Credential generation for automatic authentication on wireless access network

Network devices provide seamless offloading of data communications from a service provider's cellular network to an alternate access network outside of the service provider's cellular network. After a cellular mobile device has initially been authenticated by devices in the cellular network to communicate with a packet data network via the cellular network, the cellular mobile device is configured to leverage its prior authentication on the cellular network and automatically obtain credentials for use in logging onto the alternate access network, without requiring any action by a user of the cellular mobile device. After the cellular mobile device is logged on to the alternate access network, the cellular mobile device sends wireless data communications to the packet data network via the alternate access network instead of the cellular network.

TECHNICAL FIELD

The disclosure relates to mobile networks and, more specifically, to wireless access networks.

BACKGROUND

Use of cellular mobile devices for accessing computer data networks has recently increased dramatically. These mobile devices, often referred to as “smart” phones, provide a platform for both cellular phone calls and cellular-based access to computer data services. For example, a typical cellular network is a collection of cells that each include base stations capable of transmitting and relaying radio signals to subscribers' mobile devices. A “cell” generally denotes a distinct area of a cellular network that utilizes a particular frequency or range of frequencies for transmission of data. A typical base station is a tower to which are affixed a number of antennas that transmit and receive the data over the particular frequency. Mobile devices may transmit radio signals at the designated frequency to the base stations to initiate cellular telephone calls or packet-based data services.

With respect to data services, cellular service providers convert the cellular signals, e.g., Time Division Multiple Access (TDMA) signals, Orthogonal Frequency-Division Multiplexing (OFDM) signals or Code Division Multiple Access (CDMA) signals, received from mobile devices at the base stations into Internet protocol (IP) packets for transmission within packet-based networks. A number of standards have been proposed to facilitate this conversion and transmission of cellular signals to IP packets, such as a general packet radio service (GPRS) standardized by the Global System for Mobile Communications (GSM) Association, a Universal Mobile Telecommunications System (UMTS), an evolution of UMTS referred to as Long Term Evolution (LTE), as well as other standards proposed by the 3rdGeneration Partnership Project (3GPP), 3rdGeneration Partnership Project 2 (3GGP/2) and the Worldwide Interoperability for Microwave Access (WiMAX) forum.

In this way, the cellular service provider provides data services and connectivity to the cellular mobile devices, allowing the cellular mobile devices to access various packet data networks (PDNs). The PDNs provide a variety of packet-based data services to the cellular mobile device and allow the wireless devices to exchange service data with application or other servers of the PDNs. PDNs may include, for example, the Internet, an enterprise intranet, a layer three (L3) VPN, and a service provider's private network. A service provider's cellular network transports subscriber traffic exchanged between the cellular mobile device and the PDN.

The ubiquitous use of cellular mobile devices and the ever increasing desire by users for fast network access from around the world has presented many challenges. For example, the use of cellular mobile devices have placed a high demand for data services over the service provider's cellular network, often straining the cellular network and resulting in delayed or lost data communications. Some cellular mobile devices, in addition to supporting connections to a PDN via a radio interface, also support wireless capabilities to exchange data via an alternate access network that is separate from the cellular network of the mobile service provider. For example, many cellular mobile devices include a wireless local area network (WLAN) interface that provides data service when in the presences of a WiFi “hotspot” or other wireless access point (WAP). Other examples of such wireless capabilities may include Bluetooth or Near Field Communication (NFC). When in the presence of a WLAN, a user may wish to transition the data services of the cellular mobile device to the WLAN so as to accelerate data transmissions and avoid any delays associated with the cellular network.

SUMMARY

This disclosure describes techniques for seamless offloading of data communications from a service provider's cellular network to an alternate access network outside of the service provider's cellular network. After a cellular mobile device has initially been authenticated by the cellular network and configured to receive data services from a packet data network via the cellular network, the cellular mobile device may travel into range of a wireless access point of the alternate access network. The cellular mobile device is configured to leverage its prior authentication on the cellular network and automatically obtain credentials for logging onto the alternate access network, without necessarily requiring any action by a user of the cellular mobile device. After the cellular mobile device has automatically established data services over the alternate access network, the cellular mobile device communicates with the packet data network via the alternate access network without service interruption.

For example, after the cellular mobile device has been authenticated over the service provider's cellular network, a WiFi offload manager executing on the cellular mobile device automatically sends information that identifies the cellular mobile device to a credential portal of the service provider network. For example, the WiFi offload manager collects and sends an identifier for the cellular mobile device (e.g., an IMSI from a SIM card within the device) and a layer two (L2) identifier for a wireless local area network (WLAN) interface of the device. The credential portal generates credentials, e.g., a username and password, based on the information provided by the cellular mobile device, and sends the credentials back to the cellular mobile device. The credential portal also stores the credentials and the original information from the device to a subscriber database that is also accessible by an authentication server for the alternate access network. In the event the cellular mobile device later transitions to the alternate access network using its WLAN interface (e.g., wireless access card) and attempts to log in to the alternate access network using the provided credentials, the authentication server matches the credentials provided by the cellular mobile device to those stored in the subscriber database, and allows the cellular mobile device to access a packet data network such as the Internet via the WiFi hotspot.

In one aspect, a method includes after a cellular mobile device is authenticated on a service provider cellular network, automatically sending by the cellular mobile device a communication to a credential portal positioned within a core network of the service provider, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address associated with the cellular mobile device. The method further includes receiving, by the cellular mobile device, a communication from the credential portal, wherein the communication includes a username and password generated by the credential portal for use in authenticating the cellular mobile device on an alternate access network separate from the service provider cellular network, wherein the username and password are generated by the credential portal based on the identifier of the cellular mobile device and the L2 address associated with the cellular mobile device, and storing the username and password by the cellular mobile device. The method also includes disconnecting the cellular mobile device from the service provider cellular network, automatically providing, by the cellular mobile device, the username and password to a wireless access point of the alternate access network for authenticating the cellular mobile device on the alternate access network, and after the cellular mobile device is authenticated on the alternate access network, sending, by the cellular mobile device, data communications to a packet data network by the alternate access network instead of by the cellular network.

In another aspect, a cellular mobile device includes a transmitter and receiver to send and receive cellular communications in the form of radio frequency signals, a wireless access card to send and receive wireless communications that conform to an IEEE 802.1x standard, a microprocessor, and an operating system executing on the microprocessor to provide an operating environment of application software. The cellular mobile device also includes an offload manager application executing on the operating system, wherein, after the cellular mobile device is authenticated on a service provider cellular network, the offload manager application is configured to automatically send a communication to a credential portal positioned within a core network of the service provider, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address of the wireless access card. The offload manager receives a communication from the credential portal, wherein the communication includes a username and password generated by the credential portal for use in authenticating the cellular mobile device on an alternate access network separate from the service provider cellular network, wherein the username and password are generated by the credential portal based on the identifier of the cellular mobile device and the L2 address associated with the cellular mobile device. The offload manager stores the username and password, and disconnects the cellular mobile device from the service provider cellular network in response to receiving the communication from the credential portal and sensing a signal from a wireless access point of the alternate access network, and automatically authenticates the cellular mobile device on the alternate access network by providing the username and password to the wireless access point.

In another aspect, a non-transitory computer-readable storage medium comprising instructions for causing a programmable processor of a cellular mobile device to, after the cellular mobile device is authenticated on a service provider cellular network, automatically send a communication to a credential portal positioned within a core network of the service provider, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address associated with the cellular mobile device. The instructions also include instructions to receive a communication from the credential portal, wherein the communication includes a username and password generated by the credential portal for use in authenticating the cellular mobile device on an alternate access network separate from the service provider cellular network, wherein the username and password are generated by the credential portal based on the identifier of the cellular mobile device and the L2 address associated with the cellular mobile device, and storing the username and password. The instructions also include instructions to disconnect the cellular mobile device from the service provider cellular network, automatically provide the username and password to a wireless access point of the alternate access network for authenticating the cellular mobile device on the alternate access network, and, after the cellular mobile device is authenticated on the alternate access network, send data communications to a packet data network by the alternate access network instead of by the cellular network.

In a further aspect, a system includes a packet data network, a service provider network that includes a core network comprising a credential portal, an Authentication, Authorization, and Accounting (AAA) server, and a subscriber database accessible by the credential portal and the AAA server. The service provider network also includes a cellular network for accessing the core network and the packet data network. The system includes a cellular mobile device comprising a microprocessor, an operating system executing on the microprocessor to provide an operating environment of application software, a wireless access card to send and receive wireless communications that conform to an IEEE 802.1x standard, and an offload manager application executing on the operating system. After the cellular mobile device is authenticated on a service provider cellular network, the offload manager application is configured to automatically send a communication to the credential portal, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address of the wireless access card. Upon receiving the communication, the credential portal generates a username and password based on the identifier of the cellular mobile device and the L2 address associated with the cellular mobile device, and sends the username and password to the cellular mobile device for use in authenticating the cellular mobile device on the alternate access network. Upon receiving the username and password from the credential portal, the offload manager stores the username and password, and later disconnects the cellular mobile device from the service provider cellular network, and automatically authenticates the cellular mobile device on the alternate access network by providing the username and password to the wireless access point.

In a further aspect, a credential portal includes a physical interface that receives a communication from a cellular mobile device, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address associated with the cellular mobile device, wherein the cellular mobile device is previously authenticated on a cellular network of a service provider, and a credential generator that generates a username and password based on the identifier of the cellular mobile device and the address associated with the cellular mobile device. The credential portal stores the received identifier of the cellular mobile device and the address associated with the cellular mobile device and the generated username and password to a subscriber database accessible by an Authentication, Authorization, and Accounting (AAA) server that is used by a wireless access point of an alternate access network separate from the service provider cellular network. The credential portal forms a message that includes the username and password, and sends the message to the cellular mobile device for use in authenticating the cellular mobile device on the alternate access network.

In a further aspect, a method includes receiving, by a credential portal, a communication from a cellular mobile device, wherein the communication includes an identifier of the cellular mobile device obtained from hardware of the cellular mobile device and a layer two (L2) address associated with the cellular mobile device, wherein the cellular mobile device is previously authenticated on a cellular network of a service provider, generating, by the credential portal, a username and password based on the identifier of the cellular mobile device and the address associated with the cellular mobile device, and storing, by the credential portal, the received identifier of the cellular mobile device and the address associated with the cellular mobile device and the generated username and password to a subscriber database accessible by an Authentication, Authorization, and Accounting (AAA) server that is used by a wireless access point of an alternate access network separate from the service provider cellular network. The method also includes forming a message that includes the username and password, and sending the message to the cellular mobile device for use in authenticating the cellular mobile device on the alternate access network.

The techniques of this disclosure may provide one or more advantages. For example, the techniques described herein provide a seamless mechanism that allows the cellular mobile device to automatically obtain credentials (e.g., a username and password) to be used for authenticating on an alternate access network, such as a WiFi hotspot. The mechanism leverages the fact that the cellular mobile device was previously authenticated through the mobile wireless network. The techniques may be used on a wide variety of brands and platforms of cellular mobile device, and do not require the cellular mobile device to log onto the alternate access network using SIM-based authentication such as EAP-SIM or EAP-AKA. In other words, authentication of the cellular mobile device on an alternate access network by a AAA server of the service provider can proceed as usual according to 802.1x or Captive Portal Pages, without requiring access by the AAA server to the SIM credentials of cellular mobile device.

The techniques of the disclosure may allow the service provider to offload data communications to an alternate wireless infrastructure, such as a WLAN, and thereby to accommodate larger volume of data traffic from cellular mobile devices without requiring as much investment in cellular network infrastructure. This may offer a cost savings for the service provider.

The techniques may be seamless in that they need not necessarily require user input to authenticate the cellular mobile device on the alternate access network. For example, the user does not have to input a username and password to switch to the WiFi hotspot. Instead, the WiFi offload manager executing on the cellular mobile device can automatically obtain the login credentials and provide them to the authentication server. Moreover, authenticating the cellular mobile device on the alternate access network occurs automatically and without disruption to services provided from the packet data network to the cellular mobile device.

DETAILED DESCRIPTION

FIG. 1Ais a block diagram illustrating an example network system2in which various network components operate in accordance with the described techniques. In the example ofFIG. 1A, network system2includes network components that automatically provide seamless authentication of a cellular mobile device4while transitioning between cellular network6of a service provider (SP) network8and an alternate access network10outside of the SP network8. Network system2includes an example SP network8having a cellular network6that allows data communications between a cellular mobile device6and a packet data network (PDN)12, such as the Internet.

The techniques of this disclosure allow for offloading data communications from the service provider's cellular network6to alternate access network10outside of cellular network6. After cellular mobile device4has initially been authenticated by devices in cellular network6to communicate with PDN12and IP Multimedia Subsystem (IMS) core network16via cellular network6, cellular mobile device4may travel into range of an access point of alternate access network10. As described in further detail below, the techniques of this disclosure allow cellular mobile device4to leverage its prior authentication on cellular network6and automatically obtain credentials for authenticating on alternate access network10, without requiring any action by a user of cellular mobile device4. After cellular mobile device4is logged on to alternate access network10, cellular mobile device4can send wireless data communications to PDN12via alternate access network10instead of cellular network6.

Cellular mobile device4represents any mobile communication device that supports both cellular radio access and local wireless (so called, “WiFi”) network access, e.g., by way of a wireless LAN interface using any of the 802.11 communication protocols. Cellular mobile device4may comprise, for example, a mobile telephone, a laptop or other mobile computer having, e.g., a 3G/4G wireless card, a smart phone, or a personal data assistant (PDA) having both cellular and WLAN communication capabilities. Cellular mobile device4may run one or more software applications, such as VoIP clients, video games, videoconferencing, E-mail, and Internet browsers, among others. PDN12supports one or more packet-based services that are available for request and use by cellular mobile device4. Certain applications running on cellular mobile device4may require access to services offered by PDN12, such as mobile calls, video games, videoconferencing, and email, among others. Cellular mobile device4may also be referred to, in various architectural embodiments, as User Equipment (UE) or mobile station (MS). One example of a cellular mobile device is described in U.S. patent application Ser. No. 12/967,977 filed Dec. 14, 2010, entitled “MULTI-SERVICE VPN NETWORK CLIENT FOR CELLULAR MOBILE DEVICE,” incorporated herein by reference. Cellular mobile device4stores a unique identifier such as, for example, an International Mobile Subscriber Identity (IMSI), or an International Mobile Equipment Identity (IMEI) stored, for instance, in a subscriber identity module (SIM) or in a memory or integrated circuit of cellular mobile device4.

A service provider operates SP network8to provide network access, data transport and other services to cellular mobile device4. SP network8comprises base station14, cellular network6, and IMS core network16. Cellular mobile device4communicates with base station14over wireless links to access SP network8.

The service provider provisions and operates cellular network6to provide network access, data transport and other services to cellular mobile device4. In general, cellular network6may implement any commonly defined cellular network architecture including those defined by standards bodies, such as the Global System for Mobile communication (GSM) Association, the 3rdGeneration Partnership Project (3GPP), the 3rdGeneration Partnership Project 2 (3GPP/2), the Internet Engineering Task Force (IETF), and the Worldwide Interoperability for Microwave Access (WiMAX) forum. For example, cellular network6may represent one or more of a GSM architecture, a General Packet Radio Service (GPRS) architecture, a Universal Mobile Telecommunications System (UMTS) architecture, and an evolution of UMTS referred to as Long Term Evolution (LTE), each of which are standardized by 3GPP. Cellular network6may, alternatively or in conjunction with one of the above, implement a code division multiple access-2000 (“CDMA2000”) architecture. Cellular network6may, again as an alternative or in conjunction with one or more of the above, implement a WiMAX architecture defined by the WiMAX forum.

In the example ofFIG. 1A, SP network8comprises a Universal Mobile Telephony Service (UMTS) network that operates in accordance with the 3rd Generation Partnership Project (3GPP) standards and with the techniques described herein. For purposes of illustration, the techniques herein will be described with respect to a UMTS network. However, the techniques are applicable to other communication network types in other examples. For instance, the techniques are similarly applicable to network architectures and nodes deploying 3GPP/2, CDMA2000, WiMAX, and Mobile IP based technologies and standards.

In this example, cellular network6includes radio network controller (RNC)18coupled to base station14. RNC18and base station14provide wireless access by cellular mobile device4to cellular network6. Base station14may be a Node B base transceiver station that uses an air interface to communicate with user equipment in the geographic region (or “cell”) that base station14serves. In some examples, base station14is a femtocell. Cellular mobile device4is located within the cell served by base station14. SP network8may, in some instances, include additional base stations, each of which may serve one of several cells. In some examples, base station14may be another type of wireless transceiver station, such as a site controller or a WiMAX access point. User equipment, such as cellular mobile device4, may be referred to in alternative architectures as a mobile station (MS).

In the illustrated embodiment, cellular network6includes serving GPRS support node20(“SGSN20”), and gateway GPRS support node22(“GGSN22”). SGSN20switches mobile traffic to available GGSNs, such as GGSN22. Cellular network6also includes RNC18, which manages and routes data to/from base station14to SGSN20. RNC18may establish and support GTP tunnels to SGSN20. In some instances, RNC18comprises an IP router. In some embodiments, SP network8may include additional RNCs and associated base stations variously arranged.

SGSN20and GGSN22provide packet-switched (PS) services to RNC18. For example, SGSN20and GGSN22provide packet routing and switching, as well as mobility management, authentication, and session management for cellular mobile device4served by RNC18. The packet-switched services provided by SGSN20and GGSN22may include mobility services, such as authentication and roaming services, as well as call handling services, signaling, billing, and internetworking between cellular network6and external networks, such as PDN12. For example, SGSN20serves RNC18. Cellular mobile device4connects to SGSN20, sending identifying credentials for the SIM card inside cellular mobile device4(e.g., an IMSI) to SGSN20via RNC18, which SGSN20uses to authenticate the cellular mobile device in cooperation with Home Location Register (HLR)24. In some examples, HLR24may be connected to AAA server40.

GGSN22is a gateway node that connects cellular network6to PDN14via Gi interface26operating over a physical communication link (not shown). GGSN22also connects cellular network6to IMS core network16via Gi interface28operating over another physical communication link (not shown) or the same interface26as for PDN14. SGSN10obtains data traffic from RNC18, e.g., traffic from cellular mobile device4, and routes the data traffic to GGSN22. GGSN22decapsulates the data traffic, and initiates IP traffic on the Gi interfaces26,28. GGSN22enables access to one or more services provided by servers via PDN14, and GGSN22maps accessible services to access points. In the example ofFIG. 1A, one service includes an applications market (“APP market”)30reachable via packet data network12. Cellular mobile device4may download executable applications from application market30, to be executed on an operating system of cellular mobile device4.

In some situations, a subscriber associated with cellular mobile device4may wish to receive data services via alternate access network10instead cellular network6of SP network8. Alternate access network10may be, for example, a WLAN network. In the example ofFIG. 1A, alternate access network10includes WLAN access point32, to which cellular mobile device4can attach in order to access the services available through PDN12. The techniques of this disclosure allow for seamless authentication of cellular mobile device4on alternate access network10when the cellular mobile device transitions between cellular network6of SP network8and alternate access network10outside of the SP network8. As discussed in further detail below, in some aspects, cellular mobile device4may download an application (“app”) having a WiFi Offload Manager application that provides support for seamless offloading and authentication of cellular mobile device4onto alternate access network10when cellular mobile device4moves from cellular network6to alternate access network10. Alternatively, cellular mobile device4may be preloaded with the WiFi Offload Manager by its manufacturer.

As shown inFIG. 1A, IMS core network16includes credential portal34, which communicates with the WiFi Offload Manager application executing on cellular mobile device4to facilitate transition between cellular network6and alternate access network10. Credential portal34may be, for example, a provisioning server or other device that maintains subscriber database38within IMS core network16. Initially, cellular mobile device4is authenticated on cellular network6by SGSN20in cooperation with HLR24and connects to PDN12to exchange data communications42with PDN12.

FIG. 1Billustrates WiFi Offload Manager of cellular mobile device4communicating with credential portal34in the background to provide credential portal34with certain identifying information for cellular mobile device4. For example, when cellular mobile device4is connected to cellular network6, the WiFi Offload Manager on cellular mobile device4may establish a communication session with credential portal24(e.g., an HTTPS session) and communicate via eXtensible Markup Language (XML)-based messages or Simple Object Access Protocol (SOAP) messages44. At this time, WiFi Offload Manager reports an identifier (e.g., IMSI or IMEI) stored with the SIM card of cellular mobile device4or on the cellular device itself, and a WLAN Media Access Control (MAC) address of the cellular mobile device. Using the existing data services of cellular network6, cellular mobile device4sends the message44to credential portal34, which receives the message via firewall36coupled to GGSN22.

By virtue of the message from cellular mobile device4coming through firewall36, credential portal34can ascertain that cellular mobile device4has already been authenticated by SGSN20. Furthermore, at this time, credential portal34may also learn the layer three (L3) network address (e.g., IP address) currently allocated to cellular mobile device4for use in receiving data services from cellular network6. For example, credential portal34may examine the source IP address of messages44received from the WiFi Offload Manager executing on cellular mobile device4. At this time, credential portal34generates a username and password based on the identifying information received from cellular mobile device4, and sends a message46that includes the username and password back to cellular mobile device4for use in authentication on alternate access network10. Moreover, credential portal34updates a subscriber record within subscriber database38to store the identifier of cellular mobile device4(e.g., the IMSI or IMEI), the layer two (L2) MAC address of the WLAN interface of the cellular mobile device, the generated username and password, and the layer three (L3) network address currently assigned to the cellular mobile device. Subscriber database38may be, for example, a Structured Query Language (SQL) database. As shown, subscriber database38may be accessed by (or integrated within) Authentication, Authorization, and Accounting (AAA) server40(e.g., a RADIUS server), for use in authenticating cellular mobile device4. In some embodiments, subscriber database38may be integrated with HLR24. In some aspects, credential portal34may also obtain WLAN policy information for the Wi-Fi Offload Manager from subscriber database38, and may include the WLAN policy information in the message with the username and password.

As shown inFIG. 1B, cellular mobile device4may subsequently request access to alternate access network10using its WLAN interface in communication with WLAN access point32. At this time, alternate access network32may request a username and password, which mobile cellular device4automatically supplies based on the credential information received from credential portal34. AAA server40receives the credential information from alternate access network10along with the layer two (L2) MAC address for the WLAN interface of mobile cellular device4. AAA server40accesses subscriber database, such as by using the identifier of the WLAN interface and/or the username as a key, and verifies that the credential information automatically provided by mobile cellular device4over alternate access network10match the credentials previously generated by credential portal34for the device having that particular WLAN interface or assigned that username.

As shown inFIG. 1C, once authenticated, cellular mobile device4continues to communicate with PDN12and exchanges data communications49with PDN12through alternate access network10instead of cellular network6. Although described for purposes of example with respect to a WLAN access point, the techniques of the disclosure may be applied to offload data communications to other types of wireless capabilities, such as Bluetooth, Near Field Communication (NFC), for example. The techniques of this disclosure may be applied to both WiFi Protected Access (WPA) Enterprises and Wireless Internet Service Provider roaming (WISPr) V1.0 Gateways. In some aspects, WLAN access point34may send usage information for cellular mobile device4to AAA server40, which AAA server40can use for subscriber billing purposes. The geographic location of WLAN access point32relative to SP network8need not be limited, as long as WLAN access point32connected in some way to AAA server40of IMS core network16.

FIG. 2is a flowchart illustrating example operation of cellular mobile device4and credential portal34in accordance with aspects of this disclosure. Cellular mobile device4is authenticated by SGSN22and HLR24, e.g., using SIM credentials of cellular mobile device4. After authentication, cellular mobile device4can exchange data communications with PDN12and IMS core network16via cellular network6(50). Cellular mobile device4optionally downloads a WiFi offload manager app from app market30(e.g., an electronic store or other repository) via PDN12. The WiFi offload manager app may be received as a software package provided by a manufacturer of cellular mobile device4. Alternatively, the WiFi offload manager app may come pre-loaded on the cellular mobile device (52).

Upon connecting to cellular network6, the WiFi offload manager application executing on cellular mobile device4obtains cellular mobile device identifier(s), e.g., IMSI and/or IMEI, from the Subscriber Identity Module (SIM) card of cellular mobile device4or from the device itself. The WiFi offload manager also obtains the WLAN MAC from cellular mobile device4.

The WiFi offload manager generates a communication that includes the IMSI and IMEI of cellular mobile device4, and the WLAN MAC address of cellular mobile device4, and sends the communication to the credential portal34(54). For example, the communication may take the form of a SOAP message, XML, or other message type, and may be sent via a Hypertext Transfer Protocol Secure (HTTPS) tunnel to credential portal34. In one example aspect, cellular mobile device4may obtain the IP address of credential portal34via a DNS request to a DNS server (not shown inFIGS. 1A-1C). As another example, the IP) address of credential portal34may be programmed into the WiFi offload manager application executing on cellular mobile device4.

In response to receiving the message from the WiFi offload manager (56), credential portal34generates a username and password based on the IMSI/IMEI and WLAN MAC address provided by cellular mobile device4(58). Credential portal34may, for example, generate a username that uses a Network Access Identifier (NAI) (e.g., joe_doe@att.com) to identify the user in third party roaming based on realms. Credential portal34stores the username and password to subscriber database38(60). That is, credential portal34updates a subscriber record within subscriber database38to associate the identifier (IMSI/IMEI) of cellular mobile device4and the generated credentials with the identifier (e.g., L2 MAC address) for the WLAN interface of the cellular mobile device. In addition, credential portal34may update the subscriber record to store a layer three (L3) network address (e.g., IP address) currently assigned to cellular mobile device4by the cellular network for providing data service to the cellular mobile device4.

Subscriber database38may optionally provide WLAN offload policy information for the WiFi offload manager in the message. The policies may inform cellular mobile device4when to offload to the alternate access network10and which credentials to use then. In addition, the WLAN access point can obtain policies due to network management or for a particular session (cellular mobile device that is using the network), but these may be provided through AAA server40. Credential portal34creates a message to send to the cellular mobile device4via the HTTPS tunnel that includes the username and password. In some embodiments, the message may also include the WLAN policy and possibly other configuration information. Credential portal34sends the message to cellular mobile device (62), e.g., via a SOAP message or XML.

Cellular mobile device4receives the message from credential portal34(64). In response to receiving the communication, cellular mobile device4programs the WiFi offload manager to use the credentials and policies when a WLAN access network is to be accessed (68). For example, the WiFi offload manager on cellular mobile device4may upon receipt apply the received credentials (username and password) to the Protected Extensible Authentication Protocol (PEAP) or Tunneled Transport Layer Security (TTLS) supplicant or WISPr V1.0 Smartclient on cellular mobile device4to be automatically supplied when later authenticating cellular mobile device4on alternate access network10using WLAN access point32. This authentication then occurs without requiring any user input. For example, authentication may be triggered when cellular mobile device4senses the WiFi signal from WLAN access point32, which may happen immediately after the credentials or stored, or at a later time (67). For example, cellular mobile device4may detect a signal having strength above a predefined threshold. Cellular mobile device4may in some embodiments look specifically for a WiFi signal from a WLAN access point32owned by the service provider that operates SP network8. Cellular mobile device4sends an authentication message such as an 802.1x PEAP or TTLS authentication message to WLAN access point32that includes the username and password. WLAN access point32forwards the 802.1x PEAP/TTLS message to AAA server40with the WLAN MAC address of the cellular device4that is attached and requesting authentication.

AAA server40checks the username and password and the WLAN MAC address received in the PEAP/TTLS message against subscriber database38. If the credentials match those stored by credential portal34in subscriber database38for the particular WLAN MAC address, AAA server40proceeds with authentication of cellular mobile device4on alternate access network10(70). At this point, cellular mobile device4is able to continue to exchange data communications with PDN12via alternate access network10. In this manner, the authentication of cellular mobile device4on alternate access network10by AAA server40can proceed as usual according to 802.1x, without requiring access by AAA server40to the SIM credentials of cellular mobile device4.

The techniques need not necessarily require user input to authenticate the cellular mobile device4on the alternate access network10. For example, the user need not necessarily input a username and password to switch to the WLAN access point. Instead, the WiFi offload manager executing on the cellular mobile device can automatically obtain the authentication credentials and provide them to AAA server40. Moreover, authenticating the cellular mobile device4on the alternate access network occurs may automatically without disruption to services provided from the packet data network to the cellular mobile device4.

The exchange between cellular mobile device4and credential portal34may occur as soon as cellular mobile device4can reach credential portal34, such as the first time cellular mobile device4is started with a connection manager. The devices may be configured to repeat this exchange as often as desired to refresh the password, and also may be done just before cellular mobile device4moves to the WLAN network. Alternatively, a single username/password may be used for the lifetime of cellular mobile device4. The cellular mobile device4may therefore still be able to use the provided login credentials when cellular mobile device4senses an alternate access network10but cannot reach cellular network6anymore to obtain credentials.

FIG. 3is a block diagram illustrating an example embodiment of a cellular mobile device4that operates in accordance with the techniques described herein. In this example, cellular mobile device4includes a hard-ware72that provides core functionality for operation of cellular mobile device4. Hardware72may include one or more programmable microprocessors74configured to operate according to executable instructions (i.e., program code), typically stored in a computer-readable medium such as static, random-access memory (SRAM) device or Flash memory device. Transmitter76and receiver78communicate with other communication devices via a wireless communication, such as cellular communications in the form of high-frequency radio frequency (RF) signals. Hardware72may include additional discrete digital logic or analog circuitry. WLAN interface (IF)75is an interface, such as a wireless access card, used for connecting to a wireless network, and has an associated a L2 address, such as a MAC address, referred to as a WLAN MAC address of cellular mobile device4. WLAN IF may send and receive wireless communications according to 802.3, and use the IEEE 802.1x standard for authentication. SIM card77stores information that uniquely identifies cellular mobile device4, including an IMSI. Input/output component (I/O)79allows data signals to be input and output from cellular mobile device4. As one example, a user of cellular mobile device4may interact with cellular mobile device4via I/O79.

Operating system80executes on microprocessor74and provides an operating environment for one or more user applications82(commonly referred to “apps”). O/S interface84proves an interface layer of software capable of making kernel calls into operating system80. In other words, O/S interface84provides a framework within which WiFi offload manager86operates and may, for example, allow WiFi offload manager86to execute within a “user” space of the operating environment provided by cellular mobile device4. O/S interface84may allow other forms of protocol handlers to be “plugged in” for interfacing with operating system80. O/S interface84interacts with operating system80to provide OS-level support for protocol-specific handlers.

In some cases, executable code for control application88and WiFi offload manager84may be distributed as a single distribution package90that is downloadable from a standard “app” deployment mechanism, such as provided by a server associated with an electronic store or other repository for user applications, and/or provided by a manufacturer of cellular mobile device4. That is, control application80and WiFi offload manager84may be integrated into a multi-service client for cellular mobile device4to allow easy deployment. An application management utility on cellular mobile device4may, for example, issue a request to an App market30server and, in response receive distribution package for processing and installation on cellular mobile device4. Control application80may provide a user interface by which a user of cellular mobile device4is able to configure and manage WiFi offload manager84.

After cellular mobile device4is authenticated on cellular network6by interacting with SGSN20and HLR24and using its SIM credentials, cellular mobile device4exchange data communications with PDN12via cellular network6. When WiFi offload manager84of cellular mobile device4is attached to the cellular network6, WiFi offload manager84obtains the IMSI from the SIM card77of cellular mobile device4, and/or the IMEI from cellular mobile device4and generates a message that includes the IMSI and IMEI. WiFi offload manager84also obtains the WLAN MAC address of WLAN interface75of cellular mobile device4and includes this in the message. WiFi offload manager84sends the message via an HTTPS tunnel to credentials portal34of IMS core network16over cellular network6. The message may be, for example, a SOAP message or XML. As another example, WiFi offload manager84may cause cellular mobile device4to transmit the credentials information to credential portal34by a Short Message Service (SMS) message.

WiFi offload manager84also processes a response message received from credential portal34, e.g., via a SOAP message, XML, SMS, or the like. The response message includes a username and password generated by credential portal34, and may also include WLAN policy information for WLAN access point32. WiFi offload manager84stores the username, password, and WLAN policy information to memory of cellular mobile device4. Authentication module92uses the stored username and password for authentication with AAA server40(e.g., 802.1x authentication) to log on to alternate access network10. Authentication module92may also use the WLAN policies to use (e.g., SSID to use for WiFi).

FIG. 4is a block diagram illustrating an example embodiment of a credential portal34in accordance with the techniques of this disclosure. In the example ofFIG. 4, credential portal34includes a control unit92and a set of interface cards (IFCs)94for communicating packets via inbound links and outbound links. As one example, credential portal34may be a provisioning server.

Control unit92includes credential generator95. Credential generator95generates a username and password for a cellular mobile device4based on the IMSI/IMEI, and WLAN MAC address received from cellular mobile device4. The username and password may be persistent credentials, or may be one-time use credentials for cellular mobile device4, requiring that cellular mobile device4obtain new credentials each time cellular mobile device4logs on to alternate access network10, or upon expiration of a time period. Credential generator95forms a message to send to cellular mobile device4that includes the generated username and password.

Control unit92includes an administrator interface96, by which a network administrator can configure credential portal34. For example, the administrator may configure credential expiration settings98, which may include a time period after which a given username/password will expire for a cellular mobile device. The time period may be a fixed period of time after which the credentials will expire. Credential portal34may also provide information about credential expiration settings98to cellular mobile device4when providing credentials.

Control unit92also includes WLAN policies99, which credential generator95may access to obtain WLAN policies specific to the WLAN MAC address provided by cellular mobile device4. WLAN policies provide configuration information for cellular mobile device4for WiFi usage on the alternate access network10. WLAN policies99may include, for example, a broadcast SSID to use on the WiFi network, priority level to be used for the offloading, credential renewal policies, and other policies.

In some embodiments, additional aspects may also be included to increase security. For example, the username/passwords provided by credential portal34may expire after a configurable time period, e.g., daily, hourly, or other time period. When the username/password combination expires on cellular mobile device4, WiFi offload manager84may send a new message with the IMSI, IMEI, and WLAN MAC to credential portal34, and credential portal34returns a new username/password. The expiration time period may be configured on credentials manager34and WiFi offload manager84, e.g., depending on service provider preferences. As another example of enhanced security features, WiFi offload manager84may require a new password to be assigned by credentials manager34before cellular mobile device4returns to alternate access network10, should cellular mobile device4return to the cellular network6in the interim. As another example, credentials portal34may transfer authentication credentials by an out-of-band transport mechanism, such as SMS, for example.

FIG. 5is a sequence diagram100illustrating example operation of network devices in accordance with the techniques of this disclosure. The example ofFIG. 5illustrates operation of User Equipment (UE) (e.g., cellular mobile device4), SGSN20, HLR24, GGSN22, a portal (e.g., credential portal34), AAA40, and WLAN access point32, in operating in accordance with one example aspect of this disclosure. Specifically,FIG. 5illustrates example operation in a WPA network. As shown inFIG. 5, the UE, SSGN, and HLR perform authentication of the UE over cellular network6. After the PDP Context activate to the GGSN, the UE can communicate with IMS core network16and PDN12(e.g., the Internet).

AAA server40checks the username and password and the WLAN MAC address received in the PEAP/TTLS message against subscriber database38. If the credentials match those stored by credential portal34in subscriber database38, AAA server40proceeds with authentication of cellular mobile device4on alternate access network10, and then cellular mobile device4can exchange data communications with PDN12via alternate access network10. In this manner, the authentication of cellular mobile device4on alternate access network10by AAA server40can proceed as usual according to 802.1x, without requiring access by AAA server40to the SIM credentials of cellular mobile device4.

In addition, during authentication with the AAA server40, WLAN access point32may report the WLAN MAC address that was given to cellular mobile device4(e.g., within an EAPoL message104). AAA server40queries subscriber database38with the username, and subscriber database38returns the stored password and WLAN MAC address associated with the username. After AAA server40checks whether the password and WLAN MAC are valid and matching, AAA server40sends a RADIUS Access Accept to WLAN access point32. Checking the WLAN MAC address can be optional, and used as an additional security check to avoid a user of cellular mobile device4sharing a received username and password from credential portal34with other cellular mobile devices that have not been authenticated through SGSN20of cellular network6, and that then try to log in on alternate access network10using the username and password but through a different WLAN MAC address.

FIG. 6is a sequence diagram110illustrating example operation of network devices in accordance with the techniques of this disclosure. The example ofFIG. 6illustrates operation of User Equipment (UE) (e.g., cellular mobile device4), SGSN20, HLR24, GGSN22, a portal (e.g., credential portal34), AAA40, WLAN access point32, and a WISPr V1.0 Gateway in operating in accordance with another example aspect of this disclosure. Specifically,FIG. 6illustrates example operation in a WISPr V1.0 network. The techniques may be similar to those described above with respect to WPA networks, with a few differences. For example, after the UE attaches to the WLAN (e.g., alternate access network10) (112) using SSID, the UE opens authentication with the WISPr Gateway using SSID via tunneled HTTPS (114). Within the tunneled HTTPS session, the UE logs in to the WISPr Gateway using the username/password credentials provided by credential portal34. The WISPr Gateway sends a PAP authentication (116) to AAA server40that includes the username/password and WLAN MAC address. AAA server40queries subscriber database38with the username, and subscriber database38returns the stored password and WLAN MAC address associated with the username. After AAA server40checks whether the password and WLAN MAC are valid and matching, AAA server40sends a RADIUS Access Accept to WISPr Gateway, and WISPr Gateway lets the WLAN MAC/IP address combination use the Internet and starts accounting (118).

The techniques described in this disclosure may also be embodied or encoded in an article of manufacture including a computer-readable medium encoded with instructions. Instructions embedded or encoded in an article of manufacture including a computer-readable medium encoded, may cause one or more programmable processors, or other processors, to implement one or more of the techniques described herein, such as when instructions included or encoded in the computer-readable medium are executed by the one or more processors. Computer readable storage media may include random access memory (RAM), read only memory (ROM), programmable read only memory (PROM), erasable programmable read only memory (EPROM), electronically erasable programmable read only memory (EEPROM), flash memory, a hard disk, a compact disc ROM (CD-ROM), a floppy disk, a cassette, magnetic media, optical media, or other computer readable media. In some examples, an article of manufacture may include one or more computer-readable storage media.

Various aspects of this disclosure have been described. These and other aspects are within the scope of the following claims.