Method for processing location information relating to a terminal connected to a packet network via a cellular network

• US 20010055394A1
• Filed: 05/23/2001
• Published: 12/27/2001
• Est. Priority Date: 05/24/2000
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Technologies Oy (Nokia Corporation)
• Inventors: Vanttinen, Veijo, Tang, Haitao
• Granted Patent: US 8,781,123 B2
• Time in Patent Office: Days
• US Class Current: 380/258
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 63/126 the source of the received data
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/106 Packet or message integrity
• CPC Class Codes: H04W 12/108 Source integrity

Abstract

A method (400) for processing location information relating to a certain mobile station in a cellular network is presented. The method involves a first network element, which is connected to the cellular network, and second and third network elements, which are connected to a packet data network. The first network receives (401) a location information request (201) relating to the mobile station from a second network element. A security document relating to the second network element is requested (404) from a third network element; establishment (406) of one security association pointing from the second network element to the first network element and involving information is the security document is initiated; after successful establishment of said security association, the data origin of the location service request is authenticated (408); and after successful authentication, a location procedure relating to the mobile station in the cellular network is initiated (410). Also a network element (900), a packet data device (950) and a mobile station (901) are presented.

Claims

1. A method (400) for processing location information, which is related to a certain mobile station in a cellular network, the method comprising the step of:

a first network element, which is connected to the cellular network, receiving (401) a location information request (201) relating to the mobile station from a second network element, which is connected to a packet data network,

requesting (404) from a third network element, which is connected to the packet data network, a security document relating to the second network element,

initiating the establishment (406) of at least one security association, which security association specifies at least data origin authentication and points from the second network element to the first network element and which establishment involves use of information comprised in the security document,

after successful establishment of said security association, authenticating (408) the data origin of the location service request, and

if the data origin of the location service request is authenticated successfully, initiating (410) a location procedure relating to the mobile station in the cellular network.

2. A method according to

claim 1

, wherein the security document relating to the second network element is a public key certificate, which comprises an identifier specifying the second network element and a public key of the second network element and which is cryptographically signed by the third network element.

3. A method according to

claim 1

, further comprising the step of:

requesting from the third network element a second security document relating to the first network element.

4. A method according to

claim 3

, wherein the security document comprises a first key, which is encrypted using a second key shared between the first network element and the third network element, and the second security document comprises the first key, which is encrypted using a third key shared between the second network element and the third network element.

5. A method according to

claim 3

, further comprising the step of:

initiating the establishment of a second security association from the first network element to the second network element using at least information comprised in the second security document.

6. A method according to

claim 5

, wherein the security association is a set of Internet Security Associations pointing from the second network element to the first network element and the second security association is a second set of Internet Security Associations pointing from the first network element to the second network element.

7. A method according to

claim 5

, wherein the second security association specifies at least data encryption.

8. A method according to

claim 1

, wherein the security association is a set of Internet Security Associations pointing from the second network element to the first network element.

9. A method according to

claim 1

, further comprising the steps of:

a third network element, which is connected to the packet data network, producing (404) said security document,

establishing (406) at least one security association, which specifies at least data origin authentication and which points from the second network element to the first network element, using at least information comprised in the security document, and

after the establishment of said security association, authenticating (408) the data origin of the location service request, and

carrying out (701) a location procedure relating to the mobile station in the cellular network.

10. A method according to

claim 9

, further comprising the step of:

transmitting (707, 713) location information relating to the mobile station to the second network element.

11. A method according to

claim 10

, wherein the location information relating to the mobile station is transmitted to the second network element from the first network element.

12. A method according to

claim 11

, further comprising the steps of:

the third network element producing a second security document relating to the first network element, and

establishing a second security association, which specifies at least data encryption and points from the first network element to the second network element, using at least the information specified in the second security document.

13. A method according to

claim 10

, further comprising the step of:

before transmitting the location information to the second network element, establishing (708) a third security association, which specifies at least data origin authentication and points from the second network element to a packet data device, which is either connected to the mobile station or is an integral part of the mobile station.

14. A method according to

claim 10

, wherein the location information relating to the mobile station is transmitted from a device, which is either connected to the mobile station or is an integral part of the mobile station.

15. A method according to

claim 14

, further comprising the step of:

before transmitting the location information to the second network element, establishing (708) a third security association, which specifies at least data origin authentication and points from the second network element to a packet data device, which is either connected to the mobile station or an integral part of the mobile station.

16. A method according to

claim 15

, further comprising the step of:

before transmission of location information, establishing (710) a fourth security association, which specifies at least data encryption and which points to the second network element from said packet data device.

17. A method according to

claim 14

, further comprising the steps of:

the mobile station receiving (702) a notification relating to the location procedure relating to the mobile station, and

the mobile station informing (703) said packet data device about the notification.

18. A method according to

claim 1

, wherein the first network element is a network element of a GPRS network.

19. A method according to

claim 18

, wherein the first network element is a Gateway Mobile Location Center.

20. A method according to

claim 1

, wherein the first network element is a network element of a UMTS network.

21. A network element (900) of a cellular network, the network element comprising

means (910) for receiving from a packet data network a location information request relating to a certain mobile station,

means (920) for initiating a location procedure in the cellular network,

means (930) for establishing security associations pointing to the network element from a network element of the packet data network,

means (931) for performing security functions as specified by the security associations on data it receives from the packet data network,

means (932) which are arranged to determine, if there is an existing security association pointing to the network element from a sender of a location information request, and

means (933) for initiating security association establishment, which are arranged to establish a security association if there does not exist a security association, which points towards the network element from the sender of a location information request.

22. A network element according to

claim 21

, further comprising

means (940) for receiving from a device reachable via the cellular network a request about a security association, which points to the network element from a certain network element of the packet data network,

means (932) for determining whether a requested security association exists, and

means (940) for transmitting information about the requested security association to the device.

23. A network element according to

claim 21

, further comprising

means (943) for receiving a request to produce security documents relating to the device and to the sender of a location information request, and

means (944) for producing a first security document relating to the device and a second security document relating to the sender of the location information request.

24. A network element according to

claim 21

, wherein it is a network element of a GPRS network.

25. A network element according to

claim 24

, wherein it is a Gateway Mobile Location Center.

26. A network element according to

claim 21

, wherein it is a network element of a UMTS network.

27. A packet data device (950) being an integral part of a mobile station or being attachable to a mobile station, comprising

means (960) for receiving information about a location information request and about a sender of a location information request from the mobile station and

means (970) for exchanging with a network element connected to a cellular network information about a security association, which points to the network element from the sender of the location information request.

28. A device according to

claim 27

, further comprising means (980) for establishing a second security association, which points to the device from the sender of the location information request and specifies at least data origin authentication.

29. A device according to

claim 28

, further comprising means (980) for requesting a network element of the cellular network to produce security documents relating to the device and to the sender of the information request for the establishment of the second security association.

30. A device according to

claim 27

, further comprising means (990) for transmitting to the mobile station a permission to send location information to the sender of the location information request, which means are arranged to transmit the permission when there is said security association.

31. A device according to

claim 27

, further comprising means for locating itself.

32. A device according to

claim 31

, comprising a Global Positioning System receiver.

33. A mobile station (901), comprising

means for receiving a notification from a cellular network about a location information request,

means for responding to the cellular network with a notification response, and

means for notifying a packet data device, which is either an integral part of the mobile station or attached to the mobile station, about the location information request.

34. A mobile station according to

claim 33

, wherein the means for responding to the cellular network are arranged to be initiated by a permission sent by the packet data device.