Service access control interface for an unlicensed wireless communication system

• US 7,283,822 B2
• Filed: 02/06/2006
• Issued: 10/16/2007
• Est. Priority Date: 10/17/2003
• Status: Expired due to Term

• Current Assignee: Ribbon Communications Operating Company, Inc. (Ribbon Communications, Inc.)
• Original Assignee: Kineto Wireless Incorporated (Ribbon Communications, Inc.)
• Inventors: Gupta, Rajeev, Gallagher, Michael D., Khetawat, Amit, Sethi, Swaran Singh
• Primary Examiner(s): Eng; George
• Assistant Examiner(s): Miller; Brandon J.
• Application Number:
  US11/349,025
• Publication Number:
  US 20060223498A1
• Time in Patent Office: 617 Days
• Field of Search: 455/448, 455/432.2, 455/462, 455/433, 455/426.1, 455/41.2, 455/436, 455/435.1, 455/432.1, 455410-411, 370/331
• US Class Current: 455/436
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/71 Hardware identity
• CPC Class Codes: H04W 12/72 Subscriber identity
• CPC Class Codes: H04W 12/73 Access point logical identity
• CPC Class Codes: H04W 60/04 using triggered events
• CPC Class Codes: H04W 76/30 Connection release
• CPC Class Codes: H04W 8/205 Transfer to or from user equipment or user record carrier
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 84/16 WPBX [Wireless Private Branch Exchange]
• CPC Class Codes: H04W 88/06 adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/12 Access point controller devices
• CPC Class Codes: H04W 88/16 Gateway arrangements
• CPC Class Codes: H04W 92/02 Inter-networking arrangements
• CPC Class Codes: H04W 92/06 : between gateways and public network devices

Abstract

Some embodiments provide a system for authorization and authentication of an unlicensed mobile access (UMA) subscriber. The system includes an UMA network controller (UNC) which is communicatively coupled to a licensed wireless communication system. The system also includes an access point (AP) that serves a wireless local area network (WLAN). The system further includes a mobile station (MS) that is communicatively coupled to the AP and the licensed wireless communication system. The system also includes an authentication server that is communicatively coupled to the UNC. The authentication server authenticates a UMA subscriber for accessing an unlicensed mobile access network (UMAN) that includes the UNC and the AP.

Claims

1. A system for authorization and authentication of an unlicensed mobile access (UMA) subscriber, the system comprising:

a) an unlicensed network controller communicatively coupled to a licensed wireless communication system, wherein the unlicensed network controller comprises an IP network controller (INC) communicatively coupled to the licensed wireless communication system and a security gateway communicatively coupled to the INC;

b) a mobile station (MS) communicatively coupled to the INC through the security gateway and communicatively coupled to the licensed wireless communication system;

c) a first server communicatively coupled to the security gateway for authentication of the MS into the unlicensed network controller; and

d) a second server communicatively coupled to the INC for exchanging session specific data with the INC, wherein the second server authorizes said session specific data.

2. The system of claim 1, wherein the INC and the second server communicate using remote access dial-in user service (RADIUS) protocol.

3. The system of claim 1, wherein the first server is communicatively coupled to the licensed wireless communication system home location register (HLR) and a set of databases comprising authorization, authentication, and accounting data.

4. The system of claim 1, wherein the second server is an authorization, authentication, and accounting (AAA) server.

5. The system of claim 1, wherein the unlicensed network controller further comprises a media and signaling gateway communicatively coupled to the INC, to the security gateway, and to the licensed wireless communication system.

18. The method of claim 1, wherein the first server and the second server are the same physical server.

19. The system of claim 1, further comprising an access point (AP), wherein the security gateway and the AP are connected through a broadband access network.

20. The system of claim 19, wherein the session specific data comprises a media access control (MAC) address of the AP.

21. The system of claim 19, wherein the session specific data comprises a service set identifier (SSID) of the AP.

22. The system of claim 19, wherein the broadband access network is the Internet.

23. The system of claim 19, wherein the second server obtains a location of the AP from a set of operator databases, wherein when no location is available for a particular AP, the second server denies UMA service from the particular AP.

24. The system of claim 1, wherein the second server utilizes the session specific data to verify that the subscriber has a UMA subscription, is trying to access UMA through a valid access point, and is using an access point located within a valid Public Land Mobile Network (PLMN).

25. The system of claim 1, wherein the INC receives the session specific data from the MS as part of a UMA registration process.

26. The system of claim 1, wherein the INC receives the session specific data from the MS as part of a UMA discovery process.

27. The system of claim 1, wherein the session specific data comprises the UMA subscriber'"'"'s international mobile subscriber identity (IMSI).

28. The system of claim 1, wherein the session specific data comprises a cell global identification (CGI) from a licensed wireless communication system cell site upon which the MS is already camped.

29. The system of claim 1, wherein the licensed wireless communication system comprises a Serving General Packet Radio Service (GPRS) Switch Node (SGSN), wherein the INC is communicatively coupled to the SGSN.

30. The system of claim 5, wherein the media and signaling gateway is communicatively coupled to a Mobile Switching System (MSC) of the licensed wireless communication system.

6. A method of authorization and authentication of an unlicensed mobile access (UMA) subscriber, the method comprising:

a) receiving at a first server through a security gateway of an unlicensed network controller, information for authentication of a mobile station (MS) into the unlicensed network controller;

b) receiving at an IP network controller (INC) of the unlicensed network controller, session specific data from the MS, wherein the INC is communicatively coupled to a licensed wireless communication system and is communicatively coupled to the security gateway;

c) sending from the INC said session specific data to a second server;

d) performing a set of authorization checks by the second server by accessing aset of databases; and

e) sending a message from the second server to the INC to inform the INC whether the UMA subscriber is authorized to utilize the services of an unlicensed mobile access network comprising the unlicensed network controller.

7. The method of claim 6, wherein said session specific data comprises the UMA subscriber'"'"'s international mobile subscriber identity (IMSI).

8. The method of claim 6, wherein said session specific data comprises a media access control (MAC) address of an access point (AP).

9. The method of claim 6, wherein said session specific data comprises a service set identifier (SSID) of an access point (AP).

10. The method of claim 6, wherein said session specific data comprises a cell global identification (CGI) of the licensed wireless communication system.

11. The method of claim 6, wherein said perfonning a set of authorization checks by the second server comprises verifying whether the UMA subscriber has a valid UMA subscription.

12. The method of claim 6, wherein the security gateway is communicatively coupled to an access point (AP), wherein said performing a set of authorization checks by the second server comprises verifying whether the AP is a valid access point.

13. The method of claim 6, wherein the security gateway is communicatively coupled to an access point (AP), wherein said performing a set of authorization checks by the second server comprises verifying whether the AP is located within a valid public land mobile netxvork (PLMN).

14. The method of claim 6, wherein said performing a set of authorization checks by the second server comprises obtaining a location of an access point (AP) from a database.

15. The method of claim 14 further comprising sending the location of the AP from the second server to the INC.

16. The system of claim 6, wherein the second server is an authorization, authentication, and accounting (AAA) server.

17. The method of claim 6, wherein the first server and the second server are the same physical server.

31. An unlicensed network controller communicatively coupled to a licensed wireless communication system, comprising:

a) an IP network controller (INC) communicatively coupled to the licensed wireless communication system; and

b) a security gateway communicatively coupled to the INC and communicatively coupled a first server for authentication of a mobile station (MS) into the unlicensed network controller, wherein the MS is communicatively coupled to the INC through the security gateway, wherein the MS is communicatively coupled to the licensed wireless communication system;

wherein the INC is communicatively coupled to a second server for exchanging session specific data between the second server and the INC, wherein the second server authorizes said session specific data.

32. The unlicensed network controller of claim 31, wherein the INC and the second server communicate using remote access dial-in user service (RADIUS) protocol.

33. The unlicensed network controller of claim 31, wherein the first server is communicatively coupled to the licensed wireless communication system home location register (HLR) and a set of databases comprising authorization, authentication, and accounting data.

34. The unlicensed network controller of claim 31, wherein the second server is an authorization, authentication, and accounting (AAA) server.

35. The unlicensed network controller of claim 31, wherein the first server and the second server are the same physical server.

36. The unlicensed network controller of claim 31, wherein the unlicensed network controller further comprises a media and signaling gateway communicatively coupled to the INC, to the security gateway, and to the licensed wireless communication system.

37. The unlicensed network controller of claim 36, wherein the media and signaling gateway is communicatively coupled to a Mobile Switching System (MSC) of the licensed wireless communication system.

38. The unlicensed network controller of claim 31, wherein the INC receives the session specific data from the MS as part of an unlicensed mobile access registration process.

39. The unlicensed network controller of claim 31, wherein the INC receives the session specific data from the MS as part of an unlicensed mobile access discovery process.

40. The unlicensed network controller of claim 31, wherein the licensed wireless communication system comprises a Serving General Packet Radio Service (GPRS) Switch Node (SGSN), wherein the INC is communicatively coupled to the SGSN.

41. The unlicensed network controller of claim 31, wherein the INC performs a set of unlicensed mobile access control functions and packet gateway functions, wherein the unlicensed mobile access control functions provide the overall management, control, and signaling component of an unlicensed mobile access network architecture, wherein the packet gateway functions provide the conversion of frames received from the MS into a format required by the ii censed wireless communication system.