MXPA02002018A

MXPA02002018A - Gsm security for packet data networks.

Info

Publication number: MXPA02002018A
Application number: MXPA02002018A
Authority: MX
Inventors: Rios Jose Luis Mariz
Original assignee: Ericsson Telefon Ab L M
Priority date: 1999-08-31
Filing date: 2000-08-31
Publication date: 2002-09-18
Also published as: EP1208715A1; AU7047100A; ZA200201005B; WO2001017310A1; CN1385051A

Abstract

In a communication system methods and apparatus that apply GSM security principles to authenticate users who are requesting access to packet data networks are provided. The authentication process is triggered by an authenticating entity when it needs to verify the identity of a user trying to access certain resources, e.g., an application of a network. The authenticating entity sends an authentication request to an authentication server. The authentication server checks whether the users identity corresponds to a known user. If so, the authentication server generates an authentication token that is sent to the user via an access network and a remote host. The authentication server uses a secure communication link, via a wireless network, to request the user to send the authentication token back to the authentication server via the secure communication link over a public land mobile network. Once the user sends the authentication token back to the authentication server via the secure channel, the authentication server compares the authentication token sent to the user and received from the user through the secure communication link. If the authentication tokens match, the authentication server instructs the authenticating entity to grant the user access to the requested services. If the authentication tokens do not match, the user will be denied access to the requested services.

Description

* GSM SECURITY FOR DATA NETWORKS BY PACKAGE BACKGROUND The present invention generally relates to methods and apparatus for providing security for packet data networks and more particularly methods and apparatuses for applying GSM security principles for authenticating users who are requesting access to packet data networks. 10 The number of users who have access to Packet Data Networks (PDN), for example, the Internet, from remote locations increases every day. In this way, the number of private networks that interconnect to the Internet has grown significantly. A private network is typically 15 a network in which access to the computers sites of the private network is limited to authorized users. When the private network connects to the Internet, security procedures, including authentication procedures, are carried out to ensure that only users 20 authorized computers can access the private network. For example, when a user requires access to a computer site of the private network of a remote location, the user must be authenticated before the user is guaranteed access to the computer site. 25 Some authentication procedures Í ** AA? ^ ** **** I. *. * A * ****. * ^ *** ^ **,,. ^^ .... conventional tok.AJjii use passwords. A password is a string of characters recognized by automatic means and allows a user to access protected files, or input or output devices. Most sophisticated systems, such as Kerberos, use authentication schemes based on passwords. Kerberos is a security system for client / server calculation. A password can be generated at a remote site, which is requesting access to a private network computer site. Some systems use symmetric or asymmetric cryptographic techniques to create and authenticate the password, which will be described in detail later. The continuous development of the PDNs has generated a wide range of services by computer. In some cases, services are restricted to a number of users. In other cases, services are accessed dynamically on a commercial basis, that is, users pay to use the services. In both cases mentioned above, users must authenticate themselves using a service provision system from a service provider before they can access the desired services. In this way, the service provider ensures that only qualified users can thus access the services. Cellular communication systems control the resources of a network that are used by Mobile Stations (MS) corresponding to authorized users. In a conventional GSM cellular communication system, the MS includes a Subscriber Identity Module (SIM). The SIM contains the subscriber information which includes, for example, the data used to allow the MS to access the network infrastructure of the GSM cellular communication system. The ISM participates in the authentication of the user and in the subsequent encryption, if any, of a radio communication. A user identity authentication operation verifies that the service is provided to only a limited and controllable set of users, while the authorization operation verifies that a limited and controllable set of resources is provided to the appropriate users. In principle, having access to a network is similar to getting access to any particular application server in the sense that it requires a client to open a session with a specific server, for example, the access server. The access session covers all other possible sessions with different servers, and is a prerequisite to any interaction with a server in the network. Each server can have its own procedures to authenticate and authorize users. Remote access to public or private data networks is growing tremendously, especially . * & **. _ * A * i.A. through PSTN / ISDN dial-up connections, which are insecure, as they transmit data over unsafe communication lines. Additionally, the software to break security is quite advanced and is used more widely than it was in the past, which makes it more difficult to prevent users without authorization to have access to secured information. Since data networks are growing rapidly, separate security procedures for each application of the data network may not be sufficient to protect against an intruder once the intruder places himself in the data network. In this way, general and political data network security procedures are becoming more necessary to protect data networks by private packets. Weak authentication and strong authentication are two commonly known types of authentication. Both weak and strong authentication can use known authentication security methods such as: a lexical symbol (for example, a unique combination of bits), a password (for example, a secret character string), or biometric information (for example, digital printing, voice printing, retinal scanning, etc.). Weak authentication is referred to as individual factor authentication, since it uses only one .i * _- * k * it **** i * ... - «ai ^. _ta -. • a? 'i method to authenticate a user. Weak authentication also includes techniques that include traditional static passwords and one-time passwords. Static passwords, however, can be broken by 5 software programs, including keyboard attack monitoring programs, breaking programs to guess, and sniffing programs. Static passwords can be protected from the aforementioned software programs by generating a 10 one-time password (one per session) that can not be calculated from previous passwords, that is, by entering a pseudo-random sequence as a calculation factor. The one-time password is generated from a "real" password that can never be transmitted 15 about the network (a secret shared between the user and the network). Strong authentication is referred to as the authentication of two factors. Strong authentication is more secure than weak authentication because it authenticates the 20 user using two methods, usually a lexical symbol and a password. Systems that generate one-time access codes from a lexical symbol and password are already available in the market, such as Security Dynamic's Secure ID, Safeword's Safeword DES Gold 25 Card and Digital Pathway 's Defender. For example, the symbol ? AAáá * M, sA. *. * T-t * * * **** * ^, * .. -v _ .... - _ _, .. **, .. ^^ _ .. "_, ¿^ t. aaaaafi lexicon can be a hardware device and the password can be a Personal Identification Number (PIN) code to access the hardware device. Strong authentication can still be made more secure, for example, by introducing explicit authentication, the network generates a random factor as input to the user's password generation operation (this is known as the network challenges the user). Secondly, the life cycle of the access code can be very short, for example, 1 minute, therefore implementing a continuous authentication process as the session continues. Third, more sophisticated keys and algorithms, based on symmetric or asymmetric cryptography, can be used. The commonly used authentication procedures are based on identity / password methods. The most advanced systems use one-time passwords and methods based on lexical symbols. However, those implementations have limitations. For example, the methods of initiating fixed / password interaction provide weak security. Additionally, strong authentication methods require a user to contain additional devices, i.e., lexical symbol devices. Certain strong authentication mechanisms require specific hardware, for example smart card readers. In addition, some strong authentication methods require specific hardware and software configurations that result in an administrative burden. Consequently, the lack of flexibility of lexical symbol devices creates additional problems with strong authentication methods. Thus, there is a need to apply GSM security principles to authenticate users in the PDNs in order to improve security in having access to private service networks as well as specific services and applications of the private service network. There is an additional need to use two different communication channels between a private service network and a user that requires access to it, where one of the channels can be an insecure channel connected to a PDN over an access network and can not transport any sensitive information between a remote computer and the PDN, and the other channel can be a secure channel that can exchange security information between an MS and the PDN over a Public Land Mobile Network (PLMN). There is an additional need to use such GSM security principles to authenticate a user when conducting e-commerce transactions.

COMPENDIUM According to the Applications of the invention, these and other objects are met by methods and devices that apply GSM security principles to user authentication in PDNs in order to improve the security of access to private service networks. In accordance with an exemplary embodiment of the present invention, a communication system for authenticating a user that requires access to a PDN comprises a PLMN connected to the PDN. A remote computer connects to the PDN through an access network. A mobile station can be coupled to the PLMN via a wireless link. In response to the user who requires access to the PDN, the PDN generates and sends a lexical authentication symbol on a secured and unsecured communication channel to the user through the access network and the remote computer. The user sends the authentication of the lexical symbol back to the PDN over a secured channel of the PLMN, where the PDN compares the lexical authentication symbols to determine whether they guarantee the user's access to the PDN. In accordance with another exemplary embodiment of the present invention, a communication system has an electronic commerce server that authenticates a user when performing an electronic commerce transaction. A user who wishes to carry out an electronic commerce transaction sends a request to the PDN. The PDN generates a Í * tt.A < t..lttti ?? i. lexical symbol of authentication. A payment server that handles the loading aspect from an e-commerce application is contacted. The lexical authentication symbol is sent to the user from the PDN through an access network using an unsecured or secured communication line. The user sends the lexical authentication symbol back to the PDN via a secured communication channel on a PLMN. The lexical authentication symbol that was sent to the user is compared to the lexical authentication symbol that is sent by the user to the PDN to determine if the user is authorized to proceed. The communication system also has an authentication server that communicates with the payment server to load the user for the electronic commerce transaction. Additionally, the billing information can be sent to a billing system of the PLMN.

BRIEF DESCRIPTION OF THE DRAWINGS The features, objects and advantages of the present invention will become apparent upon reading this description together with the accompanying drawings, in which similar reference numerals refer to similar elements and in which: FIGURE 1 is a block diagram illustrating a communication system according to an exemplary mode LY-A < t *** -. ***. * * - ** * **. .M,! ** ^ j. .. a of the present invention; FIGURE 2 is a block diagram illustrating a mobile station structure according to an exemplary embodiment of the present invention; FIGURE 3 is a block diagram illustrating a method for authenticating a user in accordance with an exemplary embodiment of the present invention; FIGURE 4 is a flow chart illustrating a method for communicating between the Mobile Equipment (ME) and a SIM of an MS in accordance with an exemplary embodiment of the present invention; FIGURE 5 is a block diagram illustrating a communication system for authenticating the user when accessing a PDN in a dialing scenario according to another exemplary embodiment of the present invention; FIGURE 6 is a message sequence diagram illustrating a method for authenticating a user in accordance with another exemplary embodiment of the present invention; FIGURE 7 is a block diagram illustrating a communication system for authenticating the user when performing electronic commerce transactions in accordance with an exemplary embodiment of the present invention; FIGURE 8 is a message sequence diagram illustrating a method for authenticating the user when performing e-commerce transactions in accordance with an exemplary modality; FIGURE 9 is a block diagram illustrating a communication system using Unstructured Supplementary Service Data (USSD) in accordance with an exemplary embodiment of the present invention; FIGURE 10 is a message sequence diagram illustrating a method for authenticating a user in a network scenario using USSD in accordance with an exemplary embodiment of the present invention; FIGURE 11 is a block diagram illustrating a communication system using a Wireless Application Protocol (WAP) according to an exemplary embodiment of the present invention; and FIGURE 12 illustrates a method for authenticating a user in the communication system shown in FIGURE 11.

DETAILED DESCRIPTION FIGURE 1 is a block diagram illustrating a communication system in accordance with an exemplary embodiment of the present invention. In FIGURE 1, the communication system comprises a PLMN 22, a PDN 24, an access network 26, a remote computer 32 and an MS 68. The PDN 24 can be connected to the access network 26 via communication links (not shown). The network 26 of Access can be connected to the remote computer 32 via a communication link 30. The PLMN 22 comprises a Base Transceiver Station 36 (BTS) connected to a Base Station Controller (BSC) 38 via a communication link 40. A Central Location / Visitor Register of Mobile Switching (MSC / VLR) 42 can be connected to BSC 38 and to a Short Message Service Center 44 (SMS-C) via communication links 46 and 48, respectively. A Local Location Register (HLR) 50 can be connected to an MSC / VLR 42 and an Authentication Center 52 (AuC) via communication links 54 and 56, respectively. The PDN 24 comprises an authentication server 58 connected to an authentication entity 60 via a communication link 62. A WAP server 76 may be able to connect to the authentication server 58 via the communication link 78. A Router 64 of Network Access Service (ÑAS) is connected to the authentication entity 60 via the communication link 66. The authentication server 58 can be connected to the SMS-C 44 via the communication link 72. The detailed aspects of this connection are not critical to the present invention, and therefore are not shown. However, the connection depends on the type of connection (for example X.25, IP) and the security mechanisms in place (for example, i ** iA ** i_i -t.fca.

Ipsec. tunnel servers, routers, protective barriers). The HLR 56 can be connected to the authentication server 58 via the communication link 74. The MS 68 communicates with the PLMN 22 via a wireless connection, shown as the radio link 70. The PLMN 22 can be constructed in accordance with the Global Systems for Mobile Communication (GSM) standard described in the European Standard Telecommunication Institute (E documents ETS 300 573, ETS 300 574 and ETS 300 578, which are incorporated in this for reference. The GSM specification is known in the art and will not be described hereunder in the present. The BTS 36 receives the uplink signals generated by the MS 68 via the radio link 70. The BTS 36 generates downlink signals to transmit to the MS 68 via the radio link 70. The BTS 36 also communicates with the BSC 38, which controls the operation of a group of base stations (not shown). The HLR 50 contains subscription and position information with respect to the subscribers to the communication system. The HLR 50 is thus used to identify / verify a subscriber. The HLR 50 also contains subscriber data regarding the characteristics and services of the communication system available to the subscriber. The AuC 52 handles the security functionality for the PLMN 22. The AuC 52 stores the subscriber's private keys and applies the security algorithms A3 (authentication) and A5 (encryption / decryption). The security algorithms A3 and A5 are described in the Edocument ETS 300 929, which is incorporated herein by reference. The algorithms of A3 and A5 are also specified in Appendix C of ETS 300 534, which is incorporated herein by reference. The SMS-C44 receives messages generated in the PDN 24 via the communication link 72. The SMS-C44 packages the messages received in messages of Short Message Services (SMS). SMS messages are transmitted as defined in the corresponding GSM standard specification and thus will not be described further below. The remote computer 32, for example, a personal computer or laptop computer, contains conventional client software for remote access to the PDN 24 in a manner, the Microsoft Internet Explorer, the Netscape America On-Line Navigator, etc. The PDN 24 comprises many computers (not all shown). The authentication entity 60 is responsible for ensuring that only authorized users are given access to the resources in PDN 24. These resources may include applications or contain within applications. It will be appreciated by those skilled in the art that PDN 24 and . - * -. -. , "the access network 26 can be connected through the intermediate PDNs, for example, ISP, Intranets. It will also be appreciated by those skilled in the ordinary art that the access network 26 may be a cellular network, and thus may link the remote computer 26 to the NAS / router 64 by conventional wireless methods. It will also be appreciated by those skilled in the ordinary art that the authentication server 58 can be connected to the PLMN 22 by a system of intermediate gateways. The authentication server 58 provides authentication service to the PDN 24. The authentication server 58 generates a lexical authentication symbol for each access request and handles the dialogue with the authentication application in a processing device (not shown) of the MS 68. The processing device will be described in detail below with the description of FIGURE 2. Authentication server 58 validates the response of the processing device. The authentication server 58 communicates the result of the authentication process to the authentication entity 60. Any possible encryption of the communication between the processing device and the authentication server 58 requires that the corresponding algorithms and key values can be stored in the authentication server 58. If the scheme of GSM security is reused, the authentication server 58 will not store the keys themselves nor will it calculate the authentication algorithms, instead it will obtain the necessary values for the corresponding AuC 52 in the GSM network. When the authentication is associated with a payment, the authentication server 58 is responsible for establishing the corresponding dialogue with a payment server (not shown) and sending the necessary information (for example, price) of the authentication entity to the authentication server. payment. The authentication entity 60 invokes the appropriate mechanisms, for example, protocols, application programming interfaces to request information from the authentication server 58. The authentication entity 60 sends a lexical authentication symbol to the remote computer 32 and processes the result of the authentication process. When the authentication is associated with an operation that requires the recording of additional information, for example, a payment, the authentication entity 60 requires a user authentication by the authentication server 58. The authentication request includes the additional information. It will be appreciated by those skilled in the ordinary art that the authentication entity 60 and the server ÍAi, .A »¿lliti.i.t *******, __ *. --a-aJ- a,,, "", .. »" ,,. gu * ^ *, ._ *,. J &** ,. . _ * _ *. * ajujjaj A 58 authentication can be located in different PDNs with the condition that they are linked by a secure data channel, for example an Ipsec tunnel. FIGURE 2 is a block diagram of a mobile station structure and network environment interacting therewith in a scenario using SMS according to an exemplary embodiment of the present invention. The mobile station structure (MS) comprises a SIM 90 and ME 92. The network environment comprises a PLMN 82, and an authentication server 84. The PLMN 82, in turn, comprises an SMS-C 86 that can be connected to the authentication server 84 via the communication link 88. The ME 92 comprises a keyboard 102 and a screen 104. The SIM 90 comprises a SIM operation system 96 (SIM OS), a GSM part 98, a SIM application tool 100 (STK) and an authentication application. , i.e., a processing device, shown as AUTH-APP 108. The ME 92 and the SIM 90 communicate with each other via a communication link 94. The SIM 90 can be an "intelligent" card installed within the MS 80 and contains a subscriber information that includes, for example, the data used to allow the MS 80 to access the network infrastructure of the GSM communication system . The SIM 90 participates in the authentication of the user in the encryption ** - A * * & .. & & ,.

Subsequent radio communication, if any. The MS 80 when communicating with the PLMN 82 via a wireless communication link, shown as radio links 106. The SIM 90 is corresponding to the standards of the specification ISO / EEC / 7816 and GSM 11.14 (Phase 2+). The GSM 11.14 defines the interface between the SIM 90 and the ME 92, and the ordering procedures for the ME 92, specifically for the AUTH-APP 108. The AUTH-APP 108 is a structure for enabling the applications that exist in the SIM 90 to interact and operate with the ME 92. For example, the interactions include displaying messages on the screen 104, obtaining an input from the keypad user 102 and sending and receiving short messages via the radio link 106. The SIM OS 96 provides the execution and management of the structure for the GSM application that handles the conventional GSM functionality. Along with it, the STK 100 provides the environment for all types of applications such as the AUTH-APP 108. The AUTH-APP 108 handles communication with the authentication server 84 through a secure channel (not shown). When the AUTH-APP 108 receives an authentication request from the authentication server 84 through the PLMN 82, it instructs the MS 80 to request a lexical authentication symbol. Once you have entered the lexicon of tai.ai.aai _t_ A. ** t í. ! * ._, authentication in the MS 80 the AUTH-APP 108 sends the authentication response containing the lexical symbol of authentication back to the authentication server 84 through the PLMN 82. The execution of the authentication application made by the AUTH -APP 108 can be protected by a PIN code. Any possible encryption of the communication between the AUTH-APP 108 and the authentication server 84 requires that the corresponding algorithms and the key values are stored in the AUTH-APP 108. Still with reference to FIGURE 2 a high security level can be achieved by the use of end-to-end encryption in the communication path between the MS 80 and an authentication server 84. The encryption occurs at the application level between the AUTH-APP 108 of the MS 80 and the authentication server 84. The encryption of the data contents exchanged by MS 80 and the authentication server 84 can be achieved in accordance with symmetric encryption or asymmetric encryption. In the symmetric encryption, a secret key is shared between the AUTH-APP 108 of the SIM 90 and the authentication server 84. The secret key is used to encrypt the data in the MS 80 and the authentication server 84. Normally, such a secret key for channel encryption (also called encryption key) is ,. » ...... ^ *, * A. a. *,] *. ,% *?,. ? "i" is generated per communication session between the two communication parties (MS 80 and the authentication server 84) based on a certain germinal value chain which is usually the user's individual secret key. Each user is assigned an individual secret key when the user signs for the services. The user keeps the same key, unless the secret key has to be updated. In one embodiment of the invention, user authentication is improved by questioning the individual secret key of the user stored in the SIM 90. This is done by the standard GSM authentication methods, from the authentication server 84 and thus it will not be further described herein. The authentication server 84 is connected to the GSM core network to access the security information from an AuC (not shown) of the PLMN 82. The authentication server 84 does not need to run the GSM encryption algorithm or store the encryption algorithm. secret key of the user. Instead, the authentication server 84 can retrieve a random number (RAND) and SRES pairs for the user of the AuC. The AUTH-APP 108 on the SIM 90 can reuse the GSM security information (key and algorithm); will use the A3 algorithm to obtain the SRES of the RAND and the individual secret key stored in the SIM 90. FIGURE 3 illustrates a method to authenticate t.i * t- »??.? i .. *. < A user is in accordance with an exemplary embodiment of the present invention. In FIGURE 3, a communication system comprises a remote computer 116, an access network 118, a PLMN 120, MS 122 and a PDN 110, which comprise an authentication entity 112 and authentication server 114. In FIGURE 3 the method begins at step 124 where a user initiates an operation request to connect the remote computer 116 to the PDN 110 via the access network 118. In step 125, the authentication entity 112 communicates with the authentication server 114 via a secure packet data connection (not shown) and requires authentication of the user attempting to access the PDN 110. In step 126, the authentication server 114 provides the authentication entity 112 with a lexical authentication symbol (not shown). In step 127, the authentication entity 112 transmits the lexical authentication symbol to the remote computer 116 via the access network 118. In step 128, the authentication server 114 makes contact with the MS 122 via the PLMN 120, using conventional wireless methods, and requires the user to transmit by the MS 122 the lexical authentication symbol that was sent to the remote computer 116 in the step 127 back to the authentication server 114 via MS 122 and PLMN 120. MS 122 may require the user to enter a PIN code before the user can enter the MS 122 authentication lexical symbol using an input device such as, for example, a keyboard. In step 129, the user enters the PIN code using the keypad of MS 122. Once the PIN code has been validated, an application in the SIM within MS 122 communicates with MS 122 to prompt the user to enter the lexical authentication symbol received by the remote computer 116 in step 127. In step 130, the user enters the lexical authentication symbol using the input device such as a keyboard of the MS 122. In step 132, the application of the SIM instructs the MS 122 to send the back identification lexical symbol to the authentication server 114 via the PLMN 120. Finally, the authentication server 114 determines whether the lexical authentication symbol received by the PLMN 120 matches the lexical authentication symbol that was transmitted to the remote computer 116 in step 127. If the lexical authentication symbol matches, the authentication server 114 instructs the authentication entity 112 have user access to the service ** AA. . IT'S REQUIRED If the lexical authentication symbols do not match, an appropriate error condition will be sent to the authentication entity 112. In this way, the user is denied access to the required service. It will be appreciated by those skilled in the ordinary art that the MS 122 and the remote computer 116 can be joined by a wireless, wired or infrared connection (not shown) to achieve a faster authentication process. For example, the SIM application can retrieve the lexical authentication symbol from the remote computer 116 without the intervention of the user as described below. Referring again to step 129, the user may enter the PIN code in the remote computer 116 instead of the MS 122. The remote computer 116 may then automatically send the PIN code to the MS 122 via a wireless, wired or infrared connection. between the MS 122 and the remote computer 116. In addition, the PIN code can be stored in the remote computer 116 when the remote computer 116 can automatically transfer the PIN code to the MS 122 via wireless, wired or infrared connection, once the remote computer 116 receives the authentication lexical symbol. as described in step 127. Alternatively, with reference again to the I ** I A I. «S * a * tAi? ** *. j & mk kiL *. step 130, the MS 122 can automatically retrieve the lexical authentication symbol of the remote computer 116 by wired, wireless or infrared connection. FIGURE 4 is a flow diagram illustrating an exemplary embodiment of the method of communication between the ME 92 and the SIM 90 of the MS 80 shown in FIGURE 2. In accordance with FIGURE 4, in step 140, the ME 92 receives a short message from a PLMN 82 (FIGURE 2). The short message may be a message asking ME 92 to send a lexical symbol of 10 authentication to the PLMN 82. In step 142, the ME 92 sends an authentication request (SMS-PP download) to the SIM 90. The SIM 90 activates its authentication application, reads the authentication request and obtains a RAND. In step 144, the SIM 90 sends a PIN code request to the ME 90.

A user answers the PIN code request by entering a PIN code using an entry device such as a keypad 102 (FIGURE 2) of the ME 92. The ME 92 can display the PIN code entered in the screen 104. The ME 92 reads the keyboard PIN code 20 104. Then, in step 146 ME 92 sends the PIN code to the SIM 90. The SIM 90 checks the PIN code to verify that it is an authorized PIN code for the ME 92. The SIM 90, then in the stage 148, send a lexical symbol 25 of authentication to ME 92. The user responds when entering *** aAA * A **** ^ M, i S * ** J. A-.I the lexical authentication symbol using the input device such as a keyboard 108. The ME 92 can display the lexical authentication symbol entered in the screen 104 and read the lexical authentication symbol of the keyboard 102. The ME 92, in step 150, sends the lexical symbol of authentication of SIM 90. The SIM 90 calculates the SRES applying the security algorithm of A3 to the RAND and the private key. The SIM 90 prepares a response using SRES and the lexical authentication symbol. Step 152, SIM 90 sends an authentication response to ME 92. Finally, in step 154, ME 92 sends a short message, which contains the lexical authentication symbol to PLMN 82. Referring again to the FIGURE 3, the application within SIM in the MS 122 can be securely stored an authentication key, like the authentication server 114. Optionally, the keys can be generated and / or stored between the authentication server 114. The keys can also be obtained from an external node that provides adequate generation and / or storage functionality. It will be appreciated by those skilled in the ordinary art that a session key can be used in the encryption of subsequent communications between a remote computer and an authentication entity in a PDN.

-.¡LA?.?. I 'Á, * ***. , A session key can be obtained by applying an appropriate algorithm to the RAND and using the private key. This is done, for example, in the GSM system during the calculation of the encryption key (Kc), where an A8 security algorithm is applied to the RAND using the subscriber's private key. The algorithm generated by Kc is called the security algorithm A8 and is used to calculate the Kc of the RAND sent during the authentication procedure. The algorithm of A8 is specific operator. The A8 is applied to the PLMN 120 by the AuC (not shown) and on the user side by SIM (not shown) in the MS 122. Thus the Kc does not have to be transmitted, since it is calculated at both ends of the encrypted channel. The specification for algorithm A8 is described in Appendix C of ETS 300 534, which has been previously incorporated by reference. In this approach, the application in the SIM (not shown) of MS 122 can apply to the appropriate algorithm to obtain a session key in reception of the lexical authentication symbol. Then you can send the resulting session key to the telephone network access client on the remote computer 116 via MS 122. The telephone network access client can apply the received key for the encryption / decryption of the subsequent communications with the PDN 110. The authentication server 114 can also i * í & * Í *? * **** * * * ***** ** * * *** ¿} .? ? th t * k. obtain the session key that applies the same algorithm as the application in the MS 122 SIM used to calculate the session key. The authentication server 114 may also include the session key in the authentication response sent to the authentication entity 112. When the asymmetric encryption is used to generate the session key on the authentication server 114, it is encrypted with the public key of the subscriber, and is sent along with the RAND in the message to the application in the MS SIM 122. The application in the MS 122 SIM can obtain the session key value using its private key. Then you can send the resulting session key to the dialing client on the remote computer 116 via MS 122. The dialing client can apply the received key for encryption / decryption of the subsequent communications with the PDN 110. The SIM in the MS 122 will store its own private key and public key of the authentication server 114. In this way, the authentication server 114 will store its own private key and the public keys of each user. Optionally, the authentication server 114 can retrieve those keys from an external node (not shown). The following discussion describes a unilateral two-step authentication mechanism. Other mechanisms, such as those shown ISO / IEC 9798-3, can also be i aj, a - .. afa, i apply, including mutual authentication. Still with reference to FIGURE 3, assuming that the authentication server 114 stores the necessary keys and is capable of applying the encryption algorithm, the user initiates the connection by means of a remote computer 116 to an access server in a PDN 110 .

The access network provides the communication path between the remote computer 116 and the PDN 110. The authentication entity 112 contacts the authentication server 114 through a secure packet data connection and requires authentication of the user attempting to access . The authentication server 114 generates a RAND. Then, it makes contact with MS 122 using wireless network infrastructure. The message includes the RAND. The authentication server 114 provides the authentication entity 112 with a lexical symbol to the authentication that is sent to the remote computer 116 via the access network 148. The application in the MS SIM 122 receives the message from the authentication server 114 in accordance with the usual wireless procedures. The application in the MS SIM 122 optionally communicates with the MS 122 to require the user to enter a PIN code. Once the PIN code is «I t4jU has validated, the application communicates with the MS 122 to require the user to enter the lexical authentication symbol received by the remote computer 116. The application constructs the authentication response message including the signature corresponding to the received RAND applied to the algorithm (symmetric or asymmetric) to the RAND using the key stored in the SIM in MS 122. The signature may optionally include the lexical symbol of the authentication. The application in the MS SIM 122 instructs the wireless terminal to send the response back to the authentication server 114 using standard wireless procedures. Finally, the authentication server 114 determines whether the response received by the wireless network is correct and includes the lexical authentication symbol. The authentication server 114 will apply the algorithm (symmetric or asymmetric) to the signature received using the key for that user. If the resulting information matches the RAND and the lexical authentication symbol values, the authentication server 114 instructs the authentication entity 112 to have user access to the required service. Otherwise, an appropriate error condition is sent to the authentication computer. * * * t *** A-? * l? . . t & * ÍÍ ***** t ... _.... 1. _ .. ^. . a, - a í = ¿-. «JJaJJa.» »-a. ** * ,to . . «.-" ^, *** & YEAH The present invention is well suited for the authentication of dial access for a communication system. FIGURE 5 is a diagram of a communication system according to another exemplary embodiment of the present invention. In FIGURE 5, the communication system comprises a PLMN 160, a PDN 162, a remote access network 164, a modem 166, a remote computer 170 and an MS 208. The MS 208 communicates with the PLMN 160 via a link wireless shown as radio link 210. The PLMN 160 comprises a BTS 172, BSC 174, an MSC / VLR 178, an SMS-C 180, an HLR 186 and AuC 188. The PDN 162 comprises an authentication server 194, an authentication, authorization and account server 196 ( AAA) and a ÑAS 200. The communication system of FIGURE 5 is substantially similar to the communication system of FIGURE 1, except that the authentication entity 60 in FIGURE 1 is replaced with the AAA server 196 of FIGURE 5. The ÑAS 200 communicates with the AAA server 196 using an appropriate protocol, for example RADIUS. The server 194 during the authentication acts as a main server for the server 196 AAA. The AAA server 196 receives an authentication request from the ÑAS 200 for a user who is configured to use the communication system. With the exception of AAA server 196, the components of FIGURE 5 perform - - ** k¿ * í í. the same function as its corresponding components of FIGURE 1, and thus will not be further described herein. FIGURE 6 is a message sequence diagram illustrating a dialing scenario of the communication system of FIGURE 5 in accordance with an exemplary embodiment of the present invention. The protocols used in FIGURE 6 are for illustrative purposes only and thus do not limit the applicability of the present invention. The user initiates communication from the User's PC 170, which serves as the user's remote access to the ISP / Intranet (not shown) using a conventional dial-up client application. Once the communication path to the ÑAS 200 has been established, the installation process begins. In step 220, the ÑAS 200 sends an identity request for the User's PC 170, requesting the User's PC 170 to identify the user. Step 222, the User's PC 170 responds to the identity partition by sending a response containing the user's identity to the ÑAS 200. Once the user's identity arrives in the ÑAS 200, in step 224 an access request (identity) is sent to the server 196 AAA. The AAA server 196 checks the identity of the user and sends the access request to the authentication server 194 (step 226). * at ~ ¿,. ^. - » »*. ~. , **? In step 228, the authentication server 194 obtains a RAND and an SRES pair of the AuC 188 in the PLMN 160 (FIGURE 5). Then, in step 230 the authentication server 194 requests that the SMS-C 180 generate an SMS message, which requests the application in the SIM (not shown) of the MS 208 to authenticate the user. In the request it contains the RAND obtained from the AuC 188. The authentication server 194 checks the identity of the user received in step 226 and generates a lexical authentication symbol. In step 232, the lexical authentication symbol is sent to the AAA server 196. The AAA server 196 sends the lexical symbol of the authentication to the User's PC 170 via the ÑAS 200, shown in steps 234 and 236. The lexical symbol of the authentication is displayed to the user on a PC 170 display screen. of the User. In step 238, the MS 208 receives the SMS message containing the RAND and sends it to the SIM authentication application (not shown) of the MS 208. The authentication application processes the message and requests the user PIN code , which can be the PIN code and the SIM. The user enters the PIN code using the login device such as an MS 208 keypad in step 239. The SIM authentication application validates the PIN code. If the user types in a PIN code incorrect, the user has a limited number of re-entries to enter the correct PIN code. If a maximum number of consecutive failures is reached, the application prevents the SIM from accepting a PIN code. If the PIN code corresponds to the code corresponds to the PIN code stored in the SIM, the authentication application prompts the user for the lexical authentication symbol. Still referenced in step 239, the user enters the lexical authentication symbol, which can be displayed on the screen of the User PC 170 (in step 236), using the keyboard of MS 208. The authentication application applies to the algorithm appropriate to the RAND to obtain SRES. The algorithm used can be the GSM authentication algorithm A3, which obtains an SRES from the RAND and a private key stored in the SIM. Then in step 240, the MS 208 sends a short message containing the lexical authentication symbol and the SRES to the SMS-C 180 based on a request by an authentication application. In step 242, the User PC 170 sends a response in the ÑAS 200. The ÑAS 200, in step 244, sends an access request response to the AAA server 196. Step 246, the AAA server 196 sends an access request response to the authentication server 194. Then, in step 248, the SMS-C 180 sends an SMS indication message, which contains the lexical symbol of the Ai. To the authentication and the SRES to the authentication server 194. Once the SMS indication message arrives at the authentication server 194, the authentication server 194 compares the received lexical authentication symbol with the lexical authentication symbol sent to the AAA server 196, and the SRES to the SRES obtained from the AuC. 188. If all the values agree, the user is authenticated. Thus, in step 250, the authentication server 194 sends an access acceptance message to the server 194 AAA, instructing the AAA server 196 to authorize the user's access attempt. Finally, step 252, AAA server 196 confirms acceptance with ÑAS 200. The present invention can be used to authenticate a user when performing e-commerce transactions. FIGURE 7 is a block diagram illustrating a communication system for authenticating a user when performing electronic commerce transactions in accordance with an exemplary embodiment of the invention. The communication system of FIGURE 7 comprises a PLMN 258, a PDN 272, an access network 280, a modem 282, a remote computer 284 and an MS 286. The PLMN 258 comprises a BTS 260, a BSC 262, an MSC / VLR 264, an HLR 268, and an AuC 270, an SMS-C 266 and a billing system 271. The PDN 272 comprises an authentication server 274, a server 276 aa »A of electronic commerce, and a ÑAS 278. The communication system of FIGURE 7 is identical to the communication system of FIGURE 1, except that the authentication entity 60 of FIGURE 1 is replaced with the trading server 276 electronic and the PLMN 258 has a billing system 271, which is connected to the authentication server 174, with the exception of the electronic commerce server 276 and the billing system 271, the components of FIGURE 7 perform the same function as its components corresponding to FIGURE 1 and thus will not be further described herein. The e-commerce server 276 and the authentication server 174 can be located in different PDNs, as long as there is a secure data channel between them, for example, the Ipse tunnel. In addition, the remote computer 284 can be connected to the PDN 272 through other PDNs, for example, the Internet. In this approach, authentication, for example, can be triggered by an electronic commerce application that wishes to authenticate the user for a purchase. The e-commerce server 276 can make contact with the authentication server 274 by means of a secure packet data connection to request the authentication of the user attempting to access. The authentication request can include all the payment information A * Lií ¿? * *: Í * l * * i? H ** relevant, for example, the price, items that are purchased. This application can optionally display in the payment information, for example, the price, in the ME (not shown) of the MS 286. After validating a response received from the application, the authentication server 274 can make contact with a server of authentication. payment, that is, the identity handles the charge for the application of electronic commerce. The payment server can be part of the e-commerce infrastructure or it can be integrated with the network billing system 271, or it can be a payment provider of the Internet. If authentication is successful, the operation of charges is achieved and the authentication server 274 confirms the payment to the electronic commerce server 276 to have user access to the required server or article. In a way, an appropriate error condition is sent to the authentication computer. In this way, the user is denied access to the required service or item. FIGURE 8 is a message sequence diagram illustrating a method for authenticating a user when performing an electronic commerce transaction in accordance with an exemplary embodiment of the present invention. According to FIGURE 8, the method begins at step 350, where the e-commerce server 276 requests the identity of the user. Then, in step 352, the electronic commerce application obtains the identity of the user by means of a response identity of the User PC 284, for example, the user is prompted by a display screen of the User PC 284 to enter his identity. In step 354, the e-commerce server 276 sends the authentication request to the authentication server 274. In addition to the user's identity, the authentication request includes all relevant payment information, for example, price and items that are purchased. In step 356, the authentication server 274 obtains from the AuC 270 in the PLMN 258 (FIGURE 7) a RAND and a pair of SRESs. Then, in step 358, the authentication server 274 requires the SMS-C 266 to generate an SMS message to request the identification application in the SIM (not shown) of the MS 286 to authenticate the user. The request contains the RAND obtained from the AuC 270. Optionally, the request may include the price and the items that are purchased in order to ensure the integrity of such payment / purchase information. The authentication server 274 checks the identity of the user and generates a lexical authentication symbol. In step 360, the lexical authentication symbol is sent to the electronic commerce server 276. Step 362, e-commerce server 276 sends a request for a lexical symbol of _t * Aí * J, £ *** ** a, -, j a. * * *. * * at- *. *, * ************, * i * t * _ ** * *, *. * aaa. tULal i authentication to the user through PC 284 of the User. The User PC 284 displays the request for the lexical authentication symbol to the user. In step 364, the SMS-C 266 sends an SMS message that includes the RAND to the MS 286. The MS 286 receives the message and sends it to the authentication application in the SIM (not shown) of the MS 286. The application The authentication process processes the message and asks the user to enter a PIN code, which can be a SIM PIN code. The user enters the code 10 of PIN through a keyboard of MS 286 in step 365. The authentication application validates the PIN code. The user has a limited number of re-entries to enter the correct PIN code. If the maximum number of consecutive failures is reached, the application prevents the SIM 15 accept a PIN code. If the value corresponds to the PIN code stored in the SIM, the authentication application prompts the user for the lexical authentication symbol. Still with reference to step 365, the user enters the lexical authentication symbol, which is 20 shows on the screen of the User PC 284 (see step 362), using the keyboard of the MS 286. The authentication application applies the appropriate algorithm to the RAND to obtain the SRES. The algorithm used in this approach is the GSM A3 authentication algorithm, which obtains 25 the RAND SRES and a private key stored in the SIM TT JTpttWtt - M * »**** l ^ .í t.« ¡«J. I í * iíj, * i ** ^ **. -. *** a a a -,. - *** **. ^ **** *****, a ^ a * * ", *. _ * ^ *** AMAA A (step 366). The authentication application requires the MS 286 to send an SMS message containing the lexical authentication symbol and the SRES to the SMS-C 266. In step 368, the SMS-C 266 sends the SMS indication message 5 containing the lexical authentication symbol SRES to the authentication server 274. The authentication server 274 compares the lexical authentication symbol received from that sent to the electronic commerce application and the SRES to the SRES obtained from AuC 270. 10 If all the values agree, the authentication server 274 can optionally contact a payment server and send the payment information received from the electronic commerce application to the payment server. Step 370, authentication server 274 generates a 15 charge record (payment information) and transfer it to the billing system 271 of PLMN 258. In this way, the purchase can be included in the billing corresponding to the user's wireless subscription. Once the payment information is communicated, the 20 e-commerce application is informed of the result of the operation. Step 372, the authentication server 274 sends a message to the electronic commerce server 276. Finally, in step 374, the electronic commerce server 276 confirms the operation. The present invention can be implemented in a MtfU ** * *. *. . , ..., ... . - * communication system that uses Unstructured Supplementary Services Data (USSD). FIGURE 9 is a block diagram illustrating a USSD communication system in accordance with an exemplary embodiment of the invention. The communication system of FIGURE 9 comprises a PLMN 400, a PDN 402, an access network 404, a modem 406, a remote computer 408, an MS 410 and a radio link 412. The PLMN 400 comprises a BTS 414, a BSC 416, an MSC / VLR 418, an HLR 420, and an AuC 422. The PDN 402 comprises an authentication server 424, a server 426 of AAA and a NaS 428. The system of The communication of FIGURE 9 is substantially similar to the communication system of FIGURE 1, except that the PLMN 400 does not require an SMS-C. In FIGURE 9 the AuC 422 is connected to the HLR 420 and the HLR 420 is connected to the authentication server 424. In FIGURE 9, the user of MS 410 (not shown) and the operator of PLMN 400 (not shown) the application defined to communicate in a way that MS 410 and the intermediate network are transparent. The handling of USSD is described in ETS 300 625, which is incorporated herein by reference. FIGURE 10 is a message sequence diagram illustrating a method for handling USSD of the communication system shown in FIGURE 9 in accordance with an exemplary embodiment of the present invention. In FIGURE 10, the user initiates communication from the PC 408 of User, which serves as the user's remote access, to the ISP / Intranet (not shown) using a conventional dial-up client application. Once the communication path to ÑAS 428 has been established, the installation process begins. In step 500, the ÑAS 428 sends an identity request to the User PC 408 requesting that the User PC 408 identify the user. In step 502, the User PC 408 responds to the identity request by sending a response containing the user's identity to the ÑAS 428. Once the user's identity arrives in the ÑAS 428, in step 504, an access request (identity) is sent to the AAA server 426. The AAA server 426 checks the identity of the user and sends the access request to the authentication server 424 (step 506). In step 508, the authentication server 424 sends a USSD request to the HLR 420. The HLR transmits the USSD request to the MSC / VLR serving the area where the subscriber is currently located. The MSC / VLR receives the request and sends it to MS through the BSC and the BTS (not shown in the flow). The authentication server 424 also sends an access challenge containing the lexical authentication symbol to the AAA server 426 (step 510). Then in step 512, the AAA server 426 sends the access challenge containing the lexical authentication symbol to the ÑAS 428. In step 514, the ÑAS 428 sends the * «jajj a request that contains the lexical symbol of authentication to the PC 408 of User. Step 516, the MSC / VLR 418 sends a USSD request to the MS 410. In step 518, the user enters the authentication lexical symbol in the MS 410. In step 520, the MS 410 sends a USSD response that contains the authentication lexical symbol MSC / VLR 418. In step 522, the User PC 408 sends a reply message to the ÑAS 428. Then, in step 524, the ÑAS 428 sends an access request containing user identities and the response message to the AAA server 426. The AAA server 426 sends the access request containing the user's identity and the response request to the authentication server 424 (step 526). In step 528, the HLR 420 sends a USSD response containing the lexical authentication symbol to the authentication server 424. In step 530, the authentication server sends an access acceptance message to the AAA server 426. Finally, in step 532, the AAA server 426 sends the message acceptance message to the ÑAS 428. The present invention can be implemented from a communication system using the WAP. The WAP specifies an application structure as well as network protocols for wireless devices. The WAP model is similar to the World Wide Web (WWW), which is optimized to match the characteristics of the wireless environment. The WAP architecture and protocols are specified in the corresponding WAP forum specifications, for example, WAP architecture April 30, 1998, where the latest version is the WAP specification series 1.1. FIGURE 11 is a block diagram illustrating a communication system for the WAP according to an exemplary embodiment of the present invention. The communication system comprises a PLMN 600, a PDN 602, an access network 604, a remote computer 606, an MS 608 containing a WAP browser (not shown) and a radio link 610. The PDN 602 comprises an authentication entity 614, an authentication server 616, a ÑAS 618 and a WAP server 620. The PLMN 600 can be constructed in accordance with GSM standards. The PLMN 600 may comprise a WAP Gateway 612. The WAP gateway 612 can be connected to the WAP server 620 via the communication link 626. The WAP server 620 can be connected to the authentication server 616 via the communication link 628. In FIGURE 11, the MS user and the authentication application in the WAP server 620 communicate in accordance with the WAP specifications defined by the WAP Forum. j a.l i i i i i. Í. **, t - ^ FIGURE 12 illustrates a method for authenticating a user in the communication system shown in FIGURE 11 in accordance with an exemplary embodiment of the present invention. In FIGURE 12, the user requests a service that requires authentication. The method begins at step 700 where the authentication entity 614 sends an identity request to the User PC 606 to identify the user. Step 702, User PC 606 responds to the identity request by sending a response containing the user's identity to authentication entity 614. In step 704, the authentication entity 614 sends an access request to the authentication server 616. In step 706, the authentication server 616 sends a lexical authentication symbol to the authentication entity 614. The authentication server 616 also sends an authentication request to the authentication application within the WAP server 620 (step 708). In step 710, the authentication entity 614 sends the lexical authentication symbol to the User PC 606. The WAP server 620 passes the request through the WAP gateway 612 to the MS 608 (step 712 and 714). In step 716, the user enters the lexical authentication symbol in MS 608. Steps 718 and 720, MS 608 sends a response containing the lexical symbol ***** ^ **** of authentication through the WAP gateway 612 to the WAP server 620. In step 722, the WAP server 620 sends a response containing the lexical authentication symbol to the authentication server 616. Finally in step 724, the authentication server sends an access acceptance message to the authentication entity 614. It will be appreciated by those of ordinary skill in the art that the present invention can be modified into other specific forms without departing from its essential character. Thus, the embodiments described herein should therefore be considered in all respects to be illustrative and not restrictive. r. * B jjj J *****, tjÉÉJm. . * .. * .. *.! t? to,

Claims

CLAIMS 1. A method for authenticating a user that requires access to a packet data network (PDN), comprising the steps of: (a) receiving a request for access to the PDN; (b) generate a lexical authentication symbol; (c) sending the lexical authentication symbol to the user from the PDN via an access network over an unsecured or insured communication link; (d) interrogating the user of the PDN for the lexical authentication symbol via a secured communication link over a public land mobile network (PLMN); (e) sending the lexical authentication symbol received by the user to the PDN via the secured communication link over the public land mobile network (PLMN); and (f) comparing the lexical authentication symbol of step (c) with the lexical authentication symbol of step (e) to determine whether the user has access to the PDN. The method of claim 1, wherein the user has access to the PDN if the lexical authentication symbol of step (c) matches the lexical symbol of the authentication of step (e). 3. The method of claim 1, wherein the aL.- -üiit. l a t «i, ,, * .. * ¿.. a * Í t? » ..... .... ¿¿í *. The user is denied access to the PDN if the lexical authentication symbol of step (c) does not match the lexical authentication symbol of stage (e). The method of claim 1, further comprising the step of using an authentication entity to send a request to an authentication server, wherein the authentication server checks the identity of the user. The method of claim 4, further comprising the step of using the authentication entity to generate the lexical authentication symbol. The method of claim 5, further comprising the step of using the identification server to send the lexical authentication symbol to the PDN. The method of claim 6, wherein the authentication server compares the lexical authentication symbol of step (c) with the lexical authentication symbol of (e). The method of claim 7, wherein step (e) further comprises using a mobile station to send the lexical authentication symbol to the PDN via the PLMN. The method of claim 8, further comprising the step of entering at least a Personal Identification Number (PIN) code or the lexical symbol ? t *, **** *** - £ »of authentication in the mobile station. The method of claim 8, further comprising the step of entering at least a Personal Identification Number (PIN) code or the lexical symbol 5 for authentication on a remote computer, wherein the mobile station is connected to the remote computer via a wired or wireless connection to transmit the PIN code or the lexical authentication symbol from the remote computer to the mobile station via the wired connection 10 or Wireless The method of claim 8, further comprising the step of automatically sending a Personal Identification Number (PIN) code stored in a remote order to the mobile station. 12. The method of claim 8, further comprising the step of sending the lexical authentication symbol from the PDN to a remote computer, wherein the remote computer automatically sends the lexical authentication symbol to the mobile station. 13. The method of claim 8, further comprising the step of performing end-to-end encryption of the information that is transferred between the mobile station and the authentication server through the PLMN. 14. The method of claim 13, which also 25 comprises the steps of using the server authentication to contain an encryption key or formula generation algorithm and use the encryption key or formula generation algorithm to calculate an encryption key per communication session between the mobile station and the authentication server through the PLMN. The method of claim 13, further comprising the steps of using the mobile station to contain an encryption key generation algorithm 10 or formula and use the encryption key or formula generation algorithm to calculate an encryption key per communication session between the mobile station and the authentication server through the PLMN. The method of claim 13, further comprising the steps of using the authentication server to contain an encryption algorithm and applying the encryption algorithm for the information that is transferred between the mobile station and the authentication server by means of the PLMN 17. The method of claim 13, further comprising the steps of using the mobile station to contain an encryption algorithm and applying the encryption algorithm to the information that is transferred between the mobile station and the authentication server by means of the 25 PLMN. Ü? S i8MHMÍÍÍIteffi áá * &tet i ¿a * aa¿aaÍ * .. ** M **** i * *. a -Saaa- aag. a a. -a a- *., aa * f * ** ** ti * ¿aa aa a aja. ** ** * A-. La-aLti 18. The method of claim 8, further comprising the step of questioning the individual authentication key of the user stored in the mobile station of the authentication server when communicating through the PLMN The method of claim 18, further comprising the steps of using the authentication server to compare the result of the user authentication key, and, together with the verification of the lexical authentication symbol, determine whether the user has access to the PDN. The method of claim 18, further comprising the step of using the mobile station to contain an authentication algorithm and generate a response to the statement that can be sent to the authentication server together with the lexical authentication symbol through the PLMN. The method of claim 1, further comprising the step of performing end-to-end encryption of information that is transferred between the user and the PDN once the user has gained access to the PDN. The method of claim 21, further comprising the steps of using the authentication server to contain an encryption key or formula generation algorithm and using the encryption key or formula generation algorithm and using the generation algorithm of encryption key or formula to calculate an encryption key per communication session between the user through the PDN through the access network. The method of claim 21, further comprising the steps of using a mobile station to contain an encryption key or formula generation algorithm and using the encryption key or formula generation algorithm to calculate an encryption key by communication session between the user and the PDN through the access network. The method of claim 21, further comprising the steps of using a mobile station to transfer an encryption key to a remote computer for further use to encrypt the information that is transferred between the user and the PDN once it is the user has gained access to the PDN. The method of claim 21, further comprising the steps of using the PDN to contain an encryption algorithm and applying the encryption algorithm to the information that is transferred between the user and the PDN once the user has earned access to the PDN. 26. The method of claim 21, which also & i * e ** a base transceiver station connected to a base station controller; a mobile switching center / visited position register connected to a short message service center and the base station controller; and a local position register connected to an authentication center. 29. The communication system of claim 28, wherein the remote computer is connected to the network access server through the access network. 30. The communication system of claim 29, where the short message service center is connected to an authentication server. 31. The communication system of claim 30, wherein the authentication server is connected to the local position register. 32. The communication system of claim 31, wherein the authentication server is connected to a Wireless Application Protocol (WAP) server. 33. The communication system of claim 32, wherein the PDN further comprises an authentication entity connected to the authentication server and even a network access server. 34. The communication system of claim 31, wherein the PDN further comprises: an authentication, authorization and account server (.AAA) connected to the authentication server; and a network access server connected to the AAA server. 35. The communication system of the claim 34, wherein the authentication server has the ability to connect to several PLMN interfaces to use at least one Short Message Service, Unstructured Supplementary Services Data or Wireless Application Protocol wireless technologies. 36. The communication system of claim 34, wherein the authentication server is connected to the PLMN by an intermediate gateway system. 37. The communication system of claim 31, wherein the PDN further comprises: an electronic commerce server connected to the network access server and the authentication server; and a billing system connected to the authentication server. 38. The communication system of the claim 37, wherein the mobile station comprises: a mobile equipment; and a subscriber identification module (SIM). 39. The communication system of claim 38, wherein the SIM further comprises, an operating system of i * L *. * d ** iüA i .. ** a * .- SIM, a part of GSM, a SIM Application tool kit and an authentication application, where the SIM operating system together with the equipment of SIM application tools provide the appropriate environment for the authentication application to operate and communicate with the authentication server. 40. The communication system of claim 39, wherein the messages transferred between the authentication application and the authentication server are 10 encrypt. 41. A method for authenticating a user when conducting an electronic commerce transaction comprising the steps of: (a) receiving a request for access to a 15 Data per Package (PDN) Network to analyze the electronic commerce transaction; (b) generate a lexical authentication symbol; (c) contact a payment server that manages the change for an electronic commerce application; 20 (d) sending the lexical authentication symbol to the user from the PDN via an access network over an unsecured or insured communication link; (e) sending the lexical authentication symbol received by the user to the PDN through a channel of 25 secured communication over a public land mobile network g ^ j ^ e ^ HE * * * * * *. > l **. **** iA ^ i *. ,.,. ****?. **. Í (PLMN); and (f) comparing the lexical authentication symbol of step (d) with the lexical authentication symbol of step (e) to determine whether the user performing the electronic commerce transaction is authenticated. 42. The method of claim 41, wherein an authentication server communicates with a payment server to load the user for the electronic commerce transaction. 43. The method of claim 42, wherein the billing information is sent to a billing system. 44. A communication system for authenticating a user that requires access to a Packet Data Network (PDN), comprising: (a) means to receive a request for access to the PDN; (b) means for generating a lexical symbol of authentication; (c) means for sending the lexical authentication symbol to the user from the PDN via an access network over an unsecured or insured communication link; (d) means for sending the lexical authentication symbol received by the user to the PDN by means of a t aalaS? .1 eA *? ***? ***** ... a-a ^,, secure communication channel over a public network mobile network (PLMN); and (e) means for comparing the lexical authentication symbol of step (c) with the lexical authentication symbol of step (d) to determine whether the user gains access to the PDN. 45. The communication system of claim 44, further comprising: (f) means for generating a session key per communication session with a mobile station by means of the PLMN; (g) means for generating the session key per communication session with a remote computer through an access network, once the user has gained access to the PDN; (h) means for placing the authentication key of the individual user stored in the mobile station by the PLMN; (i) means for checking the result of the site with the user's individual key and, together with the verification of the lexical authentication symbol, determining whether the user gains access to the PDN; (j) means for applying an encryption algorithm for the information that is exchanged with the mobile station through the PLMN; Y ?? »k?,? A *** i? * * T * nn» * - - ***** (k) means to apply the encryption algorithm to the information exchanged with the remote computer via the network of access once the user has gained access to the PLMN. * .Í, .Íi, A.Í. * Í ** ** .., *.,.,., *,. **: .. a,, SUMMARY OF THE INVENTION In a communication system, methods and apparatuses that apply GSM security principles to authenticate users that are requiring access to packet data networks is provided. Authentication processes are triggered by an authentication entity when it needs to verify the identity of a user trying to access certain resources, for example, an application of a network. The authentication entity sends an authentication request to an authentication server. The authentication server checks if the identity of the user corresponds to a known user. If so, the authentication server generates a lexical authentication symbol that is sent to the user through an access network and a remote computer. The authentication server uses a secure communication link, via a wireless network, to require the user to send the lexical authentication symbol back to the authentication server via the secure communication link on a public land mobile network. Once the user sends the lexical authentication symbol back to the authentication server via the secure channel, the authentication server compares the lexical authentication symbol sent to the user and received from the user through the secure communication link. If the symbols Authentication lexicons coincide, the authentication server instructs the authentication entity to gain user access to the required services. If the lexical authentication symbols do not match, the user will be denied access to the required services.