Abstract:
A system and method for the implementation of a proxy smart card application in a mobile telephone. The mobile telephone receives a smart card related message from a remote terminal. If the smart card related message is related to a function implemented by electronic device software within the mobile telephone, the electronic device software processes the message. If the smart card related message is not related to a function implemented by the electronic device software, the message is transmitted to the smart card.

Description:
FIELD OF THE INVENTION  
       [0001]     The present invention relates generally to networking systems. More particularly, the invention is related to 3GPP-Wireless LAN interworking, EAP SIM and EAP AKA authentication and split user equipment usage scenarios.  
       BACKGROUND OF THE INVENTION  
       [0002]     New wireless LAN standards IEEE 802.11i and Wi-Fi Protected Access (WPA) use Extensible Authentication Protocol (EAP) for network access authentication and key agreement. In this situation, the wireless LAN station implements an EAP peer, which communicates with an EAP server implementation on the network side. During the EAP authentication exchange, the EAP peer and the EAP server exchange EAP packets. The EAP authentication server is usually a backend element which is separate from the wireless LAN access point. EAP has been designed to easily support several different authentication algorithms so that a separate EAP method implementation can be used for each authentication algorithm.  
         [0003]     A new 3GPP Wireless LAN interworking standard enables a wireless LAN terminal to use the 3GPP smart card based authentication mechanisms for wireless LAN network access authentication. In the basic case, a single piece of user equipment is equipped with both the smart card and the wireless LAN interface. The wireless LAN terminal uses the Extensible Authentication Protocol method for GSM Subscriber Identity Modules (EAP-SIM) or the Extensible Authentication Protocol for 3G Authentication and Key Agreement (EAP-AKA) protocols to perform network access authentication. These protocols require access to the smart card of the device. Smart cards are widely used in portable electronics devices and are discussed in detail in UK Patent No. 2,370,659, assigned to Nokia Corporation and incorporated herein by reference.  
         [0004]     In split user equipment (UE) situations, the wireless LAN network interface and the smart card reside in separate pieces of equipment. Typically in this case, a laptop equipped with a wireless LAN interface uses a mobile telephone, equipped with a smart card, for EAP-SIM and EAP-AKA authentication. As discussed above, these protocols require access to a smart card located on the mobile telephone. The laptop uses a Bluetooth connection to the mobile telephone in order to access the smart card for the wireless LAN authentication. Other possible communication connections could also be used to connect the laptop to the mobile telephone, such as RFID, WLAN (802.11x), infrared, UWB, or even a cabled connection such as a serial, parallel, or USB cable.  
         [0005]     In the split UE case, there are three different ways to implement the EAP peer for EAP-SIM and EAP-AKA protocols. In the first implementation, the laptop implements the EAP peer and only uses the mobile phone for the smart card operations. In this scenario, EAP packets received from the wireless LAN network are processed by the laptop, and the laptop also generates all EAP packets that need to be transmitted to the network.  
         [0006]     In the second implementation, the EAP-SIM and EAP-AKA peers are implemented by the mobile phone. The laptop passes through EAP packets from its wireless LAN interface to the mobile phone, and the mobile phone processes the EAP packets. The mobile phone uses the smart card for 3GPP authentication primitives only. The mobile phone generates the EAP packets that are to be transmitted to the wireless LAN network and sends them to the laptop. The laptop then forwards the outgoing EAP packets to the network.  
         [0007]     In the third implementation, the smart card implements the EAP-SIM and EAP-AKA peers. In this case, special EAP capable smart cards are used. The laptop passes through EAP packets from its wireless LAN interface to the mobile phone, which again passes the EAP packet to the special smart card for processing. The smart card processes incoming EAP packets and generates outgoing EAP packets. The smart card passes its outgoing EAP packets to the mobile phone which further passes them to the laptop. The laptop then transmits the EAP packets to the wireless LAN network.  
         [0008]     In 3GPP standardization, it is desired that the Bluetooth SIM Access Profile (SAP) be used in the split user equipment scenario. However, SAP is a low-level interface for accessing the smart card over a Bluetooth connection. SAP contains operations for exchanging application protocol data units (APDU), so it assumes that the smart card, rather than the mobile telephone, performs all the processing. This implies that if APDUs were used to send EAP packets to the mobile telephone, the EAP SIM and EAP AKA protocols would have to be implemented by the smart card.  
         [0009]     It is currently desirable to implement EAP methods on the smart card, and they have product plans for special EAP smart cards. However, it may also be desirable for EAP methods to be implemented by the mobile telephone.  
       SUMMARY OF THE INVENTION  
       [0010]     The present invention resolves the above issues by having the EAP SIM and EAP AKA protocols implemented by the mobile telephone, even when a low-level interface such as Bluetooth SAP is being used. The laptop computer sends EAP requests to the mobile telephone over a Bluetooth connection, and the mobile telephone sends the EAP responses back to the laptop. After successful authentication, the mobile telephone sends session keys to the laptop. The mobile telephone uses a standard SIM card or a universal integrated circuit card (UICC) to perform the computations required for EAP SIM or EAP AKA authentication. The protocols are implemented by software that is running in the mobile telephone. While Bluetooth is mentioned herein as an example connection between the laptop and mobile telephone, it should be understood that other connections types may be used such as RFID, WLAN, infrared, UWB or even cabled connections such as serial, parallel, or USB cables.  
         [0011]     The present invention results in a number of advantages over conventional systems. Under the present invention, the Bluetooth SIM access profile can be used, and any smart card applications can be implemented by computer software. Additionally, operations do not have to deploy special smart cards with EAP support.  
         [0012]     These and other objects, advantages and features of the invention, together with the organization and manner of operation thereof, will become apparent from the following detailed description when taken in conjunction with the accompanying drawings, wherein like elements have like numerals throughout the several drawings described below. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0013]      FIG. 1  is an overview diagram of a system according to an embodiment of the present invention;  
         [0014]      FIG. 2  is a perspective view of a mobile telephone that can be used in the implementation of the present invention;  
         [0015]      FIG. 3  is a schematic representation of the telephone circuitry of the mobile telephone of  FIG. 2 ;  
         [0016]      FIG. 4  is a schematic representation of the circuitry of the smart card represented in  FIG. 3 ;  
         [0017]      FIG. 5  is a schematic diagram of the memory structure held by the smart card of  FIG. 3 ;  
         [0018]      FIG. 6  shows a laptop computer with an infrared port exchanging information with the mobile telephone of  FIG. 2 ;  
         [0019]      FIG. 7  is a flow chart showing the steps involved in the implementation of the present invention; and  
         [0020]      FIG. 8  is a schematic representation of a network system including a mobile phone with a smart card according the to the principles of the present invention. 
     
    
     DETAILED DESCRIPTION OF THE INVENTION  
       [0021]     The present invention involves the implementation of a proxy smart card application in the mobile telephone.  FIG. 1  shows a system  10  in which the present invention can be utilized, comprising multiple communication devices that can communicate through a network. The system  10  may comprise any combination of wired or wireless networks including, but not limited to, a mobile telephone network, a wireless Local Area Network (LAN), a Bluetooth personal area network, an Ethernet LAN, a token ring LAN, a wide area network, the Internet, etc. The system  10  may include both wired and wireless communication devices.  
         [0022]     For exemplification, the system  10  shown in  FIG. 1  includes a mobile telephone network  11  and the Internet  28 . Connectivity to the Internet  28  may include, but is not limited to, long range wireless connections, short range wireless connections, and various wired connections including, but not limited to, telephone lines, cable lines, power lines, and the like.  
         [0023]     The exemplary communication devices of system  10  may include, but are not limited to, a mobile telephone  12 , a combination PDA and mobile telephone  14 , a PDA  16 , an integrated messaging device (IMD)  18 , a desktop computer  20 , and a notebook computer  22 . The communication devices may be stationary or mobile as when carried by an individual who is moving. The communication devices may also be located in a mode of transportation including, but not limited to, an automobile, a truck, a taxi, a bus, a boat, an airplane, a bicycle, a motorcycle, etc. Some or all of the communication devices may send and receive calls and messages and communicate with service providers through a wireless connection  25  to a base station  24 . The base station  24  may be connected to a network server  26  that allows communication between the mobile telephone network  11  and the Internet  28 . The system  10  may include additional communication devices and communication devices of different types.  
         [0024]     The communication devices may communicate using various transmission technologies including, but not limited to, Code Division Multiple Access (CDMA), Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Transmission Control Protocol/Internet Protocol (TCP/IP), Short Messaging Service (SMS), Multimedia Messaging Service (MMS), e-mail, Instant Messaging Service (IMS), Bluetooth, IEEE 802.11, etc. A communication device may communicate using various media including, but not limited to, radio, infrared, laser, cable connection, and the like.  
         [0025]      FIGS. 2 and 3  show one representative mobile telephone  12  according to one embodiment of the invention. It should be understood, however, that the present invention is not intended to be limited to one particular type of mobile telephone  12  or other electronic device. The mobile telephone  12  of  FIGS. 2 and 3  includes a housing  30 , a display  32  in the form of a liquid crystal display, a keypad  34 , a microphone  36 , an ear-piece  38 , a battery  40 , an infrared port  42 , an antenna  44 , a smart card  46  in the form of a UICC according to one embodiment of the invention, a card reader  48 , radio interface circuitry  52 , codeccircuitry  54 , a controller  56  and a memory  58 . Individual circuits and elements are all of a type well known in the art, for example in the Nokia range of mobile telephones.  
         [0026]     As shown in  FIG. 4 , the smart card  46  includes a plastic card body  60  and a module  62  which comprises an integrated circuit  64  and contacts  66 . As represented in  FIG. 5 , the integrated circuit  64  comprises input/output circuits  68 , a processor  70  and non-volatile memory  72 .  
         [0027]     Referring to  FIG. 6 , the mobile telephone  12  may exchange information with an external device such as a laptop computer  22  having a laptop infrared port  74  through an infrared link  76 .  FIG. 8  is a representation of the larger system, showing the communication stream among the mobile telephone  12  with smart card  46 , the laptop computer  22 , a wireless LAN access point  23 , and the network authentication (EAP) server  26 . In this situation, the smart card  46  can be a standard GSM SIM or 3G UICC smart card. In this situation, the laptop computer  22  passes through EAP packets between the mobile telephone  12  and the wireless LAN access point  23 . The mobile telephone  22  intercepts APDUs that relate to EAP implementation. The mobile telephone  22  includes EAP-SIM and EAP-AKA peer implementations and use a standard GSMor UICC for peer implementation.  
         [0028]      FIG. 7  shows the steps involved in the implementation of the present invention. The process begins at step  100  with the mobile telephone  12  receiving a message related to the smart card  46  over a Bluetooth connection. At step  110 , the mobile telephone  12  determines whether the message (such as a command APDU) is related to a function that is implemented by computer software as a proxy smart card application. If the message is not related to a proxy smart card application software, represented at  80  in  FIG. 2 , then at step  120  the mobile telephone  12  transmits the message to the smart card  46  for processing. However, if the message is related to a function that is implemented by the smart card application software  80 , then at step  130  the mobile telephone  12  does not send anything to the smart card  46 . Instead, the message is processed by the smart card application software  80 . The mobile telephone software also generates any required response messages at step  140 . Although the mobile telephone  12  does not send the message to the smart card  46  for processing, the mobile telephone  12  may use the services of the smart card  46  while processing the message.  
         [0029]     From the viewpoint of the laptop computer  22 , it does not make any difference whether a function is implemented by an actual smart card  46  or by the smart card application software  80 .  
         [0030]     In the split user equipment scenario, the mobile telephone  12  processes all EAP SIM and EAP AKA related messages (APDUs) by software, but the mobile telephone  12  may forward other messages, such as generic SIM access messages, to the smart card  46 . While processing the EAP SIM and EAP-AKA-related messages, the mobile telephone  12  uses the standard authentication primitives of the smart card  46 .  
         [0031]     While several embodiments have been shown and described herein, it should be understood that changes and modifications can be made to the invention without departing from the invention in its broader aspects. For example, but without limitation, the present invention can be used in conjunction with a variety of electronic devices. In addition, while exemplary embodiments disclose using a Bluetooth connection, other connection types may be used such as RFID, WLAN, infrared, UWB, serial cable connections, parallel cable connections, or USB cable connections to name a few. Various features of the invention are defined in the following Claims: