KR20080036954A - Universal convergence border gateway - Google Patents

Abstract

A services gateway, which links client access by any technology to multiple service nodes, even if the client access technology is not directly compatible with the service node. The universal convergence border gateway (UCBG) utilizes the IP layer as a harmonizing layer to decouple standard services from their normally-associated access technologies. This is particularly advantageous with multifunction client devices because the best available wireless access technology. can be used independently of the type of service being accessed. The UCBG uses a single encryption scheme to multiplex the traffic for various services with different characteristics into multiple data flows. The UCBG uses a single encryption scheme to converge the data flows to the client using a single control path without losing each traffic's characteristics such as QoS. The gateway also demultiplexes the converged traffic that it receives from the client in order for the data to reach the appropriate service node.

Description

Universal convergence border gateway {UNIVERSAL CONVERGENCE BORDER GATEWAY}

This application discloses US Provisional Application No. 60 / 682,226, filed May 18, 2005; Claims priority on 60 / 682,227, filed May 18, 2005 and 60 / 698,055, filed July 11, 2005.

The present invention relates generally to methods and systems for providing unified transmission of wireless services, in particular wireless services.

New generations of mobile cellular technologies have typically upgraded legacy core networks by introducing new air interfaces. Prior to commercial adoption, new wireless air-interfaces are required to be integrated to the extent that legacy systems can provide seamless transitions, reuse existing OSS and provide existing services. This rigorous standardization process has delayed or made it difficult to adopt new wireless technologies.

In addition, unauthorized wireless technologies are increasingly being allowed by mobile cellular operators as low cost alternative access networks. In turn, mobile operators may provide the same services through any access technologies, including unauthorized radio.

Accordingly, there is a need for a wireless service gateway that enables the continuous deployment of new access technologies by reusing existing service delivery platforms or OSS. This allows new services to be easily introduced regardless of the access network.

background: IP  Access to multiple services over the network

Because current convergence technologies only integrate access technologies in addition to services, they require user equipment that must adjust individual security or service gateways for each service being accessed. There is no focal point between these services, which can cause problems with service delivery and CPU processing.

Thus, without the need for user equipment to adjust individual security or service gateways for each service accessed, it allows clients to access all packet network services provided by the core network, thereby eliminating problems associated with service delivery and CPU processing. There is a need for a reducing wireless service gateway.

Universal Convergence  Perimeter gateway ( UCBG )

The present invention provides a service gateway that links client access to multiple service nodes by any technique, although the client access technique is not directly compatible with the service node. The Universal Convergence Border Gateway (UCBG) uses the IP layer as a harmonizing layer to separate standard services from the constraints of common associated access technologies. This is particularly advantageous for multifunctional client devices because the best available radio access technology can be used regardless of the type of service being accessed.

UCBG multiplexes traffic from various services, aggregates data flows into a single primary security mechanism, and sends it to user clients. Advantageously, the user equipment can connect with various other types of data flows. The gateway also demultiplexes the aggregated traffic received from the user client to route traffic to the appropriate services.

In preferred embodiments, a single encryption scheme is used to secure multiple data flows with different features for multiple different services. Thus, independent multiple transport channels using different encryption schemes need not be maintained by the user client. UCBG can maintain different traffic characteristics of various data flows while maintaining a single encryption scheme.

UCBG also allows mobile operators and service providers to provide the same services and integrated billing / OSS via any authorized or unauthorized access technologies by acting as anchor points for multiple access and services. Among the services provided, corporate services may require a username / password to authorize access to the client. When a client accesses a corporate service through GPRS and other access mechanisms, there must be a mechanism for securely transferring the username / password through the untrusted access network. The proposed UCBG provides this mechanism by using the config payload of the IKE message to send username / password information to the IKE SA. Thus, the information is protected and clients can access the corporate domain through a secure VPN.

Some examples of the advantages of the disclosed UCBGs are as follows:

통합 과금;

Consolidated billing;

다른 액세스 기술들 간의 연속 이동성;

Continuous mobility between different access technologies;

기존 GGSN을 통해 GPRS/UMTS/EDGE 패킷 네트워크에 의하여 제공된 모든 서비스들에 대한 액세스;

Access to all services provided by the GPRS / UMTS / EDGE packet network through the existing GGSN;

기존 PDSN을 통해 cdma2000 셀룰라 패킷 네트워크들에 의하여 제공된 모든 서비스들에 대한 액세스;

Access to all services provided by cdma2000 cellular packet networks via existing PDSN;

사용자 클라이언트 및 UCBG간에 IP 연속성을 가능하게 하는 임의의 액세스 기술을 사용하여 기존 GGSN을 통해 GPRS/UMTS/EDGE 패킷 네트워크에 의하여 제공되고 기존 PDSN를 통해 cdma2000 셀룰라 패킷 네트워크들에 의하여 제공되는 모든 서비스들에 대한 액세스;

All services provided by the GPRS / UMTS / EDGE packet network over the existing GGSN and over cdma2000 cellular packet networks over the existing PDSN using any access technology that enables IP continuity between the user client and UCBG. Access to;

이동 셀룰라 네트워크들의 기존 과금 및 OSS의 재사용;

Reuse of existing billing and OSS of mobile cellular networks;

최종 사용자 트래픽 당 라우팅 및 보안 정책들의 강화;

Strengthening routing and security policies per end user traffic;

One or multiple data flows towards the user client accessing the service bundle provided based on the requested services, end user capabilities, and UCBG conditions (eg, load); And

모든 데이터 흐름들에 대한 단일 암호화 방식을 사용하면서 서비스들의 번들을 액세스하는 사용자 클라이언트 쪽으로의 다중 데이터 흐름들의 다른 트래픽 특징 유지.

Maintain different traffic characteristics of multiple data flows towards the user client accessing the bundle of services while using a single encryption scheme for all data flows.

The invention will be described with reference to the accompanying drawings, which show important exemplary embodiments of the invention and are incorporated herein by reference.

1 illustrates a conventional network architecture.

2 is a message flow / signaling chart for a conventional network architecture.

3 illustrates an exemplary embodiment of a network architecture incorporating a universal convergence border gateway.

4 is a message flow / signaling chart for an exemplary embodiment of a network architecture incorporating a universal convergence border gateway.

FIG. 5 illustrates an exemplary embodiment of a universal convergence border gateway used as an access-independent service gateway. FIG.

FIG. 6 illustrates another exemplary embodiment of a universal convergence boundary gateway and dual-mode user equipment.

Many inventive techniques of this application will be described in connection with the preferred embodiments (not by way of limitation).

1 describes a conventional network architecture.

In this example, the user equipment 101 uses the access network 103 to access the services provided by the core network 157. For each service accessed by user equipment 101, a separate secure connection, such as 105, 121, 129 or 145, must be created.

For example, to access GPRS services via WLAN, IKE / IPsec SA 105 is formed between user equipment 101 and TTG 107. GTP tunnel 109 is then formed using a subset of Gn reference points Gn '. The link 117 (via the Gi or Go interface) between the IMS services 119 and the GGSN 111 allows the user equipment 101 to access the IMS services 119. The user equipment 101 can access the packet services 115 via the link 113 via the Gi interface.

In order to access VoIP services, another secure connection 121 is formed between the user equipment 101 and the security gateway 123. Once the secure connection 121 is formed, the user equipment 101 can access the VoIP services 127 via the softswitch 125.

In order to access cdma2000-based services, another secure connection, such as IKE / IPsec SA 129, is formed between the user equipment 101 and the PCF 131. An R-P tunnel 133 is then formed between the PCF 131 and the PDSN 135 (via the R-P interface). The link 141 between the IMS services 143 (via the interface Pi) and the PDSN 135 allows the user equipment 101 to access the IMS services 143. User equipment 101 can access packet services 139 via a link 137 via a Pi interface.

In order to access PSTN 155 using unauthorized mobile access 149, another secure connection 145 needs to be formed between user equipment 101 and secure gateway 147. UMA network controller 149 connects user equipment 101 to PSTN 155 via a link 151 between UMA 149 and MSC / GMSC 153 (via interface A).

Thus, for each service node accessed by user equipment 101, a separate secure connection must be maintained by user equipment 101. As a result, the user can only access the service through the connected access technology.

2 is a message flow / signaling chart of a conventional network architecture.

In this example, the UE forms a TTG and an IKE SA for GPRS traffic (message flow 210). An IPSec tunnel is set up between the UE and the TTG, and a primary GTP tunnel is formed between the TTG and the GGSN (message flow 203). When there is QoS1 in the IPsec tunnel and primary GTP tunnel setup, that is, GPRS traffic with the requested QoS, the GPRS traffic is carried in the IPSec tunnel and the TTG sends the traffic to the GGSN (message flow 205). When there is GPRS traffic with other QoS, such as QoS2, there is currently no way specific to the UE and TTG to distinguish or separate the traffic so that the traffic is mixed in one IPSec tunnel (message flow 207). . This can cause quality problems because traffic with very different features (eg, voice and web browsing) is handled in the same way. TTG can use the GPRS mechanism to distinguish traffic on the GGSN side. The traffic can then be carried in separate GTP tunnels between the TTG and GGSN. When another service through another service node, such as a UMA via UNC, is requested, another secure tunnel must be established on this node side. To accomplish this, a new IKE SA is formed between the UE and the SGW (Security Gateway) (message flow 209). The second IPsec tunnel is then set up using a new IKE SA between the UE and the SGW (message flow 211). UMA traffic is carried in this second IPSec tunnel, and the SGW sends the traffic to the UNC (message flow 213). There is no relationship between these two services.

Integrated service delivery

3 illustrates an example embodiment of a network architecture incorporating a universal convergence border gateway.

In this figure, the Universal Convergence Border Gateway (UCBG) 301 is the core component of service convergence. UCBG 301 forms a secure connection 303 to user equipment 101. Secure connection 303 ensures completeness and security when transmitting data over wireless and distributed access networks such as WLAN 103 (especially in the case of roaming). The secure connection is only formed after successful authentication and authorization procedures based on the client's requested service and current subscription. UCBG 301 may communicate with an external server for signaling, control, and accounting purposes.

In contrast to the architecture shown in FIG. 1, the architecture shown in FIG. 3 provides access to each service accessed because the UCBG forms a primary security association with the user client and uses this SA for all traffic for other multiple services. There is no need for user equipment that must support individual secure access to the system. User equipment no longer needs to maintain secure connections 105, 121, 129, 145. UCBG replaces security gateways 107, 147, TTG 107, and PCF 131. Services are typically not limited to associated access technologies and become universally available through other access networks.

3 shows a few examples of applications that can be integrated using a universal convergence border gateway.

IMS 애플리케이션: IMS는 셀룰라 기술들을 통해 멀티미디어 서비스들의 보안 전송을 위한 IP-기반 인프라스트럭처이다. IMS 서비스들은 이송층으로서 PS 도메인을 사용하며, GGSN 또는 PDSN 플랫폼으로부터 제공될 수 있다. IMS 및 GGSN(Gi 또는 Go 인터페이스를 통해) 또는 PDSN(Pi 인터페이스를 통해)사이의 링크는 QoS 및 정책 파리미터들 뿐만 아니라 과금 상관 식별자들을 교환하도록 한다. UCBG(301)는 GGSN(111) 또는 PDSN(135) 플랫폼들 및 모든 연관된 구성들을 재사용함으로서 임의의 액세스 기술(TTG/터널-스위칭 모드 또는 PCF에서 전개되는)을 통해 IMS 서비스들(119, 143)을 가능하게 한다.

IMS Application: IMS is an IP-based infrastructure for secure delivery of multimedia services through cellular technologies. IMS services use the PS domain as the transport layer and may be provided from a GGSN or PDSN platform. The link between IMS and GGSN (via Gi or Go interface) or PDSN (via Pi interface) allows for exchanging billing correlation identifiers as well as QoS and policy parameters. UCBG 301 reuses IGS services 119 and 143 via any access technology (deployed in TTG / tunnel-switching mode or PCF) by reusing the GGSN 111 or PDSN 135 platforms and all associated configurations. To make it possible.

VoIP 애플리케이션들: UCBG(301)는 WLAN 액세스 기술을 통해 사용자 장비로부터의 보안 접속을 종료할 수 있다. 일단 사용자 장비와의 보안, 인증 세션이 형성되면, VoIP 인프라스트럭처(127)를 가진 오퍼레이터의 소프트스위치(125)는 대안 액세스 기술들을 통해 사용자 장비에 SIP-기반 VoIP 호출들을 전송할 수 있다. 이는 WLAN 액세스를 전송하여 전체 전개 비용을 감소시키기 위하여 오퍼레이터가 그의 현재 2G/3G 풋프린트를 확장하도록 한다.

VoIP Applications: UCBG 301 may terminate a secure connection from user equipment via WLAN access technology. Once a secure, authenticated session with the user equipment is established, the operator's softswitch 125 with the VoIP infrastructure 127 may send SIP-based VoIP calls to the user equipment via alternative access technologies. This allows the operator to extend his current 2G / 3G footprint to send WLAN access to reduce overall deployment costs.

UMA 애플리케이션: UMA 솔루션은 (A 인터페이스를 통해) 한 측면으로부터 기존 2G MSC(153)로의 접속부(151) 및 VPN/IP를 통해 다른 측면으로부터 사용자 장비로의 접속부에 의하여 2G BSC 기능(GANC/UNC(149))을 에뮬레이트 한다. 릴리스 6 인터워킹 아키텍처와 UMA를 스무스하게 통합하기 위하여, 중첩 기능들을 최소화하고 릴리스 6 I-WLAN 시스템들에서 이용가능한 기존 기능들을 재사용하는 것이 바람직하다. UCBG(301)는 UMA 서비스들을 위한 보안, 인증 및 허가 베어러(bearer)를 제공할 수 있다.

UMA Application: The UMA solution uses the 2G BSC function (GANC / UNC) from one side (via A interface) to the existing 2G MSC 153 and the other side from the other side to the user equipment via VPN / IP. Emulate 149). In order to seamlessly integrate the UMA with the Release 6 interworking architecture, it is desirable to minimize overlapping functions and reuse existing functions available in Release 6 I-WLAN systems. UCBG 301 may provide a security, authentication and authorization bearer for UMA services.

Other features and QoS  With requirements Traffic  Use a single primary security association to distinguish and separate

In various embodiments, the UCBG 301 allows mobile operators and service providers to separate the services from the associated access technologies, thereby providing the same services and integrated billing / OSS via any authorized or unauthorized access technologies. Provide it.

In one embodiment, once a primary security association, such as an IKE SA, is formed, several child or IPSec SAs are created to carry service traffic with QoS or other features such as "access features", such as a company intranet. However, these IPSec SAs are controlled by one primary SA used to generate IPSec SAs. This allows to distinguish and separate traffics with different features and QoS requirements. Thus, traffic features are not lost while maintaining a single encryption scheme.

In one embodiment, IKE is used as the primary SA between the UCBG and the user client, and the configuration payload of IKE is used to indicate other services and / or service nodes when creating an IPSec SA on the UCBG 301 side. do. UCBG 301 stores these features with IPSec SPI and determines if a service and / or service node should be used for such traffic when IPSec traffic with a particular SPI flows inward. Therefore, no complicated logic is required to distinguish the traffic in the UCBG 301, and the UCBG 301 can simply transmit the traffic to the appropriate service node using the IPSec SPI value.

Among the services provided, corporate services 307 may require a username / password before granting access to the client. When a client accesses corporate services 307 via link 305 (via the Gi interface) using a different access mechanism than GPRS, the username / password is secured over the access network, particularly the untrusted access network. There must be a mechanism available to transmit it. The disclosed UCBG provides a security mechanism that uses the construction payload of the IKE message. The username / password information is sent to the IKE SA, and UCBG sends this information to the GGSN using standard GPRS processes. Thus, the information is protected and clients can access the corporate domain through a secure VPN.

Since the username / password is sensitive information, this information is provided only after the user and the UCBG are mutually authenticated and a secure IKE SA is formed. Using this method, a user can access corporate services 307 through a secure IPSec tunnel.

Some examples of the advantages of this embodiment include the following:

서비스들의 번들을 액세스하는 사용자 장비 쪽에서 하나 이상의 IPSec SA를 가진다. 최종 사용자 쪽에서 단일 또는 다중 터널들을 사용하기 위한 결정은 요청된 서비스들, 최종-사용자 능력들 및 UCBG 조건들(예컨대, 로드)의 동적 조합에 기초한다;

It has one or more IPSec SAs on the user equipment side that access the bundle of services. The decision to use single or multiple tunnels at the end user side is based on a dynamic combination of requested services, end-user capabilities and UCBG conditions (eg, load);

서비스 유효성, 사용자 선호도 및/또는 서비스 카테고리에 따라 개별적으로 또는 함께 터널들을 제거한다;

Remove tunnels individually or together according to service availability, user preferences and / or service category;

1차 SA(IKE SA)의 페이로드를 사용하여 UCBG에 서비스들 및 이들의 특징들을 전송한다;

Send services and their features to the UCBG using the payload of the primary SA (IKE SA);

일단 정보가 저장되면, IPSec SPI를 사용하여 서비스들 및 이들의 특징들을 단순하게 식별한다;

Once the information is stored, the IPSec SPI is used to simply identify the services and their features;

보안 IPSec 터널을 통해 애플리케이션 레벨 인증을 위한 애플리케이션 액세스 서버에 사용자이름 및 패스워드 정보를 전송한다;

Send username and password information to the application access server for application level authentication over a secure IPSec tunnel;

애플리케이션 또는 도메인 사용자이름 및 패스워드 정보를 반송하기 위하여 IKE 구성 페이로드를 사용한다;

Use the IKE configuration payload to return application or domain username and password information;

클라이언트가 보안 전송 채널을 통해 UCBG에 애플리케이션 사용자이름 및 패스워드 정보를 제공하도록 한다;

Allow the client to provide UCBG application username and password information over a secure transport channel;

클라이언트가 선택된 APN에 기초하여 IKE 구성 페이로드의 애플리케이션 사용자이름 및 패스워드를 제공하도록 한다.

Allows the client to provide an application username and password for the IKE configuration payload based on the selected APN.

4 is a message flow / signaling chart of an exemplary embodiment of a network architecture incorporating a universal convergence border gateway.

In this figure, an IKE SA is formed between the UE and the UCBG (message flow 401). This SA is used for all services regardless of services and / or service features, such as QoS. All of the control messages are encrypted and their integrity is protected. The first IPSec SA is formed for data transmission. This example assumes that the service requested by the user requires GGSN as the service node. A GTP tunnel is formed between UCBG and GGSN (message flow 403). For traffic for this service, the UE transmits and receives data in the IPSec tunnel 1, and the UCBG sends a message to the GGSN (message flow 405). If other services with different features, such as QoS, are requested at the same service node, i.e., the GGSN side, a second IPSec SA may be formed. The new IPSec SA key may or may not be used depending on the policy. Another GTP tunnel is formed to carry traffic with other Quos, for example QoS2 (message flow 407). If another service node, such as another service via UNC, is requested, the UE forms another IPSec SA (message flow 409). For UMA traffic, the UE sends this traffic in the appropriate IPSec tunnel. The UCBG identifies the traffic by the SPI and sends the traffic directly to the UNC (message flow 411). For GPRS traffic with another QoS, such as QoS2, the UE sends the traffic in the appropriate IPSec tunnel, and the UCBG sends the traffic directly to the GGSN (message flow 413). If there is a request to establish a VPN for the enterprise, the UE can establish another IPSec tunnel, providing the necessary username / password information. UCBG sends this information and request to GGSN to form GTP tunnel (message flow 415). Enterprise VPN traffic is returned to the destination through the appropriate IPSec tunnel and GTP tunnel in the enterprise intranet (message flow 417).

New access technology

It is clear that wireless applications are changed to IP (Packet Switch (IP)). The common packet services platform allows mobile operators to easily introduce new services to enhance existing services.

In addition, mobile operators want to extend their service delivery to all deployed access technologies (eg, cellular, Wi-Fi or WiMAX). The disclosed integrated gateway platform allows for continuous access to wireless services via any access technologies while providing secure access to the operator's core service delivery platforms.

5 illustrates an example embodiment of a universal convergence boundary gateway used as an access-independent service gateway.

In this embodiment, the user equipment 101 can access all services via access technologies such as Wi-Fi, WiMAX, GPRS / EDGE, and any general purpose IP. UCBG 301 operates at the IP layer. Thus, UCBG 301 functions independently of access network technology. The UCBG 301 may be easily deployed at the core network edge to provide secure common service transport regardless of the access technology used by the user equipment 101.

This architecture allows mobile operators to use existing 3GPP frameworks to integrate new access technologies. One such technique for receiving multiple presses is WiMAX initiated by the IETF under the IEEE 802.16e standard. By using the same framework as TS 23.234, 3GPP can quickly include WiMAX, which can be used to further extend the scope of 3G and IMS.

Harmonizing  As a hierarchy IP  Use layer

 UCBG 301 typically uses the IP layer as the harmonizing layer to separate standard services from the constraints of associated access technologies. This is particularly advantageous for multifunctional client devices because the best available radio access technology can be used regardless of the type of service being accessed.

6 illustrates another exemplary embodiment of a universal convergence boundary gateway and dual-mode user equipment.

In this embodiment, the user equipment 101 is preferably a dual-mode (eg WLAN + GPRS) user equipment. Using the UCBG 301, services can be accessed directly via GPRS connection 601 or via WLAN connection 603. If GPRS access is more appropriate, UCBG 301 acts as a GPRS node and allows direct routing of user traffic through GPRS connection 601. If WLAN access is more appropriate, the UCBG establishes a secure tunnel through the WLAN and fortifies traffic through the WLAN connection. When a particular service (eg, IMS 119) is provided through an existing node, such as GGSN 111, UCBG 301 forms a GTP tunnel 109 towards GGSN 111, WLAN connection 603 and Switch user traffic between GPRS connections 601.

According to a disclosed class of progressive embodiments, using a IP layer to separate standard services from commonly associated access technologies; And causing the user equipment to access standard services independently of the access technology typically associated with the services.

According to a disclosed class of progressive embodiments, a server typically includes a server that uses an IP layer to separate standard services from associated access technologies; A communication system is provided in which user equipment can access standard services regardless of the access technology typically associated with the services.

According to the disclosed class of the progressive embodiments, a method for allowing a mobile device to communicate with other service nodes simultaneously, comprising a single primary to simultaneously participate in multiple data flows with different traffic characteristics for different types of multiple services. Using a security association; A communication method is provided wherein the mobile electronic device uses the single primary security association to manage the different types of multiple services.

According to a disclosed class of progressive embodiments, there is provided a method comprising: multiplexing multiple data flows with different features for different types of multiple services using a single encryption scheme; And communicating the data flows between a mobile electronic device and a convergence gateway using respective secondary data paths under management of a single primary control path, wherein the mobile electronic device manages the single primary control path. There is provided a communication method, which can simultaneously access services from different types of multiple services.

According to a disclosed class of progressive embodiments, a mobile electronic device capable of simultaneously participating in multiple data flows with different traffic characteristics for different types of multiple services; And multiplexing software; The multiplexing software generates the multiple data flows using a configuration of a single primary security association to distinguish the multiple data flows, and allows the mobile electronics to interface with a convergence gateway via a single primary security association; A communication system is provided in which the mobile electronic device can simultaneously access the different types of multiple services under the control of the single primary security association.

According to a disclosed class of progressive embodiments, a system for communicating with a mobile client, comprising a single primary security association between a server and the mobile client; The server uses the payload of the single primary security association to multiplex traffic for two or more different types of services into two or more data flows; A communication system is provided wherein the server simultaneously transmits services from two or more different types of service nodes to the mobile client under control of the single primary security association.

According to a disclosed class of progressive embodiments, there is provided a method of transmitting network services to a client, comprising: executing, at a mobile client, multiple applications interfacing to different types of data flows, and controlling a single primary security association; Multiplexing and demultiplexing the data flows in multiple secondary security associations below; And at a gateway server, multiplexing and demultiplexing different types of multiple data flows in multiple secondary security associations, and routing the data flows to the appropriate server nodes; A transmission method is provided wherein the server simultaneously transmits services from the service nodes to the client regardless of the access technology used by the client to access the services.

According to a disclosed class of progressive embodiments, a method of transmitting network services, comprising: managing a first data flow between a server and user equipment to carry traffic of a first characteristic associated with a first service node; If there is traffic of a second characteristic associated with the first service node, managing a second data flow between the server and the user equipment to carry traffic of the second characteristic; And if there is traffic associated with the second service node, managing a third data flow between the server and the user equipment to carry traffic associated with the second service node; Respective services of the first and second nodes are transmitted to the user equipment via the respective data flows under the control of a single security association between the user equipment and the server; Additional data flows between the server and the user equipment are generated as needed using the single security association.

According to the disclosed class of the progressive embodiments, there is provided a security association between a server and a user equipment; A first data flow between the server and the user equipment, wherein the first data flow is generated from a payload configuration of the security association and carries traffic of a first feature associated with a first service node; A second data flow between the server and the user equipment when there is traffic of a second feature associated with the first service node, the second data flow being generated from the payload configuration of the security association and Carry traffic of a second feature; And a third data flow between the server and the user equipment when there is traffic associated with a second service node, wherein the third data flow is generated from the payload configuration of the security association and the second service node. Carry traffic associated with; An end user can access the services of the first and second service nodes simultaneously under the control of the security association; Additional data flows between the server and the user equipment are generated as needed using the security association.

Modifications and variations

As will be appreciated by one of ordinary skill in the art, the inventive concepts described herein may be modified and modified within the scope of the present invention, and therefore the scope of the present invention is not limited by some of the specific exemplary techniques given.

Although IPSec is used to secure and distinguish traffic in preferred embodiments, any method for securing and discriminating traffic may be used.

Although IKE is used with IPSec to properly configure the protocol in preferred embodiments, other encryption standards are possible. For example, DES, 3DES, D-H, MD5, SHA-1, RSA signature, AES and CAs can be used.

Although IKE is used for key exchange and management for IPsec in preferred embodiments, other key exchange and management mechanisms are also possible.

The UCBG of the present invention may be implemented in any hardware including chassis based platforms. When tax base-based platforms are used, the taxi's blades are divided into clusters to function as control blades or data blades. Ceci provides high effectiveness so that active user sessions and statistics are not lost even in case of blade failure. There will be no single point of failure in UCBG.

General further background to assist in describing the variants and implementations is disclosed in the publications described below, all of which are incorporated herein by reference:

Sumit Kasera & Nishit Narang, 3G Mobile Networks (2005)

Theodore S. Rappaport, Wireless Communications Principles and Practice (2nd ed. 2002).

The detailed description set forth in this application should not be construed to mean that any particular element, step, or function is an essential component that should be included in the claims, and the scope of the patent subject matter is defined only by the claims that are issued. .

The claimed claims should be construed as broadly as possible, and the subject matter is not intentionally assigned, transferred or abandoned.

Claims (47)

Separating standard services from associated access technologies typically using an IP layer; And Causing the user equipment to access standard services independently of the access technology typically associated with the services. Typically includes a server that uses the IP layer to separate standard services from associated access technologies; User equipment is capable of accessing standard services regardless of the access technology typically associated with the services. A method of allowing a mobile device to communicate with other service nodes simultaneously, Using a single primary security association to simultaneously participate in multiple data flows with different traffic characteristics for different types of multiple services; And the mobile electronic device uses the single primary security association to manage the different types of multiple services. 4. The method of claim 3, wherein the multiple data flows are controlled by the single primary security association. 4. The method of claim 3, wherein the single primary security association is an Internet Key Exchange Security Association (IKE SA). 6. The method of claim 5 wherein the information about the services is transmitted using a configuration payload of the IKE SA. 6. The method of claim 5 wherein the service features are transmitted using a configuration payload of the IKE SA. 6. The method of claim 5 wherein username / password information of the client is securely transmitted to a service that requires the information using the configuration payload of the IKE SA. 4. The method of claim 3, wherein the multiple data flows are Internet Protocol Security Security Associations (IPSec SAs). 10. The method of claim 9, wherein the multiple data flows are distinguished using their respective security parameter index (SPI) values. Multiplexing multiple data flows with different features for different types of multiple services using a single encryption scheme; And Communicating the data flows between the mobile electronic device and the convergence gateway using respective secondary data paths under management of a single primary control path; And the mobile electronic device can simultaneously access services from different types of multiple services under management of the single primary control path. 12. The method of claim 11 wherein the multiple data flows are multiplexed using a single encryption scheme and the traffic characteristics of the data flows are not lost during multiplexing. 12. The method of claim 11, wherein the single primary control path is an Internet Key Exchange Security Association (IKE SA). The method of claim 11, wherein the data flows are Internet Protocol Security Security Associations (IPSec SAs). A mobile electronic device capable of simultaneously participating in multiple data flows with different traffic characteristics for different types of multiple services; And Includes multiplexing software; The multiplexing software, Generate the multiple data flows using a configuration of a single primary security association to distinguish the multiple data flows, Allow the mobile electronics to interface with a convergence gateway via a single primary security association; And the mobile electronic device can simultaneously access the different types of multiple services under control of the single primary security association. The communication system of claim 15, wherein the multiple data flows are controlled by the single primary security association. The communication system of claim 15, wherein the single primary security association is an Internet Key Exchange Security Association (IKE SA). 18. The communication system of claim 17, wherein the service information including the service features is transmitted using a configuration payload of the IKE SA. 18. The communication system of claim 17, wherein username / password information of a client is securely transmitted to a service that requires the information using a configuration payload of the IKE SA. The communication system of claim 15, wherein the multiple data flows are Internet Protocol Security Security Associations (IPSec SAs). 21. The communication system of claim 20, wherein the multiple data flows are distinguished using their respective security parameter index (SPI) values. 16. The communications system of claim 15 wherein the multiplexing software is executed on the mobile electronics. 16. The communication system of claim 15, wherein traffic characteristics of the multiple data flows are not lost during multiplexing. A system for communicating with a mobile client, Includes a single primary security association between the server and the mobile client; The server uses the payload of the single primary security association to multiplex traffic for two or more different types of services into two or more data flows; And the server simultaneously transmits services from two or more different types of service nodes to the mobile client under control of the single primary security association. 25. The communication system of claim 24, wherein the data flows are controlled by the single primary security association. 25. The communication system of claim 24, wherein the server multiplexes the traffic from two or more different types of service nodes using a single encryption scheme, and traffic characteristics of the data flows are not lost during the multiplexing. 25. The communication system of claim 24, wherein the server demultiplexes traffic associated with the two or more other types of services from the mobile client to route the traffic to appropriate service nodes. 25. The communication system of claim 24, wherein the server demultiplexes traffic associated with two or more different types of service nodes using Internet Protocol Security Security Parameter Index (IPSec, SPI) values. 25. The communication system of claim 24, wherein the single primary security association is an Internet Key Exchange Security Association (IKE SA). 30. The communication system of claim 29, wherein username / password information of a client is securely transmitted to a service that requires the information using a configuration payload of the IKE SA. 25. The communication system of claim 24, wherein the data flows are Internet Protocol Security Security Associations (IPSec SAs). A method of sending network services to a client, On mobile clients, Executing multiple applications that interface to different types of data flows, and Multiplexing and demultiplexing the data flows in multiple secondary security associations under control of a single primary security association; And On the gateway server, Multiplexing and demultiplexing different types of multiple data flows in multiple secondary security associations, and Routing the data flows to the appropriate service nodes; And the server simultaneously transmits services from the service nodes to the client regardless of the access technology used by the client to access the services. 33. The method of claim 32, wherein the gateway server multiplexes the data flow using a single encryption scheme and the traffic characteristics of the data flows are not lost during multiplexing. 33. The method of claim 32, wherein the server demultiplexes the data flows using Internet Protocol Security Security Parameter Index (IPSec SPI) values. 33. The method of claim 32, wherein the single primary security association is an Internet Key Exchange Security Association (IKE SA). 36. The method of claim 35, wherein username / password information of a client is securely transmitted to a service that requires the information using a configuration payload of the IKE SA. 33. The method of claim 32, wherein the data flows are Internet Protocol Security Security Associations (IPSec SAs). A method of transmitting network services, Managing a first data flow between the server and the user equipment to carry traffic of a first characteristic associated with the first service node; If there is traffic of a second characteristic associated with the first service node, managing a second data flow between the server and the user equipment to carry traffic of the second characteristic; And If there is traffic associated with the second service node, managing a third data flow between the server and the user equipment to carry traffic associated with the second service node; Respective services of the first and second service nodes are transmitted to the user equipment via the respective data flows under the control of a single security association between the user equipment and the server; Additional data flows between the server and the user equipment are generated as needed using the single security association. The method of claim 38, wherein the single security association is an Internet Key Exchange Security Association (IKE SA). 39. The method of claim 38, wherein the first, second and third data flows are Internet Protocol Security Security Associations (IPSec SAs). Security association between server and user equipment; A first data flow between the server and the user equipment, the first data flow being generated from a payload configuration of the security association and carrying traffic of a first feature associated with a first service node; A second data flow between the server and the user equipment when there is traffic of a second feature associated with the first service node, the second data flow being generated from the payload configuration of the security association and Carry traffic of a second feature; And A third data flow between the server and the user equipment in the presence of traffic associated with a second service node, wherein the third data flow is generated from the payload configuration of the security association and with the second service node. Carry associated traffic; An end user can access the services of the first and second service nodes simultaneously under the control of the security association; Additional data flows between the server and the user equipment are generated as needed using the security association. 42. The communications system of claim 41 wherein the first, second and third data flows are controlled by the security association. 42. The communications system of claim 41 wherein the server multiplexes the first, second and third data flows using a single encryption scheme, and wherein traffic characteristics of the data flows are not lost during multiplexing. 42. The communications system of claim 41 wherein the server demultiplexes data flows from the end user and sends the data flows to the appropriate service nodes. 45. The communication system of claim 44, wherein the server demultiplexes the data flows using Internet Protocol Security Security Parameter Index (IPSec SPI) values. 42. The communications system of claim 41 wherein the security association is an Internet Key Exchange Security Association (IKE SA). 42. The communication system of claim 41, wherein the data flows are Internet Protocol Security Security Associations (IPSec SAs).

Images