Communication System and Method for Providing a Mobile Communications Service

• US 20070287422A1
• Filed: 08/29/2005
• Published: 12/13/2007
• Est. Priority Date: 09/30/2004
• Status: Active Grant

• Current Assignee: Unify GmbH & Co. KG (Atos SE)
• Original Assignee: Siemens AG
• Inventors: Totzke, Jurgen, Fartmann, Alfons, Schafer, Gunter, Westerhoff, Lars
• Granted Patent: US 8,688,077 B2
• Time in Patent Office: Days
• US Class Current: 455/411
• CPC Class Codes: H04L 12/185 with management of multicast group membership
• CPC Class Codes: H04L 12/1886 with traffic restrictions for efficiency improvement, e.g. involving subnets or subdomains
• CPC Class Codes: H04L 12/189 in combination with wireless systems selective distribution or broadcast in wireless communication networks H04W4/06
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/14 for detecting or protecting against malicious traffic
• CPC Class Codes: H04W 12/122 Counter-measures against attacks; Protection against rogue devices
• CPC Class Codes: H04W 12/125 Protection against power exhaustion attacks
• CPC Class Codes: H04W 12/126 Anti-theft arrangements, e.g. protection against subscriber identity module [SIM] cloning
• CPC Class Codes: H04W 4/06 Selective distribution of broadcast services, e.g. multimedia broadcast multicast service [MBMS]; Services to user groups; One-way selective calling services
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]

Abstract

The invention relates to a communication system and a method for providing a mobile telecommunication service. A communication network transmits messages on the basis of at least one internet protocol. A network connection computer connects an access network for mobile computers and the communication network. The access network is equipped with several access points comprising corresponding access point connection computers, which are configured to create a communication connection between variable access points and the mobile computers. An authorization verification computer establishes and manages trusted relationships between several communication elements. The network connection computer and the access point connection computer are configured to execute packet filtering during the receipt and transmission of messages for the secure protection of the communication system.

Claims

1-15. -15. (canceled)

16. A communication system for providing a mobile telecommunication service, comprising:

a communication network configured to transmit messages based upon an Internet protocol;

a mobile computer;

an access network for the mobile computer in which messages are transferred using a multicast process;

a network connection computer that connects the access network to the communication network;

a plurality of access points in the access network, each access point having respective access point connection computers configured to establish a communication connection with the mobile computer; and

an authentication verification computer for establishing and managing trusted relationships between a plurality of the communication elements,

wherein the network connection computer and the access point connection computer are configured to execute a packet filtering method for security-related protection of the communication system when receiving and transmitting messages, and

wherein the network connection computer and the authentication verification computer are configured to execute an overload control method by providing a communication protocol for the communication elements in order to prevent a malfunction of the communication elements as a result of an attack.

17. The communication system as claimed in claim 16, wherein the network connection computer and the access point connection computer are configured to execute a packet filtering method in order to repel a predetermined class of attacks which use deliberately changed source addresses.

18. The communication system as claimed in claim 17, wherein the network connection computer and the access point connection computer are configured to execute the packet filtering method in order to protect an internal message exchange within the access network from external attacks.

19. The communication system as claimed in claim 16, wherein the authentication verification computer is configured to establish and manage at least one permanent trusted relationship:

between each of the access point connection computers and the authentication verification computer, or

between the network connection computer and the authentication verification computer, or

between the network connection computer and each of the access point connection computers, or

between the access point connection computers of a group of access point connection computers, or

between communication elements in a network area which are configured to receive a uniform paging service.

20. The communication system as claimed in claim 16, wherein the authentication verification computer establishes and manages a permanent trusted relationship between the authentication verification computer and the mobile computer.

21. The communication system as claimed in claim 16, wherein during an initial registration of the mobile computer, the authentication verification computer establishes and manages a temporary trusted relationship between the mobile computer and at least one of the communication elements.

22. The communication system as claimed in claim 16, wherein the authentication verification computer is configured to execute an overload control method according to a token bucket method.

23. A method for providing a mobile telecommunication service via a communication network configured to transmit messages based upon an Internet protocol, comprising:

transmitting a message via a multicast process within an access network for mobile computers;

connecting a plurality of access points in the access network to the communication network via a network connection computer;

establishing a communication connection between the access network and a mobile computer to communicate with the access points;

establishing and managing trusted relationships between a plurality of communication elements of the communication network via the authentication verification computer;

executing a packet filtering method for security protection of the communication network at the boundaries of the access network when receiving and transmitting messages via the network connection computer and the access point connection computer; and

executing an overload control via the network connection computer and the authentication verification computer via a communication protocol for the communication elements of the communication network in order to prevent malfunction of one of the communication elements as a result of an attack.

24. The method as claimed in claim 23, wherein a packet filtering method for repelling a predetermined class of attacks using deliberately changed source addresses is executed.

25. The method as claimed in claim 24, wherein the packet filtering method is executed for protection of an internal message exchange within the access network from external attacks.

26. The method as claimed in claim 23, wherein a distribution of keys to adjacent communication elements of an access point of the access network provides for a further access point to execute local authentication of a mobile computer while automatically tracking an existing useful data connection.

27. The method as claimed in any one of claim 23, wherein the overload control method is executed during an initial registration process of the mobile computer or while executing or updating paging services.

28. The method as claimed in claim 27, wherein the overload control method is implemented by a Linux net filter architecture.

29. The method as claimed in claim 28, wherein the overload control method is executed on a plurality of levels.

30. The method as claimed in claim 29, wherein the overload control method is executed decentrally on a level of geographical cells.

31. The method as claimed in claim 30, wherein the overload control method is executed centrally on a level of the total network load.

32. The method as claimed in claim 32, wherein the overload control method is executed according to a token bucket method.