Method and system for bearer authorization in a wireless communication network

• US 20040073686A1
• Filed: 09/29/2003
• Published: 04/15/2004
• Est. Priority Date: 06/27/2001
• Status: Active Grant

• Current Assignee: Nokia Technologies Oy (Nokia Corporation)
• Original Assignee: Nokia Solutions and Networks US LLC (Nokia Corporation)
• Inventors: Hurta, Tuija
• Granted Patent: US 7,506,362 B2
• Time in Patent Office: Days
• US Class Current: 709/229
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32

Abstract

The present invention relates to a method and a system for bearer authorization in a wireless communication network, including the creation of an authorization binding information (AUTN) in a control function (PCF) of an application layer of said wireless communication network, the allocation of a control function identifier representative of the actual address of the control function in said wireless communication network and incorporating said identifier into said authorization binding information, the transmission of the so created authorization binding information to a terminal device (UE) having access to said wireless communication network, and the bearer authorization proceeding from the terminal device through a transport layer of said wireless communication layer by deriving the actual address of said control function from which the authorization binding function has originated based on the control function identifier included in said authorization binding information. In this manner, inherent security risks involved in sending the actual control function address to a terminal device or User Equipment are eliminated, and the authorization binding information is reduced in size.

Claims

1. A method for bearer authorization in a wireless communication network comprising an application layer and a transport layer, said method comprising the steps of:

a) creating an authorization binding information in a control function of said application layer;

b) allocating a control function identifier representative of the actual address of said control function in said wireless communication network and incorporating said identifier into said authorization binding information;

c) transmitting the so created authorization binding information to a terminal device having access to said wireless communication network; and

d) carrying out said bearer authorization for said terminal device through said transport layer of said wireless communication network by deriving the actual address of said control function from which the authorization binding information has originated in said wireless communication network based on the control function identifier included in said authorization binding information.

2. A method according to claim 1, wherein said identifier is arranged to take a numerical integer value selected from a predetermined range of values.

3. A method according to claim 1 or 2, wherein said authorization binding information comprises an authorization token, the creation of which is initiated by transmitting authorization information from a Proxy Call State Control Function (P-CSCF) in the wireless communication network to one of a plurality of Policy Control Functions in said wireless communication network.

4. A method according to claim 3, wherein the created Authorization Token is sent to said Proxy Call State Control Function and forwarded by said Proxy Call State Control Function to said terminal device,

5. A method according to any of the preceding claims, wherein said authorization binding information is dispatched from said terminal device to a node in said transport layer.

6. A method according to claim 5, wherein said node is a Serving GPRS Support Node, and the authorization binding information is further passed from said Serving GPRS Support Node to a Gateway GPRS Support Node in said transport layer.

7. A method according to claim 5, wherein said node is adapted to derive said actual control function address in said wireless communication network from the control function identifier incorporated in said authorization binding information.

8. A method according to claim 7, wherein said node is adapted to request authorization from the control function having said derived actual address.

9. A method according to claim 7, wherein said address derivation is carried out by said node using an access point specific list of control function identifiers and corresponding addresses.

10. A method according to claim 6, wherein said Gateway GPRS Support Node is adapted to derive said actual Policy Control Function address in said wireless communication network from the Policy Control Function identifier included in said Authorization Token and to request authorization from the Policy Control Function having the derived actual address.

11. A method according to claim 10, wherein said address derivation is carried out by said Gateway GPRS Support Node using an access point specific list of Policy Control Function identifiers and corresponding addresses.

12. A system for bearer authorization in a wireless communication network, comprising:

a) means for creating an authorization binding information in a control function (PCF) provided in an application layer of said wireless communication network;

b) means for allocating a control function identifier representative of the actual address of said control function in said wireless communication network and for incorporating said identifier into said authorization binding information;

c) means for transmitting the so created authorization binding information to a terminal device (UE) having access to said wireless communication network; and

d) means for carrying out said bearer authorization for said terminal device through a transport layer of said wireless communication network by deriving the actual address of said control function from which the authorization binding information has originated in said wireless communication network based on the control function identifier included in said authorization binding information.

13. A system according to claim 12, wherein said identifier is a numerical integer value selected from a predetermined range of values.

14. A system according to claim 12 or 13, wherein said authorization binding information comprises an authorization token the creation of which is initiated by a Proxy Call State Control Function (P-CSCF) in a core network (CN) transmitting authorization information to one of a plurality of Policy Control Functions in said wireless communication network.

15. A system according to claim 14, wherein said Policy Control Function is arranged to send the created authorization token back to said Proxy Call State Control Function, said Proxy Call State Control Function is arranged to forward the token to said terminal device, said terminal device is arranged to pass the token to a Serving GPRS Support Node (SGSN) within said core network, and said Serving GPRS Support Node is arranged to pass the token to a Gateway GPRS Support Node (GGSN) within said core network.

16. A system according to claim 15, wherein said Gateway GPRS Support Node is arranged to derive said actual Policy Control Function address in said wireless communication network from the Policy Control Function identifier included in said authorization token and to request authorization (au_req) from the Policy Control Function having the derived actual address.

17. A system according to claim 16, wherein said Gateway GPRS Support Node is arranged to carry out said address derivation using an access point specific list of Policy Control Function identifiers and corresponding addresses.