MEANS AND METHOD FOR CONTROLLING NETWORK ACCESS IN INTEGRATED COMMUNICATIONS NETWORKS

• US 20100037284A1
• Filed: 06/28/2005
• Published: 02/11/2010
• Est. Priority Date: 06/28/2005
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Sachs, Joachim
• Granted Patent: US 9,521,149 B2
• Time in Patent Office: Days
• US Class Current: 726/1
• CPC Class Codes: H04L 43/0847 Transmission error
• CPC Class Codes: H04L 43/087 Jitter
• CPC Class Codes: H04L 43/0888 Throughput
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/082 using revocation of authorisation
• CPC Class Codes: H04W 28/18 Negotiating wireless communication parameters
• CPC Class Codes: H04W 74/00 Wireless channel access
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]

Abstract

The invention provides methods and means for assisting the control of a User Terminal'"'"'s, UT'"'"'s, (240), access to an access network domain in a radio communications network. An MRRM-function co-operates with an A2-entity of said communications network wherein the MRRM function is arranged to carry out the following steps: receiving RRIM-messages from a second access network domain of said network, said messages comprising at least one parameter value, X2, of a radio resource parameter, P2, related to the traffic load and/or the radio resource consumption and/or the characteristics of at least one radio traffic channel, of said second access network domain, defining a criterion, C, for granting said UT (240) access to said second access network domain, wherein said C is a function of at least said parameter value, X2, establishing whether said criterion, C, is fulfilled or not for said UT (240), instructing said second authorization entity, A2, that said UT (240) is authorized to access said second access network domain if said criterion, C, is fulfilled for said UT (240) and instructing said second authorization entity, A2, that said UT (240) is not authorized to access said second access network domain if said criterion, C, is not fulfilled for said UT (240).

Claims

1. A method for assisting the control of a User Terminal'"'"'s, UT'"'"'s, access to an access network domain in a radio communications network, said method to be used by a Multi Radio Resource Management, MRRM, function of said communications network, said MRRM function being arranged to communicate with a first radio access network domain to which a first authorization entity, A1, authorizes UTs access. and to communicate with at least a second radio access network domain to which a second authorization entity, A2, authorizes UTs access, said method comprising the steps of:

receiving at least one radio resource information message, RRIM, from said second access network domain, said message comprising at least one parameter value, X₂, of at least one radio resource parameter, P₂, related to the traffic load and/or the radio resource consumption and/or the characteristics of at least one radio traffic channel, associated with said second access network domain,

defining a criterion, C, for granting said UT access to said second access network domain, wherein said C is a function of at least said parameter value, X₂,

establishing whether said criterion, C, is fulfilled or not for said UT,

instructing said second authorization entity, A2, that said UT is authorized to access said second access network domain if said criterion. C, is fulfilled for said UT and instructing said second authorization entity. A2, that said UT is not authorized to access said second access network domain if said criterion. C, is not fulfilled for said UT.

2. The method according to claim 1 further comprising the steps of:

receiving at least one radio resource information message, RRIM, from said first access network domain, said message comprising at least one parameter value, X₁, of at least one Parameter, P₁, related to the traffic load, and/or the radio resource consumption and/or the characteristics of at least one radio traffic channel, associated with said first access network domain, —

defining said criterion, C, to be a function of at least said parameter value, X₁.

3. The method according to claim 1 wherein said X₂ represents a total traffic load associated with said second access network domain in terms of throughput (Kb/s), total number of served users (UTs), interference value (e.g. in terms of W or SIR), total number of channel access collisions, transmission power (W), or represents a radio resource consumption in terms of transmission power (W), total number of served UTs, total number of used codes or sub-carriers or time slots. associated with said second access network domain, or represents a radio channel quality of said UT, in terms of a SNR-value or a SIR-value or a BER-value or a FER-value or throughput-value (Kb/s) or packet delay value (ms).

4. The method according to claim 2 wherein said X₁ represents a total traffic load associated with said first access network domain in terms of throughput (Kb/s), total number of served users (UTs), interference value (e.g. in terms of W or SIR), total number of channel access collisions, transmission power (W), or represents a radio resource consumption in terms of transmission power (W), total number of served UTs. total number of used codes or sub-carriers or time slots, associated with said first access network domain, or represents a radio channel quality of said UT, in terms of a SNR-value or a SIR-value or a BER-value or a FER-value or throughput-value (Kb/s) or packet delay value (ms).

5. The method according to claim 1 wherein said first access network domain forms a 3GPP cellular radio network and said second access network domain forms a wireless data network according to an IEEE 802 standard or according to a standard Internet protocol for mobile applications. MIP, or wherein said second access network domain forms a 3GPP cellular radio network and said first access network domain forms a wireless data network according to an IEEE 802 standard or according to a standard Internet protocol for mobile applications, MIP.

6. The method according to claim 1 wherein the definition of said criterion C comprises the following steps:

defining a maximum tolerable threshold value, X_2MAX, for said radio resource parameter P₂,

estimating the effective value, X_2EST, of said parameter P₂ as a consequence of said UT being granted access to said second access network domain,

granting said UT access to said second access network domain only if said X_2EST is below said X_2MAX.

7. The method according to claim 1 wherein the definition of said criterion C comprises the following steps:

defining a minimum tolerable threshold value, X_2MiN for said radio resource parameter P₂, being a QoS value requested by said UT,

estimating the effective value, X_2EST, of said parameter P₂ as a consequence of said UT being granted access to said second access network domain.

granting said UT access to said second access network domain only if said X_2EST exceeds said X_2MIN.

8. The method according to claim 2 wherein the step of defining said C comprises the following steps:

choosing a current parameter value, X₁, of said first access network domain, being a parameter value representing the total traffic load associated with said first access network domain or a specific base station of said first access network domain with which said UT is currently communicating,

estimating an effective value of a corresponding parameter, X_2EST, for said second access network domain in case a communication session of said UT is handed over to said second access network domain, said X_2EST being a parameter value representing the total traffic load associated with said second access network domain or a specific access node, AP, of said second access network domain,

defining said C so as to grant said UT access to said second access network domain only if said estimated X_2EST is below said current X₁.

9. The method according to claim 2 wherein the step of defining said C comprises the following steps:

choosing a current parameter value, X₁, of said first access network domain, being a QoS parameter value associated with a communication session of said UT currently communicating through said first access network domain, —

estimating an effective value for a corresponding QoS parameter, X_2EST, in case said communication session of said UT is routed through said second access network domain instead of said first access network domain,

defining said C so as to grant said UT access to said second access network domain only if said estimated X_2EST exceeds said current X₁.

10. The method according to claim 1 further comprising the steps of:

monitoring whether said criterion C continues to be fulfilled after having instructed said A2 to grant authorization for said UT,

establishing that said C is no longer fulfilled for said UT, —

instructing said A2 to revoke the authorization for said UT to access said second access network domain.

11. The method according to claim 1 further comprising the steps of:

forming a global access policy concerning at least one UT'"'"'s authorization to access said second access network domain, wherein said global policy is a function of said criterion, C.

monitoring radio resource parameter values relating to said second access network domain and/or said first access network domain and establishing the authorization status for at least said UT according to said global policy,

detecting the change of authorization status for at least said UT, according to said global policy,

forming a policy update message comprising an authorization instruction,

sending said policy update message to said authorization entity application, A2, responsible for establishing whether said UT is authorized to access said second access network domain.

12. The method according to claim 11 wherein said authorization instruction comprises a maximum or minimum tolerable parameter value associated with said second access network domain.

13. The method according to claim 1 wherein the step of instructing said second authorization entity, A2, comprises the following step:

sending an access network domain access reply message comprising an access grant identifier indicating the authorization status of said UT based on said C, and comprising a UT identifier, to said A2 entity.

14. The method according to claim 1 wherein said MRRM function is realized as a MRRM entity residing in a single network node and wherein said RRIM message/s comprises a plurality of parameter values related to at least one radio resource parameter, or a set of radio resource parameters, of said radio communications network and wherein said C is a function of said plurality of parameter values.

15. An authorization method to be used by an Authorization entity, A2, residing in a authorization network node being connected with a radio access network domain in a radio communications network wherein said A2 entity authorizes UTs access to said second access network domain according to a local authorization policy of said second access network domain, said method comprising the steps of:

receiving an access request from a UT to access said second access network domain, —

establishing whether said UT is authorized to access said second access network domain according to said local authorization policy,

receiving a global authorization policy update message from a Multi Radio Resource Management entity residing in a network node of said communications network. said MRRM entity being arranged to establish a global authorization policy for a plurality of authorization domains in said communications network, said global authorization policy overriding said local authorization policy,

granting said UT authorization to access to said second access network domain only if said UT is authorized to access said second access network domain according to said local authorization policy and according to said global authorization policy update message.

16. The method according to claim 15 further comprising the steps of:

forwarding said access request to said Multi Radio Resource Management entity in said network node,

receiving said global authorization policy update message in form of an access reply message from said MRRM entity, said message comprising an access grant identifier indicating whether said UT is to be granted access to said second access network domain or not, along with a UT identifier identifying said UT.

17. A network node being arranged to communicate with a first access network domain in an integrated radio communications network to which domain a first authorization entity, A1, authorizes UTs access, and being arranged to communicate with a second access network domain in said communications network to which domain a second authorization entity, A2, authorizes UTs access. wherein said network node comprises means for:

receiving at least one radio resource information message, RRIM, from said second access network domain, said message comprising at least one parameter value, X₂, of at least one radio resource parameter, P₂, related to the traffic load and/or the radio resource consumption and/or the characteristics of at least one radio traffic channel, associated with said second access network domain,

defining a criterion, C, for granting said UT access to said second access network domain, wherein said C is a function of at least said parameter value, X₂,

establishing whether said criterion, C, is fulfilled or not for said UT,

instructing said second authorization entity, A2, that said UT is authorized to access said second access network domain if said criterion, C, is fulfilled for said UT and instructing said second authorization entity, A2, that said UT is not authorized to access said second access network domain if said criterion, C, is not fulfilled for said UT.

19. The network node according to claim 17, further being arranged as a Radio Network Controller, RNC, being arranged to communicate with said first access network domain via a first data port, and to communicate with said second access network domain via a second data port.

18. (canceled)

20. (canceled)

21. An authorization network node being arranged to communicate with a second access network domain in an integrated radio communications network to which domain a second authorization entity, A2, residing in said network node, authorizes UTs access, wherein said authorization network node comprises means for

receiving an access request from a UT to access said second access network domain,

establishing whether said UT is authorized to access said second access network domain according to said local authorization policy,

receiving a global authorization policy update message from a Multi Radio Resource Management entity residing in a network node of said communications network, said MRRM entity being arranged to establish a global authorization policy for a plurality of authorization domains in said communications network, said global authorization policy overriding said local authorization policy,

granting said UT authorization to access to said second access network domain only if said UT is authorized to access said second access network domain according to said local authorization policy and according to said global authorization policy update message.

23. The authorization network node according to claim 21 wherein said network node is realized as a DIAMETER or RADIUS server exploiting an EAP or an EAP-TLS or an EAP-TTLS or an EAP-PEAP protocol.

22. (canceled)

24. (canceled)

25. (canceled)

26. (canceled)

27. (canceled)

28. (canceled)

29. Data storage means having stored thereon a plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps of a method for assisting the control of a User Terminal'"'"'s, UT'"'"'s, access to an access network domain in a radio communications network, said method to be used by a Multi Radio Resource Management, MRRM, function of said communications network, said MRRM function being arranged to communicate with a first radio access network domain to which a first authorization entity, A1, authorizes UTs access, and to communicate with at least a second radio access network domain to which a second authorization entity, A2, authorizes UTs access, said method comprising the steps of:

receiving at least one radio resource information message, RRIM, from said second access network domain, said message comprising at least one parameter value, X₂, of at least one radio resource parameter, P₂, related to the traffic load and/or the radio resource consumption and/or the characteristics of at least one radio traffic channel, associated with said second access network domain,

defining a criterion, C, for granting said UT access to said second access network domain, wherein said C is a function of at least said parameter value, X₂,

establishing whether said criterion, C, is fulfilled or not for said UT,

instructing said second authorization entity, A2, that said UT is authorized to access said second access network domain if said criterion, C, is fulfilled for said UT and instructing said second authorization entity, A2, that said UT is not authorized to access said second access network domain if said criterion, C, is not fulfilled for said UT.

30. Data storage means having stored thereon a plurality of instructions including instructions which, when executed by a processor, cause the processor to perform the steps of an authorization method to be used by an Authorization entity. A2, residing in a authorization network node being connected with a radio access network domain in a radio communications network wherein said A2 entity authorizes UTs access to said second access network domain according to a local authorization policy of said second access network domain, said method comprising the steps of:

receiving an access request from a UT to access said second access network domain,

establishing whether said UT is authorized to access said second access network domain according to said local authorization policy,

receiving a global authorization policy update message from a Multi Radio Resource Management entity residing in a network node of said communications network, said MRRM entity being arranged to establish a global authorization policy for a plurality of authorization domains in said communications network, said global authorization policy overriding said local authorization policy,

granting said UT authorization to access to said second access network domain only if said UT is authorized to access said second access network domain according to said local authorization policy and according to said global authorization policy update message.