Method, network access element and mobile node for service advertising and user authorization in a telecommunication system

• US 20040072557A1
• Filed: 08/08/2003
• Published: 04/15/2004
• Est. Priority Date: 02/09/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Xu, Lin, Paila, Toni
• Granted Patent: US 7,171,198 B2
• Time in Patent Office: Days
• US Class Current: 455/414.1
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/00 Services specially adapted for wireless communication networks; Facilities therefor
• CPC Class Codes: H04W 72/20 Control channels or signalling for resource management
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/183 Processing at user equipment or user record carrier
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support

Abstract

A network access sequence for a mobile node (MN) in one or more foreign domains (FD). A foreign domain sends (A1) service advertisement messages (M1), each of which comprises an identifier (41) of the message, network address information (43) and a detailed service offering (42). The mobile node stores (A2) the detailed service offerings and selects one of them. Then it sends a service request message (M2) to the foreign domain which sent the selected service offering (62). The service request indicates (55) the selected service offering (62) and the mobile node'"'"'s credentials (54). The foreign domain conveys the credentials to the mobile node'"'"'s home domain (HD) for authentication and authorization and checks (A4) if the selected service offering (62) can be supported. Next the foreign domain (FD) allocates communication resources for supporting the selected service offering and indicates (M9) to the mobile node the availability of the requested service.

Claims

1. A method for performing a network access sequence for a mobile node (MN) in one or more foreign domains (FD), characterized by the steps of:

the one or more foreign domains (FD) sending (Al) service advertisement messages (M1), each service advertisement message comprising;

an identifier (41) of the service advertisement message in question;

network address/identity information (43) relating to the foreign domain in question; and

a detailed service offering (42);

the mobile node (MN) receiving and storing (A2) the detailed service offerings (42) and forming an indication (55) of a selected detailed service offering (62);

the mobile node (MN) sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54);

the foreign domain (FD) conveying (M4-M7) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization;

the foreign domain (FD) checking (A4) if the selected service offering (62) can be supported on the basis of available communication resources;

if the selected service offering (62) can be supported, the foreign domain (FD) allocating communication resources for supporting the selected service offering and indicating to the mobile node the availability of a service according to the selected service offering.

4. A method according to claim 1, 2 or 3, characterized by the steps of:

the foreign domain (FD) signing the service advertisement messages (M1) with a digital signature (47); and

the mobile node (MN) verifying the digital signature (47);

wherein a two-way trust relationship is dynamically established between the mobile node (MN) and the foreign domain (FD).

5. A method according to any of the claims 1 to 4, characterized by the foreign domain (FD) performing the checking step (A4) after it has performed the conveying step (M4-M7).

6. A method according to any one of claims 1 to 5, characterized by the mobile node (MN) automatically forming the indication (55) of the selected service offering (62) on the basis of pre-stored criteria.

7. A method according to any one of claims 1 to 5, characterized by the mobile node (MN) forming the indication (55) of the selected service offering (62) by presenting the detailed service offerings to a user and by receiving the user'"'"'s selection.

8. A method according to any one of the preceding claims, characterized in that the detailed service offerings (42) indicate quality of service information (61b).

9. A method according to any one of the preceding claims, characterized in that the detailed service offerings (42) indicate a validity period (46).

2. A method for performing a network access sequence for a mobile node (MN) in one or more foreign domains (FD), characterized by the steps of:

the one or more foreign domains (FD) sending (Al) service advertisement messages (M1), each service advertisement message comprising;

network address/identity information (43) relating to the foreign domain in question; and

a detailed service offering (42);

the mobile node (MN) receiving and storing (A2) the detailed service offerings (42) and forming an indication (55) of a selected detailed service offering (62), and calculating an identifier (41) of the service advertisement message in question;

the mobile node (MN) sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54);

the foreign domain (FD) conveying (M4-M7) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization;

the foreign domain (FD) checking (A4) if the selected service offering (62) can be supported on the basis of available communication resources;

if the selected service offering (62) can be supported, the foreign domain (FD) allocating communication resources for supporting the selected service offering and indicating to the mobile node the availability of a service according to the selected service offering.

3. A method for performing a network access sequence for a mobile node (MN) in one or more foreign domains (FD), characterized by the steps of:

the one or more foreign domains (FD) sending (A1) service advertisement messages (M1), each service advertisement message comprising;

an identifier (41) of the service advertisement message in question;

network address/identity information (43) relating to the foreign domain in question; and

the mobile node (MN) receiving and storing (A2) the identifier (41), extracting therefrom a detailed service offering (42); and

forming an indication (55) of a selected detailed service offering (62);

the mobile node (MN) sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54);

the foreign domain (FD) conveying (M4-M7) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization;

the foreign domain (FD) checking (A4) if the selected service offering (62) can be supported on the basis of available communication resources;

if the selected service offering (62) can be supported, the foreign domain (FD) allocating communication resources for supporting the selected service offering and indicating to the mobile node the availability of a service according to the selected service offering.

10. A network access element (AAAL) for supporting the access sequence of a mobile node (MN) in one or more foreign domains (FD),

characterized by:

a service advertisement logic (A1) for sending service advertisement messages (M1) to the mobile node, each service advertisement message comprising;

an identifier (41) of the service advertisement message in question;

network address/identity information (43) relating to the foreign domain in question; and

a detailed service offering (42); and

a resource allocation logic (A4) for;

receiving a service request message (M2, M3) from the mobile node (MN), the service request message (M2, M3) comprising the mobile node'"'"'s credentials (54) and an indication (55) of the service offering (62) selected by the mobile node or its user;

conveying (M4) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization and for receiving an authentication and authorization indication (M7) from the mobile node'"'"'s home domain (HD);

checking if the service indicated by the selected service offering (62) can be supported on the basis of available communication resources; and

allocating communication resources if the service indicated by the selected service offering can be supported.

13. A network access element (AAAL) according to claim 10, 11 or 12, characterized in that the resource allocation logic (A4) is adapted to perform the checking operation after conveying (M4) the mobile node'"'"'s credentials to the mobile node'"'"'s home domain.

14. A network access element (AAAL) according to claim 13, characterized in that the resource allocation logic (A4) is adapted to perform the checking operation before receiving an authentication and authorization indication (M7) from the mobile node'"'"'s home domain.

11. A network access element (AAAL) for supporting the access sequence of a mobile node (MN) in one or more foreign domains (FD),

characterized by:

a service advertisement logic (Al) for sending service advertisement messages (M1) to the mobile node, each service advertisement message comprising;

network address/identity information (43) relating to the foreign domain in question; and

a detailed service offering (42); and

a resource allocation logic (A4) for;

receiving a service request message (M2, M3) from the mobile node (MN), the service request message (M2, M3) comprising the mobile node'"'"'s credentials (54) and an indication (55) of the service offering (62) selected by the mobile node or its user;

conveying (M4) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization and for receiving an authentication and authorization indication (M7) from the mobile node'"'"'s home domain (HD);

checking if the service indicated by the selected service offering (62) can be supported on the basis of available communication resources; and

allocating communication resources if the service indicated by the selected service offering can be supported.

12. A network access element (AAAL) for supporting the access sequence of a mobile node (MN) in one or more foreign domains (FD),

characterized by:

a service advertisement logic (Al) for sending service advertisement messages (M1) to the mobile node, each service advertisement message comprising;

an identifier (41) of the service advertisement message in question;

network address/identity information (43) relating to the foreign domain in question; and

a resource allocation logic (A4) for;

receiving a service request message (M2, M3) from the mobile node (MN), the service request message (M2, M3) comprising the mobile node'"'"'s credentials (54) and an indication (55) of the service offering (62) selected by the mobile node or its user,

conveying (M4) the mobile node'"'"'s credentials (54) to the mobile node'"'"'s home domain (HD) for authentication and authorization and for receiving an authentication and authorization indication (M7) from the mobile node'"'"'s home domain (HD);

checking if the service indicated by the selected service offering (62) can be supported on the basis of available communication resources; and

allocating communication resources if the service indicated by the selected service offering can be supported.

15. A mobile node (MN) capable of performing a network access sequence in one or more foreign domains (FD), characterized by a service advertisement processing logic (A2) for:

receiving and storing service advertisement messages (M1) from said one or more foreign domains (FD), each service advertisement message comprising an identifier (41) of the service advertisement message in question;

network address/identity information (43) relating to the foreign domain in question; and

a detailed service offering (42);

forming an indication (55) of a selected detailed service offering (62); and

sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54).

18. A mobile node (MN) according to claim 15, 16 or 17, characterized by automatically forming the indication (55) of the selected service offering (62) on the basis of pre-stored criteria.

19. A mobile node (MN) according to claim 15, 16 or 17, characterized by forming the indication (55) of the selected service offering (62) by presenting the detailed service offerings to a user and by receiving the user'"'"'s selection.

16. A mobile node (MN) capable of performing a network access sequence in one or more foreign domains (FD), characterized by a service advertisement processing logic (A2) for:

receiving and storing service advertisement messages (M1) from said one or more foreign domains (FD), each service advertisement message comprising a network address/identity information (43) relating to the foreign domain in question and a detailed service offering (42);

forming an identifier (41) of the service advertisement message in question based on the information contained in the service offering (42), and an indication (55) of a selected detailed service offering (62); and

sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54).

17. A mobile node (MN) capable of performing a network access sequence in one or more foreign domains (FD), characterized by a service advertisement processing logic (A2) for:

receiving and storing service advertisement messages (M1) from said one or more foreign domains (FD), each service advertisement message comprising an identifier (41) of the service advertisement message in question and network address/identity information (43) relating to the foreign domain in question;

extracting a detailed service offering (42) from the identifier (41) and an indication (55) of a selected detailed service offering (62); and

sending a service request message (M2) to the foreign domain (FD) which sent the selected service offering (62), the service request message (M2) comprising the indication (55) of the selected service offering (62) and the mobile node'"'"'s credentials (54).