Systems and methods for providing emergency service trust in packet data networks

• US 8,498,223 B2
• Filed: 08/18/2008
• Issued: 07/30/2013
• Est. Priority Date: 08/16/2007
• Status: Active Grant

• Current Assignee: Rolling Wireless SA RL
• Original Assignee: Sierra Wireless Incorporated
• Inventors: Kavanaugh, Richard Thomas
• Primary Examiner(s): Harper, Kevin C
• Application Number:
  US12/193,255
• Publication Number:
  US 20090141707A1
• Time in Patent Office: 1,807 Days
• Field of Search: None
• US Class Current: 370/254
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0823 using certificates cryptographic mechanisms or cryptographic arrangements for entity authentication involving certificates H04L9/3263
• CPC Class Codes: H04M 2242/04 for emergency applications
• CPC Class Codes: H04M 7/006 Networks other than PSTN/ISDN providing telephone service, e.g. Voice over Internet Protocol (VoIP) , including next generation networks with a packet-switched transport layer H04L65/00 takes precedence; aspects not specific to the type of network H04M3/00; special services in those networks H04M3/42
• CPC Class Codes: H04W 4/90 Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• CPC Class Codes: H04W 76/50 for emergency connections
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

A method and apparatus for providing in a packet data telecommunication network serving one or more end terminals and/or Mobile Stations (MSs), a method for establishing, managing, modifying, and terminating an End-to-End (E2E) Emergency Service (ES) Chain-of-Trust (CoT) from an Access Serving Network (ASN) and Connectivity Service Network (CSN) to a PSAP, PSAP proxy, or PSAP (i.e. PSTN) gateway that results in the creation of a trust relationship amongst the components in the established ES CoT necessary to allow or validate the granting of any unauthenticated or unprovisioned ES network access and ES operation establishment, modification, and termination requests from amongst the components in an ES CoT to assist a particular terminal/MS or ES network component attempting to establish an ES session between the ES user agent of the terminal/MS and a serving PSAP.

Claims

1. In a packet data telecommunication network serving one or more end terminals and/or Mobile Stations (MSs), a method for establishing, managing, modifying, and terminating an End-to-End (E2E) Emergency Service (ES) Chain-of-Trust (CoT) from an Access Serving Network (ASN) and Connectivity Service Network (CSN) to a PSAP, PSAP proxy, or PSAP gateway, the method comprising:

creating a trust relationship amongst components in the established ES CoT;

allowing or validating the granting of any unauthenticated or unprovisioned ES network access and ES operation establishment, modification, and termination requests from amongst the components in an ES CoT based on the created trust relationship; and

assisting a particular terminal/MS or ES network component attempting to establish an ES session between an ES user agent of the terminal/MS and a serving PSAP.

2. The method of claim 1 wherein the ES operation requested through the ES CoT is terminated and performed within one of the components in the CoT.

3. The method of claim 1 wherein the ES operation includes an establishment, modification, or termination of one or more network layer based Hotline rule operations used to block or restrict some or all non-ES based network layer traffic.

4. The method of claim 1 wherein the ES operation includes an establishment, modification, or termination of one or more network layer based high-QoS Service Flows and/or classifiers for ES network layer traffic.

5. The method of claim 1 wherein the ES operation includes an establishment, modification, or termination of one or more session and/or application layer based Hotline rule operations to block or restrict some or all non-ES based session and/or application layer traffic.

6. The method of claim 1 wherein the ES operation includes an establishment, modification, or termination of one or more session and/or application layer based high QoS Service Flows and/or classifiers for ES based session and application layer traffic.

7. The method of claim 1 wherein an ES operation request is sent from the terminal/MS associated with the establishing or established ES, a router or firewall providing ASN gateway access for the terminal/MS, or one of the components of the established CoT.

8. The method of claim 1 wherein the CoT establishment, modification, or termination request is sent from the terminal/MS associated with the establishing or established ES, a router or firewall providing ASN gateway access for the terminal/MS, one of the components of the established CoT, or a legacy PSTN based PSAP that may not be a direct component of the established ES CoT.

9. The method of claim 8 wherein the CoT is established or terminated in an uplink manner.

10. The method of claim 8 wherein the CoT is established or terminated in a downlink manner.

11. The method of claim 8 wherein the CoT is established or terminated in an intermediate manner.

12. The method of claim 8 wherein an ES CoT modification request is triggered by a handoff operation of a MS from a first serving ASN/CSN to a secondary serving ASN/CSN.

13. The method of claim 1 wherein a component in an establishing or established ES CoT can modify an ES operation request, through interception and alteration/extension to said ES operation request in order to take into account the impact the said component has on the end-to-end routing and characteristics of the data and control plane bearers associated with the established or establishing ES.

14. The method of claim 12 wherein the ES CoT component is a VPN server or client that alters or extends the content of an ES operation request to take into account the changes to the ES data and control plane bearer routing caused by the VPN tunneling of ES and non-ES traffic.

15. The method of claim 12 wherein the ES CoT component is a VoIP server/service or client.

16. The method of claim 12 wherein the ES CoT component is an Instant Messaging (IM) server/service or client.

17. The method of claim 12 wherein the ES CoT component is a real-time text server/service or client.

18. The method of claim 12 wherein the ES CoT component is an Internet Multimedia Service (IMS) based server/service or client.

19. The method of claim 1 wherein the components of an established ES CoT can include any networking component along the establishing or established ES control and data plane end-to-end link between an ASN/CSN and a PSAP that acts on the control and data plane traffic used for the CoT establishment, modification, or termination messaging as well as the ES operation request/response messaging to alter or extend the ES control plane route to achieve, maintain, and terminate the intended ES establishment.

20. The method of claim 19 wherein a component of an established ES CoT is a PSAP, PSAP gateway, or PSAP proxy.

21. The method of claim 19 wherein a component of an established ES CoT is a network service that support an ES capability server or a video conferencing server.

22. The method of claim 19 wherein a component of an established ES CoT is an IP Multimedia System (INIS) server component of a home or visited network or service provider.

23. The method of claim 19 wherein a component of an established ES CoT is a Policy Charging and Control (PCC) server component of a home network, visited network, or Application Service Provider (ASP).

24. The method of claim 19 wherein a component of an established ES CoT is a VPN server.

25. The method of claim 19 wherein a component of an established ES CoT is a VPN client.

26. The method of claim 19 wherein a component of an established ES CoT is a firewall.

27. The method of claim 19 wherein a component of an established ES CoT is a router using NAT.

28. The method of claim 19 wherein a component of an established ES CoT is a Customer Premises Equipment (CPE) device linking one or more terminals/MSs to an ASN over a Small Office Home Office (SOHO) or other local network.

29. The method of claim 19 wherein a component of an established ES CoT is an Emergency Services Routing Proxy Server.

30. The method of claim 19 wherein a component of an established ES CoT is an SIP server.

31. The method of claim 19 wherein a component of an established ES CoT is an SIP registrar.

32. The method of claim 19 wherein a component of an established ES CoT is an SIP proxy server.

33. The method of claim 19 wherein a component of an established ES CoT is a roaming ASN from a visited-network that can provide ES-only and/or general network connectivity access to a terminal/MS attempting to access a home-network ES.

34. The method of claim 1 wherein the ES CoT is established, modified, and terminated utilizing a Public Key Infrastructure (PKI) to allow for a component of an establishing or established ES CoT to authenticate another component to be added to the same ES CoT.

35. The method of claim 34 wherein the PKI provides a common format for public key certificates combined with a certification path validation algorithm to allow for a component of an establishing or established ES CoT to authenticate another component to be added to the same ES CoT.

36. The method of claim 35 wherein the common format for public key certificates and a certification path validation algorithm are provided through the use of X.509 digital certificates with a root certificate associated with a regional and/or world-wide ES component accreditation authority.

37. The method of claim 1 wherein the ES CoT is established, modified, and terminated utilizing a web-of-trust model to allow for a component of an establishing or established ES CoT to authenticate another component to be added to the same ES CoT.

38. The method of claim 37 wherein the web-of-trust model is based on Pretty Good Privacy (PGP) encryption.

39. The method of claim 37 wherein the web-of-trust model is based on OpenPGP or a future derivative.

40. The method of claim 1 wherein the established ES CoT is used to verify and/or guarantee the authenticity of the ES operation requestor and the validity of the ES operation contents being requested to be only for a valid ES purpose.

41. The method of claim 1 wherein the established ES CoT is used to guarantee the message integrity of all ES request/response and CoT modification/termination messaging sent and received amongst the members of the ES CoT.

42. The method of claim 1 wherein the established ES CoT is used to guarantee the confidentiality of all ES operation requests and responses and CoT modification and termination messaging sent and received amongst the members of a particular ES CoT.

43. The method of claim 1 wherein a terminal/MS, CPE, VPN client, ES user agent, or other general user agent is used to relay ES CoT management messaging, ES operation requests/responses, and/or other general messaging to/from the ASN over the MAC layer interface between the terminal/MS and ASN to overcome the inability of the ASN/CSN to receive and respond to these messages directly due to a VPN tunnel that terminates in a terminal/MS, CPE, VPN client, ES user agent, or other general user agent.

44. The method of claim 1 wherein the ASN/CSN allows a leap-of-faith unauthenticated and/or unsubscribed grant of ES level network access to the terminal/MS to attempt the establishment of an ES session with the expectation a ES CoT will be established shortly thereafter that allows the ASN/CSN to validate or invalidate the authenticity of the attempted ES session by the terminal/MS.

45. The method of claim 44 wherein the ASN/CSN and/or associated backend network components can collect and keep records of invalid ES session attempts by the terminal/MS that can be used for purposes such as blacklisting, certificate revocation list additions, and/or legal action against the owner and/or subscriber of the terminal/MS.