Concept for secure wireless roaming

The article below is from makr.dk and should be regarded as out of date. It dates from 2001 and has been retained solely for historical reasons.
The article discusses a system that can provide secure, encrypted access to internal networks from the Internet via a wide variety of access methods.

The system is designed to be based on a PCMCIA card for a laptop, but could in principle be implemented using a CompactFlash card or a device connected to a USB port or similar.
This card is, in principle, a GSM device.
The card must support the various GSM frequencies to ensure the widest possible roaming coverage.
The card must support all types of calls, e.g. HSCSD and GPRS.
As the mobile network evolves, the card must keep pace. The main point is simply global communication via a mobile network.

The card must connect via GPRS using IP to an access server located on the network to which access is required.
Due to the increased cost, HSCSD should only be used sparingly, and only where GPRS is not available. When the card operates via HSCSD, a call is made to a call server connected to the access server.

The card must incorporate a VPN hard token and hardware encryption, which work in conjunction with corresponding hardware on the access server.
This ensures that only people with this card can connect to the access server, even though, in principle, one could connect from any IP address assigned via GPRS on the network one is currently on.

Once this connection has been established, you can transfer IP traffic (or, in principle, other traffic via bridging) to the access server and thus to the internal network.

When you have access to a faster connection than the mobile network, you simply connect to it.
This could be via a modem from a hotel room or via Wi-Fi at home or in an airport.
The software for the card detects (if active) the new connection and establishes a tunnel to the access server via it. The tunnel must, as far as possible, be able to function despite any obstacles that may be present, i.e. NAT, firewalls, proxies, etc.
The access server and the software on the client now negotiate a secure tunnel by exchanging information via the GPRS connection. The client thereby authenticates itself and sends and receives public keys for hardware encryption of the traffic through the tunnel. These keys are regularly renewed via the GPRS connection to ensure the highest possible level of security.
Following this exchange, a secure tunnel to the access server is established, and the software on the client blocks all connections to and from the device, ensuring that all traffic must pass through this tunnel.
This provides a secure, high-speed (i.e. faster than GPRS) connection to the access server and the internal network.

The software must be able to recognise (via negotiation with the access server) when it is connected directly to the internal network, and in that situation must either not route through the access server, or route through an internal access server, should one, for example, wish to have extra security on internal Wi-Fi connections.