Method for extending mobile IP and AAA to enable integrated support for local access and roaming access connectivity

• US 7,525,937 B2
• Filed: 08/26/2004
• Issued: 04/28/2009
• Est. Priority Date: 02/04/2002
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: O'Neill, Alan
• Primary Examiner(s): Chan; Wing F
• Assistant Examiner(s): ROBERTS, BRIAN S
• Application Number:
  US10/926,541
• Publication Number:
  US 20050041650A1
• Time in Patent Office: 1,706 Days
• Field of Search: None
• US Class Current: 370/328
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04W 8/20 Transfer of user or subscriber data
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

This document describes a way to extend Mobile IP Authentication Authorization and Accounting (AAA) signaling to enable a node to request from a network operator combinations of home and local service capabilities (when roaming) in an efficient and scalable manner. It also enables the home and foreign service providers to constrain and account for actual services provided based on a combination of the foreign and home operator policy.

Claims

1. An access node for providing at least two concurrent access services to a mobile node when the mobile node is outside its home domain, the access node comprising:

an input/output interface for receiving a remote access message and relaying the remote access message to a home agent; and

a processor coupled with a memory, wherein the processor is configured to

a) generate an authentication and authorization request (AAR) message based on the remote access message;

b) send the AAR message through the input/output interface to an authentication/authorization/accounting (AAA) proxy server, and

c) implement the at least two concurrent access services for the mobile node based on a return AAR message received from the AAA proxy server.

2. The access node of claim 1 wherein the remote access message comprises at least two profile selectors and a network access identifier (NAI).

3. The access node of claim 2 wherein the network access identifier (NAI) comprises at least one realm part for identifying at least one home service profile server and at least one username part for identifying at least one service profile.

4. The access node of claim 3 wherein the at least one home service profile server is part of a home authentication/authorization/accounting (AAA) server, and wherein the AAR message is used by the home AAA server to confirm authentication and authorization.

5. The access node of claim 2 further comprising a state information module residing within the memory, the state information module storing at least two service profiles based on the at least two profile selectors, wherein the at least two service profiles are returned by the return AAR message.

6. The access node of claim 5 wherein the processor is further configured to provide the at least two concurrent access services based on the at least two service profiles.

7. The access node of claim 6 further comprising a nested mobile Internet Protocol (MIP) extension module residing within the memory, wherein the nested MIP extension module stores a plurality of mobile Internet Protocol (MIP) addresses to implement the at least two concurrent access services for the mobile node.

8. The access node of claim 6 wherein the protocol associated with the home agent is one of the following:

standard MIP remote access, standard point-to-point tunneling protocol (PPTP) remote access or standard IP security (IPSEC) remote access.

9. The access node of claim 6 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.

10. A wireless communication node for providing at least two concurrent access services to a mobile node when the mobile node is outside its home domain, the wireless communication node comprising:

means for receiving a remote access message;

means for relaying the remote access message to a home agent;

means for generating an authentication and authorization request (AAR) message based on the remote access message;

means for sending the AAR message to an authentication/authorization/accounting (AAA) proxy server, and

means for implementing the at least two concurrent access services for the mobile node based on a return AAR message received from the AAA proxy server.

11. The wireless communication node of claim 10 wherein the remote access message comprises at least two profile selectors and a network access identifier (NAI).

12. The wireless communication node of claim 11 wherein the network access identifier (NAI) comprises at least one realm part for identifying at least one home service profile server and at least one username part for identifying at least one service profile.

13. The wireless communication node of claim 12 wherein the at least one home service profile server is part of a home authentication/authorization/accounting (AAA) server, and wherein the AAR message is used by the home AAA server to confirm authentication and authorization.

14. The wireless communication node of claim 11 further comprising means for storing at least two service profiles based on the at least two profile selectors, wherein the at least two service profiles are used to provide the at least two concurrent access services.

15. The wireless communication node of claim 14 further comprising means for storing a plurality of mobile Internet Protocol (MIP) addresses to implement the at least two concurrent access services.

16. The wireless communication node of claim 15 wherein the protocol associated with the home agent is one of the following:

standard MIP remote access, standard point-to-point tunneling protocol (PPTP) remote access or standard IP security (IPSEC) remote access.

17. The wireless communication node of claim 15 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.

18. A method for providing at least two concurrent access services to a mobile node when outside its home domain comprising:

relaying a remote access message to a home agent;

generating a first authentication and authorization request (AAR) message based on the remote access message;

sending the first AAR message to an authentication/authorization/accounting (AAA) proxy server;

receiving a first return AAR message from the AAA proxy server; and

implementing the at least two concurrent access services for the mobile node based on the first return AAR message.

19. The method of claim 18 further comprising receiving the remote access message wherein the remote access message comprises at least two profile selectors and a first network access identifier (NAI).

20. The method of claim 19 wherein the at least two profile selectors are each either a signaling flag or a message extension.

21. The method of claim 19 wherein the first network access identifier (NAI) comprises a first realm part for identifying a home service profile server and a first username part for identifying a first service profile on the home service profile server.

22. The method of claim 21 wherein the home service profile server is part of a home authentication/authorization/accounting (AAA) server.

23. The method of claim 22 wherein the first AAR message is used to confirm authentication and authorization by the home AAA server.

24. The method of claim 23 wherein the home service profile server provides the first service profile, and wherein the first service profile relates to a first of the at least two concurrent access services for the mobile node.

25. The method of claim 24 wherein the first NAI further comprises a second realm part for identifying a service profile server in a third party AAA server.

26. The method of claim 25 wherein the service profile server in the third party AAA server provides a second service profile related to a second of the at least two concurrent access services for the mobile node.

27. The method of claim 26 wherein the at least two concurrent access services include at least one of a remote access service and a local access service.

28. The method of claim 24 wherein the remote access message further comprises a second NAI further comprising a second realm part for identifying a service profile server in a third party AAA server.

29. The method of claim 28 wherein the service profile server in the third party AAA server provides a second service profile related to a second of the at least two concurrent access services for the mobile node.

30. The method of claim 29 wherein the at least two concurrent access services include at least one of a remote access service and a local access service.

31. The method of claim 18 wherein the home agent is either a local home agent or a remote home agent.

32. The method of claim 31 wherein the protocol associated with the home agent is one of the following:

standard MIP remote access, standard point-to-point tunneling protocol (PPTP) remote access or standard IF security (IPSEC) remote access.

33. The method of claim 18 wherein the first return AAR message from the AAA proxy server is derived from at least one other AAA server coupled to the AAA proxy server.

34. The method of claim 33 where the at least one other AAA server is a home AAA server.

35. The method of claim 18 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.

36. The method of claim 18 further comprising:

generating a second AAR message based on the remote access message;

sending the second AAR message along with the first AAR message to the authentication/authorization/accounting (AAA) proxy server;

receiving a second return AAR message along with the first return AAR message from the AAA proxy server; and

implementing at least two concurrent access services for the mobile node based on the first return AAR message and the second return AAR message.

37. The method of claim 36 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.

38. A computer-readable medium storing program code thereon, comprising:

program code for relaying a remote access message to a home agent;

program code for generating a first authentication and authorization request (AAR) message based on the remote access message;

program code for sending the first AAR message to an authentication/authorization/accounting (AAA) proxy server;

program code for receiving a first return AAR message from the AAA proxy server; and

program code for implementing at least two concurrent access services for a mobile node based on the first return AAR message.

39. The computer-readable medium of claim 38 further comprising program code for receiving the remote access message wherein the remote access message comprises at least two profile selectors and a first network access identifier (NAI).

40. The computer-readable medium of claim 39 wherein the first network access identifier (NAI) comprises a first realm part for identifying a home service profile server and a first username part for identifying a first service profile on the home service profile server.

41. The computer-readable medium of claim 40 wherein the home service profile server is part of a home authentication/authorization/accounting (AAA) server.

42. The computer-readable medium of claim 41 wherein the first AAR message is used to confirm authentication and authorization by the home AAA server.

43. The computer-readable medium of claim 42 wherein the home service profile server provides the first service profile, and wherein the first service profile relates to a first of the at least two concurrent access services for the mobile node.

44. The computer-readable medium of claim 43 wherein the first NAI further comprises a second realm part for identifying a service profile server in a third party AAA server.

45. The computer-readable medium of claim 44 wherein the service profile server in the third party AAA server provides a second service profile related to a second of the at least two concurrent access services for the mobile node.

46. The computer-readable medium of claim 43 wherein the remote access message further comprises a second NAI further comprising a second realm part for identifying a service profile server in a third party AAA server.

47. The computer-readable medium of claim 46 wherein the service profile server in the third party AAA server provides a second service profile related to a second of the at least two concurrent access services for the mobile node.

48. The computer-readable medium of claim 38 wherein the protocol associated with the home agent is one of the following:

standard MIP remote access, standard point-to-point tunneling protocol (PPTP) remote access or standard IP security (IPSEC) remote access.

49. The computer-readable medium of claim 38 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.

50. The computer-readable medium of claim 38 further comprising:

program code for generating a second AAR message based on the remote access message;

program code for sending the second AAR message along with the first AAR message to the authentication/authorization/accounting (AAA) proxy server;

program code for receiving a second return AAR message along with the first return AAR message from the AAA proxy server; and

program code for implementing at least two concurrent access services for the mobile node based on the first return AAR message and the second return AAR message.

51. The computer-readable medium of claim 50 wherein one of the at least two concurrent access services utilizes either a code division multiple access (CDMA) technology or an orthogonal frequency division multiple access (OFDMA) technology.