Abstract:
A communication method, comprising constructing a Virtual Private Network (VPN) tunnel between a mobile device and an Intranet; and performing an Extensible Authentication Protocol-Subscriber Identification Module (EAP-SIM) authentication through the VPN tunnel. Access right of target service can be verified according to information in a SIM card no matter what kind of network access technology the service subscriber is using with the proposed communication method. A system utilizing the method is further provided.

Description:
BACKGROUND  
       [0001]     The invention relates in general to server access, and in particular to a system and method for wireless access to an application server.  
         [0002]     Owing to the growing popularity of Wireless Local Area Network (WLAN), merging of WLAN technology into cellular networks has become popular. Concerns remains regarding the insecure nature of data access in wireless networks such as WLAN. Typically, Extensible Authentication Protocol-Subscriber Identification Module (EAP-SIM) authentication is applied to resolve the authentication issue of network security.  
         [0003]     Conventionally, SIM-based authentication, authority and accounting (AAA) of a dual network is accomplished through an EAP-SIM, with the collaboration of cellular network operators and WLAN operators. To date there is still no viable solution for service providers, such as Voice over IP (VoIP) or Internet Online Gaming providers, to incorporate authentication of service applications into EAP-SIM based AAA method. When a dual network user roams into a WLAN or a Public WLAN (PWLAN) owned by a non-SIM card distributor, the user cannot execute the EAP-SIM based authentication procedure at the application level, despite the service provider having authentication rights for both SIM card and application access.  
         [0004]      FIG. 1  is a flowchart of a conventional EAP-SIM authentication procedure in a system incorporating peer station  90  and authenticator  91 . Authenticator  91  takes an initiative to release EAP-Request/Identity Packet  900 , peer station  90  responds with EAP-Response/Identity Packet  902 , containing typically an International Mobile Subscriber Identity (IMSI) or a temporary identity of peer station  90 . Authenticator  91  then transmits EAP-Request/SIM/Start Packet  904 , comprising a list of supported authentication versions at authenticator  91 . In response, peer station  90  replies with EAP-Request/SIM/Start Packet  906 , comprising a random number and a selected authentication version. Authenticator  91  exchanges messages with the authentication center (AuC) (not shown) of Global System for Mobile Communications (GSM) network, computing a session key, and sending EAP-Request/SIM/Challenge Packet  908 , comprising a randomized challenge and a Message Authentication Code (MAC) protecting the challenge. Upon receiving Packet  908 , peer station  90  performs GSM algorithm to verify MAC and derive the session key, returning EAP-Response/SIM/Challenge Packet  912  comprising resultant MAC for a successful authentication. Authenticator  91  in turn compares the received MAC with the transmitted MAC, and returns EAP-Success Packet  914  if the two MACs are consistent, at which time the EAP-SIM authentication is successful.  
         [0005]     Technology in the relevant field includes a billing method for network telecommunication employing SIP authentication, as disclosed in US patent US2002/0146005A1, and a authentication proxy architecture for a Web-based wireless intranet applications disclosed in U.S. Pat. No. 6,732,105B1. Nevertheless, conventional technology does not provide security mechanism during authentication, nor is it applicable for accessing every application level service in an intranet. Thus, there is neither support for application level authentication nor secure access to the application servers under dual network architecture.  
       SUMMARY  
       [0006]     A communication method between a mobile device and a Intranet is provided. The communication method comprises constructing a Virtual Private Network (VPN) tunnel between the mobile device and the Intranet, and executing an Extensible Authentication Protocol-Subscriber Identification Module (EAP-SIM) authentication therethrough.  
         [0007]     A communication system is also provided, comprising a mobile device sending a request for an application, and a Intranet receiving the request and establishing an Internet connection with the mobile device, constructing a Virtual Private Network (VPN) tunnel in the Internet connection, and executing EAP-SIM authentication therethrough. 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0008]     The invention will become more fully understood from the detailed description, given hereinbelow, and the accompanying drawings. The drawings and description are provided for purposes of illustration only and, thus, are not intended to limit the present invention.  
         [0009]      FIG. 1  is a flowchart of a conventional EAP-SIM authentication.  
         [0010]      FIG. 2  is a block diagram of an embodiment of system deployment according to the invention.  
         [0011]      FIG. 3A-3B  are detailed flowcharts of an embodiment of the invention.  
         [0012]      FIG. 4  is a block diagram of a mobile device module, according to an embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0013]     The invention provides a method and system for accessing an application server in an Intranet. In terms of providing secure network access, it utilizes Virtual Private Network (VPN) tunneling for security, through which application authentication can be conducted through it using EAP-SIM authentication.  
         [0014]      FIG. 2  is a diagram of a system for accessing application server according to an embodiment of the present invention, the system comprising a mobile device  10 , a service proxy  20 , an Authentication, Authority and Accounting (AAA) server  22 , a Home Location Register/Authentication Center (HLR/AuC) server  24 , and an application server  26 .  
         [0015]     Mobile device  10  is a service subscriber of a service application in an intranet. Service proxy  20  is a gateway server in the intranet. AAA server  22  is responsible for authentication, authority, and accounting. HLR/AuC server  24  manages user profiles and authentication information. Application server  26  provides various service applications in the intranet. The intranet may be a WLAN.  
         [0016]      FIG. 3  is a flowchart of a method for accessing application server in an embodiment of the present invention. The access flow is applicable to a system in  FIG. 2 , and is disclosed in four phases for explanation. A secure socket layer (SSL) connection is established between a mobile device and a service proxy in the first phase P 1 . A virtual private network (VPN) connection is further established in the second phase P 2 . In the third phase P 3  an application level authentication is carried out by means of EAP-SIM authentication. For successful authentication, the temporary VPN tunnel is validated, and data transmission therethrough is granted in the fourth phase P 4 .  
         [0017]     In phase P 1 , a secure socket layer (SSL) session is established between a service subscriber and a service proxy to secure subsequent data transmission, whereby security of data transaction in the second phase P 2  is ensured. The service subscriber may be a mobile device. The service proxy may be a proxy server in an intranet.  
         [0018]     In phase P 2 , a temporary VPN tunnel is initiated within the SSL session. The VPN tunnel may be realized with Layer 2 Tunneling Protocol (L2TP) and IP Security Protocol (IPSec). The L2TP secured by IPSec may operate in either main mode or aggressive mode, in which the main mode provides more data security than the aggressive mode, at the expense of slower VPN session establishment. The main mode utilizes two message transmissions comprising a protected identity and a key separately for service subscriber, whereas the aggressive mode completes the transmission of an unprotected identity and a key in one message, rendering faster IPSec security association (SA). As the aggressive mode of IPSec negotiation is deployed, the security of subscriber identity is provided via the SSL session. Implementation of the VPN tunnel is not intended here to limit the invention, as those skilled in the art may choose other VPN implementations.  
         [0019]     In the third phase P 3 , authentications for EAP-SIM and service applications are verified. Upon successful authentication of EAP-SIM and service applications, the temporary VPN tunnel is validated and application data is transmitted therethrough. For unsuccessful authentication, the temporary VPN tunnel is removed and data transmission is terminated.  
         [0020]     Instead of embedding only the service subscriber identity, or International Mobile Subscriber Identity, into EAP-response/Identity packet, information requesting the access rights to the service application in the intranet is also attached to the packet. The requested access information may be an address of the application server and a communication port for the application service. Upon completion of SIM number verification, the AAA server forwards access-request packet  130  containing the access information to the HLR/AuC server, and receives packet  131  including intranet access information of the service subscriber from the HLR/AuC server. If the subscriber has access rights to the service application, the HLR/AuC server issues access-accept in packet  131 , the AAA server delivers EAP-success packet  132  to the subscriber and redirects the access-accept packet  133  to the application server. The application server then requests user profile with packet  135  from the HLR/AuC server, accepts and sets up working environment based on the user profile packet  137 , and transfers data of the authenticated service with the subscriber. The application server may carry out further actions based on the information in the access-accept packet.  
         [0021]     In the fourth phase P 4  the service application data is transmitted between the mobile device and the application server via service proxy, where the security of the data is provided via the VPN tunnel.  
         [0022]      FIG. 4  is a block diagram of a mobile device module  10 , according to an embodiment of the invention, comprising a Virtual Private Network (VPN) tunnel module 00 establishing VPN tunnel with a Intranet, and an EAP-SIM authentication module 02 performing EAP-SIM authentication therethrough. VPN tunnel module 00 comprises an Internet security module 000 and a VPN security module 002, in which Internet security module 000 establishes security sessions with an internet encryption algorithm, and VPN security module 002 exchanges a VPN security negotiation in the security session. The internet encryption algorithm may be accomplished through Secure Socket Layer. The VPN security negotiation may be implemented with L2TP and IPSec protocol. EAP-SIM authentication module 002 delivers SIM identity and requested access information of the mobile device. The access information may be an address of the application server and a communication port for the application service.  
         [0023]     Mobile device module  10  in  FIG. 4  may be realized through software implementation, hardware implementation, or a combination thereof.  
         [0024]     While the invention has been described by way of example and in terms of preferred embodiment, it is to be understood that the invention is not limited thereto. To the contrary, it is intended to cover various modifications and similar arrangements (as would be apparent to those skilled in the art). Therefore, the scope of the appended claims should be accorded the broadest interpretation so as to encompass all such modifications and similar arrangements.