KR20050048662A - Method and system for providing access via a first network to a service of a second network - Google Patents

Abstract

The present invention relates to a method and system for providing access from a first network (30) to a service of a second network, wherein an authentication signaling is used to transfer a service selection information to the second network (70). Based on the service selection information, a connection can be established to access the desired service. Thereby, cellular packet- switched services can be accessed over networks which do not provide a context activation procedure or corresponding control plane signaling function.

Description

TECHNICAL AND SYSTEM FOR PROVIDING ACCESS VIA A FIRST NETWORK TO A SERVICE OF A SECOND NETWORK}

The invention provides, for example, a service subscribed to a General Packet Radio Service (GPRS) network or a Universal Mobile Telecommunications System (UMTS) network via a first network, such as a wireless local area network (WLAN). A method and system for providing access to services in a second network.

In recent years, the wireless communications market has grown considerably. Wireless technology can now reach virtually any location on the ground. With the great success of wireless telephony and messaging services, it's no surprise that wireless communications are beginning to be applied in the personal and business computing space. Because they are no longer bound by the devices of wired networks, people can access and share information on a global scale almost anywhere they venture.

The main motivation and gain from the WLAN is increased mobility. Network users can move almost without restrictions and access the LAN from almost anywhere. In addition to increased mobility, WLANs provide increased flexibility. Employees can use small computers and wireless links to organize meetings to share and discuss future design plans and products. These “ad hoc” networks can be formed and broken down around the conference table and / or globally as needed for a very short time. WLANs provide the connectivity and convenience of wired LANs without requiring expensive wiring or rewiring.

However, even with the fastest laptop computers, poor access to the Internet or corporate intranets reduces productivity during the move. Despite the revolution of the Global System for Mobile Communications (GSM), laptop users need faster access to download large files and quickly synchronize their email. Recently created mobile information societies require data to be available at any time. As a solution to this problem, an operator WLAN solution has been proposed that allows broadband access to laptops or terminal devices in special places such as airports, convention centers, hotels and meeting rooms. Thus, mobile network operators can provide broadband access to the Internet, an organization's intranet, or other service machines from almost anywhere in the world. Thus, a public WLAN service with unique WLAN roaming features can be provided.

In packet-switched cellular networks, such as GPRS or UMTS networks, the description of a user's service is specified by an access point names (APN). GPRS is a common packet domain core network used for both GSM networks and UMTS networks. This common core network is designed to provide packet switched services and support several quality of service levels to enable non real time traffic and efficient transmission of real time traffic. The Serving GPRS Support Node (SGSN) keeps track of the individual locations of the mobile terminals and performs security functions and access control. The Gateway GPRS Support Node (GGSN) provides for interaction with external packet switched networks and is connected to the SGSN via an IP based packet domain backbone network. In a backbone network, the APN is actually a reference to the GGSN to be used. In addition, in the GGSN, the APN may identify the external network and optionally the service to be provided. Further details regarding the use and structure of APNs are defined, for example, in 3GPP specification TS 23.003.

APN selected by the terminal device or user equipment (UE) or by the user of this terminal device when the user is connected to the GPRS service, i.e., when setting up a packet data protocol (PDP) context specified in 3GPP specification TS 23.060 The information is sent from the terminal device to the network via PDP context establishment signaling. This information consists of the APN and, optionally, a username and password (if required to access a service behind the selected APN). In a GPRS network, this information is used to select the appropriate GGSN. This information also arrives at the selected GGSN, which GGSN also uses to establish a connection to a network node behind the GGSN, such as an organization's intranet or operator service node. If provided, the username and password are passed to the relevant network node behind the GGSN to allow this connection to be granted.

However, in the presented public or operator WLAN systems, no operation similar to GPRS PDP context activation is provided. Specifically, there is no dedicated signaling for setting up services between the WLAN terminal device (ie, WLAN UE) and the WLAN network or a network behind this WLAN network. Thus, GPRS type service selection and activation over a WLAN network is not possible, causing disadvantages in the proposed public or operator WLANs.

Hereinafter, the present invention will be described in more detail with reference to the accompanying drawings.

1 is a schematic block diagram illustrating the basic principles underlying the present invention.

2 is a schematic block diagram of a WLAN connected to an application server through a WLAN gateway of a GPRS network.

3 illustrates EAP signaling according to a preferred embodiment of the present invention.

4 illustrates the format of an enhanced EAP Response Challenge packet according to a preferred embodiment.

Accordingly, it is an object of the present invention to provide a method and system for providing access to services provided by GPRS or any other second network from a WLAN network or any other first network.

This object is achieved by a method of providing access to a service provided by a second network via a first network, which method:

Signaling service selection information via the first network to an authentication server means of the second network using an authentication message; And

Accessing the services provided on the access point indicated by the service selection information, using the service selection information.

The above object is also achieved by an authentication server device providing an authentication mechanism, which authentication server:

Extract service selection information for selecting a service from the received authentication message; And

Use the service selection information to establish a connection to services provided on the access point indicated by the service selection information.

The object is also achieved by a terminal device providing access to a network service, which terminal device is configured to set service selection information for selecting the network service in an authentication message.

Therefore, when service selection information or service technology is transmitted to the second network using authentication signaling between the terminal device and the authentication server of the second network, the authentication server uses the service selection information to access a desired service or a subscribed service. Set. This makes it possible to access network services of a third party via a first network, for example a WLAN. Thus, dynamic service selection and multiple simultaneous connections to different services are enabled, resulting in continuity of service between different networks, such as WLAN and cellular packet switched networks. By this, network flexibility and user mobility can be enhanced, and service logic can be unified in different networks.

From the network operator's point of view, the proposed solution is advantageous in that current service technology mechanisms, such as the APN mechanism in GPRS, are available for new operator WLANs, thereby supporting a legacy solution.

The authentication message may be a message of Extensible Authentication Protocol (EAP). Specifically, this authentication message can be an EAP response message.

The service selection information may include at least one APN parameter. This at least one APN parameter may include the APN, username and password of the desired service. In addition, the APN parameter may be encrypted in the authentication message. The encryption applied for the different APN parameters may be selected differently, such that the selected APN parameters may be sent by the authentication server to the selected access point in an encrypted format, and the selected APN parameters may be selected. Only decrypted in service network.

Now, a preferred embodiment will be described based on the network architecture shown in FIGS. 1 and 2, where a user of a WLAN is authenticated by EAP authentication to access the WLAN network and cellular packet switched services.

1 is a schematic block diagram of a network architecture including a WLAN 30 and a GPRS network 70. First, a terminal device or UE 10 that is subscribed to a GPRS service and wants to gain access to the service is authenticated to the GPRS network 70 via WLAN 30 using authentication signaling, for example, an authorization request message. Service selection information indicating at least one APN parameter and an optional username and password is transmitted to the server 50 (step 1). The authentication server 50 then selects a WLAN gateway 60 that is deployed within the GPRS network 70 and then signals service information to this WLAN gateway 60 and, in response, provides the requested service and at least 1 Connection information for establishing a connection between the application server 80 identified by the two APN parameters and the access server 40 of the WLAN 30 is received from the WLAN gateway 60 (second step). More specifically, the authorization request may also be sent to the application server 80 or other external AAA server along with the username and password, and the WLAN gateway 60 first receives a response from such server and then receives the response. Proxy to the access server 40.

2 is a more detailed block diagram of a network architecture in which a preferred embodiment of the present invention may be implemented. In FIG. 2, the WLAN UE 10 is connected to the access point 20 of the WLAN 30 via a wireless connection. Note that the access point 20 has a function similar to that of a base station of a general cellular network. This access point 20 is mobile and forms part of the wired network infrastructure. Further details regarding the architecture and functionality of the WLAN network 30 may be obtained, for example, from the IEEE specification 802.11.

The WLAN 30 also has a WLAN access server 40 that establishes a connection to external networks, such as the GPRS network 70 or other packet switched network 90 (eg, the Internet or an operator or corporate intranet). Include. The GPRS network 70 has an authentication server 50 and an authentication server database 55 assigned thereto. The database 55 stores subscriber information such as service profile information of each connected terminal device or UE. This information is stored after being retrieved from the permanent subscriber database 110 of the subscriber's home network 110. Note that the functionality of the authentication server 50 may also be located in the user's home network or WLAN backbone or subsystem. If a GSM SIM card is used within the UE 10, authentication signaling by the UE 10 may be based on the EAP SIM authentication protocol. Alternatively, if a UMTS SIM card is used in the UE 10, the authentication may be based on the EAP AKA (Authentication and Key Exchange) authentication protocol.

The EAP protocol mechanism is used for authentication and session key distribution by GSM SIM or USIM. Authentication is based on a challenge-response mechanism, where an authentication algorithm running on a SIM or USIM card can be provided with a random number (RAND) as a challenge. The SIM or USIM executes an operator specific confidentiality algorithm, which takes as input the secret key and RNAD stored on the SIM or USIM and generates a response (SRES) and key as output. This key is originally intended to be used as an encryption key on the air interface. The authentication server 50 has an interface to the GSM or UMTS home network 100 of the UE 10 and is a gateway between a packet switched AAA (authentication, authorization and accounting) network and the GSM or UMTS authentication infrastructure. Plays a role. After receiving an EAP Identity Response that includes a user identity that can be mapped to a user's International Mobile Subscriber Identity (IMSI), the authentication server 50 may then register the home location register (HLR) of the user's home network 100 or N triplets or quintuplets are obtained from the authentication center of the home subscriber server (HSS) 110. From the triplets, the authentication server 50 derives the keying material based on the cryptographic algorithm.

According to a preferred embodiment, WLAN authentication signaling is used to signal GPRS service subscription or selection information via the authentication server 50 to the GPRS network 70. The GPRS service information or service selection information includes the APN of the desired service and optionally includes a user name and password necessary for accessing the service through the indicated APN. The authentication server 50 uses the obtained service selection information to select the WLAN gateway 60 having a function similar to the GGSN, so that the user can obtain access to the subscription service. The subscription service may be, for example, access to an organization's intranet or mobile operator's services.

3 is a signaling block diagram illustrating EAP-SIM authentication signaling between UE 10 and authentication server 50 of GPRS network 70. The first EAP request (not shown) issued by the network is an EAP Identity Request. The client or UE 10 responds with an EAP identity response that includes anonymous or IMSI (step 1). This anonymity is used when the UE 10 is using identity privacy support. In response to the EAP Identity Response message or packet, the authentication server 50 sends an EAP Challenge Request containing n random numbers RAND, among other parameters (step 2). In response, the UE 10 issues an EAP Challenge Response that includes the calculated response value SRES. In addition, according to a preferred embodiment of the present invention, the EAP challenge response also includes at least one encrypted APN parameter specifying the desired GPRS service to be accessed. These encrypted APN parameters include the APN of the desired service and optionally include a username and password to gain access to the service (step 3). The encryption applied to different APN parameters may be selected differently. That is, the APN itself may be only the APN parameter required for AP selection, so that only these parameters should have a format that can be decrypted and / or read by the access server. The username and password parameters may be sent by the authentication server to the selected access point in an encrypted format, which parameters are decrypted only at that access point or at the selected service network. Therefore, it is impossible to access them while being transmitted over the first network. If the authentication procedure is successful, the authentication server 50 responds with an EAP success message (step 4).

The authentication signaling procedure makes it possible to signal service selection parameters to the authentication server 50 without requiring any additional context activation functionality required in a typical GPRS network without WLAN functionality. To achieve this enhanced functionality of authentication signaling, the client software of the UE 10 is modified or programmed to add respective service selection information to the EAP Challenge Response message. Specifically, if a user chooses to connect to a particular service identified by his APN, service information or service selection information is configured in the client software of the UE 10. For each service, the following settings can be performed. First, an empty text entry may be set that identifies the service for the user. Secondly, the name of the domain name server (DNS) assigned by the APN, i.e., the identity of the public land mobile network (PLMN) plus the mobile operator (MO), may be set to indicate a particular service, and thirdly A setting (eg, yes / no setting) indicating whether a username and password are required may be made in the client software. The third setting may include a setting indicating either a predefined or dynamic username and / or password setting.

After receiving the EAP request message at the latest, the UE 10 obtains the service selection related information required from the user, and then encrypts it as specified by the signaling protocol used, such as EAP-SIM. The UE 10 then inserts APN parameter information into the EAP challenge response message and then sends it to the authentication server 50 via the WLAN 30.

4 illustrates the format of an enhanced EAP SIM challenge response message according to a preferred embodiment occurring in a SIM. The "code" field is used to identify the message as a reply message. The "Identifier" field is an octet, which helps match the reply to the response. Specifically, the "Identifier" field must match the "Identifier" field of the message sent in the response. The "Length" field indicates the length of an EAP message or packet. The "Type" field and the "Sub Type" field are set to specific values that specify the EAP SIM Challenge Response message. The "reserved" fields are set to zero on transmission and ignored on receipt. The "AT_SRES" field indicates the attribute value, followed by an additional "length" field and a "reservation" field indicating the length of the next SRES value. Finally, the proposed APN parameters specifying the requested service can be added, for example as encrypted values.

It should be noted that the present invention is not limited to the WLAN and GRPS services described above, and may be used for any network architecture in which the control plane signaling necessary to access the packet switched service is not provided to the access network. The functionality of the authentication server 50 and gateway 60 need not necessarily be GPRS functionality, but may be located in any backbone network or subsystem of the WLAN or any other network accessible by the WLAN 30. These may be provided in standalone server devices or in GPRS GGSN or SGSN functions respectively. In addition, the service being accessed need not be a GPRS service. Thus, the WLAN UE 10 may be a single mode WLAN terminal without GPRS functionality, but having the ability to access external services via authentication signaling, for example by a mechanism similar to the GPRS service selection mechanism. In addition, any predetermined authentication message can be used to transmit the service selection information. Accordingly, preferred embodiments may be modified within the scope of the appended claims.

Claims (27)

In a method for providing access to a service provided by a second network (90) via a first network (30), a) signaling service selection information to the authentication server means (50) of said second network (90) via said first network using an authentication message; And b) using the service selection information to access the services provided on the access point indicated by the service selection information. The method of claim 1, And said first network is a wireless local area network (30). The method according to any of the preceding claims, And said second network is a cellular packet switched network (70). The method of claim 3, wherein And the cellular packet switched network is a GPRS network (70). The method according to any of the preceding claims, The authentication message is an EAP message. The method of claim 5, wherein The EAP message is an EAP SIM or EAP AKA message. The method according to claim 5 or 6, The authentication message is an EAP challenge response message. The method according to any of the preceding claims, And the service selection information includes at least one APN parameter. The method of claim 8, Wherein said at least one APN parameter comprises an APN, a username and a password. The method according to claim 7 or 8, The APN parameter is encrypted in the authentication message. The method according to claim 9 or 10, At least one of the APN parameters is encrypted so that it can only be decrypted in the network defined by the APN. An authentication server device providing an authentication mechanism, The authentication server 50 is: a) extracting service selection information for selecting a service from the received authentication message; And b) using the service selection information to establish a connection to the services provided on the access point indicated by the service selection information. The method of claim 12, And the authentication mechanism is based on the EAP protocol. The method of claim 13, And the received authentication message is an EAP challenge response message. The method according to any one of claims 12 to 14, Authentication server device, characterized in that the authentication server is a standalone WLAN authentication server (50). The method according to any one of claims 12 to 14, And the authentication server is GGSN. The method according to any one of claims 12 to 16, And the service selection information includes at least one APN parameter. The method of claim 17, And the APN parameter is encrypted in the authentication message. The method of claim 17 or 18, At least one of the APN parameters is decrypted at the authentication server. 20. The method of claim 17, wherein At least one of the APN parameters is transmitted by the authentication server to the access point in an encrypted manner. A terminal device providing access to network services, the terminal device comprising: And the terminal device sets service selection information for selecting the network service in an authentication message. The method of claim 21, And the authentication message is an EAP message. The method of claim 22, The EAP message is an EAP challenge response message. The method of claim 23, The EAP challenge response message is an EAP SIM or EAP AKA challenge response message. The method according to any one of claims 21 to 24, And the service selection information includes at least one APN parameter. The method according to any one of claims 21 to 25, And the service is a GPRS service. In a system that provides access to services of a second network (90) from a first network (30), A terminal device according to any of claims 21 to 26, wherein the terminal device (10) is connected to the first network (30); And 21. A system comprising an authentication server device (40) according to any of the claims 14-20, wherein the authentication server is connected to the second network.