Method, and associated apparatus, for selectively permitting access by a mobile terminal to a packet data network

• US 6,230,002 B1
• Filed: 11/19/1997
• Issued: 05/08/2001
• Est. Priority Date: 11/19/1997
• Status: Expired due to Term

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Darroch, John, Johannsen, Berndt Ove, Floden, Anders, Johansson, Lena
• Primary Examiner(s): MAUNG, NAY AUNG
• Application Number:
  US08/974,135
• Time in Patent Office: 1,266 Days
• Field of Search: 455/410, 455/411, 455/422, 455/432, 455/436, 455/466, 455/556, 455/557, 455/558, 379/355, 379/356, 379/357, 380/247, 380/248, 380/271
• US Class Current: 455/411
• CPC Class Codes: G06F 21/31 User authentication
• CPC Class Codes: H04L 63/083 using passwords cryptographic mechanisms or cryptographic arrangements for entity authentication using a predetermined code H04L9/3226
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 9/40 Network security protocols
• CPC Class Codes: H04W 12/068 using credential vaults, e.g. password manager applications or one time password [OTP] applications

Abstract

A method, and associated apparatus, improves the authentication security of authentication procedures performed by a wireless host when requesting access to communicate with a host site of a private network. A password is generated by the execution of an application at a processing device of a SIM (subscriber identity module) defined in the GSM Phase 2+ system. When generated thereat, improved authentication security results as computations need not be performed at a wireless host or other separate physical entity.

Claims

1. In a communication system having a wireless network and a packet data network coupled thereto, the packet data network including a host site and permitting selective access thereto, the wireless network permitting radio communications with a mobile terminal, an improvement of an assembly for selectively permitting access by the mobile terminal to the packet data network, thereby to permit communications between the mobile terminal and the host site, said assembly comprising:

a processing device releasably coupled to, and carried by, the mobile terminal, said processing device having a password-generation algorithm executable thereon, said processing device for generating a password when the password-generation algorithm is executed; and

an authentication server coupled to the packet data network and forming a portion thereof, said authentication server for receiving the password generated responsive to execution of the password-generation algorithm, said authentication server for authenticating the mobile terminal responsive to values of the password generated by said processing device and received at said authentication server, the mobile terminal permitted to communicate with the host site when the password is authenticated by said authentication server.

2. The assembly of claim 1 wherein the mobile terminal generates a retrieve password command and wherein said processing device is coupled to receive the retrieve password command, the password-generation algorithm executed at said processing device when the retrieve password command is received thereat.

3. The assembly of claim 2 wherein the password-generation algorithm, when executed by said processing device, prompts the mobile terminal for an input code and wherein the password generated by the execution of the password-generation algorithm is responsive, in part to the input code provided by the mobile terminal.

4. The assembly of claim 1 wherein the mobile terminal generates a communication initiation request to initiate communication with the host site and wherein said authentication server requests transmission thereto of the password generated by said processing device responsive to the communication initiation request.

5. The assembly of claim 1 wherein the wireless network comprises a GSM (general system for mobile communications) network, wherein the mobile terminal includes a SIM (Subscriber Identity Module) card releasably connected thereto, and wherein said processing device is disposed upon the SIM card.

6. The assembly of claim 1 wherein said authentication server compares values of the password generated by the mobile terminal with internally-generated values and wherein the mobile terminal is authenticated if the values of the password correspond with the internally-generated values.

7. The assembly of claim 1 wherein said processing device further has an encryption algorithm executable thereon, said processing device for generating an encryption key by which to encrypt information transmitted by the mobile terminal.

8. The assembly of claim 1 wherein the wireless network further includes an SMS (short message service) center and provides for the communication of SMS messages with the mobile terminal, wherein the mobile terminal generates a communication initiation request to initiate communication with the host site and wherein said authentication server requests with an SMS-message transmission thereto of the password generated by said processing device responsive to the communication initiation request.

9. The assembly of claim 1 wherein a control channel is formed between the wireless network and the mobile terminal, wherein the mobile terminal generates a communication-initiation request to initiate communication with the host site and wherein said authentication server requests, with a message broadcast upon the control channel, for transmission thereto of the password generated by said processing device.

10. The assembly of claim 9 wherein the mobile terminal generates a retrieve password command responsive to reception thereat of the message broadcast on the control channel and wherein said processing device is coupled to receive the retrieve password command, the password-generation algorithm executed at said processing device when the retrieve password command is received thereat.

11. The assembly of claim 1 wherein said processing device further comprises a first storage location, wherein said authentication server forms first internally-generated values and forwards the first internally-generated values to the mobile terminal, and wherein the algorithm executed by said processing device generates the password with values corresponding to the first internally-generated values and stores the password so-formed at said first storage location.

12. The assembly of claim 11 wherein the mobile terminal generates a retrieve password command when communications are to be initiated with the host site, wherein the password-generation algorithm executed at said processing device to retrieve the password stored at said first storage location when the retrieve password command is received thereat.

13. The assembly of claim 11 wherein said authentication server forms the first internally-generated values at selected intervals.

14. The assembly of claim 11 wherein said processing device further comprises a second storage location, wherein said authentication server forms second internally-generated values and forwards the second internally-generated values to the mobile terminal, and wherein said processing device further has an encryption algorithm executable therein, the encryption algorithm for retrieving the second internally-generated values and for storing the second internally-generated values at the second storage location as an encryption key.

15. The assembly of claim 14 wherein said processing device retrieves the encryption key stored at said second storage location and provides the encryption key to the mobile terminal to encrypt information transmitted therefrom.

16. The assembly of claim 1 further comprising a modem connected to the mobile terminal and a wireline connection for coupling the modem together with the packet data network and wherein said authentication server receives the password by way of the wireline connection.

17. A method for selectively permitting access by a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the mobile terminal, said method comprising the steps of:

generating automatically a password at a processing device releasably coupled to the mobile terminal;

providing the password generated in said step of generating to the mobile terminal;

forwarding the password provided to the mobile terminal to an authentication server;

authenticating the mobile terminal responsive to values of the mobile terminal forwarded thereto; and

permitting the mobile terminal to communicate with the host site if the password is authenticated during said step of authenticating.

18. A method for selectively permitting access by a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the mobile terminal, said method comprising the steps of:

generating a password at a processing device releasably coupled to the mobile terminal;

providing the password generated in said step of generating to the mobile terminal;

forwarding the password provided to the mobile terminal to an authentication server;

authenticating the mobile terminal responsive to values of the mobile terminal forwarded thereto;

permitting the mobile terminal to communicate with the host site if the password is authenticated during said step of authenticating; and

wherein the wireless network comprises a GSM (general system for mobile communications) network, wherein the mobile terminal includes a SIM (subscriber identity module) card and wherein the processing device at which the password is generated is positioned at the SIM card.

19. A method for selectively permitting access by a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the mobile terminal, said method comprising the steps of:

generating automatically a password at a processing device releasably coupled to the mobile terminal;

providing the password generated in said step of generating to the mobile terminal;

forwarding the password provided to the mobile terminal to an authentication server;

authenticating the mobile terminal responsive to values of the mobile terminal forwarded thereto;

permitting the mobile terminal to communicate with the host site if the password is authenticated during said step of authenticating; and

wherein the wireless network further includes an SMS (short message service) center and provides for the communication of SMS messages with the mobile terminal and wherein said method comprises the additional step of requesting by the authentication server with an SMS message for said forwarding of the password thereto.

20. A method for selectively permitting access by a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the mobile terminal, said method comprising the steps of:

forming first internally-generated values at an authentication server;

forwarding the first internally-generated values to the mobile terminal;

storing the first internally-generated values at a storage location associated with a processing device removably connected to the mobile terminal, the first internally-generated values forming a password;

retrieving the password stored at the storage location during said step of storing when the mobile terminal initiates communications with the host device;

providing the password retrieved during said step of retrieving to the authentication server;

authenticating the mobile terminal responsive to values of the password provided to the authentication-server; and

permitting the communications between the mobile terminal and the host site if the mobile terminal is authenticated during said step of authenticating.

21. A method for selectively permitting access by a wireless communication station that includes a wireless host and a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the wireless communication station via the mobile terminal, said method comprising the steps of:

generating electronically a password at a processing device releasably coupled to the mobile terminal;

providing the password from the processing device to the mobile terminal;

providing the password from the mobile terminal to the wireless host;

requesting the password from the wireless communications station by an authentication server via a first wireline link;

forwarding the password from the wireless host to the authentication server via the first wireline link or a second wireline link;

authenticating the wireless communication station responsive to at least one value of the password forwarded to the authentication server; and

permitting the wireless communication station to communicate with the host site if the password is authenticated during said step of authenticating.

22. A method for selectively permitting access by a wireless communication station that includes a wireless host and a mobile terminal to a host site of a packet data network, the packet data network coupled to a wireless network, the wireless network permitting radio communications with the wireless communication station via the mobile terminal, said method comprising the steps of:

requesting a password from the wireless communication station by an authentication server via a wireless link;

generating electronically the password at a processing device releasably coupled to the mobile terminal;

providing the password from the processing device to the mobile terminal;

providing the password from the mobile terminal to the wireless host;

forwarding the password from the wireless host to the authentication server via a wireline link;

authenticating the wireless communication station responsive to at least one value of the password forwarded to the authentication server; and

permitting the wireless communication station to communicate with the host site if the password is authenticated during said step of authenticating.