Classifications

• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/02—Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• • G—PHYSICS
  • G06—COMPUTING; CALCULATING OR COUNTING
  • G06F—ELECTRIC DIGITAL DATA PROCESSING
  • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
  • G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
  • G06F16/22—Indexing; Data structures therefor; Storage structures
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
  • H04L63/00—Network architectures or network communication protocols for network security
  • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
  • H04W12/06—Authentication
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/02—Services making use of location information
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/02—Services making use of location information
  • H04W4/029—Location-based management or tracking services
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W4/00—Services specially adapted for wireless communication networks; Facilities therefor
  • H04W4/90—Services for handling of emergency or hazardous situations, e.g. earthquake and tsunami warning systems [ETWS]
• • H—ELECTRICITY
  • H04—ELECTRIC COMMUNICATION TECHNIQUE
  • H04W—WIRELESS COMMUNICATION NETWORKS
  • H04W64/00—Locating users or terminals or network equipment for network management purposes, e.g. mobility management

Definitions

• the invention is in the field of telecommunications, and more particularly in the field of the location of a user terminal when it attaches to an access point to a network. More specifically, the invention relates to the use of an authentication protocol for carrying location information.
• location information is considered by a growing number of legislations to be personal data, which should be protected against disclosures other than those required for the provision of a requested service, or those required by law.
• cellular networks such as for example 3G or LTE / EPC networks
• the geographical location of the base stations is accurately known by their operator.
• location information is available to the operator each time a user's mobile terminal attaches to one of his base stations.
• Another problem is that in the case of non-cellular access networks, such as WiFi, ADSL or FTTx access networks, the access points are not systematically pre-localized by their operator. No information is therefore available to the operator at the time of attachment of a terminal to these access networks.
• 3GPP TS 23.203 version 12.0.0 defining the Policy and Charging Control (PCC) architecture, discloses a solution for tracing a location information from a terminal to an operator, through a query and response mechanism, but can only be implemented by a specific signaling protocol, and after the terminal is attached to its access point.
• PCC Policy and Charging Control
• this solution also has a security problem because the exchanges are not secure, the confidentiality of the location information is not assured.
• One of the aims of the invention is to overcome disadvantages of the state of the art.
• the invention improves the situation by means of a method of attaching a user terminal to an operator's access network, comprising a step of transmitting an attachment request to the operator. access network by the terminal, a step of receiving an authentication request from an authentication server of the operator, a step of generating an authentication response message,
• the method further comprising:
• a step of inserting the location information into the authentication response message A step of issuing the authentication response message.
• the terminal By modifying the authentication response message, the terminal sends back a location information to the access network operator during its attachment phase.
• the operator has location information for his access point, he obtains in all cases information about the location of the terminal itself, which moreover may be more precise than that of the point. access to locate the terminal.
• the operator obtains this information without delay, during the attachment phase of the terminal.
• This modification of the authentication response message goes against the prejudices of the skilled person, because an authentication protocol is restricted to the need to identify with certainty a user or a terminal authorized to access to certain protected resources, and is not intended to convey information other than that strictly necessary for that purpose.
• the location information comprises at least one parameter included in a group of parameters comprising:
• the precision of the location can be adapted according to the needs, by selecting one or more particular types of location parameter.
• the GPS coordinates give the position of the terminal with a precision of the order of one meter. They are available when the terminal has a function called GPS (Global Positioning Sytem) which requires the ability to process the signals emitted by the GPS positioning satellites.
• GPS Global Positioning Sytem
• the SSID is the WiFi access point to which a terminal attaches.
• the operator stores the street address of all WiFi access points he manages. Location by street address is less accurate than GPS coordinates, but may be more useful in some cases.
• the domain name identifies the access network to which the terminal is attached.
• the cell identifier (Cell Id) makes it possible to know that the terminal is in the coverage area of the cell.
• Any other type of address of the point of attachment to the access network can be used for location purposes, when there is a link between this address and the more or less precise physical position of this access point.
• the step of obtaining above comprises a step of selecting at least one location information parameter according to a precision criterion predetermined by a quality of service constraint.
• the terminal can select from different types of location parameters when several are available to it. It is possible for it to adapt the degree of precision to the location requirements of a service requested from the operator.
• the SSID may be used as location information inserted in the authentication response message, preferably at coordinates provided by the GPS function of the terminal.
• the operator can consult his subscriber base to obtain for example the physical address of the subscriber who has been assigned this SSID.
• the address of a home or business is more accurate or useful than GPS coordinates, such as the case of a call emergency issued from a multi-storey building.
• the location of the access point will be as accurate as that of the terminal, and there is no need to use the GPS function of the terminal, provided that the location information relating to the access point is accessible to the terminal.
• the invention also relates to a method of processing a request for attachment of a user terminal to an access network of an operator, comprising a step of receiving a request for consecutive access authorization a request for attachment to the access network by the terminal, the method further comprising:
• the operator With this method of processing an attachment request which stores a location information of a terminal in a database, the operator is able to provide communication services enriched by this location information, and this as soon as the terminal is attached to the access network.
• Such an enriched communication service is for example the emergency call service. It is indeed particularly useful, even vital for the user of the terminal, if he establishes an emergency call following the attachment of his terminal to the access network, to be immediately located by the emergency services .
• HLR Home Location Register 3G
• HSS Home Subscriber Server, 4G
• the method of processing an attachment request comprises a step of deleting the location information of the database when the terminal detaches from the access network.
• the location data of a user are to be treated by the operator as personal data, they are only used for the need to provide a particular service to the user, and they are erased Operator databases as soon as this service is no longer needed.
• the step of extracting the location information from the attachment request processing method is followed by a rejection step of the attachment request, based on at least one location information.
• a rejection step of the attachment request based on at least one location information.
• the at least one determined communication service is an emergency call service.
• the invention also relates to a method of using a location information relating to a user terminal, said information having been stored in a database when the terminal is attached to an access network of a user. operator, the method comprising, on receiving a call from the terminal to a predetermined recipient, a step of obtaining said information by querying said database, and a step of transferring the call based at least said recipient and said location information obtained.
• This method of use according to the invention is particularly useful, for example when it is implemented in a service platform handling emergency calls. Indeed, the presence and accuracy of the location information, which is vital in this case, is made possible even in the case of VoIP calls made from non-cellular access networks.
• the invention also relates to a device for attaching a user terminal to an access network of an operator, comprising a module for transmitting a request for attachment to the access network by the terminal, a module for receiving an authentication request from an authentication server of the operator, a module for generating an authentication response message,
• the device further comprising:
• a module for obtaining a location information A module for inserting the location information into the authentication response message,
• a module for transmitting the authentication response message can be implemented in a user terminal.
• the invention also relates to a device for processing a request for attachment of a user terminal to an operator's access network, comprising a module for receiving a request for consecutive access authorization. to a request for attachment to the access network by the terminal, the device further comprising:
• a module for sending an authentication request to the terminal A module for sending an authentication request to the terminal
• This device can be implemented in an authentication server of the operator.
• the invention also relates to a device for using a location information relating to a user terminal, said information having been stored in a database when the terminal is attached to an access network of a user. operator, the device comprising a module for obtaining said information by interrogation of said database, and a transfer module of the call based at least on the recipient of the call and said location information obtained.
• This device can be implemented in a transit node managed by the operator, and able to process the communication flows from a user terminal attached to an access network managed by the operator. This may be for example a routing node or a call control server.
• the invention also relates to a user terminal, comprising a device for attaching a user terminal to an access network of an operator, as described above.
• the invention also relates to an authentication server, comprising a device for processing a request for attachment of a user terminal to an access network of an operator, as described above.
• the invention also relates to a transit network node, comprising a device for using a location information relating to a user terminal, as described above.
• the invention also relates to a signal transmitted by a terminal, carrying an authentication response message, the message comprising a location information relating to the terminal, and the message being intended for an authentication server of a network of a network. operator, the server being able to extract said information from the message, and store said information in a database.
• the signal according to the invention allows for example an operator to include the location information in a communication transferred to an emergency call center, for example.
• the invention also relates to a computer program comprising instructions for implementing the steps of the method of attaching a user terminal to an access network of an operator, as described above, when this method is executed by a processor.
• the invention also relates to a computer program comprising instructions for implementing the steps of the method of processing a request for attachment of a user terminal to an access network of an operator, such as as previously described, when this method is executed by a processor.
• the invention also relates to a computer program comprising instructions for implementing the steps of the method of using a location information relating to a user terminal, as described above, when this method is executed by a processor.
• the invention relates to a recording medium readable by a user terminal, an authentication server or a service platform, on which is recorded one of the programs that has just been described, which can use any language programming, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other desirable form.
• FIG. 1 shows an exemplary implementation of the method of attachment of a user terminal to an operator's access network, of the method of processing a terminal attachment request. of an operator access network, and the method of using location information relating to a user terminal, according to an embodiment of the invention
• FIG. 2 shows an exemplary structure of a device for attaching a user terminal to an access network of an operator, according to one aspect of the invention
• FIG. 3 shows an exemplary structure of a device for processing an application for attachment of a user terminal to an access network of an operator, according to one aspect of the invention
• FIG. 4 shows an exemplary structure of a device for using a location information relating to a user terminal, according to one aspect of the invention.
• an exemplary implementation of the invention is presented in an operator network operating in a packet mode, such as an LTE / EPC network, based on the Extensible Authentication Protocol (EAP). , or extensible authentication protocol, defined by RFC 3748 of the IETF), and a case of use of call to an emergency service, but the invention also applies to other protocols and other use cases, such as the IETF IKEv2 standard (Internet Key Exchange version 2).
• EAP Extensible Authentication Protocol
• FIG. 1 shows an exemplary implementation of the method of attachment of a user terminal to an operator's access network, of the method of processing an attachment request of a terminal of an operator. user to an access network of an operator, and the method of using location information relating to a user terminal, according to one embodiment of the invention.
• Steps E1 to E6 are implemented by a user terminal and describe the method of attaching a user terminal to an access network of an operator, according to an embodiment of the invention.
• a step E1 the user terminal UE, or terminal UE, issues an attachment request to an access network represented by one of its access points AP.
• This AP access point verifies the access rights of the UE terminal, by consulting an AAA authentication server.
• the terminal UE receives an authentication request from the AAA server, for example using 3GPP TS 23.402 and 33.402.
• This standard uses the EAP protocol which allows the use of different authentication methods for terminal access to the EPC core network via non-3GPP access points.
• the message received during step E2 may be in the form of a message of the type "EAP Request [... Location-TLV (GPS, SSID, ...)]" according to a modification of the EAP standard.
• EAP TLV extensions method For example, the EAP-SIM method defines the possibility of adding additional information in the form of a TLV (Type-Length-Value).
• TLV Type-Length-Value
• Such a modified EAP message comprises for example a Location-TLV, itself comprising:
• the terminal UE During a step E3, the terminal UE generates an authentication response message conforming to the same EAP protocol.
• the terminal UE obtains a location information, that is to say relating to its positioning in space or in a network.
• This information may include GPS coordinates obtained by consulting its embedded GPS function if it has one, or other types of location parameters. For example, it may include the SSID of the access point if it is a WiFi access point.
• the location information may include both the GPS coordinates and the SSID.
• the terminal UE inserts the location information obtained in the authentication response message generated in step E3.
• the message thus enriched during step E5 may be in the form of a message of the type "EAP Response [... Location-TLV (GPS, SSID, ...)]" according to a modification of the EAP standard.
• EAP Response [... Location-TLV (GPS, SSID, 7)]
• Such modified EAP Response message includes for example the following parameters:
• step E6 the terminal UE sends the enriched authentication response message in step E5 to the server AAA.
• step not shown the terminal UE terminates its attachment process AP access point, after receiving the AAA server confirmation of its authentication.
• the method of attaching a user terminal to an operator's access network enables the terminal to transmit location information to an operator's equipment, here the AAA server.
• the steps F1 to F7 are implemented by an authentication server and describe the method of processing a request for attachment of a user terminal to an access network of an operator, according to a mode of authentication. embodiment of the invention.
• the AAA server receives a request for access authorization consecutive to the attachment request from the terminal UE to the access point AP of the access network of the operator.
• the AAA server issues an authentication request to the terminal UE. This request has been described with reference to step E2.
• step F3 the AAA server receives an authentication response message from the terminal UE. This response message has been described with reference to step E6.
• the AAA server extracts the location information of the response message.
• the AAA server stores the extracted information in a database Loc.
• This Loc database can be included in the AAA server, or in separate equipment.
• the method of processing a request for attachment of a user terminal to an access network of an operator allows an equipment of the operator, here the server AAA , store for future use and a location information relative to the terminal.
• the AAA server deletes the location information from the database, for example when the server AAA is notified that the terminal has detached from the access point, or after expiry of a predetermined period.
• the steps G1 to G3 are implemented by a transit network node and describe the method of using a location information relating to a user terminal, according to one embodiment of the invention.
• the example used here is that of an emergency call center, whose call number varies by country or region, and is for example 1 12 in Europe, or 91 1 in North America .
• a TN transit network node receives a call for the emergency call center 1 12. Detecting that the recipient is the 1 12, and knowing that the 1 12 is a service requiring information of location, the TN node interrogates in a step G1 b the Loc database, using an identifier of the calling terminal, for example its telephone number.
• the TN node obtains location information relating to the calling UE user terminal.
• the TN node processes the call based on the recipient and the location information obtained. For example, it adds said information in at least one packet of the data stream intended for 1 12.
• the method of using location information relating to a user terminal allows a transit node located between an origin point and a destination point of a communication, to provide at the point of destination, here an emergency call processing center, location information relating to the point of origin, here a user terminal.
• the attachment device 100 implements the method of attaching a user terminal to an access network of an operator, an embodiment of which has just been described.
• Such a device 100 can be implemented in a user terminal capable of to attach to a packet-switched access network.
• the device 100 comprises a processing unit 130, equipped for example with a ⁇ micropr microprocessor, and driven by a computer program 1 10, stored in a memory 120 and implementing the method of attachment according to the invention. invention.
• the code instructions of the computer program 1 10 are for example loaded into a RAM memory, before being executed by the processor of the processing unit 130.
• Such a device 100 comprises:
• a transmission module 140 able to issue an attachment request (att req) to a packet-switched access network
• a reception module 145 able to receive an authentication request (aut req) from an authentication server,
• a generation module 150 able to generate an authentication response message
• a obtaining module 155 able to obtain location information relating to the terminal
• An insertion module 160 able to insert the location information relating to the terminal into the authentication response message
• a transmission module 165 capable of transmitting a signal carrying an authentication response message (sig).
• the device 100 may also comprise:
• a selection module 170 able to select at least one parameter constituting the location information.
• FIG. 3 an example of a structure of a device for processing a request for attaching a user terminal to an access network of an operator, according to an aspect of the invention, is now presented. 'invention.
• the processing device 200 implements the method of processing a request for attachment of a user terminal to an access network of an operator, an embodiment of which has just been described.
• a device 200 may be implemented in an authentication server capable of authenticating a terminal attaching to a packet-switched access network.
• the device 200 comprises a processing unit 230, equipped for example with a microprocessor ⁇ , and driven by a computer program 210, stored in a memory 220 and implementing the processing method according to the invention.
• a computer program 210 stored in a memory 220 and implementing the processing method according to the invention.
• the code instructions of the computer program 210 are for example loaded into a RAM memory, before being executed by the processor of the processing unit 230.
• Such a device 200 comprises:
• a reception module 240 adapted to receive an attachment request (att req) to a packet-switched access network
• a reception module 250 able to receive a signal carrying an authentication response message (sig) from a user terminal,
• An extraction module 255 able to extract location information relating to the user terminal, from the received response message
• a storage module 260 able to store the extracted information in a database (Loc).
• the device 200 may also comprise:
• a deletion module 270 able to delete the information from the Loc database
• a rejection module 275 able to reject the attachment request of the user terminal according to the extracted location information.
• the database Loc can be implemented in the device 200 or in a separate device. In relation with FIG. 4, an example of structure is now presented a device for using a location information relating to a user terminal, according to one aspect of the invention.
• the device 300 of use implements the method of using a location information relating to a user terminal, an embodiment of which has just been described.
• Such a device 300 may be implemented in a transit node located between an origin point and a destination point of a communication.
• the device 300 comprises a processing unit 330, equipped for example with a ⁇ micropr microprocessor, and driven by a computer program 310, stored in a memory 320 and implementing the method of use according to the invention.
• the code instructions of the computer program 310 are for example loaded into a RAM memory, before being executed by the processor of the processing unit 330.
• Such a device 300 comprises:
• a reception module 340 able to receive packets of a communication flow (paq) coming from a user terminal,
• An interrogation module 345 able to interrogate a remote database (Loc) comprising location information, using an identifier extracted from the received packet stream;
• a obtaining module 350 able to obtain from the remote database (Loc) a location information relating to the user terminal,
• the modules described with reference to FIGS. 2 to 4 may be hardware or software modules.

Landscapes

• Engineering & Computer Science (AREA)
• Computer Networks & Wireless Communication (AREA)
• Signal Processing (AREA)
• Computer Security & Cryptography (AREA)
• Theoretical Computer Science (AREA)
• General Engineering & Computer Science (AREA)
• Software Systems (AREA)
• Physics & Mathematics (AREA)
• Databases & Information Systems (AREA)
• General Physics & Mathematics (AREA)
• Data Mining & Analysis (AREA)
• Business, Economics & Management (AREA)
• Health & Medical Sciences (AREA)
• Emergency Management (AREA)
• Environmental & Geological Engineering (AREA)
• Public Health (AREA)
• Computer Hardware Design (AREA)
• Computing Systems (AREA)
• Mobile Radio Communication Systems (AREA)

Applications Claiming Priority (2)

Publications (1)

Family

ID=49231590

Family Applications (1)

Country Status (5)

Families Citing this family (2)

Citations (1)

Family Cites Families (18)

• 2013
  • 2013-04-02 FR FR1352980A patent/FR3004037A1/fr not_active Withdrawn
• 2014
  • 2014-03-28 EP EP14723096.5A patent/EP2982149A1/fr not_active Withdrawn
  • 2014-03-28 CN CN201480024858.XA patent/CN105165043A/zh active Pending
  • 2014-03-28 WO PCT/FR2014/050741 patent/WO2014162085A1/fr active Application Filing
  • 2014-03-28 US US14/779,944 patent/US20160050560A1/en not_active Abandoned

Patent Citations (1)

Non-Patent Citations (3)

Also Published As

Similar Documents

Legal Events