SERVICE ACCESS CONTROL INTERFACE FOR AN UNLICENSED WIRELESS COMMUNICATION SYSTEM

• US 20080057908A1
• Filed: 08/06/2007
• Published: 03/06/2008
• Est. Priority Date: 10/17/2003
• Status: Active Grant

• Current Assignee: Ribbon Communications Operating Company, Inc. (Ribbon Communications, Inc.)
• Original Assignee: Kineto Wireless Incorporated (Ribbon Communications, Inc.)
• Inventors: Gupta, Rajeey, Sethi, Swaran, Khetawat, Amit, Gallagher, Michael
• Granted Patent: US 7,454,207 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: H04W 92/02 Inter-networking arrangements

Abstract

Some embodiments provide a system for authorization and authentication of an unlicensed mobile access (UMA) subscriber. The system includes an UMA network controller (UNC) which is communicatively coupled to a licensed wireless communication system. The system also includes an access point (AP) that serves a wireless local area network (WLAN). The system further includes a mobile station (MS) that is communicatively coupled to the AP and the licensed wireless communication system. The system also includes an authentication server that is communicatively coupled to the UNC. The authentication server authenticates a UMA subscriber for accessing an unlicensed mobile access network (UMAN) that includes the UNC and the AP. Some embodiments define an interface between the UNC and the authentication server uses Remote Access Dial-In User Service (RADIUS) protocol. In some embodiments, the authentication server is an Authorization, Authentication, and Accounting (AAA) server.

Claims

1-10. -10. (canceled)

11. A method of performing register transactions for a first wireless communication system comprising a network controller, wherein the network controller comprises an IP network controller (INC) communicatively coupled to a second wireless communication system, wherein the network controller comprises a security gateway communicatively coupled to the INC, the method comprising:

a) authenticating a client device into the network controller by a first server communicatively coupled to the security gateway;

b) sending a register request message from the client device to the

INC through the security gateway;

c) sending a set of attributes from the INC to a second server;

d) authorizing said register request by the second server utilizing a set of databases; and

e) sending a result of said authorization from the second server to the INC.

12. The method of claim 11, wherein said authorization of the register request by the second server comprises:

when the second server is configured to check a subscriber'"'"'s international mobile subscriber identity (IMSI) on register request;

a) retrieving a subscriber record by the second server from a database server; and

b) setting by the second server a register reject cause to IMSI not allowed when no subscriber record is found or a subscriber status was set to barred.

13. The method of claim 11, wherein said authorization of the register request by the second server comprises:

when no response is received from the database server;

a) setting a register reject cause to network congestion by the second server; and

b) assigning a value to a timer to cause the client device to delay sending another register request.

14. The method of claim 11, wherein the first wireless communication system further comprises an access point (AP), wherein said authorization of the register request by the second server comprises retrieving a subscriber record by the second server from a database server when the second server is configured to check AP on register.

15. The method of claim 14, wherein said authorization of the register request by the second server further comprises setting by the second server a register reject cause to AP not allowed when a subscriber record is found and the AP is not listed as a valid AP.

16. The method of claim 14, wherein the client device is a mobile station (MS), wherein the register request comprises a MS radio identity attribute and an AP radio identity attribute, wherein an AP is valid when the AP radio identity corresponds to a valid location in a subscriber record associated with the MS.

17. The method of claim 14, wherein the client device is not a mobile station (MS), wherein an AP is valid when the register request comprises a MS radio identity attribute that corresponds to a valid location in a subscriber record associated with the client device.

18. The method of claim 17, wherein the client device is a fixed terminal adaptor.

19. The method of claim 18, wherein the MS radio identity attribute is a MAC address of the fixed terminal adaptor.

20. The method of claim 14, wherein said authorization of the register request by the second server further comprises:

a) setting a register reject cause to network congestion by the second server when no response was received by the second server from the database server; and

b) assigning a value to a timer to cause the client device to delay sending another register request.

21. The method of claim 14, wherein said authorization of the register request by the second server further comprises setting by the second server a register reject cause to IMSI not allowed when no subscriber record is found or a subscriber status was set to barred.

22. The method of claim 11, wherein sending the result of said authorization comprises sending a register accept message from the second server to the INC.

23. The method of claim 11 further comprising storing a current location of the client device.

24. The method of claim 23 further comprising:

a) determining that a deregistration of the client device is required;

b) sending a message to the second server indicating a deregistration transaction;

c) updating the current location of the client device; and

d) receiving a deregister accept message at the INC from the second server.

25. The method of claim 22, wherein the register accept message comprises a geographical location, the method further comprising storing the geographical location as a current location of the client device.

26. The method of claim 22, wherein the register accept message comprises a location status, the method further comprising:

a) storing the location status by the INC; and

b) sending the location status to the client device.

27. The method of claim 11, wherein the second server is an authorization, authentication, and accounting (AAA) server.

28. The method of claim 11, wherein the INC and the second server communicate by utilizing the remote access dial-in user service (RADIUS) protocol.

29. The method of claim 11, wherein sending the result of said authorization comprises sending a register reject message comprising a rejection cause from the second server to the INC.

30. A network controller comprising:

a) a security gateway communicatively coupled to a first server for authentication of a mobile station (MS) into the network controller; and

b) an IP network controller (INC) communicatively coupled to a licensed wireless communication system and communicatively coupled to the security gateway;

wherein the INC is for;

i) receiving a register request message from the MS through the security gateway;

ii) sending a set of attributes to a second server for authorizing said register request by the second server utilizing a set of databases; and

iii) receiving a result of said authorization from the second server.

31. The network controller of claim 30, wherein the INC is further for receiving from the second server a reject message with a cause field, said cause field set to international mobile subscriber identity (IMSI) not allowed when:

i) the second server is configured to check a subscriber'"'"'s IMSI on register request; and

ii) no subscriber record is found or a subscriber status was set to barred.

32. The network controller of claim 30, wherein the security gateway is communicatively coupled to an access point (AP), wherein the INC is further for receiving from the second server a reject message with a cause field, said cause field set to AP not allowed when:

i) the second server is configured to check AP on register;

ii) a subscriber record is found; and

iii) the AP is not listed as a valid AP.

33. The network controller of claim 32, wherein said cause field is set to international mobile subscriber identity (IMSI) not allowed when no subscriber record is found or a subscriber status was set to barred.

34. The network controller of claim 30, wherein the second server is an authorization, authentication, and accounting (AAA) server.

35. The network controller of claim 30, wherein the INC and the second server communicate by utilizing the remote access dial-in user service (RADIUS) protocol.