Access through non-3GPP access networks

• US 10,356,619 B2
• Filed: 03/13/2018
• Issued: 07/16/2019
• Est. Priority Date: 04/11/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Naslund, Mats, Arkko, Jari, Blom, Rolf, Lehtovirta, Vesa Petteri, Norrman, Karl, Rommer, Stefan, Sahlin, Bengt
• Primary Examiner(s): Su, Sarah
• Application Number:
  US15/919,404
• Publication Number:
  US 20180206118A1
• Time in Patent Office: 490 Days
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 72/53 based on regulatory allocation policies

Abstract

A user equipment receives an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA′) message, from an authentication server related to the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through an access network. The user equipment sets up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP AKA′ message indicating that the access network is untrusted.

Claims

1. A method performed by a user equipment for communication through an access network, the method comprising:

receiving an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA′

) message, from an authentication server related to the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through the access network; and

setting up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP AKA′

message indicating that the access network is untrusted.

2. The method of claim 1, wherein the authentication server is a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a home network of the user equipment.

3. The method of claim 1, wherein the authentication procedure is based on EAP AKA′

.

4. The method of claim 1, further comprising:

obtaining information from the message indicating at least one protocol to be used for communication along the connection to be established; and

using the at least one protocol in establishing the connection through the access network.

5. A user equipment for communication through an access network, the user equipment comprising:

one or more processing circuits configured to;

receive an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA′

) message, from an authentication server related to the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through the access network; and

set up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP AKA′

message indicating that the access network is untrusted.

6. The user equipment of claim 5, wherein the one or more processing circuits are further configured to:

obtain information from the message indicating at least one protocol to be used for communication along the connection to be established; and

use said at least one protocol in establishing the connection through the access network.

7. The user equipment of claim 5, wherein the authentication server is a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a home network of the user equipment.

8. The user equipment of claim 5, wherein the authentication procedure is based on EAP AKA′

.

9. An authentication server related to a user equipment, the authentication server comprising:

one or more processing circuits configured to;

participate in an authentication procedure that establishes connectivity from the user equipment through an access network;

generate an Extensible Authentication Protocol Authentication and Key Agreement Prime (EAP AKA′

) message indicating whether or not the access network is trusted;

send the EAP AKA′

message to the user equipment, as part of the authentication procedure, before the user equipment has established a connection through the access network.

10. The authentication server of claim 9, wherein the authentication server is a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a home network of the user equipment.

11. The authentication server of claim 9, wherein the authentication procedure is based on EAP AKA′

.

12. The authentication server of claim 9, wherein to generate the EAP AKA′

message, the one or more processing circuits are further configured to include information indicating at least one protocol to be used for communication along the connection to be established.