Access Through Non-3GPP Access Networks

• US 20110035787A1
• Filed: 11/05/2008
• Published: 02/10/2011
• Est. Priority Date: 04/11/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Sahlin, Bengt, Arkko, Jari, Naslund, Mats, Norrman, Karl, Rommer, Stefan, Blom, Rolf, Lehtovirta, Vesa
• Granted Patent: US 8,621,570 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 72/53 based on regulatory allocation policies

Abstract

When setting up communication from a user equipment UE (1), such as for providing IP access for the UE in order to allow it to use some service, information or an indication or at least one network properly relating to a first network, e.g. the current access network (3, 3′), is sent to the UE from a node (13) in a sue and network such as the home network (5) of the subscriber ask UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (3, 3′) is trusted or not.

Claims

1-29. -29. (canceled)

30. A method of establishing connectivity from a user equipment through an access network, including the steps of:

sending to the access network from the user equipment a request for a connectivity;

a node in the access network receiving the request and, in response thereto, initiating an authentication procedure for the user equipment, by sending a message to an authentication server related to the user equipment, said authentication server executing the authentication procedure; and

establishing the requested connectivity;

wherein one of the messages sent to the user equipment from the authentication server to the user equipment in the authentication procedure includes information of or indicates a special condition relating to at least one network property of the access network; and

wherein the user equipment, in the step of establishing the requested connectivity, uses the received information or the indication of the special condition for selecting an appropriate way of establishing the requested connectivity through the access network.

31. The method of claim 30, wherein the network property indicates whether the access network is trusted or not.

32. The method of claim 31, where the connectivity to be established is an IP connection, including the additional step of:

allocating an IP address to the user equipment, wherein in a set-up procedure, if the user equipment has been allocated an IP address before a possible start of an authentication procedure performed according to the EAP, an IPsec tunnel is set up to a gateway in the home network or a network related thereto, and if a start of an authentication procedure performed according to the EAP occurs before the user equipment has been allocated an IP address, setting up an IPsec tunnel if the access network is signaled as being untrusted or setting up a plain communication channel with no IPSec tunnel established if the access network is signaled as being trusted.

33. The method of claim 30, wherein the network property indicates the use of at least one protocol to be used for communication along the requested connectivity to be established.

34. The method of claim 33, wherein said at least one protocol relates to security.

35. The method of claim 33, wherein said at least one protocol relates to mobility signaling.

36. The method of claim 30, wherein the authentication server comprises an AAA server in a home network of the user equipment.

37. The method of claim 36, wherein the authentication procedure is based on the EAP and said one of the messages is an EAP message sent from the AAA server.

38. The method of claim 30, wherein the authentication server comprises an HSS server in a home network of the user equipment.

39. The method of claim 30, wherein the authentication procedure is based on the EAP.

40. The method of claim 39, wherein the authentication procedure is based on the EAP AKA.

41. The method of claim 40, wherein said one of the messages is an EAP Request/AKA challenge signal.

42. The method of claim 40, wherein said one of the messages is an EAP Request/AKA-Notification signal.

43. The method of claim 40, wherein said one of the messages is an EAP Success signal.

44. A user equipment for communication through an access network, said user equipment comprising:

a unit for retrieving special information from or for interpreting a special condition indicated in one of the messages sent to the user equipment from a node, in an authentication procedure being part of setting up a connection from the user equipment through the access network, the special condition relating to at least one network property of the access network; and

a unit for using, in a following stage of the procedure of setting up the connection, the retrieved information or the result of the interpreting of the special condition for selecting an appropriate way of establishing the connectivity through the access network.

45. The user equipment of claim 44, wherein the unit for retrieving or interpreting is arranged to obtain information from said one of the messages indicating whether the access network is trusted or not, and the unit for using is arranged to set up a security tunnel for communication if the information indicates that the access network is untrusted and to set up a plain communication channel if the information indicates that the access network is trusted.

46. The user equipment of claim 44, wherein the unit for retrieving or interpreting is arranged to obtain information from said one of the messages indicating at least one protocol to be used for communication along the connectivity to be established, and the unit for using is arranged to use said at least one protocol in establishing the connectivity through the access network.

47. A server in a home network of a user equipment, the server arranged to send information to the user equipment in an authentication procedure being part of establishing connectivity from the user equipment through an access network, wherein the server is arranged to introduce, in a message included in said information sent to the user equipment, special information indicating a special condition relating to at least one network property of the access network or modifying said message to indicate the special condition.

48. The server of claim 47, wherein the server is an AAA server or an HSS server.

49. The server of claim 47, wherein the server is arranged to introduce special information indicating whether the access network is trusted or not.

50. The server of claim 47, wherein the server is arranged to introduce special information indicating at least one protocol to be used for communication along the connectivity to be established.

51. The server of claim 47, wherein the server comprises an AAA server and that the server is arranged to introduce the special information in an EAP message.

52. The server of claim 51, wherein the EAP message is an EAP Request/AKA challenge signal.

53. The server of claim 51, wherein the EAP message is an EAP Request/AKA-Notification signal.

54. The server of claim 51, wherein the EAP message is an EAP Success signal.

55. A computer program product comprised in or for use by a user equipment related to a server, the computer product being an electronic memory carrying computer readable instructions which when run by the user equipment causes the user equipment to retrieve special information from or for interpreting a special condition indicated in one of the messages sent to the user equipment from the server to which the user equipment is related, in an authentication procedure being part of setting up a connection from the user equipment through an access network, the special condition relating to at least one network property of the access network, and to use, in a following stage of the procedure of setting up the connection, the retrieved information or the result of the interpreting of the special condition for selecting an appropriate way of establishing the connectivity through the access network.

56. A computer program product, comprised in or for use by a server related to user equipments, the computer program product being an electronic memory carrying computer readable instructions which when run by a server causes the server to introduce, in a message included in information sent to one of user equipments related to the server, special information indicating a special condition relating to at least one network property of an access network, through which is a connection from said user equipment is to be set up, or to modify said message to indicate the special condition.