Access control according to a policy defined for a group of associated electronic devices comprising a cellular modem

• US 8,688,115 B2
• Filed: 11/23/2009
• Issued: 04/01/2014
• Est. Priority Date: 11/23/2009
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Mildh, Gunnar, Mikls, Gyrgy
• Primary Examiner(s): Brandt, Christopher M
• Application Number:
  US13/510,444
• Publication Number:
  US 20120258740A1
• Time in Patent Office: 1,590 Days
• Field of Search: 455/410, 455/411, 455/435.1, 455/450, 455/451, 455/452.1, 455/434, 455/452.2, 455/456.1, 455/456.4
• US Class Current: 455/435.1
• CPC Class Codes: H04L 63/107 wherein the security policies are location-dependent, e.g. entities privileges depend on current location or allowing specific operations only from locally connected terminals
• CPC Class Codes: H04M 15/00 Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/70 Administration or customization aspects; Counter-checking correct charges
• CPC Class Codes: H04M 15/765 Linked or grouped accounts, e.g. of users or devices
• CPC Class Codes: H04M 15/77 involving multiple accounts per user
• CPC Class Codes: H04M 15/771 per terminal or location, e.g. mobile device with multiple directory numbers
• CPC Class Codes: H04M 15/80 Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8005 Flat-fee
• CPC Class Codes: H04M 15/88 Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 15/887 limit per user or user related number
• CPC Class Codes: H04M 3/38 Graded-service arrangements, i.e. some subscribers prevented from establishing certain connections queuing arrangements H04Q3/64
• CPC Class Codes: H04W 12/088 using filters or firewalls
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/04 based on user or terminal location or mobility data, e.g. moving direction, speed
• CPC Class Codes: H04W 8/18 Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data

Abstract

Access control according to a policy defined for a plurality of electronic devices comprising a cellular modem and associated with the same user If an end user has two electronic devices, such as a fire alarm or an electricity meter, which both have a cellular modem and are allowed to operate in parallel under the same subscription, the end user can abuse this subscription by lending or selling one of the devices to another person. This abuse can be prevented by the present invention in that the network access is controlled according to a policy defined for the plurality of electronic devices operating under the same subscription. In particular, the policy defines a threshold distance between a primary electronic device and each additional electronic device belonging to said plurality of electronic devices operating under the same subscription which specifies the maximum distance from the primary electronic device which still allows to gain access to the network.

Claims

1. A method, in a wireless telecommunication network, comprising:

determining that a first user equipment device and a second user equipment device have connected to the network, the first user equipment device and the second user equipment device being first and second user equipment devices of a plurality of user equipment devices associated with a common user;

in response thereto, controlling network access of the first user equipment device according to a policy defined for the plurality of user equipment devices, the controlling network access comprising controlling the network access of the first user equipment device according to the distance between the first user equipment device and the second user equipment device of the plurality of user equipment devices;

wherein the controlling network access comprises applying an upper limit to the aggregate bitrate of the first and second user equipment devices.

2. The method of claim 1 wherein the controlling network access comprises limiting or preventing the network access of the first user equipment device in response to determining that the first user equipment device is more than a threshold distance from the second user equipment device.

3. The method of claim 1:

wherein the first user equipment device has a first location identifier;

wherein the second user equipment device has a second location identifier;

further comprising comparing the first and second location identifiers.

4. The method of claim 3 wherein the respective location identifiers include one or more of:

a cell ID of a cell the corresponding user equipment device is connected to;

a sector ID of a cell the corresponding user equipment device is connected to;

a base station ID of a base station the corresponding user equipment device is connected to;

a service area ID of a service area the corresponding user equipment device is connected to;

a tracking area ID of a tracking area the corresponding user equipment device is connected to;

a routing area ID of a routing area the corresponding user equipment device is connected to;

GPS co-ordinates of the corresponding user equipment device.

5. The method of claim 1 further comprising:

sending a code to the second user equipment device;

attempting to receive a message from the first user equipment device, the message being a function of the code;

controlling network access of the first user equipment device according to whether or not the message is correctly received.

6. The method of claim 1 wherein the controlling network access comprises allowing a subset of the plurality of associated devices to use a particular service at a time.

7. The method of claim 1:

wherein the first user equipment device has a first identity;

wherein the determining comprises accessing a database, the database comprising an entry with the respective identities of each user equipment device of the plurality of user equipment devices.

8. The method of claim 1 further comprising receiving information from the first user equipment device identifying the other user equipment devices of the plurality of user equipment devices.

9. An a wireless telecommunication network, comprising:

interface circuitry configured to determine that a first user equipment device and a second user equipment device have connected to the network, the first user equipment device and the second user equipment device being first and second user equipment devices of a plurality of user equipment devices associated with a common user;

a controller configured to control the network access of the first user equipment device according to a policy defined for the plurality of user equipment devices, the control based on the distance between the first user equipment device and the second user equipment device of the plurality of user equipment devices;

wherein the controller is configured to control the network access of the first user device by applying an upper limit to at least one of;

an aggregate bitrate of the first and second user equipment devices;

an aggregate data usage of the plurality of user equipment devices in a period of time.

10. The apparatus of claim 9 wherein the interface circuitry is further configured to signal to a remote network node that the first user equipment device is one of a plurality of user equipment devices associated with a common user.

11. The apparatus of claim 9 wherein the apparatus is located in one or more of:

a mobility management entity;

a serving GPRS support node;

a GPRS gateway support node;

a packet data network gateway;

a policy control and charging rules function.

12. A method, in a wireless telecommunication network, comprising:

determining that a first user equipment device and a second user equipment device have connected to the network, the first user equipment device and the second user equipment device being first and second user equipment devices of a plurality of user equipment devices associated with a common user;

in response thereto, controlling network access of the first user equipment device according to a policy defined for the plurality of user equipment devices, the controlling network access comprising controlling the network access of the first user equipment device according to the distance between the first user equipment device and the second user equipment device of the plurality of user equipment devices;

wherein the controlling network access comprises applying an upper limit to the aggregate data usage of the plurality of user equipment devices in a period of time.

13. The method of claim 12 wherein the controlling network access comprises limiting or preventing the network access of the first user equipment device in response to determining that the first user equipment device is more than a threshold distance from the second user equipment device.

14. The method of claim 12:

wherein the first user equipment device has a first location identifier;

wherein the second user equipment device has a second location identifier;

further comprising comparing the first and second location identifiers.

15. The method of claim 14 wherein the respective location identifiers include one or more of:

a cell ID of a cell the corresponding user equipment device is connected to;

a sector ID of a cell the corresponding user equipment device is connected to;

a base station ID of a base station the corresponding user equipment device is connected to;

a service area ID of a service area the corresponding user equipment device is connected to;

a tracking area ID of a tracking area the corresponding user equipment device is connected to;

a routing area ID of a routing area the corresponding user equipment device is connected to;

GPS co-ordinates of the corresponding user equipment device.

16. The method of claim 12 further comprising:

sending a code to the second user equipment device;

attempting to receive a message from the first user equipment device, the message being a function of the code;

controlling network access of the first user equipment device according to whether or not the message is correctly received.

17. The method of claim 12 wherein the controlling network access comprises allowing a subset of the plurality of associated devices to use a particular service at a time.

18. The method of claim 12:

wherein the first user equipment device has a first identity;

wherein the determining comprises accessing a database, the database comprising an entry with the respective identities of each user equipment device of the plurality of user equipment devices.

19. The method of claim 12 further comprising receiving information from the first user equipment device identifying the other user equipment devices of the plurality of user equipment devices.

20. The method of claim 12 further comprising:

determining one or more network nodes serving the second user equipment device;

assigning the one or more network nodes to the first user equipment device.