Access through non-3GPP access networks

• US 9,137,231 B2
• Filed: 11/26/2013
• Issued: 09/15/2015
• Est. Priority Date: 04/11/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Nslund, Mats, Arkko, Jari, Blom, Rolf, Lehtovirta, Vesa Petteri, Norrman, Karl, Sahlin, Bengt, Rommer, Stefan
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/090,828
• Publication Number:
  US 20140096193A1
• Time in Patent Office: 658 Days
• Field of Search: 726/3, 726/2, 726/15, 726/27, 726/28, 726/30, 709/227
• US Class Current: 1/1
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 72/53 based on regulatory allocation policies

Abstract

When setting up communication from a user equipment UE (1), such as for providing IP access for the UE in order to allow it to use some service, information or an indication of at least one network property relating to a first network, e.g. the current access network (3, 3′), is sent to the UE from a node (13) in a second network such as the home network (5) of the subscriber of the UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (3, 3′) is trusted or not.

Claims

1. A method performed by a user equipment for communication through an access network, comprising:

retrieving information from, or interpreting a condition indicated by, a message sent to the user equipment from a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, in an authentication procedure being part of establishing a connection from the user equipment through the access network, the information or condition relating to whether the access network is trusted or not, the retrieving occurring before the connection is established; and

using, in a following stage of the procedure of establishing the connection, the retrieved information or the result of the interpreting of the condition for selecting an appropriate way of establishing the connection through the access network.

2. The method of claim 1, where the connection to be established is an IP connection, the method further comprising:

allocating an IP address to the user equipment, wherein in a set-up procedure, if the user equipment has been allocated an IP address before a possible start of an authentication procedure performed according to an Extensible Authentication Protocol (EAP), an IPsec tunnel is set up to a gateway in the home network or a network related thereto, and if a start of an authentication procedure performed according to the EAP occurs before the user equipment has been allocated an IP address, setting up an IPsec tunnel if the access network is signaled as being untrusted or setting up a plain communication channel with no IPSec tunnel established if the access network is signaled as being trusted.

3. The method of claim 1, wherein the authentication procedure is based on an Extensible Authentication Protocol (EAP) and the message is an EAP message sent from the 3GPP AAA server.

4. The method of claim 1, wherein the authentication procedure is based on an Extensible Authentication Protocol (EAP).

5. The method of claim 4, wherein the authentication procedure is based on the EAP AKA (Authentication and Key Agreement).

6. The method of claim 5, wherein said message is an EAP Request/AKA challenge signal.

7. The method of claim 5, wherein said message is an EAP Request/AKA Notification signal.

8. The method of claim 5, wherein said message is an EAP Success signal.

9. A user equipment for communication through an access network, said user equipment comprising:

one or more processing circuits configured to;

retrieve information from or interpret a condition indicated in one of the messages sent to the user equipment from a 3rd Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, in an authentication procedure being part of establishing a connection from the user equipment through the access network, the information or condition relating to whether the access network is trusted or not, the retrieving occurring before the connection is established; and

use, in a following stage of the procedure of establishing the connection, the retrieved information or the result of the interpreting of the condition for selecting an appropriate way of establishing the connection through the access network.

10. The user equipment of claim 9, wherein the one or more processing circuits are further configured to:

set up a security tunnel for communication if the information indicates that the access network is untrusted; and

set up a plain communication channel if the information indicates that the access network is trusted.

11. The user equipment of claim 9, wherein the one or more processing circuits are further configured to:

obtain information from the message indicating at least one protocol to be used for communication along the connection to be established; and

use said at least one protocol in establishing the connection through the access network.

12. A 3rd Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of a user equipment, the AAA server being configured to:

send information to the user equipment in an authentication procedure that is part of establishing connectivity from the user equipment through an access network; and

introduce, in a message included in said information sent to the user equipment, information indicating a condition of whether the access network is trusted or not or modify said message to indicate the condition;

wherein the information of the authentication procedure that is part of establishing connectivity is sent to the user equipment before the user equipment has established a connection through the access network.

13. The AAA server of claim 12, wherein the AAA server is configured to introduce the information in an Extensible Authentication Protocol (EAP) message.

14. The server of claim 13, wherein the EAP message is an EAP Request/AKA (Authentication and Key Agreement) challenge signal.

15. The server of claim 13, wherein the EAP message is an EAP Request/AKA (Authentication and Key Agreement) Notification signal.

16. The server of claim 13, wherein the EAP message is an EAP Success signal.

17. A computer program product comprised in or for use by a user equipment related to a 3 rd Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, the computer program product being an electronic memory carrying computer readable instructions which when run by the user equipment causes the user equipment to:

retrieve information from or interpret a condition indicated in one of the messages sent to the user equipment from the 3GPP AAA server, in an authentication procedure being part of establishing a connection from the user equipment through an access network, the information or condition relating to whether the access network is trusted or not, the retrieving occurring before the connection is established; and

use, in a following stage of the procedure of establishing the connection, the retrieved information or the result of the interpreting of the condition for selecting an appropriate way of establishing the connection through the access network.

18. A computer program product, comprised in or for use by a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server related to user equipments, the computer program product being an electronic memory carrying computer readable instructions which when run by an AAA server in a 3GPP home network causes the 3GPP AAA server to:

introduce, in a message included in information sent to one of user equipments related to the 3GPP AAA server, information indicating a condition relating to whether an access network, through which a connection from said user equipment is to be set up, is trusted or not;

or

modify said message to indicate the condition;

wherein the message is transmitted to the user equipment before the user equipment has established a connection through the access network.