LAN-based UMA network controller with proxy connection

• US 8,380,167 B2
• Filed: 05/10/2006
• Issued: 02/19/2013
• Est. Priority Date: 05/10/2005
• Status: Active Grant

• Current Assignee: Ribbon Communications Operating Company, Inc. (Ribbon Communications, Inc.)
• Original Assignee: Network Equipment Technologies Incorporated (Ribbon Communications, Inc.)
• Inventors: Pummill, Troy T., Isacks, Kevin, Hardie, Terry, Harty, Talbot
• Primary Examiner(s): GREGORY, BERNARR E
• Application Number:
  US11/432,302
• Publication Number:
  US 20060276138A1 (withdrawn)
• Time in Patent Office: 2,477 Days
• Field of Search: 455/403, 455/410, 455/411, 4554221-460, 713/150, 713168-181, 380/255, 380277-286, 380 44- 47, 370/310, 370328-338, 370351-356, 370/389, 370/392, 370/393, 726 1- 30, 709/238, 709/242
• US Class Current: 455/411
• CPC Class Codes: H04L 63/0281 Proxies
• CPC Class Codes: H04L 63/061 for key exchange, e.g. in peer-to-peer networks cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838
• CPC Class Codes: H04L 63/0853 using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0869 for achieving mutual authentication cryptographic mechanisms or cryptographic arrangements for mutual authentication H04L9/3273
• CPC Class Codes: H04L 63/101 Access control lists [ACL]
• CPC Class Codes: H04L 63/123 received data contents, e.g. message integrity
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 40/00 Communication routing or communication path finding
• CPC Class Codes: H04W 76/00 Connection management
• CPC Class Codes: H04W 76/10 Connection setup
• CPC Class Codes: H04W 76/12 Setup of transport tunnels
• CPC Class Codes: H04W 8/02 Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 80/10 adapted for application session management, e.g. SIP [Session Initiation Protocol] connection management H04W76/00; arrangements for session management H04L67/14
• CPC Class Codes: H04W 84/12 WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 92/02 Inter-networking arrangements
• CPC Class Codes: H04W 92/14 between access point controllers and backbone network device

Abstract

A method for managing UMA communications within a local area network and a network controller are disclosed. The method includes establishing a first connection to a first UMA device over the LAN and establishing a second connection to a UMA network controller (UNC) over an external network. The first UMA device is connected to the local area network and the UNC is connected to the external network. Packets received from the first UMA device using the first connection are sent to the UNC using the second connection. Similarly, packets received from the UNC using the second connection are sent to the first UMA device using the first connection. The first connection may include a first IPsec tunnel and the second connection may include a second IPsec tunnel. The external network may include the internet.

Claims

1. A method for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN), the method comprising:

monitoring packets passing between the LAN and an external network, wherein the packets being communications of a first UMA device connected to the LAN;

detecting whether the packets establish a connection between the first UMA device and a UMA network controller (UNC) accessible via the external network; and

intercepting packets exchanged by the first UMA device if a connection is detected as having been established between the first UMA device and the UNC.

2. The method of claim 1 further comprising:

monitoring an authentication process through which a secure channel between the first UMA device and the UNC is formed.

3. The method of claim 2 wherein the secure channel is an IPsec (IP security) tunnel.

4. The method of claim 2 further comprising:

receiving first encryption keys from the first UMA device; and

using the first encryption keys to decrypt packets exchanged between the first UMA device and the UNC.

5. The method of claim 2 further comprising:

receiving second encryption keys from the UMA network controller; and

using the second encryption keys to decrypt packets exchanged between the first UMA device and the UNC.

6. The method of claim 2 wherein the authentication process is conducting according to the IKE (Internet Key Exchange) protocol.

7. The method of claim 6 wherein the IKE protocol includes an EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) authentication process.

8. The method of claim 2 wherein the step of monitoring is performed using a cellular shared secret (Ki) of the first UMA device.

9. The method of claim 2 wherein the step of monitoring is performed using cellular triplets generated according to a unique identifier associated with the first UMA device.

10. The method of claim 9 wherein the cellular triplets are obtained from the UMA network controller over the external network.

11. The method of claim 9 wherein the cellular triplets are obtained from the first UMA device.

12. A method for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN), the method comprising:

establishing a first connection to a first UMA device over the LAN, wherein said first device is connected to the LAN;

establishing a second connection to a UMA network controller (UNC) over an external network, wherein said UNC is connected to the external network;

receiving packets from the first UMA device using the first connection;

sending packets received from the first UMA device to the UNC using the second connection;

receiving packets from the UNC using the second connection; and

sending packets received from the UNC to the first UMA device using the first connection.

13. The method of claim 12 wherein the first connection comprises a first IPsec tunnel and the second connection comprises a second IPSec tunnel.

14. The method of claim 12 wherein the external network is the internet.

15. The method of claim 12 further comprising:

monitoring an authentication process whereby the first UMA device requests access to a cellular network b exchanging packets with the UNC;

detecting authentication data in packets exchanged as art of the authentication process; and

processing communications between the first UMA device and the UMA network controller using the authentication data if the authentication process is successfully completed.

16. The method of claim 15 wherein the authentication process is conducted according to the IKE (Internet Key Exchange) protocol.

17. The method of claim 16 wherein the IKE protocol includes an EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) authentication process.

18. The method of claim 15 wherein the step of monitoring is performed using a cellular shared secret (Ki) of the first UMA device.

19. The method of claim 15 wherein the step of monitoring is performed using cellular triplets generated according to a unique identifier associated with the first UMA device.

20. The method of claim 19 wherein the cellular triplets are obtained from the UMA network controller over the external network.

21. The method of claim 19 herein the cellular triplets are obtained from the first UMA device.

22. A method for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN);

the method comprising;

receiving packets within the LAN from a first UMA device connected to the LAN, the packets including a discovery request from the first UMA device; and

assisting the first UMA device to identify a serving UMA network controller connected to an external network whereby the serving UMA network controller enables the first UMA device to access a cellular network.

23. The method of claim 22 wherein the step of assisting further comprises:

sending UMA messages to one or more of a provisioning UMA network controller and a default UMA network controller; and

identifying the serving UMA network controller based upon responses to said UMA messages.

24. The method of claim 23 further comprising:

establishing a connection with the serving UMA Fretwork controller an behalf of the first UMA device; and

providing information about the serving UMA network controller to the first UMA device when the connection with the serving UMA network controller is successfully established.

25. The method of claim 23 further comprising:

modifying address information contained in said responses to said UMA messages; and

sending said modified responses to said first UMA device.

26. The method of claim 22 further comprising:

receiving packets over the external network from a second UMA device, wherein the second UMA device is not connected to the LAN;

determining whether the second UMA device is permitted to access data services provided by the LAN; and

enabling the second UMA device to access said data services provided by the LAN based upon said determining step.

27. The method of claim 22, further comprising:

receiving a DNS request from the first UMA device; and

providing a predetermined address in response to the received DNS request.

28. The method of claim 22 further comprising:

detecting one or more network addresses of a UMA network controller in packets received from the first UMA device; and

dropping the packets if said one or more network addresses associated with the UMA network controller are detected in the packets.

29. The method of claim 22 further comprising:

receiving packets over the external network from a second UMA device, wherein the second UMA device is not connected to the LAN;

determining whether the second UMA device is permitted to access UMA services provided by the LAN; and

assisting the second UMA device to identify a UNC if the second UMA device is permitted to access the UMA services provided by the LAN.

30. The method of claim 22, further comprising:

detecting whether the first UMA device has successfully registered with a cellular network; and

storing a first identifier associated with the first UMA device in a device location table if the first UMA device has successfully registered with the cellular network.

31. The method of claim 30 further comprising:

initiating a registration process with a second UMA network controller connected to the external network if the first UMA device is detected to have not successfully registered with the cellular network; and

storing the first identifier in the device location table if the first UMA device is successfully registered with the cellular network through the second UNC.

32. The method of claim 30 further comprising:

controlling access to UMA services using identifiers stored in the device location table.

33. The method of claim 30 further comprising:

sending status information for the first UMA device to a SIP (Session Initiation Protocol) server if it is detected that said first UMA device has successfully registered with the cellular network.

34. An apparatus for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN), the apparatus comprising:

a controller operative to monitor packets passing between the LAN and an external network, the packets being communications of a first UMA device connected to the LAN;

wherein the controller is configured to detect whether the packets establish a connection between the first UMA device and a UMA network controller (UNC) accessible via the external network; and

the controller is further configured to intercept packets within the local area network exchanged by the first UMA device if a connection is detected as having been established between the first UMA device and the UNC.

35. The apparatus of claim 34 wherein the controller is further configured to monitor an authentication process through which a secure channel between the first UMA device and the UNC is formed.

36. The apparatus of claim 35 wherein the secure channel is an IPsec (IP security) tunnel.

37. The apparatus of claim 35 wherein the controller is further configured to receive first encryption keys from the first UMA device, and to use the first encryption keys to decrypt packets exchanged between the first UMA device and the UNC.

38. The apparatus of claim 35 wherein the controller is further configured to receive second encryption keys from the UNC, and to use the second encryption keys to decrypt packets exchanged between the first UMA device and the UNC.

39. The apparatus of claim 35 wherein the authentication process is conducting according to the IKE (Internet Key Exchange) protocol.

40. The apparatus of claim 39 wherein the IKE protocol includes an EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) authentication process.

41. The apparatus of claim 35 wherein the controller is configured to monitor the authentication process using a cellular shared secret (Ki) of the first UMA device.

42. The apparatus of claim 35 wherein the controller is configured to monitor the authentication process using cellular triplets generated according to a unique identifier associated with the first UMA device.

43. The apparatus of claim 42 wherein the cellular triplets are obtained from the UMA network controller over an-the external network.

44. The apparatus of claim 42 wherein the cellular triplets are obtained from the first UMA device.

45. An apparatus for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN) comprising:

a controller configured to establish a first connection to a first UMA device over the LAN, said first device being connected to the LAN;

wherein the controller is further configured to establish a second connection to a UMA network controller (UNC) over an external network, said UNC being connected to the external network;

wherein the controller is further configured to receive packets from the first UMA device using the first connection;

wherein the controller is further configured to send packets received from the first UMA device to the UNC using the second connection;

wherein the controller is further configured to receive packets from the UNC using the second connection; and

the controller is further configured to send packets received from the UNC to the first. UMA device using the first connection.

46. The apparatus of claim 45 wherein the first connection comprises a first IPsec tunnel and the second connection comprises a second IPSec tunnel.

47. The apparatus of claim 45 wherein the external network is the internet.

48. The apparatus of claim 45 wherein the controller is further configured to monitor an authentication process whereby the first UMA device request access to a cellular network,

wherein the controller is further configured to detect authentication data in packets exchanged as art of the authentication process;

and

the controller is configured to process communications between the first UMA device and the UMA network controller using the authentication data if the authentication process is successfully completed.

49. The apparatus of claim 48 wherein the authentication process is conducted according to the IKE (Internet Key Exchange) protocol.

50. The apparatus of claim 49 wherein the IKE protocol includes EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) authentication.

51. The apparatus of claim 48 wherein the controller monitors the authentication process using a cellular shared secret (Ki) the first UMA device.

52. The apparatus of claim 48 wherein the controller monitors the authentication process using cellular triplets generated according to a unique identifier associated with the first UMA device.

53. The apparatus of claim 52 wherein the cellular triplets are obtained from the UMA network controller over the external network.

54. The apparatus of claim 52 wherein the cellular triplets are obtained from the first UMA device.

55. An apparatus for managing unlicensed mobile access (UMA) devices connected to a local area network (LAN) comprising:

a controller configured to receive packets within the LAN from a first UMA device connected to the LAN, the packets including a discovery request from the first UMA device; and

the controller is further configured to assist the first UMA device to identify a serving UMA network controller connected to an external network whereby the serving UMA network controller enables the first UMA device to access a cellular network.

56. The apparatus of claim 55 wherein the controller is further configured to receive a DNS request from the first UMA device;

and

the controller is further configured to provide a predetermined address in response to the received DNS request.

57. The apparatus of claim 56 wherein the controller is further configured to detect one or more network addresses of a UMA network controller in packets received from the first UMA device;

and

the controller is further configured to drop the packets if said one or more network addresses associated with the UMA network controller are detected in the packets.

58. The apparatus of claim 55 wherein the controller is further configured to receive packets over the external network from a second UMA device wherein the second UMA device is not connected to the LAN;

wherein the controller is further configured to determine whether the second UMA device is permitted to access UMA services provided by the LAN; and

the controller is further configured to assist the second UMA device to identify a UNC if the second UMA device is permitted to access the UMA services provided by the LAN.

59. The apparatus of claim 55 wherein the controller is further configured to detect whether the first UMA device has successfully registered with a cellular network;

and

the controller is further configured to store a first identifier associated with the first UMA device in a device location table if the first UMA device has successfully registered with a the cellular network.

60. The apparatus of claim 59 wherein the controller is further configured to initiate a registration process with a second UNC connected to the external network if it is detected that the first UMA device has not successfully registered with the cellular network;

and

the controller is further configured to store the first identifier in the device location table if the first UMA device is successfully registered with the cellular network through the second UNC.

61. The apparatus of claim 59 wherein the controller is further configured to control access to the UMA services using identifiers stored in the device location table.

62. The apparatus of claim 59 wherein the controller is further configured to send status information for the first UMA device to a SIP Session Initiation Protocol) server if it is detected that said first UMA device has successfully registered with the cellular network.