METHODS AND APPARATUS TO SUPPORT LOCATION SPECIFIC CONTROL OF ACCESS TO SERVICES THROUGH UNTRUSTED WIRELESS NETWORKS

• US 20160183085A1
• Filed: 12/18/2015
• Published: 06/23/2016
• Est. Priority Date: 12/19/2014
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: YERRABOMMANAHALLI, Vikram Bhaskara, SINGH, Ajoy K., KISS, Krisztian, MALTHANKAR, Rohan C., PAULY, Thomas F.
• Granted Patent: US 10,057,767 B2
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04L 65/1016 IP multimedia subsystem [IMS]
• CPC Class Codes: H04L 65/1073 Registration or de-registration
• CPC Class Codes: H04L 65/1104 Session initiation protocol [SIP]
• CPC Class Codes: H04W 12/04 Key management, e.g. using generic bootstrapping architecture [GBA]
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/63 Location-dependent; Proximity-dependent
• CPC Class Codes: H04W 64/003 locating network equipment

Abstract

Apparatus and methods to support location specific control to allow and/or disallow access to services through untrusted wireless networks by a wireless communication device are disclosed. One or more network elements obtain a location of the wireless communication device and selectively allow and/or disallow access to one or more cellular network services and/or one or more access point names (APNs) based on the location of the wireless communication device when connecting through an untrusted wireless network.

Claims

1. A method to control service access for a wireless communication device, the method comprising:

by the wireless communication device;

establishing an encrypted connection with a server through a non-3GPP wireless access network;

establishing an authenticated connection with the server through the non-3GPP wireless access network;

providing geographic location information for the wireless communication device to the server;

requesting access to one or more services provided through one or more access point names (APNs) to the server; and

receiving an indication to allow or disallow access to at least one of the one or more services and/or to the one or more APNs based at least in part on the provided geographic location information.

2. The method as recited in claim 1, wherein the geographic location information is provided to the server by the wireless communication device as an attribute in an Internet Key Exchange Version 2 (IKEv2) protocol message.

3. The method as recited in claim 2, wherein the IKEv2 protocol message comprises a configuration request message sent during an authentication phase before authentication of the server by the wireless communication device is complete.

4. The method as recited in claim 2, wherein the IKEv2 protocol message comprises an informational notification message sent after authentication of the server by the wireless communication device is complete.

5. The method as recited in claim 1, wherein the server comprises an evolved packet data gateway (ePDG) associated with a wireless service provider.

6. The method as recited in claim 5, wherein the indication to allow or disallow access comprises a notification message from the ePDG that disallows establishment of at least one Internet Protocol Security (IPSec) tunnel to at least one of the one or more APNs.

7. The method as recited in claim 1, wherein the server comprises an Internet Protocol Multimedia Subsystem (IMS) server associated with a wireless service provider.

8. The method as recited in claim 7, wherein the geographic location information is provided to the IMS server by the wireless communication device in a Session Initiation Protocol (SIP) registration message.

9. The method as recited in claim 7, wherein the indication to allow or disallow access comprises a SIP message denying registration of the wireless communication device for the at least one of the one or more services.

10. The method as recited in claim 7, wherein the indication to allow or disallow access comprises a SIP message to start a network-initiated deregistration procedure for the at least one of the one or more services after successful registration of the wireless communication device.

11. The method as recited in claim 1, wherein the indication to allow or disallow access comprises a notification that disallows access to at least one service via the non-3GPP wireless access network based on the geographic location information provided by the wireless communication device.

12. The method as recited in claim 11, wherein the indication to allow or disallow access further comprises an indication of an alternative connection through which the wireless communication device can access the at least one service.

13. The method as recited in claim 12, wherein the alternative connection comprises a connection via a cellular wireless access network of a wireless service provider.

14. The method as recited in claim 1, wherein the geographic location information comprises a mobile country code (MCC) and/or a mobile network code (MNC).

15. The method as recited in claim 1, wherein the geographic location information comprises longitude and latitude information derived from a global positioning system (GPS) receiver of the wireless communication device.

16. The method as recited in claim 1, wherein the geographic location information comprises wireless local area network (WLAN) access point (AP) location data.

17. A wireless communication device comprising one or more processors and a storage medium storing instructions that, when executed on the one or more processors, cause the wireless device to

establish an encrypted connection with a server through a non-3GPP wireless access network;

establish an authenticated connection with the server through the non-3GPP wireless access network;

provide geographic location information for the wireless communication device to the server;

request access to one or more services provided through one or more access point names (APNs) to the server; and

receive an indication to allow or disallow access to at least one of the one or more services and/or to the one or more APNs based at least in part on the provided geographic location information.

18. The wireless communication device of claim 17, wherein geographic location information is provided to the server by the wireless communication device as configuration attribute in an Internet Key Exchange Version 2 (IKEv2) protocol informational notification message sent after authentication of the server by the wireless communication device is complete.

19. The wireless communication device of claim 17, wherein the indication to allow or disallow access to at least one of the one or more services and/or to the one or more APNs comprises notification to disallow access to a first service and to allow access to a second service.

20. A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a wireless communication device, cause the wireless communication device to:

establish an encrypted connection with a server through a non-3GPP wireless access network;

establish an authenticated connection with the server through the non-3GPP wireless access network;

provide geographic location information for the wireless communication device to the server;

request access to one or more services provided through one or more access point names (APNs) to the server; and

receive an indication to allow or disallow access to at least one of the one or more services and/or to the one or more APNs based at least in part on the provided geographic location information.