Wireless network authentication apparatus and methods

Wireless network authentication equipment and method

Wireless network authentication apparatus and methods

Priority and related applications

This application claims the jointly owned and pending U.S. patent application serial number 12/952,082 filed on November 22, 2010 and is called "Wireless Network Authentication Apparatus and Methods" )" (it claims the priority of the U.S. Provisional Patent Application No. 61/330,856 filed on May 3, 2010 called "Wireless Network Authentication System") , All of the foregoing are incorporated herein for reference.

This application is also related to the jointly owned, jointly pending U.S. provisional patent application serial number 61/354,653 filed on June 14, 2010, and is called "Method for Providing User Identity Information in Wireless Networks" "Methods for Provisioning Subscriber Identity Data in a Wireless Network")", serial number 61/366,505 applied for on July 21, 2010, and called "Virtual Subscriber Identity Module Distribution System ("Virtual Subscriber Identity Module Distribution System")" , The serial number 61/407,858 applied for on October 28, 2010 is called "Methods and Apparatus for Access Control Client Assisted Roaming ("Methods and Apparatus for Access Control Client Assisted Roaming")", October 28, 2010 The serial number 61/407,861 applied for was called "Management Systems for Multiple Access Control Entities ("Management Systems for Multiple Access Control Entities")", the serial number 61/407,862 applied for on October 28, 2010 and called "Methods and Apparatus for Delivering Electronic Identification Components Over a Wireless Network") ", the serial number 61/407,866 applied for on October 28, 2010 is called "Methods and Apparatus for Storage and Execution of Access Control Clients", The serial number 61/408,504 applied for on October 29, 2010 is called "Access Data Provisioning Service", and the serial number applied for on November 3, 2010 is 61/409,891 called "Access Data Provisioning Service". Methods and equipment for access data recovery from a malfunctioning device ("Methods and Apparatus for Access Data Recovery from a Malfunctioning Device")", the serial number 61/410,298 applied for on November 4, 2010 and called "Simulacrum of physical Security Device and Methods", and the application on November 12, 2010 The serial number of the application is 61/413,317 and is called "Apparatus and Methods for Recordation of Device History Across Multiple Software Emulation". All of the foregoing are incorporated herein. Enter as a reference.

Copyright

Part of the disclosure of this patent document contains materials protected by copyright. When this patent document or this patent disclosure appears in the patent files or records of the Patent and Trademark Office, the copyright owner has no objection to the fax reproduction of this patent document or anyone disclosed by this patent, but no matter what, in All other copyrights are reserved.

The present invention generally relates to the field of communication systems, and is viewed as an example, and more particularly relates to allowing user devices to use access control clients to access wireless networks (e.g., mobile networks, WLANs, WMANs, etc.) certified wireless systems.

Wireless systems are used to provide especially voice and data services to user equipment such as mobile phones and computers.

Conventionally, the user equipment has a subscriber identity module (SIM) card. This SIM card includes security information such as private key information that can be used to authenticate user equipment to a mobile network.

The use of a SIM card may not always be desired. For example, the need to include SIM card slots in user devices tends to make these devices bulky and increase costs. It also requires manufacturers or service providers to manage SIM card inventory and distribution.

Even when the user cannot easily obtain a SIM card, the user may want to purchase wireless services.

Therefore, it would be desirable to be able to provide an improved way to provide users with the ability to purchase and use wireless network services.

The present invention satisfies the above-mentioned needs by providing devices and methods especially for wireless network authentication.

In one aspect of the present invention, network service providers such as mobile phone companies can access customer (for example, Universal User Identity Module (USIM)) certificates through the USIM provider or directly distributed to trusted services Manager.

Trusted service managers can maintain a list of approved users. These users may be, for example, trusted service managers or customers of associated entities. For each of the approved users, the user certificate can be maintained by a trusted service manager.

The user at the user equipment can use a set of user certificates to authenticate the trusted service manager. Once authenticated, the trusted service manager can provide the user with a set of USIM credentials. These USIM certificates can be stored in a secure component on the user equipment.

When the user wants to use the wireless network service, the user equipment can establish a wireless link between the user equipment and the network service provider. During the authentication operation, the user equipment can use the USIM certificates stored in the secure element on the user equipment to authenticate the network service provider. After successful authentication, the network service provider can provide the user equipment wireless service (for example, mobile phone voice and data connection).

In another aspect of the present invention, a method for providing wireless services to users at user equipment is disclosed. In one embodiment, the method includes: distributing access customer data to a first entity; transmitting the access customer data from the first entity to the second entity through a first communication link; and using user credentials , To authenticate the user equipment; and after authenticating the user equipment, transfer the access client data from the second entity to the user equipment through a second communication link.

In a variant of the method, the first entity includes a USIM provider, and the second entity includes a trusted service manager.

In another variation of the method, the access client includes a universal SIM (USIM), and the trusted service manager implements the authentication.

In another variant, the transfer of the accessed customer data enables the user equipment to store the accessed customer data to a secure element.

In yet another variation, the second communication link includes a secure wireless connection.

In yet another variation, the first communication link further includes a physical storage device that transmits USIM data.

In another variant, the user certificate includes account information unique to the user.

In another aspect of the present invention, a wireless device is disclosed. In one embodiment, the device includes: one or more communication links, which are adapted to communicate with the service provider; a secure element, which is grouped to form a storage access client; a processor; and a storage device, with the processor For data communication, the storage device contains computer-executable instructions. When the computer-executable instructions are executed by the processor, the instructions are composed of: authenticating the service provider, wherein the successful authentication results in the provision of the service provider by the access client; and In response to receiving the access client, the access client is stored in the secure element.

In a variant of the device, the user equipment includes either or both of long-range and short-range wireless communication circuits.

In another variant, the user equipment further includes a near field communication (NFC) circuit.

In another variant, the security element is a tamper-proof integrated circuit permanently built into the device.

In another variant, the secure element is adapted to authenticate the user equipment to the network service based at least in part on the accessing client data.

In another aspect of the present invention, a method for accessing customer data safely stored in user equipment is disclosed. In one embodiment, the method includes sending one or more user credentials to a service provider, the sending enabling the service provider to authenticate the user equipment based at least in part on the one or more user credentials; Once the successful authentication of the user equipment has been achieved, the access client data is received through the communication link; and the access client data is stored in the secure element.

In a variant, the communication link includes a short-range wireless communication circuit, such as a near field communication (NFC) circuit.

In another variant, the security element is a tamper-proof integrated circuit permanently built into the device.

In another aspect of the present invention, a subscriber identity module (SIM) accessory device is disclosed. In one embodiment, the device includes: one or more communication links adapted to communicate with a mobile device; a socket; a processor; and a storage device for data communication with the processor, the storage device including a computer Execute instructions. When the computer-executable instructions are executed by the processor, the computer-executable instructions are composed of: notifying the mobile device that the SIM device exists in the socket, and the SIM device has the first SIM stored on it Data; and in response to receiving a request for SIM operation, providing access to the SIM device through the one or more communication links.

In a variant, the mobile device includes a secure element, and the secure element is configured to store one or more second SIM data.

In yet another aspect of the present invention, a computer readable medium is disclosed. In one embodiment, the medium includes a secure element (for example, a secure integrated circuit), which has an access client (for example, a virtual USIM) stored thereon, and when the data is accessed, the data is allowed to be used People can access one or more network services.

The other characteristics of the present invention, the nature of the present invention and the different advantages will be more apparent from the accompanying drawings and the detailed description of the preferred embodiments below.

Reference is now made to the drawings, where similar reference numerals throughout are related to similar parts.

Generally, those familiar with the related art will recognize that the different embodiments of the present invention can be used in both the conventional technical architecture (for example, the USIM data implemented in the physical SIM card) and the new architecture (for example, the USIM data stored in the secure element). ). In some variations, the present invention may also be able to combine conventional card operations and secure element operations, and can support the use of traditional SIM cards that are not stored in the secure element.

In an exemplary embodiment of the present invention, the SIM data includes high-security content that can be used especially for authentication (for example, keys, encryption algorithms, etc.). For example, high-security content can include authentication keys (Ki), and all encryption algorithms (for example, as announced on December 31, 2009, and called "MILENAGE algorithm set specification: used for 3GPP authentication and gold Example algorithm set of key generation functions f1, f1*, f2, f3, f4, and f5*" F1, F2, F3, F4, and F5 described in 3GPP TS 35.205 V9.0.0, all of the foregoing are combined here Enter as a reference). In another embodiment, the SIM data includes operator service bundle information and/or user data information. Examples of such information include network selection parameters, identification information, operator data, application data, etc.

General examples of network selection parameters include, without limitation, public land mobile network selector (PLMNSel), prohibited PLMN (FPLMN), home PLMN (HPLMN), etc.

General examples of identification information include, without limitation, International Mobile Subscriber Identity (IMSI), Integrated Circuit Card ID (ICCID), Temporary Mobile Subscriber Identity (TMSI), Packetized TMSI (P-TMSI), and mobile subscribers The overall service digital network number (MSISDN).

Typical operator information may include, for example: operator-controlled PLMN (OPLMN) list SPN (service provider name), PLMN network name (PNN) for name display, emergency control center (ECC) for emergency calls ), and other telephone categories.

Examples of application data include, but are not limited to, SIM Application Kit (STK) (for example, roaming intermediary, enhanced network selection (ENS), international mobile equipment identification code (IMEI) change application, etc.).

<b>The certification process of the known technology-</b>

In short, FIG. 1 shows the authentication and key agreement (AKA) 100 of a typical conventional technology in an example scenario of a UMTS cellular system. During the normal authentication procedure, the UE 102 obtains the International Mobile Subscriber Identity (IMSI) from the USIM 104. The UE transmits it to the service network (SN) 106 of the network operator or the visited core network. The SN sends the authentication request to the AuC 108 of the home network (HN). The HN compares the received IMSI with the AuC registry, and obtains the appropriate K. This HN generates a random number (RAND), and uses an algorithm to predict the random number with K to generate the expected response (XRES). This HN also generates the secret key (CK) and the complete key (IK) used in the password and overall protection, as well as the authentication token (AUTN) using different algorithms. This HN transmits the authentication vector (composed of RAND, XRES, CK, and AUTN) to this SN. This SN storage is only used for this authentication vector in the one-time authentication process. The SN delivers the RAND and AUTN to the UE.

Once the UE 102 receives the RAND and AUTN, the USIM 104 confirms whether the received AUTN is valid. If so, the UE uses the received RAND to calculate its own response using the stored K and the same algorithm used to generate the XRES. The UE returns this RES to this SN. The SN 106 compares the XRES with the received RES, and if they match, the SN approves the UE to use the operator's wireless network service.

FIG. 2 diagrammatically illustrates the AKA operation 200 of the conventional technique implemented by the USIM used to confirm the received AUTN. This USIM uses encryption functions F1, F2, F3, F4, and F5 (see 3GPP TS 35.205 V9.0.0, all previously incorporated as a reference), the stored key K, and the received AUTN and RAND. Using this RAND and K as the input of F5, this USIM calculates this AK (anonymous key). SQN (serial number) is generated by XOR (exclusive OR) of the first field of this AK and this AUTN. Using the RAND, K, SQN, and AMF as the input of F1, F2, F3, and F4, the USIM calculates the XMAC (Expected Message Authentication Code), RES, CK, and IK. After that, the UE compares the XMAC with the MAC of the AUTN; if they are different, the UE will suspend and abandon the instructions of the procedure and send the authentication failure message back to the VLR/SGSN (Visitor Location Registration Center/GPRS Service support node).

In one implementation, if the XMAC matches the MAC, the UE confirms that the SQN is within an acceptable range, and sends an authentication response message back to the VLR/SGSN, which includes the calculated result RES. The other is that if the SQN is not acceptable, the UE implements a resynchronization procedure and sends a synchronization failure message back to the VLR/SGSN.

After successfully completing the aforementioned procedures, the UE and the UTRAN agree to the CK and IK, and encryption and complete protection can be activated. Referring now to FIG. 3, a hardware architecture 300 of the conventional technology used in Subscriber Identity Modules (SIMs) is shown. As shown, the USIM 302 is stored on a universal integrated circuit card (UICC) suitable for insertion into the mobile device 304. This USIM executes the software program required for the AKA program (as described in Figures 1 and 2). The secure UICC stores only the secret keys known to the USIM and the network, and maintains internal counters (for example, status) related to secure transactions. The actual appearance of the USIM can be actually transmitted via in-box, mail, kiosk, etc., for example.

<b>Example embodiment-</b>

An exemplary embodiment of the wireless system 400 according to the present invention (in which the user at the user equipment 430 can obtain the wireless network service from the network service provider 412) is shown in FIG. 4. The user equipment 430 may be, for example, a mobile phone or a smart phone, a desktop computer, a laptop computer, or other suitable computing equipment. If properly approved, the user equipment 430 can communicate with the network service provider 412 via the wireless link 432.

The user equipment 430 may have a wireless communication circuit. For example, the user equipment 430 may use a long-range wireless communication circuit such as a mobile phone circuit to use the mobile phone frequency bands of 850 MHz, 900 MHz, 1800 MHz, and 1900 MHz (for example, the main global system for mobile communication or GSM mobile Telephone frequency band) and communicate through link 432. The long-range wireless communication circuit in the user equipment 430 may also conform to the 2100 MHz frequency band, for example. If desired, the user equipment 430 can also use a short-range wireless communication link to achieve communication with nearby equipment. For example, electronic devices can use 2.4 GHz and 5 GHz WiFi<img file="TWI433556B_D0001.tif" he="36" id="i0001" img-content="character" img-format="tif" inline="no" orientation="portrait" wi="35" />(IEEE 802.11) frequency band, and 2.4 GHz Bluetooth<img file="TWI433556B_D0002.tif" he="34" id="i0002" img-content="character" img-format="tif" inline="no" orientation="portrait" wi="35" />Band communication.

The network service provider 412 may need to properly authenticate the wireless user before providing the service. For example, the network service provider 412 may maintain Universal User Identity Module (USIM) information 414, which is used to determine whether a given user is approved to use the service of the provider 412. Unapproved users (for example, users without active accounts) will be denied service. Approved users will be allowed to establish links (such as link 432) to generate and receive voice calls, download and upload data, or otherwise obtain services available from the network service provider 412.

Conventionally, the USIM data 414 is distributed to authorized users in the form of a subscriber identity module (SIM) card. This method generally requires that a SIM card slot is available in the user's equipment.

A configuration with the type shown in FIG. 4 is beneficially unnecessary for the user equipment 430 to receive the USIM data 414 in the form of a removable SIM card. More precisely, USIM data can be distributed using wired and/or wireless network connections.

As an example, the USIM data 414 can be distributed from the network service provider 412 to the user equipment 430 directly or using one or more intermediate entities such as the USIM provider 422 and/or the trusted service manager 424.

In an exemplary implementation, for multiple users, the network service provider 412 can distribute the USIM data 414 to the USIM provider 422 through the link 416. The link 416 may be a secure wired or wireless link, or may involve the physical transmission of a storage device containing the USIM data 414.

The USIM provider 422 (which can be an organization that manufactures SIM cards, for example) can distribute this USIM data to a trusted service manager 424 through the link 420 (the other is that the trusted service manager can use another Link 418 to obtain the USIM data directly from the network service provider 412).

A trusted service manager 424 (which may be, for example, an organization that sells user equipment 430, or an entity associated with a supplier of equipment 430) may maintain a database of user credentials 426. These user certificates can be used to establish which users are approved clients of this trusted service manager, and/or are approved to obtain network services from the network service provider 412. For example, the user certificate 426 may include account information created by the user of the user equipment 430 when (or shortly after) the user equipment 430 was purchased. The user certificate 426 may, for example, include user name and password information, credit card information, and other information that can be used to establish the identity of an approved user.

In one embodiment, the trusted service manager 424 may implement and maintain user accounts (ie, maintain user credentials 426, and determine those users associated with user credentials 426 are authorized to obtain USIM data 414 to approve the account management work associated with its user equipment). Websites and customer service representatives available through the phone can be linked to the computing device of the trusted service manager 424. This website can be used, for example, to allow the user to create a collection of accounts and user credentials, purchase wireless services (to be used with the provider 412), make other purchases from a trusted service manager 424, and so on.

In a typical scenario, the user of the user equipment 430 communicates with the trusted service manager 424 through the link 434. The link 434 may include, for example, a wired and wireless link between the equipment 430 and the manager 424. If desired, the path 434 may include intermediate equipment (for example, a personal computer, and the user equipment 430 is connected to the personal computer using, for example, a universal serial bus connection).

When communicating with the trusted service manager 424, the user equipment 430 provides the user certificate to the trusted service manager. In one embodiment, the trusted service manager uses the user certificate database 426 to authenticate these certificates.

If the user equipment is successfully authenticated, the trusted service manager 424 can provide the appropriate USIM data 414 to the user equipment 430 through the secure channel in the link 434. The user equipment 430 can store the USIM data, and if desired, the USIM data is received in such a manner as in the secure element 428. The security element 428 may be, for example, a tamper-proof integrated circuit permanently constructed in the user equipment 430, or may be a removable element.

After the USIM data 414 has been stored in the user equipment 430, the user equipment can use the stored USIM data to request wireless services from the network service provider 412. Once the user equipment 430 is authenticated by the network service provider 412, the network service provider can provide wireless services such as voice calls and data link connections using the wireless path 432 to the user equipment 430.

Referring now to FIGS. 5a and 5b, there are respectively shown functional block diagrams of two exemplary embodiments of the hardware architecture (502, 504) of "virtual" subscriber identity modules (SIMs) according to the present invention. Different from the solution of the prior art in FIG. 3, the exemplary embodiment of FIGS. 5a and 5b stores the USIM 506 in the embedded secure element (SE) 508 instead of a removable card. The first illustrated embodiment 502 of the present invention (FIG. 5a) further includes a Near Field Communication (NFC) router 510. The second illustrated embodiment 504 (FIG. 5b) does not include this NFC router.

FIG. 6 shows the first embodiment 502 of FIG. 5a in combination with the SIM accessory device 602. As shown in FIG. As shown, the SIM accessory device 602 can in particular become a transitional implementation and support the traditional architecture. Traditional implementations will find special value when they are used by frequent SIM card "exchanges" and/or slow, or carriers who resist upgrading their existing networks. As shown in FIG. 6, the Bluetooth SIM Access Specification (SAP) provides the required functions (for example, the AKA protocol) that are normally performed by the physical SIM inserted in the modem.

As shown, when the SIM card 302 is inserted into the SIM accessory device slot, the accessory can communicate with the mobile device through a Bluetooth transceiver, and can be kept in a pocket, handbag, etc. During normal operation, the mobile device (communicating with this accessory) asks the user if they should use an external SIM. If so, the modem 502 accesses the external SIM 302 as needed via the Bluetooth SAP.

Referring now to FIG. 7, a method for deploying a conventional technology of the USIM 302 is graphically depicted. As shown, the USIM data is generated at the operator 708 and, in step 701, is distributed to the SIM card supplier 706. Then, in step 702, the USIM is manufactured into UICCs 302 for sale to users. Once the UICC has been inserted into the mobile device 304 in step 703, the mobile device and the operator can perform steps such as activation, authentication, and registration (step 704).

On the contrary, FIG. 8 shows an exemplary embodiment of a method for deploying USIM information 506 according to the present invention. As shown, in step 801, the USIM data is generated at the operator 808 and distributed to the USIM supplier 806. In step 802, the USIM provider can transfer the USIMs to, for example, a trusted service manager (TSM) 810. The TSM provides the USIM to the mobile device 502 through any secure channel (for example, a wireless or wired interface) (step 803). As shown, the security pipeline is based on the issuer's security domain (ISD) (step 804). During manufacturing, the ISD is burned into the mobile device. Once the USIM is successfully transferred to the mobile device, the mobile device and the operator can perform steps such as activation, authentication, and registration (step 805).

It will be appreciated that although certain aspects of the present invention are described in terms of steps in a specific order of the method, these descriptions are only illustrative of the broader method of the present invention, and can be modified as required by a particular application of. Certain steps may not be required or selected according to certain situations. In addition, certain steps or functions may be added to the disclosed embodiments, or the order of implementation of two or more steps may be changed. All such changes are deemed to be included in the invention disclosed and claimed herein.

Although the above detailed description has been applied to different embodiments to show, describe, and point out the novelty of the present invention, it will be understood that without departing from the present invention, those skilled in the art can exemplify Various omissions, substitutions, and changes are implemented in the form and details of the device or program. The foregoing description is the best mode currently considered for implementing the present invention. This description is in no way meant to be limiting, but should be regarded as an illustration of the general principles of the invention. The scope of the present invention should be determined with reference to the scope of the patent application.

<p>100. . . Authentication and Key Agreement (AKA)</p><p>102. . . User equipment</p><p>104. . . Universal user identity module</p><p>106. . . Service Network (SN)</p><p>108. . . Certification Center</p><p>200. . . AKA operation</p><p>300. . . Hardware architecture</p><p>302. . . Universal user identity module</p><p>304. . . Mobile device</p><p>400. . . Wireless system</p><p>412. . . Internet service provider</p><p>414. . . Universal User Identity Module (USIM) Information</p><p>416. . . link</p><p>418. . . link</p><p>420. . . link</p><p>422. . . USIM supplier</p><p>424. . . Trusted Service Manager</p><p>426. . . User certificate</p><p>428. . . Secure element</p><p>430. . . User equipment</p><p>432. . . Wireless link</p><p>434. . . link</p><p>502. . . Hardware architecture</p><p>504. . . Hardware architecture</p><p>506. . . Universal User Identity Module</p><p>508. . . Embedded Secure Element (SE)</p><p>510. . . Near Field Communication (NFC) router</p><p>602. . . SIM accessory device</p><p>706. . . SIM card supplier</p><p>708. . . operator</p><p>806. . . USIM supplier</p><p>808. . . operator</p><p>810. . . Trusted Service Manager (TSM)</p>

When combined with the drawings, the characteristics, objectives, and advantages of the present invention will become more apparent from the detailed description mentioned below:

Figure 1 is a diagram of the authentication and key agreement (AKA) of the conventional technology.

Figure 2 is a graph of the AKA operation of the conventional technology implemented by USIM.

Figure 3 is a diagram of the hardware architecture of the conventional technology of subscriber identity modules (SIMs).

Fig. 4 is a diagram of an exemplary wireless system according to an embodiment of the present invention.

Figure 5a is a functional block diagram of the first exemplary embodiment of the hardware architecture of "virtual" subscriber identity modules (SIMs) according to the present invention.

Fig. 5b is a functional block diagram of a second exemplary embodiment of the hardware architecture of "virtual" subscriber identity modules (SIMs) according to the present invention.

Figure 6 is a diagram of an exemplary embodiment of the present invention operating in conjunction with a SIM accessory device according to the present invention.

Figure 7 is a diagram of a conventional method of deploying a USIM to a mobile device.

FIG. 8 is a diagram showing an exemplary method of deploying USIM information to a mobile device according to the present invention.

Apple's<img file="TWI433556B_D0003.tif" he="35" id="i0003" img-content="character" img-format="tif" inline="no" orientation="portrait" wi="34" />All rights of all the drawings of copyright 2009-2010 are reserved.