Method of and system for data access over dual data channels with dynamic sim credential

A method and apparatus provide access to communication services using dynamically assigned user credentials. The method includes establishing a communication connection with a first communication network (such as GSM, UMTS, CDMA, or LTE networks) using a real user credential (e.g., a SIM, a USIM, or an R-UIM card or certificates) in a first communication module, utilizing the first communication connection to request the dynamically assigned user credential from a remote management system, and registering a second communication module into the second communication network. The second communication connection is then tethered to allow other devices to access the Internet or other network.

FIELD OF THE INVENTION

This invention relates to communication systems and, more particularly, to wireless systems that authenticate access devices and provide network services via wireless networks.

BACKGROUND OF THE INVENTION

Mobile communication services are becoming more and more popular and, with the growth of smartphone devices and mobile Internet, the capability to access the Internet anywhere, anytime is critical for end users. This is especially true for those business travelers who require data access no matter whether they are, using their Home Public Mobile Network (HPMN) or Visited Public Mobile Networks (VPMNs).

When an end user uses the HPMN service, the HPMN provides the end user with a user credential, such as a Subscriber Identity Module (SIM) card for Global System for Mobile Communications (GSM) network. The SIM Card securely stores a secret key (Ki) identifying a mobile phone service subscriber, as well as subscription information, preferences, and other information. The SIM Card also securely stores programmable algorithms A3 and A8, which is the same logic as the A3/A8 algorithm stored in the mobile network's Home Location Register (HLR). The other most important information that the SIM Card stores is the international mobile subscriber identity (IMSI), which is used to uniquely identify the mobile phone service subscriber. The Ki is a 128-bit number paired with the IMSI when the SIM card is manufactured. It is only stored on the SIM card and at the HLR, and is never transmitted across the network on any link.

The SIM Card can be in other similar forms in different mobile networks. The equivalent component in Universal Mobile Telecommunications System (UMTS) networks is a Universal SIM (USIM) card, and in Code Division Multiple Access (CDMA) networks, the equivalent component is a Removable User Identity Module (R-UIM) card.

When a user travels abroad or enters into areas where the HPMN has no direct service coverage, the user can continue to access the service through the HPMN's roaming partners, the VPMNs, via roaming agreements with the HPMN, allowing the HPMN subscribers to use the VPMN's network service for the voice, SMS, and data using the same SIM card. However, the end user needs to pay roaming service fees to the HPMN when the end user uses the service via the VPMN, and the roaming charges are normally much higher, making the final cost of using the VPMN network comparatively expensive. Thus, usually the roaming subscriber of the HPMN will buy a new SIM card for a visited country/region he/she frequently visits and manually insert the new card when s/he enters the country or region. This is inconvenient and expensive.

U.S. Pat. No. 6,466,804 to Pecen, et al. titled “Method and Apparatus for Remote Multiple Access to Subscriber Identity Module” discloses providing multiple client devices in a GSM system remote multiple access to services of a server device. The server device has a single SIM card. Using Pecen's system, information from the server SIM card can be remotely accessed from the client devices over a network connection. But because the server SlM card is local to only a single area, the server provides cheaper local roaming costs in only that area. Furthermore, Pecen's system cannot tailor the roaming based on other service requirements.

There exist demands for alternative solutions that allow a user to efficiently continue to use a mobile service but with competitive low prices and guaranteed quality of service (QoS).

SUMMARY OF THE INVENTION

The present invention relates to enabling access to communication services using dynamically assigned user credentials, including multiple communication modules. In one embodiment, a first communication module establishes a communication connection with a first communication network (such as GSM, UMTS, CDMA, and LTE networks) using a real user credential (for example, SIM, USIM, or R-UIM cards or certificates). The first communication connection is used to request the dynamically assigned user credential from a remote management system and to register a second communication module into a second communication network. The second communication connection is then further tethered to allow other devices to access the Internet or other network connection.

Tethering is a feature provided by modern smartphone and tablet designs, with the aim of allowing the sharing of Internet connections with other devices such as laptops. Connection of the phone or tablet with other devices can be done over wireless LAN (Wi-Fi), over Bluetooth or by physical connections using cables such as Universal Serial Bus (USB) connectors. By introducing the tethering function into apparatus as one embodiment of the present invention, these embodiments remove the necessary changes to the user's existing devices, thus providing a broader and easy-to-use solution for the consumer market.

One embodiment of the invention includes a Portable Access Device with dual communication modules, in the foim of a General Packet Radio Service (GPRS) modem that supports GPRS networks, and other types of modems, such as UMTS modems for UMTS networks, CDMA1X/EV-DO modems for CDMA1X/EV-DO networks, LTE modems for LTE networks, and functionally equivalent modems for use in other types of networks. Those skilled in the art will appreciate that the communication modules inside the Portable Access Device are not necessarily the same model supporting the same network, The Portable Access Device also includes one valid SIM card provided by the end user's HPMN operator that is inserted into the first communication module, one Virtual SIM Card that is inserted into the second communication module and can be assigned dynamically with new SIM cards stored in the remote management system, one SIM Adapter to communicate with the remote management server, and a Wi-Fi/Bluetooth/USB chipset that serves as a means for tethering Internet connections for other user devices. The device also includes other components, such as a CPU, memory, a hard disk, a motherboard, a battery, a display, an input interface, a USB interface, and other components to form a portable and usable electronic apparatus.

Embodiments of the invention also include a Management Server that hosts multiple SIM Card boards. Each SIM card board has multiple SIM card slots, and each SIM card slot is inserted with an actual and valid SIM card each from a different mobile network operator. Altogether these SIM cards form a SIM card pool from which SIM Cards can be dynamically selected and assigned to the Portable Access Device according to the actual location and visited network information of the Portable Access Device.

One embodiment of the invention also includes client software (the “Connector”) running on the Portable Access Device, The Connector manages the different data connections, including the first data connection via the first communication module, and the second data connection on a second communication module, as well as other tethering methods in the form of Wi-Fi, Bluetooth, a USB cable, and other components to share the first or second data communication connection. Embodiments of the invention also include Connector programming logic as a computer program running on the Portable Access Device to perform the following steps:1. Registering into the first communication network with the first user credential via the first communication module;2. Establishing the first communication connection with the first communication network using the first user credential;3. Requesting a new user credential as a second user credential via the first communication connection from the remote management server;4. Registering into the second communication network with the second user credential via the second communication module;5. Establishing a second communication connection via the second communication connection with the second user credential; and6. Tethering the second communication connection to share the second communication connection with other devices.

Another embodiment of the invention also includes software (the “User Manager”) running on the server. The User Manager communicates with the Connector on the Portable Access Device to decide whether or not to allocate an actual SIM card in the pool to the virtual SIM card based on the device's current location information. The User Manager also drives the SIM Board and SIM Adapter inside the Management Server to facilitate the SIM card authentication and ciphering procedure, which is converted between the physical electrical data with the actual SIM card and a TCP/IP based protocol with the remote SIM Adapter inside the Portable Access Device, and subsequently successfully registers the Portable Access Device with the remote SIM card into the corresponding wireless network.

DETAILED DESCRIPTION OF THE DRAWINGS

The principles of the invention will be described with particular reference to numerous exemplary embodiments. However, it should be understood that these embodiments show only a few examples of the advantageous uses realized using the principles of the invention. In general, statements made in this application do not necessarily limit any of the various claimed aspects of the present invention. Moreover, some statements may apply to some inventive features but not to others. In the drawings, like or similar elements are designated with identical reference numerals throughout the several views.

FIG. 1is a block diagram of a Portable Access Device100and a Management Server130, in accordance with one embodiment of the invention, communicating with wireless networks120and121and providing services for Wi-Fi devices122. The Portable Access Device100is a small electronic apparatus that is easy to carry and use. The Portable Access Device100includes two multiple data communication modems, a GPRS Modem101and a WCDMA Modem102, used to communicate with various wireless networks, such as the networks120and121. The modems101and102are exemplary modems equipped in the Portable Access Device100. Those skilled in the art will appreciate that other types of modems, such as CDMA1X/EV-DO modems for communication with CDMA1X/EV-DO networks, LTE modems for communication with LTE networks, and functionally equivalent modems for use in other types of networks, can also be used in accordance with the principles of the invention.

Generally, a SIM Slot is associated with each corresponding modem101and102for the modern to be registered into the corresponding wireless network. For example, the Portable Access Device100also includes SIM Slots104and106. The SIM Slot104is associated with the GPRS Modem101, and the SIM Card105is inserted into the SIM Slot104. Once the GPRS Modem101is triggered by the system, for example, by the Connector118, the GPRS Modem101can use the SIM Card105to register into the first Wireless Network120and get corresponding data connection service.

The SIM Card105“registers into” the wireless network120by, for example, transmitting information that identifies the SIM Card105to the wireless network120, so that the wireless network120can authenticate the SIM Card105and complete the registration process. The Portable Access Device100is now able to access the wireless network120and function as an access point for other devices accessing the wireless network120. Those skilled in the art will recognize that the actual registration process depends on the type of network120.

The SIM Slot106is associated with the WCDMA Modem102, but instead of having a valid SIM card inserted into the SIM slot106, a Virtual SIM Card107is inserted into it. The Virtual SIM Card107is connected with a SIM Adapter108. Unlike a regular SIM card that can directly interface with a modem using electrical signaling for the authentication procedure, the SIM Adapter108together with Virtual SIM Card107converts the electrical signaling into a TCP/IP based protocol and communicate with a remote SIM Adapter134on a Management Server130(discussed below), thus appearing to the WCDMA Modem102as a local SIM card. In fact, the actual SIM card is on the remote Management Server130and can be assigned from a pool of SIM cards dynamically according to specific service requirements.

The Portable Access Device100also comprises a Wi-Fi Transceiver103for tethering the data connection over Wi-Fi to share the Internet connections with other user devices such as laptops, personal digital assistants (PDAs), and other electronic devices, thereby turning the Portable Access Device100into a portable wireless access point and router for devices connected to it. Though the Portable Access Device100includes a Wi-Fi Transceiver103, those skilled in the art will recognize that other communication modules can be used instead of or in combination with the Wi-Fi Transceiver103. For example, the Wi-Fi Transceiver103can be replaced or combined with add-on modules such as a Bluetooth module, a USB cable, or similar modules. In this way, the Portable Access Device100can tether the Internet connections over multiple channels such as Wi-Fi, Bluetooth, USB cables, or any other wireless or wired connections. Like regular electronic apparatus, the Portable Access Device100also comprises a Universal Serial Bus (USB) interface109for tethering the Internet connection and also for management from a laptop or other electronic device, a Display Screen110to display the working status of the Device100, an Input Interface112to receive user commands, a hard disk113to store operation system files, drivers and associated configuration, settings and so on, a Battery114to provide the electronic power for the Device100, a CPU115for executing or running the system, a Memory116for use by the executing programs, and a Main Board117(e.g., a printed circuit board or PCB) to hold the above mentioned components. These components are listed merely for illustration of one embodiment. Those skilled in the art will recognize that the Portable Access Device100can include a subset of the components described, additional components, or any combination thereof.

Still referring toFIG. 1, the Management Server130manages the SIM cards that it hosts. The Management Server130communicates with the Portable Access Device100and any similarly configured portable access devices for user management and SIM card assignment. The Management Server130includes a User Manager131, which in one embodiment is a software-based component that communicates with the Connector118inside the Portable Access Device100, and manages the SIM cards to allocate the suitable SIM card to each Portable Access Device100. The Management Server130also includes one or more SIM Boards such as a SIM Board132. The SIM Board132is a SIM card container that can hold multiple actual SIM Cards133. The number of actual SIM Cards that the SIM Board132can contain varies and is determined by the model of the SIM boards. SIM Boards used in accordance with embodiments of the invention can contain any number of SIM Cards, such as 1, 16, 32, more, preferably from different mobile operators.

The SIM Board132also includes a SIM Adapter134, which is the counterpart of the SIM Adapter108inside the Portable Access Device100. The SIM Adapter134can convert the TCP/IP based communication protocol into electrical signaling to interface with an Actual SIM card for the authentication procedure, and convert the electrical based response back into a TCP/IP based response to the Portable Access Device100.

FIG. 2is a high-level flow chart showing the steps of a process200for a portable access device providing services to one or more mobile devices in accordance with one embodiment of the invention. The portable access device functions as a wireless access point, providing client devices access to a network, such as the wireless network121. The portable access device contains an on-board SIM card. Referring toFIG. 2, in the step201, the portable access device registers into a first network to get location information about the portable device. Next, in the step203, based on the location information, the process compares service metrics for accessing a second network using the on-board SIM card versus using other SIM cards from a pool of SIM Cards available to the portable access device. Service metrics include, for example, cost, data speed, or some other metric. The service metric can be any metric tailored to suit the application at hand. The SIM card with the best service metric, represented by the largest value, (e.g., lowest cost for accessing the second wireless network, supports faster data speeds on the second wireless network, etc.) is dynamically selected. In some situations, the on-board SIM card has an associated service metric that is better than the service metrics of all the SIM cards from the pool of SIM cards. In that case, the process proceeds to the step205, where the on-board SIM card is the “selected” SIM card. From the step205, the process continues to the step209.

If in the step203it is determined that the on-board SIM card does not have the best service metric from among the SIM cards in the pool of SIM cards, the process proceeds to the step207. In the step207, the process selects the SIM card from the pool of SIM cards with the best service metric. From the step207, the process proceeds to the step209, where the portable access device registers into the second wireless network using the selected SIM card for authentication and registration purposes. From the step209, the process proceeds to the step211, where the portable access device provides other devices (wireless, wired, or both) access to the second wireless network. Because the service is associated with a SIM card having a superior metric, the client devices get superior performance, such as by reduced charges, faster speeds, etc.

In one embodiment, the Portable Access Device100stores a table containing different service metrics for the SIM card105and for each of the SIM cards from the pool of SIM Cards contained in the Management Server130. In another embodiment, this table is stored on the Management Server130. This table is used to determine a “selected” SIM card based on comparative service metrics, such as described above. Those skilled in the art will recognize other locations for storing a table mapping SIM Cards to service metrics.

In one embodiment, in the step209, the portable access device is registered into the network using both the on-board SIM card and the SIM card selected from the pool of SIM cards. In this way, the portable access device sets up the communication paths to the second wireless network.

In one embodiment, the first wireless network is a totally different network from the second wireless network with regard to the network operators, technologies, frequencies, etc. In another embodiment, the first wireless network is the same network as the second wireless network, a scenario that most likely occurs when it is a VPMN network for the first SIM Card105, and a HPMN network for the second SIM Card133that is dynamically allocated from remote SIM Card pool in the Management Server130.

FIG. 3is a high-level diagram showing the steps of a process300for assigning a SIM Card from the pool of SIM Cards based on service metrics in accordance with one embodiment of the invention. Referring toFIGS. 1 and 3, the Portable Access Device100has already selected a specific SIM card from the pool of SIM cards on the Management Server130based on a superior service metric, such as discussed above. In the step301, the Management Server130receives an authentication command. In the step302, the Management Server130transmits an authentication response. The authentication procedure follows the European Telecommunications Standards Institute (ETSI) specifications GSM 11.11 for the interface with the SIM cards. In one embodiment with SIM Card as the example, the Management Server130passes the authentication parameters to the SIM card, including the RAND value as the key challenge parameter provided by the wireless network121. The SIM card then calculates a 32-bitSigned Response (SRES) value based on the stored Ki, A3 encryption algorithm, as well as the RAND value, and then sends the SRES value back to the Management Server130, which then further passes the SRES value to the Portable Access Device100over the wireless data connection.

FIG. 4shows more detailed steps of a process for accessing a network using a dynamically assigned SIM credential according to a preferred embodiment of the present invention. Referring toFIGS. 1 and 4, the Connector118running on the Portable Access Device100triggers the step401once the Connector118receives a command triggered by the user. In the step401, the Connector118registers into the wireless network120by driving the GPRS Modem101and using the actual SIM card105to pass the authentication procedure. The actual SIM card105is provided by the user's HPMN, which has a service relationship with the wireless network120. Upon successfully registering into the network120, in the step403the Connector118establishes data communication with the wireless network120. The data connection is over the GPRS connection created by the GPRS modem101, and provides the Internet connection to the Management Server130. Once the Connector118connects with the Management Server130over the data connection to the wireless network120, in the step405the Connector118requests the User Manager131to assign a SIM card to the Portable Access Device100using information similar to that in the first SIM card, information such as IMSI, MSISDN, or functionally similar information. The User Manager131assigns the corresponding SIM card (e.g., SIM Card133), and returns the response to the Connector118via the first data communication.

Upon a successful response message, in the step407the Connector118drives the second data communication module (e.g., the WCDMA Modem102) to register into the second wireless network121using the dynamically assigned SIM Card information. The WCDMA Modem102then starts the authentication procedure with the wireless network121, and, in the step409, the standard SIM card authentication and ciphering procedure is performed. However, because the Virtual SIM Card107is inserted into the SIM Slot104, the regular physical data exchange of authentication and ciphering between the modem102and the SIM Card107using the GSM 11.11 protocol is converted into a TCP/IP based protocol by the SIM Adapter108and transmitted to the remote SIM Adapter134over the first data communication connection, which is then in turn transmitted to the SIM card (e.g., SIM Card133) insider the SIM Board132.

In one embodiment, the SIM Card107is “virtual” in that, though it is not physically located in the SIM Slot106, it is made to appear to be physically located in the SIM Slot106. The SIM Card107is an empty card without any network or subscriber identity data stored inside, including the integrated circuit card identifier (ICCID), IMSI, Authentication Key (Ki), Local Area Identity (LAI) and other Operator-Specific numbers, such as Emergency Number, SMSC Addresses, etc. In one embodiment, the data and the authentication procedure are achieved by using a physical board that passes authentication requests and responses between the SIM cards on the SIM Board132and the modem102, as described above. In this way, the second wireless network121considers that the authentication requests are routed to and received from a SIM board in the SIM Slot106. After reading this disclosure, those skilled in the art will recognize other ways of providing a virtual SIM card or other credential.

After the successful authentication of the dynamically assigned SIM Card on the remote Management Server130, in the step411the WCDMA Modem102is granted access rights to the wireless network121. Thus the Connector118continues to establish second data communication to the wireless network121. Once the data connection is set up, the Portable Access Device100has 2 data connections to the wireless network121that can be connected with the Internet or other networks. The system can select between the two connections based on considerations such as cost, as the first connection is more likely to be a roaming connection with a more expensive charging rate, while the second connection is a local connection with a lower rate.

The Connector118maintains the 2 connections, and in the step413it tethers the selected connection over Wi-Fi, Bluetooth, a USB Cable, or any other type of connection, to share the Internet connection with other user devices, such as laptops, smartphones, PDAs, cameras, or functionally similar devices. The laptops, smartphones, PDAs, cameras or other functionally similar devices can now access the wireless network121over the Portable Access Device100.

In another embodiment, the system maintains only one connection to the network121, such as the cheapest connection using a SIM Card that is local to the mobile operator servicing the network121.

Preferably, the Connector118is programmed with intelligence to determine the different usage rates of the 2 SIM Cards (the actual SIM Card105inside the Portable Access Device100and the Virtual SIM Card107dynamically assigned by the remote Management Sever130) with the available network operators, and selects the most cost-effective way for the setup of network connections. For example, in one embodiment in which only one connection is maintained, if the rate of a connection using the actual SIM Card105is cheaper, which is typical for domestic/local use, the Connector118does not need to request the remote Server130to assign a new SIM card from the pool. The Connector118can tether to share the first data connection directly.

In one embodiment, the Management Server130determines whether to assign a Virtual SIM Card to the Portable Access Device100and selects an Actual SIM Card from the pool of SIM Cards on the SIM Card Board132for this purpose. In another embodiment, the Portable Access Device100performs these steps. Those skilled in the art will recognize that these steps can be performed by different components and divided among different components.

In one embodiment, the steps of the processes shown inFIGS. 2-4are stored as instructions on one or more computer-readable media for execution by one or more processors. In one embodiment, the computer-readable medium and corresponding processor for executing the processes shown inFIGS. 2 and 4are stored on the Portable Access Device100, and the computer-readable medium and corresponding processor for executing the process shown inFIG. 3are stored on the Management Server130.

FIG. 5is a high-level block diagram of the components of a system for the remote authentication procedure with the dynamically assigned user credential in accordance with one embodiment of the invention. The system includes the Management Server130coupled to the Portable Access Device100, which in turn is coupled to a mobile network170. The mobile network170includes a Base Station Subsystem/Serving GPRS Support Node (BSS/SGSN)171coupled to an Authentication Center (AuC)175. During the authentication procedure, the BSS/SGSN171gets multiple sets of random RAND values and corresponding SRES values from the AuC175, and then challenge the GPRS Data Modem101with the RAND value. The RAND value is then transferred through the Virtual SIM Card107and SIM Adapter108. The RAND value is further transmitted to the Management Server130. The Management Server130follows the European Telecommunications Standards Institute (ETSI) specifications GSM 11.11 for the interface with the SIM cards. In one embodiment with SIM Card as the example, the Management Server130passes the authentication parameters to the SIM card, including the RAND value as the key challenge parameter provided by the wireless network121. The actual SIM card then calculates a 32-bit Signed Response (SRES) value based on the stored Ki, A3 encryption algorithm, as well as the RAND value, and then sends responses back to the Management Server130. The responses are then further passed to the Portable Access Device100over the wireless data connection. The SRES value is further transmitted to the BSS/SGSN171, where it is compared with the SRES value returned by the AuC175. If the 2 SRES values match, then the BSS/SGSN171finishes the authentication procedure, and allows the Portable Access Device100to access its network services; otherwise, the access would be denied directly.

Those skilled in the art will appreciate that the concepts described herein with reference to SIMs, may also be applied to other forms of valid and commonly used user credentials, such as USIM cards and R-UIM cards, to name only two such credentials. Furthermore, the invention is not limited to tethering and sharing network connections with other user devices. Various modifications can be made to the embodiments of the invention to expand its practical uses. As one example, besides tethering the network connection, the Portable Access Device100can also offer Voice, Short Message Services, Multimedia Message Services, or other service capabilities over the dynamically assigned SIM cards, which are charged lower service charges, thereby reducing costs for the device owner. As another example, whileFIG. 1shows tethering two wireless networks, the principles of the invention can be applied to tether to any number of networks.

The present invention has been described above with reference to exemplary embodiments. It will be apparent to those skilled in the art that various modifications may be made to the embodiments without departing from the spirit and scope of the invention as defined by the appended claims.