ACCESS MANAGEMENT FOR WIRELESS COMMUNICATION

• US 20090094680A1
• Filed: 10/06/2008
• Published: 04/09/2009
• Est. Priority Date: 10/08/2007
• Status: Active Grant

• Current Assignee: Qualcomm, Inc.
• Original Assignee: Qualcomm, Inc.
• Inventors: Agashe, Parag A., Deshpande, Manoj M., Nanda, Sanjiv, Balasubramanian, Srinivasan, Ulupinar, Fatih, Song, Osok, Palanigounder, Anand, Gupta, Rajarshi, Chen, Jen Mei, Horn, Gavin B.
• Granted Patent: US 9,167,505 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04W 12/062 Pre-authentication
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 48/02 Access restriction performed under specific conditions
• CPC Class Codes: H04W 48/08 Access restriction or access information delivery, e.g. discovery data delivery signalling during connection H04W76/00
• CPC Class Codes: H04W 48/14 using user query or user detection
• CPC Class Codes: H04W 8/26 Network addressing or numbering for mobility support
• CPC Class Codes: H04W 84/045 using private Base Stations, e.g. femto Base Stations, home Node B

Abstract

Provisioning and access control for communication nodes involves assigning identifiers to sets of nodes where the identifiers may be used to control access to restricted access nodes that provide certain services only to certain defined sets of nodes. In some aspects provisioning a node may involve providing a unique identifier for sets of one or more nodes such as restricted access points and access terminals that are authorized to receive service from the restricted access points. Access control may be provided by operation of a restricted access point and/or a network node. In some aspects, provisioning a node involves providing a preferred roaming list for the node. In some aspects, a node may be provisioned with a preferred roaming list through the use of a bootstrap beacon.

Claims

1. A method of communication, comprising:

receiving a message relating to a request by an access terminal to access an access point, wherein the message comprises a first identifier associated with the access terminal;

determining a second identifier associated with the access terminal based on the first identifier; and

determining whether the access terminal is allowed to receive service from the access point based on the second identifier and at least one identifier associated with the access point.

2. The method of claim 1, wherein the first identifier comprises a temporary identifier and the second identifier comprises a permanent identifier.

3. The method of claim 1, wherein:

the second identifier identifies at least one closed subscriber group that the access terminal may access; and

the at least one identifier associated with the access point comprises a closed subscriber group identifier associated with the access point.

4. The method of claim 1, wherein the determination of the second identifier comprises sending the first identifier to a network node and receiving the second identifier from the network node.

5. The method of claim 1, wherein:

a network node makes the determination of whether the access terminal is allowed to receive service from the access point;

the message comprises a request from an access point for authenticating the access terminal; and

the method further comprises sending, to the access point, a message indicative of the determination of whether the access terminal is allowed to receive service from the access point.

6. The method of claim 1, wherein the access point makes the determination of whether the access terminal is allowed to receive service from the access point.

7. The method of claim 6, wherein the at least one identifier associated with the access point is received from a network node.

8. The method of claim 6, wherein the determination of whether the access terminal is allowed to receive service from the access point comprises:

sending the second identifier and the at least one identifier associated with the access point to a network node; and

receiving, from the network node, an indication of whether the access terminal is allowed to receive service from the access point.

9. The method of claim 1, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

10. An apparatus for communication, comprising:

means for receiving a message relating to a request by an access terminal to access an access point, wherein the message comprises a first identifier associated with the access terminal;

means for determining a second identifier associated with the access terminal based on the first identifier; and

means for determining whether the access terminal is allowed to receive service from the access point based on the second identifier and at least one identifier associated with the access point.

11. The apparatus of claim 10, wherein the first identifier comprises a temporary identifier and the second identifier comprises a permanent identifier.

12. The apparatus of claim 10, wherein:

the second identifier identifies at least one closed subscriber group that the access terminal may access; and

the at least one identifier associated with the access point comprises a closed subscriber group identifier associated with the access point.

13. The apparatus of claim 10, wherein the determination of the second identifier comprises sending the first identifier to a network node and receiving the second identifier from the network node.

14. The apparatus of claim 10, wherein:

a network node makes the determination of whether the access terminal is allowed to receive service from the access point;

the message comprises a request from an access point for authenticating the access terminal; and

the apparatus further comprising means for sending, to the access point, a message indicative of the determination of whether the access terminal is allowed to receive service from the access point.

15. The apparatus of claim 10, wherein the access point makes the determination of whether the access terminal is allowed to receive service from the access point.

16. The apparatus of claim 15, wherein the at least one identifier associated with the access point is received from a network node.

17. The apparatus of claim 15, wherein the determination of whether the access terminal is allowed to receive service from the access point comprises:

sending the second identifier and the at least one identifier associated with the access point to a network node; and

receiving, from the network node, an indication of whether the access terminal is allowed to receive service from the access point.

18. The apparatus of claim 10, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

19. An apparatus for communication, comprising:

a communication controller configured to receive a message relating to a request by an access terminal to access an access point, wherein the message comprises a first identifier associated with the access terminal; and

an access controller configured to determine a second identifier associated with the access terminal based on the first identifier, and to determine whether the access terminal is allowed to receive service from the access point based on the second identifier and at least one identifier associated with the access point.

20. The apparatus of claim 19, wherein the first identifier comprises a temporary identifier and the second identifier comprises a permanent identifier.

21. The apparatus of claim 19, wherein:

the second identifier identifies at least one closed subscriber group that the access terminal may access; and

the at least one identifier associated with the access point comprises a closed subscriber group identifier associated with the access point.

22. The apparatus of claim 19, wherein:

a network node makes the determination of whether the access terminal is allowed to receive service from the access point;

the message comprises a request from an access point for authenticating the access terminal; and

the communication controller is further configured to send, to the access point, a message indicative of the determination of whether the access terminal is allowed to receive service from the access point.

23. The apparatus of claim 19, wherein the access point makes the determination of whether the access terminal is allowed to receive service from the access point.

24. A computer-program product, comprising:

computer-readable medium comprising codes for causing a computer to;

receive a message relating to a request by an access terminal to access an access point, wherein the message comprises a first identifier associated with the access terminal;

determine a second identifier associated with the access terminal based on the first identifier; and

determine whether the access terminal is allowed to receive service from the access point based on the second identifier and at least one identifier associated with the access point.

25. The computer-program product of claim 24, wherein the first identifier comprises a temporary identifier and the second identifier comprises a permanent identifier.

26. A method of communication, comprising:

receiving a request from an access point for authenticating an access terminal; and

sending, to the access point, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

27. The method of claim 26, wherein the at least one identifier comprises a closed subscriber group identifier.

28. The method of claim 26, further comprising determining the at least one identifier based on a permanent identifier associated with the access terminal, the method further comprising determining the permanent identifier based on a temporary identifier associated with the access terminal.

29. The method of claim 28, wherein the determination of the permanent identifier comprises sending the temporary identifier to a network node and receiving the permanent identifier from the network node.

30. The method of claim 26, further comprising receiving the at least one identifier from a network node.

31. The method of claim 26, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

32. An apparatus for communication, comprising:

means for receiving a request from an access point for authenticating an access terminal; and

means for sending, to the access point, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

33. The apparatus of claim 32, wherein the at least one identifier comprises a closed subscriber group identifier.

34. The apparatus of claim 32, further comprising means for determining the at least one identifier based on a permanent identifier associated with the access terminal, and for determining the permanent identifier based on a temporary identifier associated with the access terminal.

35. The apparatus of claim 34, wherein the determination of the permanent identifier comprises sending the temporary identifier to a network node and receiving the permanent identifier from the network node.

36. The apparatus of claim 32, wherein the means for receiving is configured to receive the at least one identifier from a network node.

37. The apparatus of claim 32, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

38. An apparatus for communication, comprising:

a communication controller configured to receive a request from an access point for authenticating an access terminal; and

an access controller configured to send, to the access point, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

39. The apparatus of claim 38, wherein the at least one identifier comprises a closed subscriber group identifier.

40. The apparatus of claim 38, wherein the access controller is further configured to determine the at least one identifier based on a permanent identifier associated with the access terminal, and to determine the permanent identifier based on a temporary identifier associated with the access terminal.

41. The apparatus of claim 38, wherein the communication controller is further configured to receive the at least one identifier from a network node.

42. A computer-program product, comprising:

computer-readable medium comprising codes for causing a computer to;

receive a request from an access point for authenticating an access terminal; and

send, to the access point, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

43. The computer-program product of claim 42, wherein the at least one identifier comprises a closed subscriber group identifier.

44. A method of communication, comprising:

sending, by an access point, a request for authenticating an access terminal; and

receiving, in response to the request, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

45. The method of claim 44, further comprising determining whether the access terminal is allowed to receive service from the access point based on the at least one identifier.

46. The method of claim 45, wherein the at least one identifier comprises a closed subscriber group identifier.

47. The method of claim 45, wherein:

the at least one identifier identifies a closed subscriber group that the access terminal may access; and

the determination comprises determining whether the at least one identifier matches a closed subscriber group identifier associated with the access point.

48. The method of claim 44, wherein the request is sent based on a determination that the access terminal is not listed in a local access list of the access point.

49. The method of claim 44, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

50. An apparatus for communication, comprising:

means for sending, by an access point, a request for authenticating an access terminal; and

means for receiving, in response to the request, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

51. The apparatus of claim 50, further comprising means for determining whether the access terminal is allowed to receive service from the access point based on the at least one identifier.

52. The apparatus of claim 51, wherein the at least one identifier comprises a closed subscriber group identifier.

53. The apparatus of claim 51, wherein:

the at least one identifier identifies a closed subscriber group that the access terminal may access; and

the determination comprises determining whether the at least one identifier matches a closed subscriber group identifier associated with the access point.

54. The apparatus of claim 50, wherein the request is sent based on a determination that the access terminal is not listed in a local access list of the access point.

55. The apparatus of claim 50, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

56. An apparatus for communication, comprising:

an access controller configured to send, by an access point, a request for authenticating an access terminal; and

a communication controller configured to receive, in response to the request, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

57. The apparatus of claim 56, wherein the access controller is further configured to determine whether the access terminal is allowed to receive service from the access point based on the at least one identifier.

58. The apparatus of claim 57, wherein:

the at least one identifier identifies a closed subscriber group that the access terminal may access; and

the determination comprises determining whether the at least one identifier matches a closed subscriber group identifier associated with the access point.

59. The apparatus of claim 56, wherein the request is sent based on a determination that the access terminal is not listed in a local access list of the access point.

60. A computer-program product, comprising:

computer-readable medium comprising codes for causing a computer to;

send, by an access point, a request for authenticating an access terminal; and

receive, in response to the request, at least one identifier that identifies at least one set of access points from which the access terminal is allowed to receive at least one service.

61. The computer-program product of claim 60, wherein the computer-readable medium further comprises codes for causing the computer to determine whether the access terminal is allowed to receive service from the access point based on the at least one identifier.

62. A method of communication, comprising:

configuring an access point with a first identifier of an access terminal;

obtaining a second identifier of the access terminal based on the first identifier;

receiving a message requesting access by the access terminal; and

determining, at the access point, whether to allow the requested access based on the second identifier.

63. The method of claim 62, wherein the first identifier comprises a network address identity or a mobile station integrated services digital network number.

64. The method of claim 62, wherein the second identifier comprises an electronic serial number or an international mobile subscriber identity.

65. The method of claim 62, wherein the obtaining comprises:

sending the first identifier to a network node; and

receiving the second identifier from the network node as a result of sending the first identifier.

66. The method of claim 62, wherein the determination comprises:

sending the second identifier to a network node; and

receiving, as a result of sending the second identifier, an indication as to whether to allow the requested access.

67. The method of claim 62, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

68. An apparatus for communication, comprising:

means for configuring an access point with a first identifier of an access terminal;

means for obtaining a second identifier of the access terminal based on the first identifier;

means for receiving a message requesting access by the access terminal; and

means for determining, at the access point, whether to allow the requested access based on the second identifier.

69. The apparatus of claim 68, wherein the first identifier comprises a network address identity or a mobile station integrated services digital network number.

70. The apparatus of claim 68, wherein the second identifier comprises an electronic serial number or an international mobile subscriber identity.

71. The apparatus of claim 68, wherein the obtaining comprises:

sending the first identifier to a network node; and

receiving the second identifier from the network node as a result of sending the first identifier.

72. The apparatus of claim 68, wherein the determination comprises:

sending the second identifier to a network node; and

receiving, as a result of sending the second identifier, an indication as to whether to allow the requested access.

73. The apparatus of claim 68, wherein the access point is restricted to not provide, for at least one other access terminal, at least one of the group consisting of:

signaling, data access, registration, and service.

74. An apparatus for communication, comprising:

a provisioning controller configured to configure an access point with a first identifier of an access terminal;

an access controller configured to obtain a second identifier of the access terminal based on the first identifier; and

a communication controller configured to receive a message requesting access by the access terminal;

wherein the access controller is further configured to determine, at the access point, whether to allow the requested access based on the second identifier.

75. The apparatus of claim 74, wherein the first identifier comprises a network address identity or a mobile station integrated services digital network number.

76. The apparatus of claim 74, wherein the second identifier comprises an electronic serial number or an international mobile subscriber identity.

77. The apparatus of claim 74, wherein the obtaining comprises:

sending the first identifier to a network node; and

receiving the second identifier from the network node as a result of sending the first identifier.

78. A computer-program product, comprising:

computer-readable medium comprising codes for causing a computer to;

configure an access point with a first identifier of an access terminal;

obtain a second identifier of the access terminal based on the first identifier;

receive a message requesting access by the access terminal; and

determine, at the access point, whether to allow the requested access based on the second identifier.

79. The computer-program product of claim 78, wherein the obtaining comprises:

sending the first identifier to a network node; and

receiving the second identifier from the network node as a result of sending the first identifier.