# US 7,072,657 B2 · Method and associated apparatus for pre-authentication, preestablished virtual private network in heterogeneous access networks

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 7,072,657 B2
- Document ID: US7072657B2
- Status: Granted
- Kind: B2
- Application number: 10/121,121
- Filed: 2002-04-11
- Published: 2004-09-30
- Granted: 2006-07-04
- Earliest claimed: 2002-04-11
- Assignees: Ntt Docomo, Inc.
- Inventors: Fujio Watanabe; Shahid Shoaib; Jingjun Cao; Shoji Kurakake
- Web page: https://patentgrep.com/patent/US7072657B2

## CPC

- H04W 36/0038: {of security context information}
- H04L 63/0272: {Virtual private networks}
- H04L 63/08: {for authentication of entities (cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32)}
- H04W 36/1443: {between licensed networks}
- H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A method of coordinating the handoff of a mobile carrier between a first access network and a second access network. The method including establishing a contract between a user of a mobile carrier and a hyper operator and attempting a hand off from a first access network that the mobile carrier is currently operating within to a second access network, wherein the attempting includes authenticating at the hyper operator only that the user may have access to the second access network via the contract. Handing off to the second access network if the authenticating is successful.

## Claims

### Claim 1

A network access system serving a mobile device accessing a wide area network from a plurality of access networks, the network access system comprising a network service proxy server which (1) when requested by the mobile device attached to a first one of the access networks, provisioning a first VPN tunnel between a gateway of a private network and a gateway of that first one of the access networks, the first VPN tunnel comprising a first segment between the network service proxy server and the gateway of that first one of the access networks, and a second segment between the network service proxy server and the gateway of the private network, and (2) when the mobile device moves from that first one of the access networks to a second one of the access networks, provisioning a second VPN tunnel between the gateway of the private network and a gateway of that second one of the access networks, the second VPN tunnel comprising a first segment between the network service proxy server and the gateway of that second one of the access networks and a second segment which is the second segment of the first VPN tunnel.

### Claim 2 (depends on 1)

A network access system as in claim 1, wherein the access networks form heterogeneous access networks.

### Claim 3 (depends on 1)

A network access system as in claim 1, wherein the network service proxy server provisions the first VPN tunnel by providing VPN security information to the gateway of the private network and the gateway of the first one of the access networks.

### Claim 4 (depends on 1)

A network access system as in claim 1, wherein the network service proxy server pre-authenticates the mobile device with that second one of the access networks.

### Claim 5 (depends on 1)

A network access system as in claim 1, wherein the network service proxy server pre-establishes the second VPN tunnel with that second one of the access networks.

### Claim 6 (depends on 1)

A network access system as in claim 1, wherein the first segment of the first VPN tunnel and the first segment of the second VPN tunnel use different VPN tunneling protocols at the link layer.

### Claim 7 (depends on 1)

A network access system as in claim 1 wherein the second VPN tunnel comprises a first segment between a second network service proxy server and the gateway of that first one of the access networks, and a second segment between the second network service proxy server and the gateway of the private network.

### Claim 8 (depends on 1)

A network access system as in claim 1 wherein the second VPN tunnel comprises a first segment between a second network service proxy server and the gateway of that first one of the access networks, a second segment between the second network service proxy server and the first proxy server, and a third segment which is the second segment of the first VPN tunnel.

### Claim 9

In a network access system serving a mobile device accessing a wide area network from a plurality of access networks, a method comprising:
providing a network service proxy server;
when requested by the mobile device attached to a first one of the access networks, the network service proxy server provisioning a first VPN tunnel between a gateway of a private network and a gateway of that first one of the access networks, the first VPN tunnel comprising a first seament between the network service proxy server and the gateway of that first one of the access networks, and a second segment between the network service proxy server and the gateway of the private network; and
when the mobile device moves from that first one of the access networks to a second one of the access networks, the network service proxy server provisioning a second VPN tunnel between the gateway of the private network and a gateway of that second one of the access networks, the second VPN tunnel comprising a first segment between the network service proxy server and the gateway of that second one of the access networks and a second segment which is the second segment of the first VPN tunnel.

### Claim 10 (depends on 9)

A method as in claim 9, wherein the access networks form heterogeneous access networks.

### Claim 11 (depends on 9)

A method as in claim 9, wherein the network service proxy server provisions the first VPN tunnel by providing VPN security information to the gateway of the private network and the gateway of the first one of the access networks.

### Claim 12 (depends on 9)

A method as in claim 9, wherein the network service proxy server pre-authenticating the mobile device with that second one of the access networks prior to the mobile device attaching to that second one of the access networks.

### Claim 13 (depends on 9)

A method as in claim 9, wherein the network service proxy server pre-establishes the second VPN tunnel with that second one of the access networks prior to the mobile device attaching to that second one of the access networks.

### Claim 14 (depends on 9)

A method as in claim 9, wherein the first segment of the first VPN tunnel and the first segment of the second VPN tunnel use different VPN tunneling protocols at the link layer.

### Claim 15 (depends on 9)

A method as in claim 9, wherein the second VPN tunnel comprises a first segment between a second network service proxy server and the gateway of that first one of the access networks, and a second segment between the second network service proxy server and the gateway of the private network.

### Claim 16 (depends on 9)

A method as in claim 9, wherein the second VPN tunnel comprises a first segment between a second proxy server and the gateway of that first one of the access networks, a second segment between the second network service proxy server and the first proxy server, and a third segment which is the second segment of the first VPN tunnel.