A replay attack from an unauthorized user is easily avoided by wireless communication authentication. A mobile node acquires an inherent identification number owned by a base station connected to the mobile node, and sends authentication packet data including the identification number and information providing transfer route information for packet data sent to the mobile node through a wireless link. A router holds an inherent identification number owned by a base station connected to the router, and, if the identification number held by the router agrees with the identification number included in the authentication packet data sent from the mobile node, registers the transfer route information in a route table based on the authentication packet data.
|
1. A wireless communication authentication system comprising a mobile node connected to a base station through a wireless link and an authentication apparatus that authenticates authentication packet data sent from said mobile node,
wherein said mobile node acquires an identification number of said base station through which said mobile node is connected to said authentication apparatus, calculates an authentication code using information including said identification number, a highest-level router number, and a mobile unit identifier and using a secret key that can be recognized by only said mobile node and said authentication apparatus, generates authentication packet data from said information and said authentication code, and sends said authentication packet data to said authentication apparatus through said base station; and
wherein said authentication apparatus holds an identification number of a base station that is connected to and operates under said authentication apparatus, calculates the authentication code using said information in said authentication packet data and said secret key that said authentication apparatus recognizes, determines that authentication is successful when the calculated authentication code agrees with said authentication code included in said authentication packet data and when said identification number included in said authentication packet data agrees with said identification number that said authentication apparatus holds.
3. A wireless communication authentication system comprising a mobile node connected to a base station through a wireless link, and an authentication server connected to said base station and that authenticates authentication packet data sent from said mobile node;
wherein said mobile node acquires an identification number of said base station through which said mobile node is connected to said authentication server, calculates an authentication code using information including said identification number, a highest-level router number, and a mobile unit identifier and using a secret key that can be recognized by only said mobile node and said authentication server, generates authentication packet data from said information and said authentication code, and sends said authentication packet data to said authentication server through said base station; and
wherein said authentication server holds an identification number of a base station that is connected to and operates under said authentication server, calculates the authentication code using said information in said authentication packet data and said secret key that said authentication server recognizes, determines that authentication is successful when the calculated authentication code agrees with said authentication code included in said authentication packet data and when said identification number included in said authentication packet data agrees with said identification number that said authentication server holds.
2. A wireless communication authentication system comprising a mobile node connected to a base station through a wireless link and an authentication apparatus that authenticates authentication packet data sent from said mobile node,
wherein said mobile node acquires an identification number of said base station through which said mobile node is connected to said authentication apparatus, calculates an authentication code using information including said identification number, a highest-level router number, and a mobile unit identifier and using a secret key that can be recognized by only said mobile node and said authentication apparatus, generates authentication packet data from said information and said authentication code, and sends said authentication packet data to said authentication apparatus through said base station; and
wherein said authentication apparatus is connected to an authentication server, and said authentication server holds an identification number of a base station that is connected to and operates under said authentication apparatus, calculates the authentication code using said information in said authentication packet data and said secret that said authentication apparatus recognizes, determines that authentication is successful when the calculated authentication code agrees with said authentication code included in said authentication packet data and when said identification number included in said authentication packet data agrees with said identification number that said authentication server holds.
5. A method to be carried out by an authentication server for authenticating the connection of a mobile node connected to a base station through a wireless link, to said base station, based on authentication packet data sent from said mobile node, comprising the steps of:
controlling said mobile node to acquire an identification number of said base station through which said mobile node is connected to said authentication server, calculate an authentication code using information including said identification number, a highest-level router number, and a mobile unit identifier and using a secret key that can be recognized by only said mobile node and said authentication server, generate authentication packet data from said information and said authentication code, and send said authentication packet data to said authentication server through said base station;
holding, by said authentication server, an identification number of a base station that is connected to and operates under said authentication server;
controlling said authentication server to calculate the authentication code using said information in said authentication packet data and said secret key that said authentication server recognizes, and determine that authentication is successful when the calculated authentication code agrees with said authentication code included in said authentication packet data and when said identification number included in said authentication packet data agrees with said identification number of said base station that said authentication server holds; and
when the authentication is successful, permitting said mobile node to connect to said base station.
4. A method to be carried out by a wireless communication authentication system for authenticating, with authentication packet data, data for registering transfer route information for packet data to be sent to a mobile node connected to a base station through a wireless link, in a route table owned by an authentication apparatus that authenticates said packet data as authentication packet data, said method comprising the steps of:
controlling said mobile node to acquire an identification number of said base station through which said mobile node is connected to said authentication apparatus, calculate an authentication code using information including said identification number, a highest-level router number, and a mobile unit identifier and using a secret key that can be recognized by only said mobile node and said authentication apparatus, generate authentication packet data from said information and said authentication code, and send said authentication packet data to said authentication apparatus through said base station;
holding, by said authentication apparatus, an identification number of a base station that is connected to and operates under said authentication apparatus;
calculating the authentication code using said information in said authentication packet data and said secret key that said authentication apparatus recognizes, and determining that authentication is successful when the calculated authentication code agrees with said authentication code included in said authentication packet data and when said identification number included in said authentication packet data agrees with said identification number of said base station that said authentication apparatus holds; and
when the authentication is successful, registering said transfer route information in said route table based on said authentication packet data.
6. A wireless communication authentication system according to
7. A wireless communication authentication system according to
8. A wireless communication authentication system according to
9. A wireless communication authentication system according to
10. A wireless communication authentication system according to
|
1. Field of the Invention
The present invention relates to a wireless communication authentication system and a wireless communication authentication method for excluding an unauthorized user from a network that is connected to a wireless communication area.
2. Description of the Related Art
Generally, wireless communication systems need to authenticate legitimate users who are going to use the network in order to exclude an unauthorized user who would attempt to intercept data sent from a mobile node owned by a legitimate user to a wireless link and abuse the network based on the intercepted data.
A wireless communication authentication process which is carried out in the conventional host routing hierarchical network shown in
It is assumed that mobile node 105 is currently present in an area covered by base station 104-2 and is connected to base station 104-2 through a wireless link. Therefore, data sent from mobile node 105 travels through a communication route extending from mobile node 105 through base station 104-2, router 103-1, router 102-1 to router 101. The communication route is held in route tables that are owned respectively by routers 101, 102-1, 103-1.
Thereafter, mobile node 105 moves from the area covered by base station 104-2 into an area covered by base station 104-3.
When mobile node 105 moves, it sends route update data to base station 104-3 (step 301). The route update data includes the identifier of a destination router, the identifier of mobile node 105, a time stamp or a sequence number.
When the route update data sent from mobile node 105 is received by base station 104-3 (step 302), the received route update data is sent from base station 104-3 to router 103-2 (step 303).
When the route update data sent from base station 104-3 is received by router 103-2 (step 304), the received route update data is sent from router 103-2 to authentication server 106 (step 305).
When the route update data sent from router 103-2 is received by authentication server 106 (step 306), the received route update data is authenticated by authentication server 106 (step 307).
The route update data includes an authentication code in addition to the items described above. The authentication code is calculated by a hash function from a secret key and the above items, other than the authentication code, of the route update data. The secret key can be recognized by only authentication server 106 and mobile node 105. In step 307, the route update data is authenticated by recalculating the authentication code and determining whether the received authentication code is correct or not.
Even if the route update data is intercepted and used by an unauthorized user in the wireless zone between mobile node 105 and base stations 104-1 through 104-8, the route update data thus intercepted and used is rejected as incorrect data. Specifically, since the route update data includes the time stamp or the sequence number, authentication server 106 detects a duplication of the time stamp or the sequence number and judges that the duplicated route update data is used by an unauthorized user.
When authentication server 106 authenticates the route update data, authentication server 106 sends an authentication result to router 103-2 (step 308).
When the authentication result sent from authentication server 106 is received by router 103-2 (step 309), if the authentication result is GOOD, then the route table in router 103-2 is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station 104-3 (step 310). At this time, the route table in router 103-2 is updated such that data to be sent to mobile node 105 will be routed through base station 104-3. If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.
After the route table in router 103-2 is updated, the route update data is sent from router 103-2 to router 102-1 (step 312). Based on the received route update data and information indicating that the route update data is sent from router 103-2, the route table in router 102-1 is updated (step 313). At this time, the route table in router 102-1 is updated such that data to be sent to mobile node 105 will be routed through router 103-2.
Router 101 which is higher in level than router 102-1 already has route information with respect to mobile node 105 and the route information does not need to be changed. Therefore, the route update data is not sent from router 102-1 to router 101.
However, because one common authentication server is used to authenticate the route update data in routers 103-1 through 103-4, problems arise as follows:
When a mobile node switches base stations which the mobile node connected to according to a technique known as handover for wireless communication systems, the authentication server authenticates the connected user for the base station which is newly connected to the mobile node. If the authentication server is widely spaced from the newly connected base station, then an authentication packet transmitted between the authentication server and the base station suffers a transmission delay, possibly resulting in a communication failure time upon handover.
It has been considered to reduce the transmission delay time by placing a plurality of authentication servers in respective positions close to the base stations or designing the base stations such that they also serve as authentication servers.
However, the above solutions make it possible for an unauthorized user to use the network based on a replay attack. The replay attack is one of hacking attempts to eavesdrop on the password or the encryption key of a user and use it to masquerade the user.
A wireless communication authentication process which is carried out in the wireless communication authentication system shown in
It is assumed that mobile node 205 is currently present in an area covered by base station 204-2 and is going to be connected to base station 204-2 through a wireless link. Mobile node 205 sends route update data to base station 204-2 (step 401). The route update data includes the identifier of a destination router, the identifier of mobile node 205, a time stamp or a sequence number.
When the route update data sent from mobile node 205 is received by base station 204-2 (step 402), the received route update data is sent from base station 204-2 to authentication-capable router 203-1 (step 403).
When the route update data sent from base station 204-2 is received by authentication-capable router 203-1 (step 404), the received route update data is authenticated by authentication-capable router 203-1 (step 405).
The route update data includes an authentication code in addition to the items described above. The authentication code is calculated by a hash function from a secret key and the above items, other than the authentication code, of the route update data. The secret key is recognized by only authentication-capable routers 203-1 through 203-4 and mobile node 205. In step 405, the route update data is authenticated by recalculating the authentication code and determining whether the received authentication code is correct or not.
If the authentication result produced by authentication-capable router 203-1 is GOOD, then the route table in authentication-capable router 203-1 is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station 204-2 (step 406). At this time, the route table in authentication-capable router 203-1 is updated such that data to be sent to mobile node 205 will be routed through base station 204-2. If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.
After the route table in authentication-capable router 203-1 is updated, the route update data is sent from authentication-capable router 203-1 to router 202-1 (step 407).
When the route update data sent from authentication-capable router 203-1 is received by router 202-1 (step 408), the route table in router 202-1 is updated based on the received route update data and information indicating that authentication-capable router from which the route update data has been sent is authentication-capable router 203-1 (step 409). At this time, the route table in router 202-1 is updated such that data to be sent to mobile node 205 will be routed through authentication-capable router 203-1. Thereafter, the route update data is sent from router 202-1 to router 201 (step 410).
The route update data sent from mobile node 205 to base station 204-2 in step 401 is intercepted by mobile node 207 owned by an unauthorized user who is present in the area covered by base station 204-3 (step 411). Mobile node 207 masquerades mobile node 205 and sends the intercepted route update data to base station 204-3 (step 412). The route update data sent from mobile node 207 is received by base station 204-3 (step 413). The received route update data is sent from base station 204-3 to authentication-capable router 203-2 (step 414).
When the route update data sent from base station 204-3 is received by authentication-capable router 203-2 (step 415), the received route update data is authenticated by authentication-capable router 203-2 (step 416).
Unlike authentication server 106 shown in
If the authentication result produced by authentication-capable router 203-2 is GOOD, then the route table in authentication-capable router 203-2 is updated based on the route update data which has been authenticated and information indicating that the base station to which the route update data has been sent is base station 204-3 (step 417). At this time, the route table in authentication-capable router 203-2 is updated such that data to be sent to mobile node 205 will be routed through base station 204-3. If the authentication result is NOT GOOD, then the route table is not updated, and the authentication process is put to an end.
After the route table in authentication-capable router 203-2 is updated, the route update data is sent from authentication-capable router 203-2 to router 202-1 (step 418).
When the route update data sent from authentication-capable router 203-2 is received by router 202-1 (step 419), the route table in router 202-1 is updated based on the received route update data and information indicating that authentication-capable router from which the route update data has been sent is authentication-capable router 203-2 (step 420). At this time, the route table in router 202-1 is updated such that data to be sent to mobile node 205 will be routed through authentication-capable router 203-2.
As described above, the communication route to legitimate mobile node 205, which has been updated in step 409, is changed by mobile node 207 that has impersonated mobile node 205. Consequently, legitimate mobile node 205 is no longer able to use the wireless communication authentication system.
In view of the above problems, a process of excluding an unauthorized user is disclosed in JP-1995-203540A. According to the disclosed process, the base stations of a wireless communication network have respective authenticating functions. When a mobile node sends a connection request to a base station, the base station sends an inherent identification number of its own to the mobile node. The mobile node generates an authentication code as well as other route information based on the identification number, adds the authentication code to route update data, and sends the route update data to the base station. The base station determines, based on its authenticating function, whether the identification number included in the received route update data is the same as the identification number of the base station or not. An unauthorized user who has sent route update data including a different identification number is thus excluded.
The process disclosed in the above patent document is problematic in that many base stations installed in a wireless communication area need to have respective authenticating functions, and an edge router has to recognize whether all base stations connected to and operable under the edge router have respective authenticating functions or not. In addition, if there is a base station having no authenticating function, then the edge router is required to perform some authenticating process on its own.
It is an object of the present invention to provide a wireless communication authentication system and a wireless communication authentication method which are capable of performing a quick authentication process for avoiding a replay attack carried out by an unauthorized user, without the need for the addition of authenticating functions to respective base stations.
According to the present invention, a mobile node acquires an inherent identification number owned by a base station connected to the mobile node. The mobile node sends authentication packet data including the acquired identification number and information providing transfer route information through the base station to a router. If the identification number of the base station which is included in the authentication packet data sent from the mobile node and received by the router and an inherent identification number held by the router and owned by a base station connected to the router agree with each other, then the transfer route information is registered in a route table in the router based on the authentication packet data.
As described above, only if the identification number of the base station which is included in the authentication packet data sent from the mobile node agrees with the identification number of the base station which is held by the router, the transfer route information is registered in the route table in the router based on the authentication packet data. Even if an unauthorized user intercepts authentication packet data on a wireless link and sends the intercepted authentication packet data to a different router, the identification number of the base station which is included in the authentication packet data and the identification number of the base station which is held by the router do not agree with each other, and no transfer route information is registered in the route table. Consequently, a transfer route based on the data sent from the unauthorized user is not established, and the unauthorized user is excluded from the network. If the function according to the present invention is provided in the router, then the function does not need to be provided in each of a number of base stations installed in a wireless area. Furthermore, each of routers used independently operates to perform the above sequence, a high-speed authentication process can be carried out.
The above and other objects, features, and advantages of the present invention will become apparent from the following description with reference to the accompanying drawings which illustrate examples of the present invention.
1st Embodiment:
As shown in
As shown in
A wireless communication authentication process which is carried out in the wireless communication authentication system shown in
It is assumed that mobile node 5 has been connected to base station 4-2 and moves such that the base station to which mobile node 5 is connected changes from base station 4-2 to base station 4-3.
When mobile node 5 moves from an area covered by base station 4-2 to an area covered by base station 4-3, mobile node 5 establishes its connection to base station 4-3. Mobile node 5 sends a signal for requesting a base station ID representing an inherent identification number owned by base station 4-3 (step 801).
When the signal for requesting a base station ID is sent from mobile node 5, the signal is received by base station 4-3 (step 802).
When the signal for requesting a base station ID is received by base station 4-3, base station 4-3 sends the base station ID representing its own inherent identification number to mobile node 5 (step 803). The base station ID sent from base station 4-3 is received by mobile node 5 (step 804). The base station ID may be any inherent number for identifying a base station. For example, the base station ID may be an IP address or the latitude and longitude of a location where base station 4-3 is installed.
When the base station ID of base station 4-3 is received by wireless communication unit 22 of mobile node 5, the received base station ID is stored in base station connection information storage unit 25 by wireless controller 23. Route update data generator 21 generates route update data as authentication packet data from the stored base station ID, a highest-level router number as a destination of packet data representing transfer route information, a mobile unit identifier stored in user information storage unit 24, and a first authentication code that is generated from the above items of information and the secret key (step 805). The highest-level router number as a destination is an inherent identification number held by router 1, and may be an IP address or the like of router 1.
When the route update data is generated, the generated route update data is sent from wireless communication unit 22 to base station 4-3 (step 806). When the sent route update data is received by base station 4-3 (step 807), the received route update data is sent from base station 403 to authentication-capable router 3-2 (step 808).
When the route update date sent from base station 4-3 is received by base station communication unit 11 of authentication-capable router 3-2 (step 809), the received route update data is output from base station communication unit 11 to packet transfer unit 12. The route update data that is supplied to packet transfer unit 12 is transferred therefrom to route update data processor 14.
When the route update data is supplied to route update data processor 14, the route update data is authenticated by user authenticator 15.
Specifically, user authenticator 15 retrieves user information stored in user information storage unit 18, using as a retrieval key the mobile unit identifier included in the route update data. User authenticator 15 calculates a second authentication code using the secret key that is included in the user information that has been retrieved. User authenticator 15 compares the calculated second authentication code with the first authentication code included in the route update data (step 810).
If the retrieval of user information fails or the calculated second authentication code does not agree with the first authentication code included in the route update data, then the route update data is recognized as incorrect data, and the wireless communication authentication process is terminated.
If the calculated second authentication code agrees with the first authentication code included in the route update data, then base station manager 16 determines whether the base station ID included in the route update data is the base station ID of a base station that is connected to and operates under its own router, i.e., authentication-capable router 3-2 (step 811).
If base station manager 16 judges that the base station ID included in the route update data agrees with the base station ID, which is stored in base station information storage unit 19, of a base station that is connected to and operates under its own router, then base station manager 16 sends an agreement signal to route update data processor 14. Route update data processor 14 instructs packet transfer unit 12 to generate a route based on the route update data.
Packet transfer unit 12 now generates or updates a route for packet data sent from router 2-1 as a higher-level router for mobile node 5 (step 812). At this time, the route update data of mobile node 5 has been received through base station 4-3 by authentication-capable router 3-2. Therefore, the route to base station 4-3 is stored in route table storage unit 17 as a route for packet data sent from router 2-1 for mobile node 5.
If base station manager 16 judges that the base station ID included in the route update data does not agree with the base station ID, which is stored in base station information storage unit 19, of a base station that is connected to and operates under its own router, then the route update data is recognized as incorrect data, and the wireless communication authentication process is terminated.
Thereafter, higher-level router communication unit 13 sends the route update data to router 2-1 as a higher-level router (step 813).
When the route update data is received by router 2-1 (step 814), the route table in router 2-1 is updated based on the route update data (step 815).
2nd Embodiment:
A wireless communication authentication system according to a second embodiment of the present invention will be described below particularly with respect to a process of authenticating a connection to a wireless LAN base station according to the protocol of IEEE802.1x, for example.
As shown in
As shown in
As shown in
A wireless communication authentication process which is carried out in the wireless communication authentication system shown in
It is assumed that mobile node 33 is currently present in an area covered by base station 32-2. Mobile node 33 establishes its connection to base station 32-2, and sends a signal for requesting a base station ID representing an inherent identification number owned by base station 32-2 (step 1201).
When the signal for requesting a base station ID is sent from mobile node 33, the signal is received by base station 32-2 (step 1202).
When the signal for requesting a base station ID is received by base station 32-2, base station 32-2 sends the base station ID representing its own inherent identification number to mobile node 33 (step 1203). The base station ID sent from base station 32-2 is received by mobile node 33 (step 1204). The base station ID may be any inherent number for identifying a base station. For example, the base station ID may be an IP address or the like.
When the base station ID of base station 32-2 is received by wireless communication unit 51 of mobile node 33, the received base station ID is stored in base station connection information storage unit 55 by wireless controller 53. The stored base station ID is indicated to EAP processor 52.
Thereafter, EAP processor 52 generates an EAPOL (EAP over LAN) start packet for starting an authentication process according to the protocol of IEEE802.1x (step 1205). The generated EAPOL start packet is sent from wireless communication unit 51 to base station 32-2 (step 1206). When the sent EAPOL start packet is received by base station 32-2 (step 1207), an EAP request packet of an authentication request type depending on the received EAPOL start packet is sent from base station 32-2 to mobile node 33 (step 1208). The sent EAP request packet is received by mobile node 33 (step 1209). The EAPOL start packet and the EAP request packet will not be described in detail below as existing packets are used as the EAPOL start packet and the EAP request packet.
When the EAP request packet is received by wireless communication unit 51 of mobile node 33, EAP processor 52 generates an EAP response packet representing authentication packet data serving as route update data, from the base station ID stored in base station connection information storage unit 55, information as to a destination of packet data representing transfer route information registered in router 31-1, a user name and a sequence number stored in user information storage unit 54, and a first authentication code that is generated from the above items of information and the secret key (step 1210). The information as to a destination of packet data is an inherent identification number owned by a destination of packet data sent from mobile node 33, may be an IP address or the like of the destination.
When the EAP response packet is generated, the generated EAP response packet is sent from wireless communication unit 51 to base station 32-2 (step 1211). When the EAP response packet sent from wireless communication unit 51 is received by base station 32-2 (step 1212), the received EAP response packet is encapsulated into a RADIUS access request packet (step 1213), which is sent from base station 32-2 to RADIUS server 34-1 (step 1214).
When the RADIUS access request packet is received by communication controller 41 of RADIUS server 34-1 (step 1215), the received RADIUS access request packet is transferred to RADIUS processor 42. RADIUS processor 42 extracts the EAP response packet from the RADIUS access request packet (step 1216).
The extracted EAP response packet is output from RADIUS processor 42 to EAP processor 43, which determines whether the EAP response packet supplied to EAP processor 43 has been sent from a legitimate user or not.
Specifically, user authenticator 44 retrieves user information stored in user information storage unit 46, using as a retrieval key the user name included in the EAP response packet. User authenticator 44 calculates a second authentication code using the secret key that is included in the user information that has been retrieved. User authenticator 44 compares the calculated second authentication code with the first authentication code included in the EAP response packet (step 1217).
If the retrieval of user information fails or the calculated second authentication code does not agree with the first authentication code included in the EAP response packet, then the EAP response packet is recognized as incorrect data, and the wireless communication authentication process is terminated.
If the calculated second authentication code agrees with the first authentication code included in the EAP response packet, then base station manager 45 determines whether the base station ID included in EAP response packet is the base station ID of a base station that is connected to and operates under its own router, i.e., router 31-1 (step 1218).
Base station manager 45 determines whether the base station ID included in the EAP response packet agrees with the base station ID, which is stored in base station information storage unit 47, of a base station connected to and operable under router 31-1 that is connected to RADIUS server 34-1 or not. If the base station IDs agree with each other, then base station manager 45 sends an agreement signal to EAP processor 43. Then, EAP processor 43 indicates an authentication success to RADIUS processor 42, which sends a RADIUS access permission packet through communication controller 41 to base station 32-2 (step 1219). At this time, router 31-1 on the route for the RADIUS access permission packet going from RADIUS server 34-1 to base station 32-2 recognizes that the connection of mobile node 33 to the wireless communication authentication system is permitted. The route table is updated for transferring packet data sent from external network 40 for mobile node 33 to base station 32-2.
When the RADIUS access permission packet is received by base station 32-2 (step 1220), base station 32-2 sends an EAP authentication success packet to mobile node 33 (step 1221). The EAP authentication success packet sent from base station 32-2 is received by mobile node 33 (step 1222), starting packet communications between mobile node 33 and external network 40.
Therefore, even though no authenticating function is present in routers 31-1, 31-2, a high-speed authentication process can be performed by authentication servers provided respectively near routers 31-1, 31-2.
When the authentication process is performed, RADIUS servers 34-1, 34-2 may send encryption keys to base stations 32-1 through 32-8 and mobile node 33.
RADIUS servers 34-1, 34-2 shown in
The numbers of routers 1, 2-1, 2-2, 31-1, 31-2, authentication-cable routers 3-1 through 3-4, RADIUS servers 34-1, 34-2, and base stations 4-1 through 4-8, 32-1 through 32-8, and the number of hierarchical levels thereof are not limited to the illustrated numbers.
While preferred embodiments of the present invention have been described using specific terms, such description is for illustrative purposes only, and it is to be understood that changes and variations may be made without departing from the spirit or scope of the following claims.
Patent | Priority | Assignee | Title |
Patent | Priority | Assignee | Title |
6304968, | Feb 04 1997 | Robert Bosch GmbH | Method and device for assigning an authorization device to a base station |
6668166, | Jun 23 1999 | Alcatel-Lucent USA Inc | Apparatus and method for mobile authentication employing international mobile subscriber identity |
6891819, | Sep 05 1997 | Kabushiki Kaisha Toshiba | Mobile IP communications scheme incorporating individual user authentication |
6973068, | Sep 05 1997 | Kabushiki Kaisha Toshiba | Mobile IP communication scheme incorporating individual user authentication |
7095857, | Mar 19 2001 | NEC Corporation | Key distribution system for protection of route-update notification in micromobility networks |
7177848, | Apr 11 2000 | MasterCard International Incorporated | Method and system for conducting secure payments over a computer network without a pseudo or proxy account number |
20020018569, | |||
20030169713, | |||
20040088544, | |||
20040240411, | |||
20050014515, | |||
20050191992, | |||
20050249225, | |||
20060004643, | |||
20060034238, | |||
20060101273, | |||
JP11161618, | |||
JP2000341749, | |||
JP2001266277, | |||
JP2002281010, | |||
JP2002300152, | |||
JP2004274602, | |||
JP7203540, |
Executed on | Assignor | Assignee | Conveyance | Frame | Reel | Doc |
Jun 09 2006 | WATANABE, YOSHIKAZU | NEC Corporation | ASSIGNMENT OF ASSIGNORS INTEREST SEE DOCUMENT FOR DETAILS | 018010 | /0398 | |
Jun 19 2006 | NEC Corporation | (assignment on the face of the patent) | / |
Date | Maintenance Fee Events |
Aug 08 2019 | M1551: Payment of Maintenance Fee, 4th Year, Large Entity. |
Aug 16 2023 | M1552: Payment of Maintenance Fee, 8th Year, Large Entity. |
Date | Maintenance Schedule |
Feb 23 2019 | 4 years fee payment window open |
Aug 23 2019 | 6 months grace period start (w surcharge) |
Feb 23 2020 | patent expiry (for year 4) |
Feb 23 2022 | 2 years to revive unintentionally abandoned end. (for year 4) |
Feb 23 2023 | 8 years fee payment window open |
Aug 23 2023 | 6 months grace period start (w surcharge) |
Feb 23 2024 | patent expiry (for year 8) |
Feb 23 2026 | 2 years to revive unintentionally abandoned end. (for year 8) |
Feb 23 2027 | 12 years fee payment window open |
Aug 23 2027 | 6 months grace period start (w surcharge) |
Feb 23 2028 | patent expiry (for year 12) |
Feb 23 2030 | 2 years to revive unintentionally abandoned end. (for year 12) |