System and method for authentication in public networks

#1. Field of Invention

#The invention relates to a public network and, in particular, to an authentication system and method for public services on a wireless local area network (WLAN).

#2. Related Art

#These and other features, aspects and advantages of the invention will become apparent by reference to the following description and accompanying drawings which are given by way of illustration only, and thus are not limitative of the invention, and wherein:

#FIG. 1 is a structural diagram of the GSM authentication system in the prior art;

#FIG. 2 is a structural diagram of the public WLAN authentication system in the prior art;

#With reference to FIG. 4, the disclosed public WLAN authentication system comprises five types of elements: client end elements, access network end elements, external access network end elements, Internet end elements, and GSM core network end elements. The client end elements include an MS 10 and a WLAN card 20. The access network end elements include an AP 30, a router, and an AA 800 in a WLAN. The AA 800 is connected to an SIM card slot 888 through a computer interface 886. The SIM card slot 888 has an SIM card 88. The computer interface 886 may be an RS232, USB, PCI or PCMCIA bus so that the AA 800 can access the authentication information on the SIM card 88. The external access network end elements include a BS 35, a router 45, and an access right controller (ARC) 600. The Internet end elements include the Internet 50 and a server 60. The GSM core network end elements include an MSC 70, a VLR 75, an AuC 95, an HLR 90, and a BC 80. (The GSM core network end elements are the same as those in FIG. 1.)

#In the structure of FIG. 4, when the MS 10 asks for the Internet services, the MS 10 has to authenticate with the AA 800 and the AA 800 authenticates with the MSC 70 using the SIM card 88 of the MS 10. The authentication communication protocol between the MS 10 and the AA 800 needs not be standard. It can be the remote authentication user service (RADIUS), Kerberos, or the service provider's property. If the MS 10 fails the authentication, the service request is rejected. If the MS 10 passes the authentication, it gains the access right to the BS 30 and the router 40 and is therefore able to obtain the Internet services from the server 60 and connect to the Internet 50. After the MS 10 obtains the Internet services, the router 40 generates a usage record. The AA 800 then produces CDR's according to such usage records for the BC 80.

#With reference to FIG. 5, the disclosed authentication system comprises three authentication elements: an MS 10, an AA 800, and an authentication server 700. The AA 800 has the SIM card 88 of the MS 10, to process authentication with the authentication server 700 on behalf of the MS 10. The authentication server 700 can be the MSC 70 in a GSM network, responsible for the authentication with the SIM card 88. When the MS 10 needs Internet services, it sends out a service request to the AA 800 (signal 510) and processes authentication with the AA 800 (signal 520). If the MS 10 fails the authentication, the service request is rejected. If the authentication is successful, the AA 800 sends out a service request to the authentication server 700 (signal 530). The authentication server 700 sends out an authentication request (signal 540) to the AA 800. The AA 800 uses the SIM card 88 of the MS 10 to process authentication response (signal 550). When the authentication server 700 receives the authentication response 550, it checks whether the authentication is successful. If the authentication is successful, the authentication server 700 notifies the AA 800 of the services accept (signal 560). The AA 800 then notifies the MS 10 of the services accept (signal 570). The AA 800 further allows the MS 10 to connect to the Internet. If the authentication fails, the authentication server 700 notifies the AA 800 of the services reject (signal 580). The AA 800 then notifies the MS 10 of the services reject (signal 590).