Controlling network access

• US 20060154645A1
• Filed: 05/05/2005
• Published: 07/13/2006
• Est. Priority Date: 01/10/2005
• Status: Abandoned Application

• Current Assignee: Nokia Corporation
• Original Assignee: Nokia Corporation
• Inventors: Valkenburg, Sander Van
• Application Number:
  US11/121,999
• Publication Number:
  US 20060154645A1
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• CPC Class Codes: H04W 76/50 for emergency connections

Abstract

In a method for controlling network access, identity information for authentication is received from a communications device in a network. When the identity information indicates an identity module, the identity module is authentication. The identity module relates to the communications device, and it is associated with a further network. In response to a successful authentication of the identity module, access is granted to the communications device to a set of services of the further network. When the identity information indicates the communications device, the communications device is authenticated. In response to a successful authentication of the communications device, access is granted to the communications device to a subset of the set of services of the further network.

Claims

1. A method for controlling network access, the method comprising

receiving identity information for authentication from a communications device in a network,

authenticating an identity module relating to the communications device and associated with a further network, when the identity information indicates the identity module,

granting to the communications device access to a set of services of the further network in response to a successful authentication of the identity module,

authenticating the communications device, when the identity information indicates the communications device, and

granting to the communications device access to a subset of the set of services of the further network in response to a successful authentication of the communications device.

2. A method as defined in claim 1, comprising receiving a portion of verification information for authenticating the communications device.

3. A method as defined in claim 2, wherein the identity information indicating the communications device and the portion of verification information are received in a same message.

4. A method as defined in claim 1, comprising sending to the communications device a portion of authentication information for later use after a successful authentication of the identity module.

5. A method as defined in claim 4, wherein the portion of authentication information relates to the identity of the communications device.

6. A method as defined in claim 1, wherein the network is an access network and the further network is cellular communications network.

7. A method as defined in claim 1, wherein the access network is a network supporting packet data communications.

8. A method as defined in claim 1, wherein the network and the further network are in accordance with one of an Unlicensed Mobile Access standard, or a 3GPP wireless local area network Internetworking standard.

9. A method as defined in claim 1, wherein the identity information is received in a message of an authentication protocol.

10. A method as defined in claim 9, wherein the authentication protocol is the Internet Key Exchange protocol version 2.

31. A computer program embodied on computer readable medium comprising program instructions for causing a set of processors comprising at least one processor to performing the method of claim 1.

32. A computer program as defined in claim 31, embodied on a record medium, stored in a computer memory or carried on an electrical carrier signal.

11. A communications network, configured to

receive identity information for authentication from a communications device,

authenticate an identity module relating to the communications device and associated with a further network, when the identity information indicates the identity module,

grant to the communications device access to a set of services of the further network in response to a successful authentication of the identity module,

authenticate the communications device, when the identity information indicates the communications device, and

grant to the communications device access to a subset of the set of services of the further network in response to a successful authentication of the communications device.

12. A communications network as defined in claim 11, the communications network being in accordance with at least one of a UMA standard, or a 3GPP WLAN Interworking standard.

13. A network element, configured to

receive identity information for authentication from a communications device,

authenticate an identity module relating to the communications device and associated with a further network, when the identity information indicates the identity module, and

authenticate the communications device, when the identity information indicates the communications device.

14. A network element as defined in claim 13, configured to

grant to the communications device access to a set of services of the further network in response to a successful authentication of the identity module, and

grant to the communications device access to a subset of the set of services of the further network in response to a successful authentication of the communications device.

15. A network element as defined in claim 13, wherein the network element is configured to control access to the further network.

16. A network element as defined in claim 13, comprising a security gateway.

17. A network element as defined in claim 13, wherein the network element is configured to inform the further network element about the authentication of the identity module and the communications device.

18. A network element as defined in claim 13, comprising a security server.

19. A network element as defined in claim 13, the network element being in accordance with at least one of a UMA standard, or a 3GPP WLAN Interworking standard.

20. A method of operating a communications device, the method comprising

exchanging authentication protocol messages with a network,

authenticating an identity module associated with a further network, when the identity module is operably connected to the communications device,

storing identity information of the communications device and authentication information relating to the identity information, and

indicating to the network that the communications device is to be authenticated based on the identity information of the communications device, when no identity module is operably connected to the communications device.

21. A method as defined in claim 20, wherein said step of indicating comprises sending the identity information of the communications device to the network.

22. A method as defined in claim 20, comprising sending a portion of verifying information based on said authentication information relating to the identity information of the communications device.

23. A method as defined in claim 20, comprising sending a portion of verifying information based on said authentication information and the identity information of the communications device in a same authentication protocol message.

24. A method as defined in claim 23, comprising receiving from the network authentication information for the communications device and storing the received authentication information for further use.

25. A method as defined in claim 20, wherein the identity information of the communications device is sent in response to initiating establishment of an emergency call.

26. A method as defined in claim 20, wherein the authentication protocol is the Internet Key Exchange protocol version2.

27. A method as defined in claim 20, wherein the identity of the communications device is associated with the further network.

29. A computer program embodied on computer-readable medium comprising program instructions for causing a set of processors comprising at least one processor to perform the method of claim 20.

30. A computer program as defined in claim 29, embodied on a record medium, stored in a computer memory or carried on an electrical carrier signal.

28. A communications device, configured to

store identity information of the communications device and authentication information relating to the identity information, and

indicate to a network that the communications device is to be authenticated based the identity information of the communications device instead of using an identity module associated with a further network, when no identity module is operably connected to the communications device.

33. A method for making an emergency call from a communications device, comprising

indicating an identity of the communications device during an authentication procedure towards a network, when no identity module is operably connected to the communications device,

sending during the authentication procedure a portion of verification information based on a portion of emergency call authentication information stored in the communications device, and

establishing an emergency call via the network.

34. A method as defined in claim 33, comprising receiving said piece of emergency call authentication information via a network.

35. A method as defined in claim 33, wherein said identity of the communications device is associated with a further network.

36. A method for authenticating a communications device for an emergency call, comprising

receiving information indicating an identity of the communications device instead of an identity of an identity module during an authentication procedure in a network,

authenticating the communications device based on a piece of emergency call authentication information, and

establishing an emergency call from the communications device after successful authentication of the communications device.

37. A method as defined in claim 36, comprising delivering to the communications device a piece of emergency call authentication information

38. A method as defined in claim 36, wherein said identity of the communications device is associated with a further network.

39. A method for providing emergency call authentication information to a communications device, comprising

authenticating an identity module relating to a communications device, and

sending to the communications device a portion of emergency call authentication information for later use after successful authentication of the identity module.