Secure access method, and associated apparatus, for accessing a private IP network

Claim 2

In a method for communicating data between a private data communication network and a remote communication station, the private data communication network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private data communication network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at the network infrastructure; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; the remote communication station identity stored together with authentication data associated with the remote communication station; forwarding a network-access request to the private data communication network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private data communication network; and permitting the remote communication station to access the private data communication network if the remote communication station is determined, during said step of determining, to be permitted to access the private data communication network.

Claim 3

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at the network infrastructure; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; the remote communication station identity stored together with authentication data associated with the remote communication station; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network.

Claim 4

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at the network infrastructure; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; the remote communication station identity stored together with authentication data associated with the remote communication station; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network.

Claim 5

The method of claim 2 wherein the remote communication station comprises a wireless host coupled to a radio transceiver, the radio transceiver operable to communicate with the network infrastructure, and wherein said step of storing comprises storing a wireless host identity, the wireless host identity associated with the wireless host.

Claim 6

The method of claim 3 wherein the wireless host identity is stored at the wireless host.

Claim 7

The method of claim 4 wherein the wireless host identity is stored at the radio transceiver.

Claim 8

The method of claim 5 wherein the radio transceiver comprises a cellular mobile terminal operable in a cellular communication system, the cellular mobile terminal having a memory card, and wherein the wireless host identity is stored at the memory card.

Claim 9

The method of claim 2 wherein the radio communication system comprises a cellular communication system, wherein the remote communication station comprises a wireless host coupled to a radio transceiver and wherein said step of generating the request comprises generating an attach request, the attach request for requesting attachment, by way of a radio link, of the radio transceiver with the network infrastructure of the cellular communication system by way of an air interface formed therebetween.

Claim 10

The method of claim 2 wherein the radio communication system comprises a cellular communication system, wherein the data communicated between the remote communication station and the private IP network comprises packet data, and wherein the request generated during said step of generating is provided to a router which routes packet data.

Claim 11

The method of claim 8 wherein the cellular communication system comprises a GSM communication system and wherein the router to which the request is provided comprises a SGSN (Servicing GPRS Support Node).

Claim 12

The method of claim 2 wherein the radio communication system comprises a cellular communication system, wherein the data communicated between the remote communication station and the private IP network comprises packet-switched data, and wherein the request generated during said step of generating is provided to a router by way of a circuit-switched circuit connection.

Claim 13

The method of claim 10 wherein the cellular communication system comprises a GSM communication system and wherein the router to which the request is provided comprises an MSC/VLR (Mobile Switching Center/Visited Location Register).

Claim 14

The method of claim 2 wherein said step of storing further comprises the step of storing a private IP network identity identifying the private IP network between which the data is communicated with the remote communication station.

Claim 15

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at a storage location; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network; wherein said step of storing further comprises the step of storing a private IP network identity identifying the private IP network between which the data is communicated with the remote communication station; and wherein the IP network-access request forwarded during said step of forwarding is forwarded to the private IP network identified by the private IP network identity stored during said step of storing the private IP network identity.

Claim 16

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at a storage location; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network; wherein said step of storing further comprises the step of storing a private IP network identity identifying the private IP network between which the data is communicated with the remote communication station; and wherein the IP network-access request forwarded during said step of forwarding is forwarded to the private IP network identified by the private IP network identity stored during said step of storing the private IP network identity.

Claim 17

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at a storage location; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network; wherein said step of storing further comprises the step of storing a private IP network identity identifying the private IP network between which the data is communicated with the remote communication station; and wherein said step of generating further comprises the step of generating a wireless-host-provided, IP network identity, the wireless-host-provided, IP network identity identifying the private IP network between which the data is to be communicated with the remote communication station.

Claim 18

In a method for communicating data between a private IP (Internet Protocol) network and a remote communication station, the private IP network coupled to network infrastructure of a radio communication system of which the remote communication station forms a portion, an improvement of a secured-access method of accessing the private IP network by the remote communication station, said method comprising the steps of: storing a remote communication station identity which identifies the remote communication station at a storage location; generating a request by the remote communication station to access the network infrastructure to permit communication of data therethrough; detecting at the network infrastructure the request generated during said step of generating; authenticating the remote communication station to confirm authorization of the remote communication station to communicate by way of the network infrastructure; forwarding an IP network-access request to the private IP network if the remote communication station is authenticated during said step of authenticating, the remote communication station identified by the remote communication station identity stored during said step of storing; determining, responsive to the IP network-access request forwarded during said step of forwarding, whether the remote communication station is permitted to access the private IP network; and permitting the remote communication station to access the private IP network if the remote communication station is determined, during said step of determining, to be permitted to access the private IP network; wherein said step of storing further comprises the step of storing a private IP network identity identifying the private IP network between which the data is communicated with the remote communication station; and wherein said step of generating further comprises the step of generating a wireless-host-provided, IP network identity, the wireless-host-provided, IP network identity identifying the private IP network between which the data is to be communicated with the remote communication station.

Claim 19

The method of claim 14 wherein said step of generating further comprises the step of generating a wireless-host-provided IP network identity, the wireless-host-provided IP network identity identifying the private IP network between which the data is to be communicated with the remote communication station; and wherein the IP network-access request forwarded during said step of forwarding is forwarded to the private IP network identified by the wireless-host-provided IP network identity generated during said step of generating.

Claim 20

The method of claim 2 wherein the remote communication station has associated therewith a default-IP network identity and wherein the IP network-access request forwarded during said step of forwarding is forwarded to the private IP network identified by the default-IP network identity.

Claim 21

The method of claim 2 wherein said step of determining further comprises the step of authenticating an access request to access the private IP network.

Claim 22

The method of claim 2 wherein said step of determining comprises the steps of: storing at the private IP network a list of remote communication station identities which identify remote communication stations permitted to access the private IP network; and comparing the remote communication station identity associated with the IP network-access request forwarded during said step of forwarding with the remote communication station identities stored upon the list.

Claim 23

The method of claim 18 comprising the further step of allocating an address to the remote communication station at the private IP network if the remote communication station is permitted access thereto, the address allocated to the remote communication station for addressing data communicated by the private IP network to the remote communication station.

Claim 24

The method of claim 19 wherein the address allocated during said step of allocating comprises a temporary address, the temporary address identifying the remote communication station for a selected period.

Claim 25

In a radio communication system having a wireless access network, a private data communication network coupled to the wireless access network, and a remote communication station operable selectively to communicate data with the private data communication network by way of the wireless access network, an improvement of apparatus for selectively permitting access to the private data communication network by the remote communication station, said apparatus comprising: a storage element at the wireless access network for storing a remote communication station identity identifying the remote communication station; a detector coupled to the wireless access network, said detector for detecting a request requesting access by the remote communication station to the wireless access network to permit communication of data therethrough; an authenticator coupled to the wireless access network, said authenticator for confirming authorization of the remote communication station to communicate by way of the wireless access network; the remote communication station identity stored together with authentication data associated with the remote communication station; a network access requester coupled to said authenticator, said network access requestor operable responsive to authentication by said authenticator, said network access requester for generating a request to request access to the private data communication network by the remote communication station, the remote communication station identified in the request by the remote communication station identity stored in said storage element; and a determiner associated with the private IP network, said determiner operable responsive to the request requested by said network access requester to determine whether to permit access by the remote communication station to the private data communication network.

Claim 26

In a radio communication system having a wireless access network, a private data communication network coupled to the wireless access network, and a remote communication station operable selectively to communicate data with the private data communication network by way of the wireless access network, an improvement of apparatus for selectively permitting access to the private data communication network by the remote communication station, said apparatus comprising: a storage element at the wireless access network for storing a remote communication station identity identifying the remote communication station; a detector coupled to the wireless access network, said detector for detecting a request requesting access by the remote communication station to the wireless access network to permit communication of data therethrough; an authenticator coupled to the wireless access network, said authenticator for confirming authorization of the remote communication station to communicate by way of the wireless access network; the remote communication station identity stored together with authentication data associated with the remote communication station; a network access requester coupled to said authenticator, said network access requestor operable responsive to authentication by said authenticator, said network access requester for generating a request to request access to the private data communication network by the remote communication station, the remote communication station identified in the request by the remote communication station identity stored in said storage element; and a determiner associated with the private IP network, said determiner operable responsive to the request requested by said network access requester to determine whether to permit access by the remote communication station to the private data communication network.

Claim 27

The apparatus of claim 21 further comprising an address allocator associated with the private IP network, said address allocator for allocating an address to the remote communication station, the address allocated by said address allocator used to address data communicated to the remote communication station by the private IP network.

Claim 28

The apparatus of claim 22 wherein said address allocator comprises a dynamic allocator for dynamically allocating a temporary IP address, the temporary IP address used to address the data communicated to the remote communication station for a selected period.

Claim 29

The apparatus of claim 21 wherein said storage element further stores a private data communication address identifying the private data communication network.