Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W8/00—Network data management
  • H04W8/18—Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
  • H04W8/20—Transfer of user or subscriber data
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/40—Security arrangements using identity modules
  • H04W12/43—Security arrangements using identity modules using shared identity modules, e.g. SIM sharing
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W8/00—Network data management
  • H04W8/02—Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
  • H04W8/08—Mobility data transfer
  • H04W8/10—Mobility data transfer between location register and external networks

Definitions

• the present invention generally relates to the interoperability between services offered via a user equipment communications network, for example a mobile radio network for mobile user terminals, and the functionalities of the network. access to a wireless local area network from a peripheral device connected to a user equipment. More particularly, the invention relates to reuse of identity data stored in a SIM card-like identity module of user equipment by a peripheral device, as recommended in the Technical Report 3GPP TR 33.817 V6 .0.0, "Feasibility Study on (U) SIM Reuse Security by Peripheral Devices on Local Interfaces", March 2004.
• the aim of the invention is to provide a method that automatically and selectively allows a peripheral device to reuse identity data in an identity module of a user equipment, with a high level of security, so that the peripheral device can require the establishment of a call as if the user equipment had itself required the call.
• the reuse of the identity data by the peripheral device is performed without any user intervention and under the supervision of the operator of the network. communications to which the identity module is attached.
• a method for reusing identity data of an identity module in a user equipment by a peripheral device is characterized in that it comprises the following steps: prior storage of peripheral device identifiers in the identity module, transmission of the identifier of the peripheral device to the identity module during a communication establishment and authentication between the identity module and the peripheral device, comparing the identifier transmitted from the peripheral device to the identifiers previously stored in the identity module, and - transmitting the identity data by the identity module to the peripheral device when the transmitted identifier is recognized as one of the identifiers previously stored.
• respective sets of identity identifiers of the identity module of the identity module are previously stored in association respectively with the identifiers of the peripheral devices in the identity module.
• the method of reutilizing the identity data then comprises the following steps: after comparing peripheral device identifiers, transmitting a request including predetermined identity data identifiers from the peripheral device to the an identity module following a response of the identity module signaling that the transmitted identifier of the peripheral device belongs to the list, comparison of the identity data identifiers predetermined in the request to the identity data identifiers previously stored in the an identity module, and when all the predetermined identity data identifiers are recognized as identity data identifiers previously stored, transmission of the identity data designated by the recognized transmitted data identifiers among the data identifiers of identity associated with the device identifier, from the identity module to the peripheral device.
• FIG. 1 is a block diagram of a telecommunications system for carrying out the method of reusing identity data according to the invention
• FIG. 2 shows an algorithm of main steps of the method of reuse of identity data.
• the entities are mainly a UE user equipment equipped with an identity module MI, one or more peripheral devices DP1 to DPJ, and a PF identifier management platform dedicated in particular to a reuse service of identity data.
• the user equipment UE is a mobile radiocommunication terminal in which a removable user's smart card has been inserted attached to a digital radiocommunication network.
• RR whose operator supplied the card as a removable identity module MI.
• the smart card is a Subscriber Identity Module (SIM) card when the RR network is a second generation network of GSM or GSM / GPRS type, or a Universal Integred Circuit Card (UICC) when the RR network is of the third generation.
• SIM Subscriber Identity Module
• UICC Universal Integred Circuit Card
• the cellular radiocommunication network RR is schematically represented in the context of a GSM network by principal means to which the UE user equipment is temporarily attached, such as a BTS base station, a BSC base station controller, an MSC mobile service switch associated with a VLR visitor location recorder, and a location recorder nominal HLR.
• the base station is a node (NodeB)
• the base station controller is a RNC (Radio Network Controller) network controller.
• RNC Radio Network Controller
• the network RI temporarily serves the user equipment UE when it is for example abroad and is connected in known manner to the home radio network RR.
• Each peripheral device DPj is a device designated by the user of the identity module MI which can be connected to the equipment UE through a link LI, simultaneously or not to a communication radio between the EU equipment and the RR radio network.
• Each peripheral device DPj may for example be a laptop, a personal digital assistant PDA, another mobile terminal for wireless LAN WLAN (WireLess Area Network), or a mobile terminal type GSM or UMTS.
• the type of the communication link LI between the user equipment UE and the peripheral device DPj depends on the interfaces available in the equipment UE and the device DPj.
• the link LI is a Bluetooth link or according to the 802.11b standard, or an infrared link or any other wireless link, or else is wired of the USB bus type (Universal Serial Bus).
• the UE user equipment comprises not only a radio interface with the cellular network RR, but also a proximity link interface with at least one peripheral device DPj.
• the proximity link interface allows the UE user equipment to simultaneously communicate with a plurality of peripheral devices.
• the PF management platform and user equipment UE exchange requests and responses in the form of Short Message Service Center (CM) short messages through a short message center CM.
• CM Short Message Service Center
• the latter is connected directly or indirectly to the mobile service switch MSC in the home network RR and serves the platform PF through a high-speed telecommunications network RT such as the Internet.
• the PF management platform is also connected to the home location register HLR directly or indirectly via the internet or a signaling network specific to the operator of the RR network, as well as peripheral devices DP1 to DPJ through the Internet RT and a wireless local area network RL of the WLAN type.
• the RL short-range wireless LAN can comply with one of the 802.1Xx standards and can also meet the WiFi label.
• the local short-range network RL is installed for example in a company, a hotel, or a public place such as a station or a shopping mall.
• the local area network RL comprises several AP radio access points constituting radio terminals that can communicate with peripheral devices DP1 to DPJ within a radius of a few tens of meters.
• the AP access points are interconnected by a distribution network, for example an intranet, through an access server connected to the Internet RT through xDSL lines, in order to offer packet communications to broadband to peripheral devices.
• peripheral devices connected to the user equipment EU to the Internet RT so that this communication is equivalent to communication between the user equipment UE and the internet RT, the user equipment UE being then transparent to the network operator Radiocommunication RR.
• Three types of communications can be initialized and used from the peripheral device DPj to the Internet RT: a communication through the user equipment UE via the link LI and through the fixed part of the network RR to which the identity module MI is connected, via the OTAl (Over The Air) radio interface, or - a communication directly with the RR network without using the EU equipment, or - a communication via OTA2 radio interface through the wireless local area network RL whose operator has signed an agreement with the operator of the RR network to which the identity module MI is attached, after allowing such communication via exchanges of requests and responses between the peripheral device DPj, the identity module MI in the UE user equipment and the RR network via the LI link and the first OTAl radio interface; simultaneously with this communication, the identity module MI can participate in a conventional communication via the UE user equipment, the
• the identity module MI Prior to any communication from any peripheral device DP, the identity module MI stores in the EEPROM IDP IDI devices IDPJ DPl devices to DPJ that the user selects to connect them to the EU equipment and allow them to reuse respective identity data read in the MI identity module, and IDIj identifier sets of several identity data DI of the identity module MI associated respectively IDP IDPJ IDPJ peripheral devices DPl to DPJ in the identity module, as shown schematically in steps EOl and E02 in Figure 2.
• IDPj identifier peripheral device DPj may be analogous to a MAC (Medium Access Control) address including a device manufacturer's identifier, a peripheral device type identifier and a serial number of the peripheral device.
• MAC Medium Access Control
• the identifier IDPj is the identifier which is included in a certificate of the peripheral device furthermore comprising a private key and a public key and registered in a secure module incorporated in the peripheral device DPj, of the TPM module type. (Trusted Platform Module).
• the peripheral device DPj accesses a predetermined list of identity data of the identity module, regardless of the index j of the peripheral device. For example, the identity data that a peripheral device is likely to access is selected from the International Mobile Subscriber (IMSI) identifier.
• IMSI International Mobile Subscriber
• each peripheral device DPj whose identifier IDPj has been previously stored in the identity module MI in step E01 is only allowed to reuse a respective part DIj, or possibly the entire identity data of the identity module MI.
• the association of the peripheral device identifier IDPj with identity data identifiers IDIj is stored in the identity module MI in step E02.
• the operator of the home network RR registers in the platform PF the association of a identifier of the user identity module MI, such as the international identifier IMSI provided by the recorder HLR, to the list of identifiers IDPl to IDPJ communicated by the user in step EO1 and also the association of each IDPj identifier the
• the list of identifiers of IDPJ IDPJ authorized peripheral devices and the IDIj list of identity data identifiers for each peripheral device DPj are then transmitted by the platform PF via the RR network, the radio interface OATl and the user equipment UE to the identity module MI which stores them, in steps E01 and E02.
• the lists of identifiers are transmitted by the platform PF in response to a request to update the location of the mobile terminal, or following an authentication request, or after powering up the mobile terminal.
• the user can modify the content of the list of identifiers IDPL IDPJ devices in the identity module MI devices by modifying the bit state of one activation / deactivation respectively associated with IDPL identifiers IDPJ.
• An activation / deactivation is selected via the user graphical interface including in particular the keyboard and screen of the user equipment EU and is signaled by request to the platform PF via the OTAl interface, the RR network. and the center of short messages CM.
• the PF platform follows, validates and thus makes any modification relating to the activations / deactivations decided by the user and possibly corrects them according to the user subscription profile that the platform PF can read in the home location register HLR.
• the activation / deactivation bit of the identifier IDPj of the peripheral device DPj is set to the state " i " / "0" in the identity module MI from the user equipment UE after validation by the platform PF to retain / remove IDPj from IDP IDPJs previously stored in the identity module and peripheral devices that are allowed to reuse some identity data of the IM identity module.
• the user of the identity module MI also has the option of selecting certain identity data identifiers previously stored in the identity module in order to add or remove certain identity data identifiers from the list of identity identifiers.
• Each addition or removal of identity data identifier is validated by the PF platform.
• an enable / disable bit is associated with each of the identity data identifiers previously stored IDIj.
• the ID / ID identity data enable / disable bit is set to the "I" / "0" state in the MI identity module from the UE user equipment after validation by the platform.
• PF to keep / remove the identifier IDIj from identity data identifiers previously stored in the identity module and associated with the peripheral device DPj.
• the method of reusing identity data by any peripheral device DP identified by an IDP includes steps E1 to E9.
• step E1 communication is established between the peripheral device DP and the identity module MI in the UE user equipment.
• the link LI between the peripheral device DP and the user equipment EU is a Bluetooth link
• a PIN identification code is entered both in the user equipment UE and the peripheral device DP which each establishes a link key according to parameters such as random numbers exchanged between them, the PIN code and their Bluetooth addresses.
• the identity module MI authenticates the peripheral device DP by comparing a response it has determined and a response it has received from the peripheral device depending on the aforementioned parameters.
• the peripheral device DP can proceed in a manner analogous to authentication of the identity module MI.
• the peripheral device DP transmits its IDP ID to the identity module MI which stores it.
• authentication of the peripheral device by the MI module, or mutual authentication between them is of the Transport Layer Security (TLS) type and can replace the previous authentication or complete it.
• the identity module MI compares the transmitted identifier IDP of the peripheral device DP with the previously stored identifiers IDP1 to IDPJ of the peripheral devices DP1 to DPJ which have been previously authorized to reuse respective identity data in the identity module MI, in step E2.
• the identity module MI commands a break of the communication with the DP device in the device. user equipment UE, and signals the user for example by displaying a message of the type "DP device not allowed" on the screen of the user equipment, in step E3.
• the peripheral device DPj is not capable of selectively requesting identity data according to identity data identifiers, and the response REPL also contains the predetermined list of identity data of the identity module; the process then goes directly from step E4 to step E9, as indicated by dashed lines in FIG. 2.
• the peripheral device DPj following the REPL response containing only the IDPj identifier, the peripheral device DPj establishes and transmits a request RQ including predetermined identity data identifiers IDI to the identity module DI, in step E5.
• the identity module MI compares the IDI predetermined identity data identifiers transmitted in the request RQ by the peripheral device DPj, identity data identifiers pre-stored and associated with the identifier IDPj. If at least one of the identifiers IDI is not recognized in the list of identifiers IDIj, the identity module MI controls in step E7 in a manner analogous to step E3, a break of the communication with the device DPj in the user equipment UE, and signals it to the user for example by displaying a message of the type "reading of unauthorized identity data" on the screen of the user equipment US.
• the identity module MI controls the transmission of a response REP2 to the peripheral device DPj.
• step E9 following the response REP1 with the predetermined list of identity data of the identity module transmitted in step E4 according to the simple variant, or following the response REP2 transmitted to the step E8 with the identity data DIj designated respectively by the identifiers the
• the peripheral device DPj can fulfill the identification functions initially provided by the identity module MI by reusing at least part of the identity data DIj transmitted in the REPL / 2 response in particular so that the recorder nominal localization HLR in the network RR authenticates the peripheral device DPj, that is to say the user of the module MI, to establish a communication especially to the Internet RT, or with the network RR through the link LI, the EU user equipment and the OTAl radio interface, either with the wireless LAN RL through the OTA2 radio interface.
• the invention is not limited to the short-range network as an RL network.
• the second network RL may be another communications network, for example a cellular or cellular telephone network of the GSM or UMTS type.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Databases & Information Systems (AREA)
• Mobile Radio Communication Systems (AREA)
• Telephonic Communication Services (AREA)
• Computer And Data Communications (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=34946368

Family Applications (1)

Country Status (6)

Families Citing this family (28)

Citations (2)

Family Cites Families (10)

• 2004
  • 2004-06-28 FR FR0407047A patent/FR2872366B1/fr not_active Expired - Fee Related
• 2005
  • 2005-05-19 CN CN2005800283917A patent/CN101006739B/zh active Active
  • 2005-05-19 EP EP05752778A patent/EP1782647A1/fr not_active Withdrawn
  • 2005-05-19 US US11/630,960 patent/US8700000B2/en active Active
  • 2005-05-19 WO PCT/EP2005/052308 patent/WO2006000502A1/fr active Application Filing
  • 2005-05-19 JP JP2007518570A patent/JP4729664B2/ja active Active

Patent Citations (2)

Non-Patent Citations (1)

Also Published As

Similar Documents

Legal Events