SECURED DATA TRANSMISSION IN COMMUNICATIONS SYSTEM

• US 20100261451A1
• Filed: 10/29/2008
• Published: 10/14/2010
• Est. Priority Date: 11/01/2007
• Status: Active Grant

• Current Assignee: Teliasonera AB
• Original Assignee: Teliasonera AB
• Inventors: Korhonen, Jouni
• Granted Patent: US 8,355,695 B2
• Time in Patent Office: Days
• US Class Current: 455/410
• CPC Class Codes: H04L 63/0464 using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04W 12/03 Protecting confidentiality, e.g. by encryption
• CPC Class Codes: H04W 8/085 involving hierarchical organized mobility servers, e.g. hierarchical mobile IP [HMIP]
• CPC Class Codes: H04W 80/04 Network layer protocols, e.g. mobile IP [Internet Protocol]
• CPC Class Codes: H04W 88/182 Network node acting on behalf of an other network entity, e.g. proxy

Abstract

A solution for providing a data security service in a wireless communications system (S) is disclosed. In the solution, a first security association (SA1) is established between an anchor node (LMA1) located in a home operator network (N1) and a concentrator node (Ha) located in an interconnecting operator network (GRXa). In addition, a second security association (SA2, SA3, SA4, SA5) is established between an access node (MAG1, MAG2, MAG3, MAG4, MAG5) located in a roaming operator network (N2, N3, N4, N5) and the concentrator node (Ha, Hb) located in the interconnecting operator network (GRXa, GRXb). A user terminal (UE1-2, UE1-3, UE1-4, UE1-5) roaming in the roaming operator network (N2, N3, N4, N5) can then access external network services (E) by utilizing the first security association (SA1) and the second security association (SA2, SA3, SA4, SA5), respectively.

Claims

1-20. -20. (canceled)

21. A method for providing a security service to data traffic in a communications system, the system comprising:

a home operator network;

a roaming operator network, and

an interconnecting operator network;

the method comprising establishing at least one operator-specific security association for securing data traffic in the system,

wherein the method comprises;

establishing a first security association between an anchor node located in the home operator network and a concentrator node located in the interconnecting operator network;

establishing a second security association between an access node located in the roaming operator network and the concentrator node located in the interconnecting operator network; and

transmitting data traffic between the anchor node located in the home operator network and one or more user terminals roaming in the roaming operator network such that the data traffic transmitted between the anchor node and the concentrator node is secured by using the first security association and the data traffic transmitted between the access node and the concentrator node is secured by using the respective second security association, wherein the home operator network is the home network of said one or more user terminals.

22. A method according to claim 21, wherein the first security association is specific to the home operator network.

23. A method according to claim 21, wherein the second security association is specific to the home operator network and the roaming operator network.

24. A method according to claim 21, wherein the method comprises establishing a security association between the home operator network and each roaming partner network of the home operator network.

25. A method according to claim 21, wherein the first security association expires after a predetermined time period.

26. A method according to claim 21, wherein the second security association expires after a predetermined time period.

27. A method according to claim 21, wherein the method comprises utilizing a proxy mobile IPv6 protocol between the interconnecting operator network and the home operator network, and between the interconnecting operator network and the roaming operator network.

28. A communications system comprising

a home operator network;

a roaming operator network; and

an interconnecting operator network;

the system being arranged to establish at least one operator-specific security association for securing data traffic;

wherein the system is arranged to;

establish a first security association between an anchor node located in the home operator network and a concentrator node located in the interconnecting operator network;

establish a second security association between an access node located in the roaming operator network and the concentrator node located in the interconnecting operator network; and

transmit data traffic between the anchor node located in the home operator network and one or more user terminals roaming in the roaming operator network such that the data traffic transmitted between the anchor node and the concentrator node is secured by using the first security association and the data traffic transmitted between the access node and the concentrator node is secured by using the respective second security association, wherein the home operator network is the home network of said one or more user terminals.

29. A system according to claim 28, wherein the first security association is specific to the home operator network.

30. A system according to claim 28, wherein the second security association is specific to the home operator network and the roaming operator network.

31. A system according to claim 28, wherein it is configured to establish a security association between the home operator network and each roaming partner network of the home operator network.

32. A system according to claim 28, wherein the first security association expires after a predetermined time period.

33. A system according to claim 28, wherein the second security association expires after a predetermined time period.

34. A system according to claim 28, wherein it is configured to utilize a proxy mobile IPv6 protocol between the interconnecting operator network and the home operator network, and between the interconnecting operator network and the roaming operator network.

35. An anchor node for a communications system, wherein the anchor node is located in a home operator network, wherein the anchor node is arranged to:

establish a security association for secured data traffic with a concentrator node located in an interconnecting operator network; and

carry out data traffic transmission with one or more user terminals roaming in a roaming operator network such that the data traffic transmitted between the anchor node and the concentrator node is secured by using the security association, wherein the home operator network is the home network of said one or more user terminals.

36. An anchor node according to claim 35, wherein the security association is specific to the home operator network.

37. An anchor node according to claim 35, wherein the security association expires after a predetermined time period.

38. An access node for a communications system, wherein the access node is located in a roaming operator network, wherein the access node is arranged to:

establish a security association for secured data traffic with a concentrator node located in an interconnecting operator network; and

carry out data traffic transmission with one or more user terminals roaming in the roaming operator network such that the data traffic transmitted between the access node and the concentrator node is secured by using the security association.

39. An access node according to claim 38, wherein the security association is specific to the home operator network and the roaming operator network.

40. An access node according to claim 38, wherein the security association expires after a predetermined time period.

41. A concentrator node for a communications system, wherein the concentrator node is located in an interconnecting operator network, wherein the concentrator node is arranged to:

establish a first security association for secured data traffic with an anchor node located in a home operator network;

establish a second security association for secured data traffic with an access node located in a roaming operator network; and

transmit data traffic between the anchor node located in the home operator network and one or more user terminals roaming in the roaming operator network such that the data traffic transmitted between the anchor node and the concentrator node is secured by using the first security association and the data traffic transmitted between the access node and the concentrator node is secured by using the respective second security association, wherein the home operator network is the home network of said one or more user terminals.

42. A concentrator node according to claim 41, wherein the first security association is specific to the home operator network.

43. A concentrator node according to claim 41, wherein the second security association is specific to the home operator network and the roaming operator network.

44. A concentrator node according to claim 41, wherein the first security association expires after a predetermined time period.

45. A concentrator node according to claim 41, wherein the second security association expires after a predetermined time period.