Authentication for a commercial transaction using a mobile module

At a computing device in a distributed network environment, a method of authenticating a mobile module of portable device as being tied to a billing account of a mobile infrastructure in order to allow a user access to services, goods, or both, by validating the mobile module over a network independent of the mobile infrastructure's radio network, the method comprising:

• receiving a request to authenticate a mobile module when attempting to gain access to services, goods, or both;
• receiving one or more credentials from the mobile module used by a mobile infrastructure in validating billing account information thereof;
• sending the one or more credentials to the mobile infrastructure over an independent network separate from the mobile infrastructure's radio network;
• and
• receiving over the independent network authentication information corresponding to an activation status for the mobile module's billing account on the mobile infrastructure, thus allowing for a portable digital identity for controlling access to the services, goods, or both.

In a distributed system, a computing framework used to abstract a host computer from a mobile operator system when connecting a mobile module thereto in order to label the host computer as peripheral equipment rather than a mobile terminal subject to strict requirements of the mobile operator system, the computing framework comprising:

• a subscriber identity module (SIM) that includes information associated with a billing account for a mobile operator system;
• a host computer connecting the SIM to the mobile operator system over a network independent of the mobile operator system's radio network in order to authenticate the billing account information for the SIM;
• a SIM driver attached to the host computer for reading information from the SIM for use in at least authenticating the SIM to the mobile operator system over the independent network;
• and
• an interface acting as a firewall between the SIM and the SIM driver that defines a protocol used to protect the SIM from attack by restricting one or more of a number, sequence, or length, of commands sent between the SIM driver and the SIM.

In a computing system tied to a distributed network, a method of establishing transport level secure communications between a client and a server over an otherwise insecure network by establishing a secure tunneling between a mobile module connected to the client and a mobile infrastructure associated therewith in order to delegate session keys to at least a software stack on the client for one or more of encryption or signing purposes, the method comprising:

• identifying one or more credentials of a mobile module connected to a host computer;
• sending the one or more credentials to a mobile infrastructure for authentication of a valid billing account for the mobile module, wherein the request is sent over an independent network separate form a radio network corresponding to the mobile infrastructure;
• and
• based on the authentication, receiving from the mobile module a session key for use in a transport level secure communication over the independent network between the host computer and a server.

At a host computer in a distributed computing system, a method of establishing secure communication between the host computer and a server by using a protocol that authenticates a subscriber identity module (SIM) to a mobile infrastructure over a network connection independent from a radio network associated therewith, the method comprising:

• creating a request for a session key which includes a computed challenge response from a subscription identity module (SIM) attached to a host computer attempting to establish a secure communication with a server, wherein the challenge response is used to authenticate the SIM to a mobile infrastructure that holds billing status information thereof;
• sending the request for a session key to the server, which has a trusted relationship with the mobile infrastructure, the request for the session key sent over a network independent of a radio network related to the mobile infrastructure;
• receiving a response to the request for a session key, which includes the session key and is signed, encrypted, or both, by mobile infrastructure using a shared key, which indicates that the SIM appropriately authenticated to the mobile infrastructure using the challenge response;
• sending the session key to the SIM for validation using the shared key, which establishes a tunneled communication between the SIM and the mobile infrastructure;
• and
• upon validation of the session key, allowing the host computer to use the decrypted session key for secure communicating with the server.