Telecommunications System And Method

• US 20080117841A1
• Filed: 05/17/2004
• Published: 05/22/2008
• Est. Priority Date: 06/16/2003
• Status: Active Grant

• Current Assignee: 3G Licensing S.A. (Fineur International S.A.)
• Original Assignee: Orange S.A.
• Inventors: Chen, Xiaobao
• Granted Patent: US 7,860,037 B2
• Time in Patent Office: Days
• US Class Current: 370/310
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04L 69/161 Implementation details of TCP/IP or UDP/IP stack architecture; Specification of modified or new header fields
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 40/02 Communication route or path selection, e.g. power-based or shortest path routing
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/10 adapted for operation in multiple networks, e.g. multi-mode access points
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: Y10S 370/902 Packet switching

Abstract

A telecommunications system for communicating internet packets between a mobile communications user equipment forming a correspondent node and a mobile node via an external packet data telecommunications network. The system comprises a packet radio network providing a plurality of packet data bearers for communicating internet packets with nodes attached to the packet radio network. Each of the bearers is defined with respect to a source address of the internet packets, the packet radio network including a gateway support node operable to provide an interface between the external network and, the packet radio network. The gateway support node (GGSN) is operable to detect (56) whether an internet packet is for providing a binding update to the correspondent node of a first source address of the mobile node to a care-of-address of the mobile node. If the internet packet is a binding update, the gateway support node allows (514) egress of internet packets sent from the correspondent node having the care-of-address of the mobile node as the destination address to the external network. By obtaining the care-of-address of the mobile node from the binding update and allowing egress of packets from the correspondent node having this care-of-address as the destination address in internet packet headers, a measure of security is provided, which can prevent or at least hinder theft of service. Theft of service may occur if an unscrupulous user uses an unauthorised destination address for IP data packets sent from the mobile user equipment acting as correspondent node and having a legitimate address in the hop-by-hop extension field and an unauthorised address in the destination field address.

Claims

1. A telecommunications system for communicating internet packets between a mobile communications user equipment forming a correspondent node and a mobile node via an external packet data communications network, the system comprising

a packet radio network operable to provide a plurality of packet data bearers for communicating the internet packets with nodes attached to the packet radio network, each of the bearers being defined with respect to a source address of the internet packets, the packet radio network including a gateway support node operable to provide an interface between the external network and the packet radio network, wherein

the gateway support node is operable

to detect whether an internet packet is for providing a binding update to the correspondent node of a first source address of the mobile node to a care-of-address of the mobile node, and if the internet packet is a binding update,

to allow egress of internet packets sent from the correspondent node having the care-of-address of the mobile node as the destination address from the gateway support node to the external network.

2. A telecommunications system as claimed in claim 1, wherein the gateway support node is operable to associate the care-of-address with the first source address to the effect that the egress of the internet data packets is allowed in accordance with the egress of internet packets which is allowed for the first source address.

3. A telecommunications system as claimed in claim 2, wherein the first source address is a home address of the mobile node.

4. A telecommunications system as claimed in claim 1, 2 or 3, wherein the internet packet sent from the correspondent node includes the home address of the mobile node in an extension field of the header and the care-of-address of the mobile node in the destination address field, and the gate way support node is operable to allow the internet packet to egress from the packet radio network to the external network if both the care-of-address of the mobile node and the home address of the mobile node are legitimate addresses.

5. A telecommunications system as claimed in any preceding claim, wherein the gateway support node is operable to confirm that the care-of-address of the mobile node is a legitimate address for the mobile node before allowing the egress of internet packets.

6. A telecommunications system as claimed in claim 5, wherein the care-of-address is associated with the first source address if the care-of-address is confirmed as a legitimate address.

7. A telecommunications system as claimed in claim 5 or 6, wherein the gateway support node is operable to confirm that the care-of-address is a legitimate address by monitoring internet packets sent from the correspondent node to the mobile node, and

upon detecting a binding update acknowledgement from the mobile node that the care-of-address has been accepted,

confirming that the care-of-address of the mobile node is a legitimate address, and

thereafter allowing the internet packets to egress from the gateway support node.

8. A telecommunications system as claimed in claim 5, wherein the gateway support node is operable to confirm that the care-of-address is a legitimate address by performing a reverse routability confirmation with the mobile node.

9. A telecommunications system as claimed in any preceding claim, wherein the gateway support node includes a security function operable to control the egress of the internet packets from the packet radio network by comparing the destination address of the internet packet sent from the correspondent node with a list of legitimate destination addresses stored in a data store, the security function allowing egress of the internet packet from the packet radio network if the destination address of the internet packet appears in the list, and otherwise dropping the internet packet, the care-of-address of the mobile node being added to the list upon detecting the binding update.

10. A telecommunications system as claimed in claim 9, wherein the gateway support node includes a traffic controller operable

to compare the first source address in the internet protocol header received from the mobile node via the external network with a plurality source addresses for which the plurality of bearers have been established,

to communicate the internet packet to the correspondent node via the appropriate bearer corresponding to the first source address, if a bearer has been established for the first source address,

to determine whether an internet packet received from the mobile node is the binding update, and if the internet packet is the binding update, the associating the care-of-address with the first source address includes associating the care-of-address of the mobile node with the packet data bearer defined with respect to the first source address.

11. A telecommunications system as claimed in claim 10, wherein the traffic controller is operable to associate the care-of-address of the mobile node with the first source address by communicating the care-of-address to the security function, the security function being operable to update the list of legitimate destination addresses to include the care-of-address of the mobile node.

12. A telecommunications system as claimed in any preceding claim, wherein the packet radio network is a General Packet Radio System network and the gateway support node is a GPRS Gateway Support Node.

13. A telecommunications system as claimed in claim 12, wherein the traffic controller is a Traffic Flow Template controller operable in accordance with a GPRS standard.

14. A telecommunications system as claimed in claim 12 or 13, wherein the security function is effected by a Service Based Local Policy controller operable in accordance with the GPRS standard.

15. A telecommunications system as claimed in any of claims 4 to 14, wherein the extension header field is the hop-by-hop field as defined in accordance with an Extension Header Type 2 of Ipv6.

16. A gateway support node for communicating internet packets between an external packet data communications network and a packet radio network, the packet radio network providing a plurality of packet data bearers for communicating the internet packets, each of the bearers being defined with respect to a source address of the internet packets, wherein the gateway support node is operable

to detect whether an internet packet is for providing a binding update to the correspondent node of a first source address of the mobile node to a care-of-address of the mobile node, and if the internet packet is a binding update,

to allow egress of internet packets sent from the correspondent node haying the care-of-address of the mobile node as the destination address from the gateway support node to the external network.

17. A gateway support node as claimed in claim 16, wherein the gateway support node is operable to associate the care-of-address with the first source address to the effect that the egress of the internet data packets is allowed in accordance with the egress of internet packets which is allowed for the first source address.

18. A gateway support node as claimed in claim 17, wherein the first source address is a home address of the mobile node.

19. A gateway support node as claimed in claim 16, 17 or 18, wherein the internet packet sent from the correspondent node includes the home address of the mobile node in the extension field of the header and the care-of-address of the mobile node in the destination address field, and the gate way support node is operable to allow the internet packet to egress from the packet radio network to the external network if both the care-of-address of the mobile node and the home address of the mobile node are legitimate addresses.

20. A gateway support node as claimed in any of claims 16 to 19, wherein the gateway support node is operable to confirm that the care-of-address of the mobile node is a legitimate address for the mobile node before allowing the egress of internet packets.

21. A gateway support node as claimed in claim 20, wherein the care-of-address is associated with the first source address if the care-of-address is confirmed as a legitimate address, and otherwise not associating the care-of-address with the source address.

22. A gateway support node as claimed in any of claims 20 or 21, wherein the gateway support node is operable to confirm that the care-of-address is a legitimate address by monitoring the internet packet data sent from the mobile node to the correspondent node, and

upon detecting a binding update acknowledgement from the mobile node that the care-of-address has been accepted,

confirming that the care-of-address of the mobile node is a legitimate address, and

thereafter allowing the internet packets to egress from the gateway support node.

23. A gateway support node as claimed in claim 20, wherein the gateway support node is operable to confirm that the care-of-address is a legitimate address by performing a reverse routability confirmation with the mobile node.

24. A gateway support node as claimed in any of claim 16 to 23, including a security function operable to control the egress of the internet packets from the packet radio network by comparing the destination address of an internet packet sent from the correspondent node with a list of legitimate destination addresses stored in a data store, the security function allowing the egress of the internet packet from the packet radio network if the destination address of the internet packet appears in the list, and otherwise dropping the internet packet, wherein the care-of-address of the mobile node is added to the list, upon detecting the binding update.

25. A gateway support node as claimed in any of claims 16 to 24, including a traffic controller operable

to compare the first source address in the internet protocol header received from the mobile node via the external network with a plurality source addresses for which the plurality of bearers have been established,

to communicate the internet packet to the correspondent node via the appropriate bearer corresponding to the first source address, if a bearer has been established for the first source address,

to determine whether an internet packet received from the mobile node is the binding update, and if the internet packet is the binding update

to associate the care-of-address of the mobile node with the packet data bearer defined with respect to the first source address.

26. A gateway support node as claimed in claim 25, wherein the traffic controller is operable to associate the care-of-address of the mobile node with the first source address by communicating the care-of-address to the security function, the security function being operable to update the list of legitimate destination addresses to include the care-of-address of the mobile node.

36. A computer program providing computer executable instructions, which when loaded on to a data processor configures the data processor to operate as a gateway support node as claimed in any of claims 16 to 26.

38. A computer program product having a computer readable medium having recorded thereon information signals representative of the computer program claimed in claim 36 or 37.

27. A method of communicating internet packets between an external packet data communications network and a packet radio network, the packet radio network providing a plurality of packet data bearers for communicating internet packets, each of the bearers being defined with respect to a source address of the internet packets, the method comprising

detecting whether an internet packet is for providing a binding update to the correspondent node of a first source address of the mobile node to a care-of-address of the mobile node, and if the internet packet is a binding update,

allowing egress of internet packets sent from the correspondent node having the care-of-address of the mobile node as the destination address from the packet radio network to the external network.

28. A method as claimed in claim 27, comprising

associating the care-of-address with the first source address to the effect that the egress of the internet data packets is allowed in accordance with the egress of internet packets allowed for the first source address.

29. A method as claimed in claim 28, wherein the first source address is the home address of the mobile node.

30. A method as claimed in claims 27, 28 or 29, wherein the internet packet sent from the correspondent node includes the home address of the mobile node in the extension field of the header and the care-of-address of the mobile node in the destination address field, the allowing the internet packet to egress to the external network includes

allowing the internet packet to egress from the packet radio network to the external network if both the care-of-address of the mobile node and the home address of the mobile node are legitimate addresses.

31. A method as claimed in any of claims 28 to 30, comprising

confirming that the care-of-address of the mobile node is a legitimate address for the mobile node before allowing the egress of internet packets in accordance with the destination address.

32. A method as claimed in claim 31, wherein the confirming comprises

associating the care-of-address with the first source address if the care-of-address is confirmed as a legitimate address.

33. A method as claimed in claim 31 or 32, wherein the confirming comprises

confirming that the care-of-address is a legitimate address by monitoring internet packets sent from the mobile node to the correspondent node, and

upon detecting a binding update acknowledgement from the mobile node that the care-of-address has been accepted,

confirming that the care-of-address of the mobile node is a legitimate address, and

thereafter allowing the internet packets to egress from the gateway support node.

34. A method as claimed in claim 33, wherein the confirming that the care-of-address is a legitimate address comprises

performing a reverse routability confirmation with the mobile node.

35. A method for communicating internet packet data as claimed in any of claims 27 to 34, wherein the packet radio network is a General Packet Radio System network and the gateway support node is a GPRS Gateway Support Node.

37. A computer program having computer executable instructions, which when loaded on to a data processor causes the data processor to perform a method according to any of claims 27 to 35.

39. A telecommunications system or a gateway support node as claimed as herein before described with reference to the accompanying drawings.

40. A method substantially as herein before described with reference to the accompanying drawings.