Access through non-3GPP access networks

• US 9,949,118 B2
• Filed: 08/06/2015
• Issued: 04/17/2018
• Est. Priority Date: 04/11/2008
• Status: Active Grant

• Current Assignee: Telefonaktiebolaget LM Ericsson
• Original Assignee: Telefonaktiebolaget LM Ericsson
• Inventors: Nslund, Mats, Arkko, Jari, Blom, Rolf, Lehtovirta, Vesa Petteri, Norrman, Karl, Rommer, Stefan, Sahlin, Bengt
• Primary Examiner(s): Su, Sarah
• Application Number:
  US14/820,130
• Publication Number:
  US 20150341788A1
• Time in Patent Office: 985 Days
• CPC Class Codes: G06F 21/30 Authentication, i.e. establishing the identity or authorisation of security principals
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0892 by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/162 at the data link layer
• CPC Class Codes: H04L 63/164 at the network layer
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04W 12/06 Authentication
• CPC Class Codes: H04W 60/00 Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
• CPC Class Codes: H04W 72/53 based on regulatory allocation policies

Abstract

When setting up communication from a user equipment UE (1), such as for providing IP access for the UE in order to allow it to use some service, information or an indication of at least one network property relating to a first network, e.g. the current access network (3, 3′), is sent to the UE from a node (13) in a second network such as the home network (5) of the subscriber of the UE. The information or indication can be sent in a first stage of an authentication procedure being part of the setting up of a connection from the UE. In particular, the network property can indicate whether the access network (3, 3′) is trusted or not.

Claims

1. A method performed by a user equipment for communication through an access network, comprising:

receiving an Extensible Authentication Protocol (EAP) message, sent to the user equipment from a Third Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through the access network; and

setting up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP message indicating that the access network is untrusted.

2. The method of claim 1, wherein the authentication procedure is based on EAP.

3. The method of claim 2, wherein the authentication procedure is based on the EAP Authentication and Key Agreement (AKA).

4. The method of claim 3, wherein said message is an EAP Request/AKA challenge signal.

5. The method of claim 3, wherein said message is an EAP Request/AKA Notification signal.

6. The method of claim 3, wherein said message is an EAP Success signal.

7. A user equipment for communication through an access network, said user equipment comprising:

one or more processing circuits configured to;

receive an Extensible Authentication Protocol (EAP) message, sent to the user equipment from a 3rd Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, in an authentication procedure being part of setting up a connection from the user equipment through the access network; and

set up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP message indicating that the access network is untrusted.

8. The user equipment of claim 7, wherein the one or more processing circuits are further configured to:

obtain information from the message indicating at least one protocol to be used for communication along the connection to be established; and

use said at least one protocol in establishing the connection through the access network.

9. A computer program product comprised in or for use by a user equipment related to a 3rd Generation Partnership Project (3GPP) Authentication, Authorization, Accounting (AAA) server in a 3GPP home network of the user equipment, the computer program product being an electronic memory carrying computer readable instructions which when run by the user equipment causes the user equipment to:

receiving an Extensible Authentication Protocol (EAP) message, sent to the user equipment from the 3GPP AAA server, in an authentication procedure being part of establishing a connection from the user equipment through an access network; and

set up an IP Security tunnel between the user equipment and an evolved Packet Data Gateway responsive to the EAP message indicating that the access network is untrusted.