device.

15. The method of claim 10, wherein the user credential is a component of the mobile device and uniquely identifies the mobile device among other mobile devices supported by a mobile phone subscriber.

16. The method of claim 15, wherein the component comprises a Subscriber Identity Module card, a Universal Subscriber Identity Module card, or a Removable User Identity Module card.

17. A method of completing an authentication and registration procedure in a second communication network by utilizing an authentication and registration result for a user credential in a first communication network, the method comprising:

registering a device with the first communication network after a user credential of the device has been successfully authenticated by a first authentication server of the first communication network;

retrieving a registered service status of the device with the first communication network through an application programming interface of the device, wherein the registered service status comprises a service state stored on the device, wherein the service state is changed when the device is authenticated to access the first communication network to indicate that the device is registered with the first communication network, wherein a value of the service state is selected from a set of values each indicating a different service state of the device on the first communication network, the service state values determined before the device is authenticated by the first communication network, the different service states comprise “

in service” and

“

out of service”

;

automatically transferring the registered service status securely to a second authentication server of the second communication network;

validating the registered service status and subscription status based on information stored at the first authentication server;

granting or denying the device access to the second network based on a result of the validating responsive to the service state value corresponding to the “

in service”

status, whereby the mobile device must be authenticated with the first wireless network in order to gain access to the second wireless network; and

registering the device with the second communication network using a registration protocol of the second communication network, thereby allowing the device to access the second communication network, wherein the second communication network is a Wi-Fi network.

18. The method of claim 17, wherein the first communication network comprises a GSM network, a UMTS network, a CDMA network, or an LTE network.

19. The method of claim 17, wherein the user credential comprises a card selected from the group consisting of a SIM card, a USIM card, or an RU™

card.

20. The method of claim 17, wherein retrieving the registered service status of the device is performed by a client running on the device.

21. The method of claim 17, wherein the client comprises a wireless device operating system executing on the mobile device.

22. The method of claim 21, wherein the operating system is Android™

operating system, Windows Mobile operating system, Blackberry®

operating system, iOS™

operating system, Symbian®

operating system, Meego™

operating system, or Mango operating system.

23. The method of claim 17, wherein the registered service status of the device is packaged with an identifier of the user credential to form a service status information package.

24. The method of claim 23, wherein an identifier of the user credential comprises a Mobile Station Integrated Services Digital Network (MSISDN) of the card.

25. The method of claim 17, wherein the registered service status of the device is packaged with a registration status of the user credential on the first communication network to form a service status information package.

26. The method of claim 17, wherein the registered service status of the device is packaged with an identifier of the first communication network to form a service status information package.

27. The method of claim 26, wherein an identifier of the user credential comprises an International Mobile Station Identity (IMSI) of the card.

28. The method of claim 17, wherein the authentication server of the first communication network comprises an HLR, an HSS, an AuC, or an AAA server.

29. The method of claim 17, wherein the authentication server of the second communication network is an AAA server.

30. The method of claim 17, wherein transferring the registered service status is performed over a TCP/IP network.

31. The method of claim 17, wherein transferring the registered service status is performed using HTTP, HTTPS, or Session Initiation Protocol (SIP).

32. The method of claim 17, wherein transferring the registered service status is protected and secured with one or more multiple level encryption algorithms.

33. The method of claim 32, wherein the one or more multiple level encryption algorithms comprise TLS or 3 DES.

34. The method of claim 17, wherein validating the subscription status comprises:

receiving service state information for the user credential from the first authentication server;

comparing two service state information from different resources at the second authentication server; and

based on the comparing, validating that the device is subscribed to the service of the second communication network.

35. The method of claim 34, wherein receiving the service state information from the first authentication server comprises using MAP, IS-41, RADIUS, Diameter, or any combination thereof.

36. The method of claim 34, wherein validating the device is subscribed to the service of the second communication network is performed by the second authentication server, and subscription information of the card is stored on the first authentication server.

37. The method of claim 17, wherein granting the device access to the second communication network comprises issuing an authorization token.

38. The method of claim 37, wherein the authorization token is a one-use token.

39. The method of claim 37, wherein the authorization token is a multiple-use token.

40. The method of claim 37, wherein the authorization token comprises a one-time user name and password combination.

41. The method of claim 37, wherein the authorization token comprises one or more certificates.

42. The method of claim 17, wherein a registration and authentication protocol for the second communication network comprises WISPr 1.0.

43. The method of claim 17, wherein a registration and authentication protocol for the second communication network comprises EAP TLS.

44. The method of claim 17, wherein a registration and authentication protocol for the second communication network comprises EAP TTLS.

45. A wireless device comprising a computer memory containing computer-executable instructions that when executed by a processor perform a method comprising:

detecting that a second communication network is available;

retrieving identifier information of a user credential associated with the wireless device;

retrieving from the wireless device service state information of a first communication network, wherein the service state information comprises a service state of the wireless device on the first communication network, the service state is updated after the wireless device is authenticated, and a value of the service state is selected from a set of values determined before the wireless device roams into communication range of the first wireless network;

automatically transferring the service state information to a second authentication server of a second communication network by a client, the client comprising a set of instructions stored on a non-transitory medium and being executed by a processor, or the client comprising one or more application specific integrated circuits, wherein the second communication network is a Wi-Fi network;

receiving an authentication result from a second authentication server of the second communication network whereby the mobile device must be authenticated with the first wireless network in order to gain access to the second wireless network; and

registering the wireless device on and accessing the second communication network using a registration protocol of the second communication network responsive to the service state value corresponding to the “

in service”

status.

46. The method of claim 45, wherein the wireless device executes a smartphone operating system selected from the group consisting of Android™

, Windows Mobile, Blackberry®

, iOS™

, Symbian®

, Meego™

, and Mango.

47. The method of claim 45, wherein the retrieving identifier information comprises using a system application programming interface of an operating system executing on the wireless device.

48. The method of claim 45, wherein the retrieving service state information comprises using a system application programming interface of an operating system executing on the wireless device.

49. An authentication server for completing an authentication and registration procedure in a second communication network by utilizing an authentication and registration result of a same credential in a first communication network, the authentication server comprising a memory containing computer-executable instructions that when executed by a processor perform a method comprising:

receiving identifier information of a user credential associated with a wireless device;

receiving service state information of the first communication network from the wireless device, wherein the service state information comprises a service state value of the wireless device on the first communication network, the service state value is changed when the wireless device is authenticated on the first communication network to indicate that the wireless device has an “

in service”

status on the first communication network, the service state information being automatically transmitted by a client, the client comprising a set of instructions stored on a non-transitory medium and being executed by a processor, or the client comprising one or more application specific integrated circuits;

validating the service status with an authentication system of the first communication network, the validation of the service status being based on the service state of the wireless device, whereby the mobile device must be authenticated with the first wireless network in order to gain access to the second wireless network; and

granting the wireless device access to the second communication network based on the validation result responsive to the service state value corresponding to the “

in service”

status, wherein the second communication network is a Wi-Fi network.

50. The method of claim 49, wherein receiving the identifier information and the service state information is performed over a TCP/IP network.

51. The method of claim 49, wherein receiving the identifier information and the service state information is over a protocol selected from the group consisting of HTTP, HTTPS, and Session Initiation Protocol (SIP).

52. The method of claim 49, wherein receiving the service state information from the authentication system of the first communication network comprises using a protocol selected from the group consisting of MAP, IS-41, RADIUS, Diameter, or any combination thereof.

53. The method of claim 49, wherein granting the wireless device access to the second communication network comprises issuing an authorization token.

54. The method of claim 53, wherein the authorization token is a one-use token.

55. The method of claim 53, wherein the authorization token is a multiple-use token.

56. The method of claim 53, wherein the authorization token comprises a one-time user name and password combination.

57. The method of claim 53, wherein the authorization token comprises a multiple-time user name and password combination.

58. The method of claim 53, wherein the authorization token comprises a one-time certificate.

59. The method of claim 53, wherein the authorization token comprises a multiple-use certificate.

60. The method of claim 49, wherein granting the wireless device access to the second communication network comprises storing the authorization token in a database.