Network and node for providing a secure transmission of mobile application part messages

• US 8,037,297 B2
• Filed: 10/20/2003
• Issued: 10/11/2011
• Est. Priority Date: 10/20/2003
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Pekkala, Reijo, Wiren, Karl-Johan, Saaskilahti, Juha
• Primary Examiner(s): Chai; Longbit
• Application Number:
  US10/595,447
• Publication Number:
  US 20070127418A1
• Time in Patent Office: 2,913 Days
• Field of Search: 713/151
• US Class Current: 713/151
• CPC Class Codes: H04L 63/02 for separating internal from external traffic, e.g. firewalls
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 92/02 Inter-networking arrangements

Abstract

According to the present invention a telecommunication network with a first domain (PLMN-A) comprising at least one mobile application part protocol instance is connected to a gateway node (MSEGA) which is adapted to send and receive mobile application part messages and which is connectable to a second domain. The telecommunication network is remarkable in that the gateway node (MSEGA) is adapted to receive a mobile application part message from the first domain, to convert the received mobile application part message obtaining a secured mobile application part message, and to send the obtained message to the second domain. The gateway node (MSEGA) is further adapted to receive a secured mobile application part message from the second domain, to extract an unsecured mobile application part message from the received secured mobile application part message and to send the extracted message to the first domain.

Claims

1. A telecommunication network system having at least a gateway node, with a first domain comprising:

a mobile application part protocol instance connected to the gateway node configured to send and receive mobile application part messages in accordance with the 3rd Generation Partnership Project (3GPP) Technical Specification (TS) 3&

200, the gateway node being connected to a second domain, wherein the gateway node is configured to receive a mobile application part message from the first domain, to convert the received mobile application part message obtaining a secured mobile application part message, and to;

send the obtained message to the second domain, the gateway node further being configured to receive a secured mobile application part message from the second domain, to extract an unsecured mobile application part message from the received secured mobile application part message and to send the extracted message to the first domain, where a secured mobile application part message is obtained by security mechanisms comprising one or more of data encryption and data integrity protection applied toward a particular domain.

2. The telecommunication network according to claim 1, wherein the gateway node is connected to a third domain and wherein the gateway node performs a selective discarding of mobile application part messages received from the first domain and destined for the third domain and a selective discarding of mobile application part messages received from the third and destined for the first domain.

3. The telecommunication network according to claim 1, wherein the gateway node performs as a firewall to the third domain.

4. The telecommunication network according to claim 1 wherein the gateway node is connected to different domains, and levels of security are configurable for the different domains.

5. The telecommunication network according to claim 1 wherein for a particular domain a fallback to a lower level of security than the configured level of security for the particular domain is allowable and allowing the fallback to the lower level of security is configurable for one domain independently from a configuring of an allowing of a respective fallback to a lower level of security level for another domain.

6. A gateway node comprising an interface to a first domain of a telecommunication network for sending and receiving mobile application part messages in accordance with the 3rd Generation Partnership Project (3GPP) Technical Specification (TS) 33.200, comprising:

an interface to a second domain of the telecommunication network for sending and receiving secured mobile application part messages wherein the gateway node further comprises a conversion unit that is adapted to receive a mobile application part message via the interface to the first domain, to convert the received mobile application part message obtaining a secured mobile application part message, and to send the obtained message via the interface towards the second domain, the conversion unit further being configured to receive a secured mobile application part message via the interface to the second domain, to extract an unsecured mobile application part message from the received secured mobile application part message and to send the extracted message via the interface towards the first domain, where a secured mobile application part message is obtained by security mechanisms comprising one or more of data encryption and data integrity protection applied toward a particular domain.

7. The gateway node according to claim 6, comprising an interface to a third domain for sending and receiving mobile application part messages and a filtering unit adapted to perform a selective discarding of mobile application part messages.

8. The gateway node according to claim 6, wherein the gateway node performs as a firewall to the third domain.

9. The gateway node according to claim 6, wherein the gateway node is connected to different domains, and the gateway node comprises a security database for storing indications of levels of security for the different domains.

10. The gateway node according to claim 6, further comprising

a fallback store for storing for a particular domain and an indication that a fallback to a lower level of security than the configured level of security for the particular domain is allowable, wherein allowing of the fallback to the lower level of security is configurable for one domain independently from an allowing of a respective fallback to a lower level of security for another domain.