Packet switching control system and method

• US 6,980,512 B2
• Filed: 04/23/2001
• Issued: 12/27/2005
• Est. Priority Date: 10/26/1998
• Status: Expired due to Term

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Networks (Nokia Corporation)
• Inventors: Wallenius, Jukka, Verkama, Markku, Haumont, Serge, Uskela, Sami
• Primary Examiner(s): Pezzlo, John
• Application Number:
  US09/840,410
• Publication Number:
  US 20020012338A1
• Time in Patent Office: 1,709 Days
• Field of Search: 370/252, 370/230, 370/235, 370/329, 370/347, 370/392, 370/429, 370/360, 370/386, 370352-356, 370/400, 370/401, 370/328, 370/389, 709/228, 709/203, 379/88.17
• US Class Current: 370/230
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 63/0236 Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04W 12/02 Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/35 Protecting application or service provisioning, e.g. securing SIM application provisioning
• CPC Class Codes: H04W 4/24 Accounting or billing
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

A packet switching control system and method are described, for controlling a packet switched connection between a subscriber terminal and an end terminal identified by a connection endpoint identification in a communication network. A subscriber-specific screening list for a plurality of connection endpoint identifications is provided, wherein an subscriber-specific screening control of the packet switched connection is performed on the basis of the screening list. The screening list may contain detection point settings for an IN interrogation so as to provide an interworking function between the IN and the packet network. Moreover, the screening list may include a charging information to thereby define different charging parameters for packet connections to different connection endpoints. This enables the subscriber to define price limits for predetermined connections.

Claims

1. A packet switching control system for controlling a packet switched connection between a subscriber terminal (1) and an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising:

storing means for storing a subscriber-specific screening list for a plurality of connection endpoint identifications;

control means (7) for performing a screening control of the packet switched connection on the basis of a screening parameter corresponding to the connection endpoint identification of the end terminal (5), wherein said control means (7) belongs to a different entity than said storing means; and

screening means for performing a screening process, using the screening list, for each packet wherein a connection endpoint identifier (CEI) of each packet is checked as to allowed destination, and packets are passed when the destination is allowed whereas data packets from/to unallowed destinations are discarded.

2. A system according to claim 1, wherein said control means (7) belongs to any entity where a packet session is activated, while said storing means belongs to a fixed entity.

3. A system according to claim 1, wherein the control means (7) is arranged to download the subscriber-specific screening list, when the subscriber terminal (1) activates a packet data session.

4. A system according to claim 3, wherein the control means (7) is arranged to download the subscriber-specific screening list, when a packet is transmitted.

5. A system according to claim 3, wherein the control means (7) is arranged to load the subscriber-specific screening list from an external server or a location register (8) during an attach or location update procedure or a PDP context activation, and to store the loaded screening list in the storing means.

6. A system according to claim 5, wherein the subscriber-specific screening list comprises a tag indicating whether the list contains allowed or denied connection endpoint identifications, and wherein the control means (7) is arranged to let pass only those data packets transmitted from/to an allowed connection endpoint.

9. A system according to claim 3, wherein the subscriber-specific screening list is propagated to other network elements, if it is has been modified by a subscriber.

10. A system according to claim 1, wherein said control means (7) is a network element and arranged to perform packet screening for downlink packets in accordance with the subscriber-specific screening list.

11. A system according to claim 10, wherein said network element (7) is arranged to monitor an uplink traffic transmitted from the subscriber terminal (1) via the packet switched connection and to command the subscriber terminal (1) to screen data packets transmitted to an end terminal (5) identified as a denied packet destination based on said subscriber-specific screening list.

12. A system according to claim 10, wherein the communication network (4) is a General Packet Radio Services (GPRS) network and wherein the network element is a Gateway GPRS Support Node (GGSN) (7).

13. A system according to claim 12, wherein the screening list comprises a charging information, and wherein the GGSN (7) is arranged to supply the charging information to a Serving GPRS Support Node (SGSN) (6) which performs a charging operation in accordance with the charging information.

14. A system according to claim 1, wherein the connection endpoint identification is one of a PDP address, an IP address, a subaddress space, a port number, a DNS hostname and protocol, a cipherkey or a combination of these.

7. A racket switching control system for controlling a packet switched connection between a subscriber terminal (1) and an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising:

storing means for storing a subscriber-specific screening list for a plurality of connection endpoint identifications; and

control means (7) for performing a screening control of the packet switched connection on the basis of a screening parameter corresponding to the connection endpoint identification of the end terminal (5), wherein said control means (7) belongs to a different entity than said storing means; and

wherein the subscriber-specific screening list is initialized as an empty list which is updated by the control means (7) each time the control means (7) receives a data packet with the connection endpoint identification not included in the subscriber-specific screening list.

8. A system according to claim 7, wherein the update of the subscriber-specific screening list is performed by an inquiry to a service control function which answers to the inquiry by transmitting a connection parameter for the connection endpoint identification.

15. A subscriber terminal (1) for controlling a packet switched connection to an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising:

loading means for loading a subscriber-specific screening list;

control means (7) for performing a packet screening for uplink packets on the basis of a screening list parameter corresponding to the connection endpoint identification of the end terminal (5); and

screening means for performing a screening process, using the screening list, for each packet wherein a connection endpoint identifier (CEI) of each packet is checked as to allowed destination, and packets are passed when the destination is allowed whereas data packets from/to unallowed destinations are discarded.

16. A subscriber terminal according to claim 15, wherein said subscriber terminal is a mobile station equipment.

17. A packet switching control system for controlling a packet switched connection between a subscriber terminal (1) and an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising:

storing means for storing a subscriber-specific screening list for a plurality of connection endpoint identifications, wherein a detection point information for an interrogation of an Intelligent Network (IN) service control function can be set selectively for a specific connection endpoint identification in the subscriber-specific screening list;

control means (7) for triggering an IN interrogation, when a data packet with a connection endpoint identification, for which a detection point information is set, is transmitted via the packet switched connection; and

screening means for performing a screening process, using the screening list, for each packet wherein a connection endpoint identifier (CEI) of each packet is checked as to allowed destination, and packets are passed when the destination is allowed whereas data rackets from/to unallowed destinations are discarded.

18. A system according to claim 17, wherein the IN interrogation is triggered only for a first data packet having a new connection endpoint identification marked with a detection point.

19. A system according to claim 17, wherein the control means (7) is commanded by the service control function, which has received the IN interrogation, so as to replace the corresponding detection point information by a subscriber-specific screening information, and so to accept a data packet or to reject the data packet in accordance with the subscriber-specific screening information.

20. A system according to claim 19, wherein the service control function which has received the IN interrogation provides a more detailed subscriber-specific screening profile to the control means (7).

21. A packet switching control method for controlling a packet switched connection between a subscriber terminal (1) and an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising the steps of:

providing a subscriber-specific screening list for a plurality of connection endpoint identifications;

performing a screening control of the packet switched connection in another entity on the basis of a screening parameter corresponding to the connection endpoint identification of the end terminal (5); and

performing a screening process, using the screening list, for each packet wherein a connection endpoint identifier (CEI) of each packet is checked as to allowed destination, and packets are passed when the destination is allowed whereas data packets from/to unallowed destinations are discarded.

22. A method according to claim 21, wherein the subscriber-specific screening list is loaded from an external server or a location register (8) during an attach or location update procedure or a PDP context activation.

23. A method according to claim 21, wherein the subscriber-specific screening list is initialized as an empty list and updated each time a data packet with a connection endpoint identification not included in the subscriber-specific screening list is received.

24. A method according to claim 21, further comprising the step of propagating the subscriber-specific screening list to other network elements, if it is has been modified by a subscriber.

25. A method according to claim 21, wherein the screening control is performed in a network element for downlink packets and in the subscriber terminal for uplink packets.

26. A method according to claim 21, wherein an uplink traffic transmitted from the subscriber terminal via the packet switched connection is monitored and the subscriber terminal is commanded to screen data packets transmitted to a packet destination identified as a denied packet destination based on said subscriber-specific screening list.

27. A method according to claim 21, wherein the screening list comprises a charging information.

28. A packet switching control method for controlling a packet switched connection between a subscriber terminal (1) and an end terminal (5) identified by a connection endpoint identification in a communication network (4), comprising the steps of:

providing a subscriber-specific screening list for a plurality of connection endpoint identifications;

selectively setting a detection point information for an interrogation of an Intelligent Network (IN) service control function for a specific connection endpoint identification in the subscriber-specific screening list;

triggering an IN interrogation, when a data packet with a connection endpoint identification, for which a detection point information is set, is transmitted via the packet switched connection; and

performing a screening process, using the screening list, for each packet wherein a connection endpoint identifier (CEI) of each packet is checked as to allowed destination, and packets are passed when the destination is allowed whereas data packets from/to unallowed destinations are discarded.