Method and system for establishing a connection via an access network

• US 8,077,681 B2
• Filed: 10/08/2002
• Issued: 12/13/2011
• Est. Priority Date: 10/08/2002
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Corporation
• Inventors: Ahmavaara, Kalle, Vesterinen, Seppo
• Primary Examiner(s): Sheikh, Ayaz
• Assistant Examiner(s): Wong, Blanche
• Application Number:
  US10/265,760
• Publication Number:
  US 20040066769A1
• Time in Patent Office: 3,353 Days
• Field of Search: 370/252, 370/254, 370/465, 370/351, 370/352, 370/401, 370/328, 370/522, 370/392, 370/393, 370/353
• US Class Current: 370/338
• CPC Class Codes: H04L 12/2856 Access arrangements, e.g. Internet access asynchronous transfer mode networks H04L12/5601; broadband local area networks H04L12/2801; optical access or distribution networks H04Q11/0067; access to open networks H04L12/5691; digital subscriber line end-user equipment and bit-level processing of data on a PSTN-based network H04M11/00; home network gateways H04L12/2834; wireless access networks H04W
• CPC Class Codes: H04L 63/029 Firewall traversal, e.g. tunnelling or, creating pinholes
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04W 12/0431 Key distribution or pre-distribution; Key agreement
• CPC Class Codes: H04W 84/18 Self-organising networks, e.g. ad-hoc networks or sensor networks

Abstract

A method and system for establishing a connection via an access network (30) communicating with at least one user terminal, and at least one backbone network (100) comprising at least one user terminal authentication and authorization means (50) and at least one user data processing node (60, 62), wherein the connection of a user terminal (10) is authenticated to the access network (30) and one of the at least one user data processing nodes (60, 62) is selected based on selection information transferred in the authentication signaling. Then, a tunnel parameter information of the selected user data processing node is signaled to the access network (30) and a tunnel connection is created between the access network (30) and the selected user data processing node (60) based on the tunnel parameter information.

Claims

1. A method comprising:

authenticating, at an authentication server in a backbone network, a request for access to the backbone network that provides context-based services via a wireless access network between at least one user terminal and at least one backbone network, wherein the backbone network comprises the authentication server and at least one user data processing node;

selecting, at the authentication server, one of said at least one user data processing node; and

signaling, by the authentication server, tunnel parameter information of said selected user data processing node, said tunnel parameter information provided by said selected user data processing node, to said wireless access network for creating a tunnel connection between said wireless access network and said selected user data processing node based on said tunnel parameter information.

2. A method according to claim 1, further comprising using at least one signaled tunnel parameter as an identifier within said created tunnel connection.

3. A method according to claim 2, wherein said at least one tunnel parameter is a tunnel assignment identification.

4. A method according to claim 2, wherein said created tunnel connection is of a generic routing encapsulation type.

5. A method according to claim 4, further comprising using said at least one signaled tunnel parameter as the key parameter of the created generic routing encapsulation tunnel.

6. A method according to claim 5, wherein said wireless access network is a wireless local area network.

7. A method according to claim 6, wherein said backbone network is a cellular packet-switched network.

8. A method according to claim 7, wherein said cellular packet-switched network is a generic packet radio service network.

9. A method according to claim 8, wherein said authentication is based on an extensible authentication protocol signaling.

10. A method according to claim 9, wherein selection information is used in selecting the one of the at least one user data processing node, and wherein said selection information comprises at least one access point node parameter.

11. A method according to claim 10, wherein said at least one access point node parameter comprises an access point node, a username and a password.

12. A method according to claim 11, wherein said tunnel parameter information is signaled to said wireless access network in an authentication, authorization and accounting access accept message.

13. A method according to claim 12, wherein a utilized authentication, authorization and accounting protocol is RADIUS.

14. A method according to claim 12, wherein a utilized authentication, authorization and accounting protocol is Diameter.

15. A method according to claim 14, wherein said tunnel parameter information comprises at least one of a tunnel type, a tunnel medium, a tunnel server address and a tunnel assignment identification.

16. A method according to claim 15, wherein said selected user data processing node is a wireless local area network gateway.

17. A method according to claim 15, wherein said selected user data processing node is a gateway generic packet radio service support node.

18. A method according to claim 17, wherein said selection information is resolved to an authentication, authorization and accounting realm name.

19. A method according to claim 18, wherein said selection information is a service selection information.

20. A method according to claim 19, further comprising the step of storing at said selected user data processing node at least one of an external server realm name, tunnel parameters and filtering parameters.

21. A method according to claim 20, further comprising checking whether to signal said selection information to an external server based on said selection information.

22. A method according to claim 1, wherein the backbone network is a wireless local area network.

23. A method according to claim 1, wherein the backbone network is a general packet radio service network.

24. An apparatus comprising:

a processor; and

a memory,

wherein the processor, in conjunction with the memory, configured to;

select a user data processing node in a backbone network based on a selection information received in an authentication signaling from a terminal device connected to a wireless access network, said authentication signaling being used for authenticating a request for access to the backbone network that provides context-based services via said wireless access network between said terminal device and said backbone network;

obtain a tunnel parameter information from said selected user data processing node; and

signal said tunnel parameter information to an access server device in said wireless access network for creating a tunnel connection between said wireless access network and said selected user data processing node based on said tunnel parameter information.

25. An apparatus according to claim 24, wherein said authentication signaling is based on an extensible authentication protocol.

26. An apparatus according to claim 25, wherein said apparatus is a standalone wireless local area network authentication server.

27. An apparatus according to claim 25, wherein said apparatus is a gateway generic packet radio service support node.

28. An apparatus according to claim 27, wherein said service selection information comprises at least one access point node parameter.

29. An apparatus according to claim 28, wherein said authentication server is arranged to signal said tunnel parameter information in an authentication, authorization and accounting access accept message.

30. An apparatus according claim 29, wherein said tunnel parameter information comprises at least one of a tunnel type, a tunnel medium, a tunnel server address and a tunnel assignment identification.

31. An apparatus according to claim 30, wherein said tunnel type is generic routing encapsulation.

32. A device according to claim 31, wherein said tunnel medium is IPv4 or IPv6.

33. An apparatus according to claim 29, wherein said apparatus is arranged to incorporate an extensible authentication protocol success message into said authentication, authorization and accounting access accept message.

34. A device according to claim 30, wherein said tunnel type is generic routing encapsulation or said tunnel medium is IPv4 or IPv6.

35. An apparatus comprising:

a processor; and

a memory,

wherein the processor, in conjunction with the memory, configured to;

obtain an acceptance for an access request to a backbone network, the access request received from a terminal device via a wireless access network between the terminal device and the backbone network, and tunnel parameter information in a message received from an authentication server in the backbone network; and

create a tunnel connection between the wireless access network and a user data processing node in the backbone network based on said tunnel parameter information so as to provide access to the backbone network for the terminal device via the wireless access network.

36. An apparatus according to claim 35, wherein said received message is an authentication, authorization and accounting access accept message.

37. An apparatus according to claim 36, wherein said tunnel parameter information comprises at least one of a tunnel type, a tunnel medium, a tunnel server address and a tunnel assignment identification.

38. An apparatus according to claim 37, wherein said apparatus is configured to use said tunnel assignment identification as a flow identification of said created tunnel connection.

39. An apparatus according to claim 38, wherein said flow identification is signaled in a key generic routing encapsulation attribute.

40. A system, comprising:

an access controlling device of a wireless access network configured to establish a connection for context-based services via the wireless access network between at least one user terminal and at least one backbone network,

wherein said at least one backbone network comprises an authentication server device configured to provide an authentication mechanism and at least one user data processing node,

wherein the access controlling device is configured to obtain tunnel parameter information in a message received from the authentication server device and to create a tunnel connection between said wireless access network and a selected user data processing node based on said tunnel parameter information so as to provide a service access for the at least one user terminal to the backbone network via the wireless access network, the at least one user terminal being in communication with the wireless access network.

41. A device comprising:

means for selecting a user data processing node in a backbone network based on a selection information received in an authentication signaling from a terminal device connected to a wireless access network, said authentication signaling being used for authenticating a request for access to the backbone network that provides context-based services via said wireless access network between said terminal device and said backbone network, and wherein the authenticating is performed by a user terminal authentication and authorization means;

means for obtaining a tunnel parameter information from said selected user data processing node; and

means for signaling said tunnel parameter information to an access server device in said wireless access network for creating a tunnel connection between said wireless access network and said selected user data processing node based on said tunnel parameter information.

42. A device according to claim 41, wherein said authentication signaling is based on an extensible authentication protocol.

43. A device according to claim 42, wherein said device is a standalone wireless local area network authentication server.

44. A device according to claim 42, wherein said selection information comprises at least one access point node parameter.

45. A device according to claim 42, wherein said device comprises means for signaling said tunnel parameter information in an authentication, authorization and accounting access accept message.

46. A device according to claim 45, wherein said device comprises means for incorporating an extensible authentication protocol success message into said authentication, authorization and accounting access accept message.

47. A device according to claim 42, wherein said tunnel parameter information comprises at least one of a tunnel type, a tunnel medium, a tunnel server address and a tunnel assignment identification.

48. A device according to claim 47, wherein said tunnel type is generic routing encapsulation, and said tunnel medium is at least one of IPv4 and IPv6.

49. A device according to claim 41, wherein said device is a gateway generic packet radio service support node.

50. A device comprising:

means for obtaining an acceptance for an access request to a backbone network, the access request received from a terminal device via a wireless access network between the terminal device and the backbone network, and tunnel parameter information in a message received from an authentication server in the backbone network; and

means for creating a tunnel connection between the wireless access network and a user data processing node in the backbone network based on said tunnel parameter information so as to provide access to the backbone network for the terminal device via the wireless access network.

51. A device according to claim 50, wherein said received is an authentication, authorization and accounting access accept message.

52. A device according to claim 51, wherein said tunnel parameter information comprises at least one of a tunnel type, a tunnel medium, a tunnel server address and a tunnel assignment identification.

53. A device according to claim 52, wherein said device comprises means for using said tunnel assignment identification as a flow identification of said created tunnel connection.

54. A device according to claim 53, wherein said flow identification is signaled in key generic routing encapsulation attribute.