Apparatuses and Method for Controlling Access to an ip Multimedia System from an Application Server

• US 20070209061A1
• Filed: 03/25/2005
• Published: 09/06/2007
• Est. Priority Date: 04/02/2004
• Status: Abandoned Application

• Current Assignee: Orange S.A.
• Original Assignee: Orange S.A.
• Inventors: Dekeyzer, Dimitri, Baruch, Deborh
• Application Number:
  US11/547,144
• Publication Number:
  US 20070209061A1
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 61/00 Network arrangements, protocols or services for addressing or naming
• CPC Class Codes: H04L 61/45 Network directories; Name-to-address mapping
• CPC Class Codes: H04L 63/0209 Architectural arrangements, e.g. perimeter networks or demilitarized zones
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04W 4/12 Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 8/04 Registration at HLR or HSS [Home Subscriber Server]
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14
• CPC Class Codes: H04W 88/14 Backbone network devices

Abstract

A security node controls access to an internet protocol multi-media system (IMS) from an application server outside the system. The multi-media system includes a session protocol server (S-CSCF) and a subscriber database (HSS). The security node comprises a database access control node operable to control access to the subscriber database (HSS) from the application server, a session message control node operable to control communication of the messages to the session protocol server from the application server, and a control information database for storing control data. The control data specifies conditions for accessing the subscriber database (HSS) and for communicating with the session protocol server (S-CSCF). The database access control node is operable to control access to the subscriber database in accordance with the control data, and the session message control node is operable to control communication of messages to the session protocol server in accordance with the control data. Embodiments of the present invention can provide a facility for an application server operating externally to an internet protocol multi-media system (IMS) network to have controlled access to resources within the IMS network. For example, the access may be controlled in accordance with a policy agreed between an operator of the IMS network and an operator of the application server.

Claims

1. A security node for controlling access to an internet protocol multi-media system (IMS) from an application server outside the system, the multi-media system including a session protocol server (S-CSCF) and a subscriber database (HSS), the security node comprising

a database access control node operable to control access to the subscriber database (HSS) from the application server,

a session message control node operable to control communication of the messages to the session protocol server from the application server, and

a control information database operable to store control data specifying conditions for accessing the subscriber database (HSS) and for communicating with the session protocol server (S-CSCF), wherein the database access control node is operable to control access to the subscriber database in accordance with the control data, and the session message control node is operable to control communication of messages to the session protocol server in accordance with the control data.

2. A security node as claimed in claim 1, wherein the control data stored in the control information database includes access control information, the access control information defining a policy established by an operator of the multi-media system for at least one of allowing access to the subscriber database (HSS) from the application server and for allowing communication of the messages to the session protocol server from the application server.

3. A security node as claimed in claim 2, wherein the access control information includes a list of session protocol server permissions for controlling the communication of messages from the application server to the session protocol server.

4. A security node as claimed in claim 2 or 3, wherein the access control information includes a list of subscriber database permissions for controlling the communication of commands from the application server to the subscriber database.

5. A security node as claimed in any preceding claim, wherein the control data includes user preference information providing user defined preferences for allowing access to the subscriber information database, the database access control node being operable to control access to the subscriber database in accordance with the user preference information.

6. A security node as claimed in claim 5, wherein the user preference information is retrieved from the subscriber database and stored in the control information database.

7. A security node as claimed in claim 6, wherein the database access control node is operable to retrieve the user preference information and store the information in the control information database in response to one of the user preference information being absent from the control information database or the user preference information being considered inconsistent with the information in the subscriber database.

8. A security node according to any preceding claim, comprising a resource controller, the resource controller being operable to monitor a load on the session protocol server and the subscriber database, and to control access dynamically to at least one of the session protocol server and the subscriber database in accordance with the monitored load.

9. A security node as claimed in any preceding claim, wherein the session message control node comprises a Session Initiation Protocol (SIP) proxy.

10. A security node as claimed in claim 9, wherein the session message control node communicates with the session protocol server via an ISC interface.

11. A security node as claimed in any preceding claim, wherein the database access control node communicates with the subscriber database via an Sh interface.

12. A communications network comprising an internet protocol multi-media system (IMS) and an application server outside the system, the multi-media system including a session protocol server (S-CSCF) and a subscriber database (HSS), the communications network including

a security gateway channel (SEG) operable to communicate data between the application server and the multi-media system, the data including at least one of commands for accessing the subscriber database and messages for communicating to the session protocol server from the application server, and

a security node for controlling access to the multi-media system from the application server, the security node including

a database access control node operable to receive the commands for accessing the subscriber database from the security gateway channel and to control access to the subscriber database (HSS) by the application server,

a session message control node operable to receive the messages for the session protocol server (S-CSCF) from the security gateway channel and to control communication of the messages to the session protocol server, and

a control information database operable to store control data specifying conditions for accessing the subscriber database (HSS) and for communicating with the session protocol server (S-CSCF), wherein the database access control node is operable to control access to the subscriber database in accordance with the control data, and the session message control node is operable to control communication of messages to the session protocol server in accordance with the control data.

13. A communications network as claimed in claim 12, wherein the control data stored in the control information database includes access control information, the access control information defining a policy established by an operator of the network for at least one of allowing access to the subscriber database (HSS) from the application server and for allowing communication of the messages to the session protocol server from the application server.

14. A communications network as claimed in claim 12 or 13, wherein the control data includes user preference information providing user defined preferences for allowing access to the subscriber information database, the database access control node being operable to control access to the subscriber database in accordance with the user preference information.

15. A method of controlling access to an intemet protocol multi-media system (IMS) from an application server outside the system, the multi-media system including a session protocol server (S-CSCF) and a subscriber database (HSS), the method comprising

controlling, using a database access control node, access of the subscriber database (HSS) by the application server,

controlling, using a session message control node, communication of the messages to the session protocol server from the application server,

storing control data in a control information database, the control data specifying conditions for accessing the subscriber database (HSS) and for communicating with the session protocol server (S-CSCF), wherein the controlling access to the subscriber database includes controlling access in accordance with the control data, and the controlling communication of messages to the session protocol server from the application server includes controlling communication in accordance with the control data.

16. A computer program which when installed on a data processing apparatus, causes the data processing apparatus to perform a method of controlling access to an intemet protocol multi-media system (IMS) from an application server outside the system, the multi-media system including a session protocol server (S-CSCF) and a subscriber database (HSS), the method comprising

controlling, using a database access control node, access of the subscriber database (HSS) by the application server,

controlling, using a session message control node, communication of the messages to the session protocol server from the application server,

storing control data in a control information database, the control data specifying conditions for accessing the subscriber database (HSS) and for communicating with the session protocol server (S-CSCF), wherein the controlling access to the subscriber database includes controlling access in accordance with the control data, and the controlling communication of messages to the session protocol server includes controlling communication in accordance with the control data.

17. A computer program product including a readable medium having recorded thereon the computer program as claimed in claim 16.

18. A medium bearing signals representative of the computer program according to claim 16.