RU2575812C2 - Method and system for network access control - Google Patents

Abstract

FIELD: physics, computer engineering.

SUBSTANCE: invention relates to a device, which may include a transceiver and a processor circuit connected to the transceiver. The device may also include a local packet data network access unit operable on the processor circuit to schedule for transmission from the transceiver to a mobility management entity (MME) a request from user equipment (UE) for access to a local network, to generate a request for authentication to be sent to the UE, and to receive authentication data sent in response to the request for authentication, which improves access control at the server side to ensure robust, consistent and secure implementation.

EFFECT: ensuring robust, consistent and secure operation.

26 cl, 16 dwg

Description

State of the art

Standards are being developed to adapt wireless communications to heterogeneous networks. Often, a user of a radio equipment device connected to a public land mobile network (PLMN) may wish to connect to a local home or work network, whether it is in the vicinity of the home network or in a place remote from the home network. To make it easier for the owner of user equipment (software) to access the local network, the Third Generation Partnership Project (3GPP) defined the main functionality of access to the local network in the long-term development standard (LTE) of the PTP, called Access to the local Internet protocol ( IP) (IP) (DLIP) (LIPA) (see Release 11 of Technical Specification 22.220 v 11.2.0; Group Service and System Aspects of Technical Specification; Performance Requirements for Home Node B (OIL) (HNB) and Home Enhanced Node B (DRUV) (HeNB ); September 2011), hereinafter referred to as DLIP. In particular, DLIP means the ability of a mobile station (or “subscriber equipment” (AO)) to access a local housing / corporate network (also referred to herein as a local network or home network) that is connected to one or more localized base stations, designated as home extended nodes B or D (P) HC. DLIP allows AOs to connect to devices on a local network, such as printers, camcorders, or a local web server.

In addition to using DLIP, the network operator managing the macro network can, for example, provide access to the user's local femtocell network as a paid user service. Access to the user's local network in a situation when the AO is in the macro network coverage area is described in DLIP, TS 22.220, section 5.8, under the name “Managed Remote Access to the Home Network” (URA) (MRA). From the point of view of the user, DLIP and UUD describe the same service, namely access to the local network, the difference between them being whether the AO is in the coverage area of the macro network base station (or extended node B (RUV)) or under control Femtocell base station (D (P) HC).

However, users can strongly resist the use of the DRC provided by the ATC, as it actually transfers control of access control of their home or corporate network to a third party. Consequently, the implementation of the DRC with the ECM may require improved server-side access control to ensure a stable, ongoing, and secure implementation. In the light of these and other considerations, real improvements are needed.

Brief Description of the Drawings

1 shows a system according to various embodiments of the invention.

Figure 2 shows another scenario for using the system of figure 1.

3 illustrates the details of an embodiment of a home base station.

4 illustrates the details of a packet access module for a local area network according to various embodiments.

5 illustrates exemplary operations for establishing a connection to a home network in accordance with various embodiments.

6 illustrates exemplary signaling operations for identification in a home network in accordance with further embodiments.

7 illustrates exemplary signaling operations for identification in a home network in accordance with other embodiments.

FIG. 8 illustrates exemplary signaling operations for identification in a home network in accordance with other embodiments.

FIG. 9 illustrates exemplary signaling operations for identification in a home network in accordance with further embodiments.

10 illustrates exemplary signaling operations for identification in a home network during an initial connection procedure, according to various embodiments.

11 illustrates exemplary signaling operations for identification in a home network according to other embodiments.

12 illustrates exemplary signaling operations for identification in a home network during initial connection activities, in accordance with further embodiments.

13 illustrates an example flowchart of an algorithm.

Fig. 14 illustrates a flowchart corresponding to further embodiments.

15 is a diagram of an example embodiment of a system.

16 illustrates an embodiment of an exemplary computer architecture.

Detailed description

Some embodiments of a communication system can be implemented using radio technology, such as 3GPP LTE-A, including, in particular, the 3GPP LTE-A LIPA standard (TS 22.220). Advanced DR (DR-U) (LTE-A) is a development of DR PPTP (3GPP LTE).

Various embodiments relate to providing authentication implemented in a D (P) HC to provide access control to the ECM. As used herein, the terms “home network” and “local area network” may refer to a residential (corporate) IP network of a packet data network, which may also include a home base station (D (P) HC) to provide wireless access to the home network . As used herein, the term “femtocell” may generally refer to a radio network that is part of an operator’s network served by a D (P) HC. For this reason, D (P) HC can form a node in the femtocell to connect the home network to the operator’s network (also designated here as the “public land mobile network” or NSMOSOP, unless otherwise specified). With this in mind, it should be noted that in a given operator’s network, a femtocell may not always be in the coverage area of a RUB or a macrocell. In various embodiments, the implementation of the femtocell connected to the home network can operate in a closed subscriber group (CSA) mode, in which the resources of the femtocell are allowed to use a limited number of participants in the CSA. This ZGA mode is often used when using femtocells located in a private enterprise or in a residential building.

In accordance with various embodiments, identification procedures may be performed providing the AO connected to the macro network with the ability to also connect to the home network. In some embodiments, identification for the home network may occur during the AO connection process, while in other embodiments, identification may occur by requesting the ability to connect to the packet data network (PDD) (PND) from the AO. Some embodiments may provide identification based on a shared secret, such as a password, while other embodiments may be based on an access list or similar procedure.

In various embodiments that involve password management, the DRC host can configure a password, a username / password combination, certificate or authentication, authorization and accounting protocol (IAU) in the DRC (network node) responsible for identification and (or) distribution of identification data to all relevant nodes. As used herein, the term “DRC leading party” refers, for example, to the party responsible for the overall operation of the home network, the party that may be in contractual relationship with the network operator, the party responsible for paying bills, the main user of the home network in the house, or IT-manager of the enterprise, when it comes to the corporate network.

Subsequently, during the initial connection procedure or during the procedure for connecting to the PSPD requested by the AO, if additional authentication is introduced to access the home network, the AO can start an identification sequence that allows the AO to connect to the home network. For example, an authentication may automatically initiate a recovery of a stored password, or an AO may provide a user interface that requests authentication. In the latter example, the local PSPD access unit 304 may include in the request message instructions to manually request from the user AO 102 data for identification. On AO 102, this request may look like a dialog asking for registration data, which are then used to complete the signaling procedures that connect the AO to the local network.

FIG. 1 illustrates one system 100 for accessing multiple networks in accordance with various embodiments. The system 100 includes subscriber equipment 102 (AO), a home network 104, a basic network NSMSOP and home RUB (D (P) HC) 108. In the present embodiments, the user AO 102 may also be the party leading the home network 104, and , in addition, the subscriber to the core network 106 NSMSOP. In the scenario illustrated in FIG. 1, when the AO 102 is remote from the location of the home network 108, the user, however, may wish to access the home network 104 to perform tasks such as controlling the operation of local devices 104a, 104b of the home network 104 or access to data stored on local devices 104a, 104b. AO 102 can be registered and connected to the core network 106 NSMOSOP so that there is an active connection to the PDP. In order to provide controlled remote access to connect to the home network 104, the AO 102 may perform procedures for providing access to the home network 104 through the operator’s core network 106. For example, AO 102 can initiate the requested AO procedure for the ability to connect to the PSPD through the NSMSSOP core network 108, which allows the AO 102 to connect to the home network 108. In various embodiments, as described in detail below, the DRU 108 can use the local PSPD access unit 110 to the implementation of procedures that ensure identification during the requested AO PSPD procedure. Additionally, the AO 102 may also include a local PSPD access unit 112 for performing identification assisting processes during the requested PSPD procedure.

Figure 2, corresponding to additional embodiments, illustrates another scenario for using the system 100 in which AO 102 can be used at the location of home network 104. In this case, AO 102 can also initiate the requested AO connectivity to a packet data network allowing AO 102 to connect to the home network 104. In the scenarios of FIGS. 1 and 2, the user of AO 102 can perform a similar set of actions, described in detail below, to connect to the home network 104.

FIG. 3 illustrates the details of an embodiment of an ARD 108. The ARD 108 may include a processing circuitry 302, a local DRC access block 304, an external DRC access block 306, and a wired interface 308. In various embodiments, the external DRC access block 306 may provide standard procedures for establishing and maintaining access to an external packet data network that is not part of the local PSPD. Such an external packet data network may include, for example, the Internet or a proprietary data network. The local PSPD access unit 304 may provide additional procedures for providing connectivity to a local network, such as a home network, to which the user of AO 102 can be admitted. A wired interface 308 can be used to connect the ARD 108 to a local network, such as a home or corporate network, via wired communication.

Block 304 access to the local PSPD may, for example, to schedule the transfer from the AO 310 to the UMC (mobility management node) received from the AO request for access to the local network. The local PSPD access unit 304 may also generate an identification request for sending to the AO. Such a request can be generated by the UUM in response to a request for access to the local network. The local PSPD access unit 304 may also receive identification data sent in response to an identification request. This identification data can be used to complete the process of connecting the requesting AO to the local network.

FIG. 4 illustrates the details of a local PSPD access unit 304 in accordance with various embodiments. In various embodiments, the local PSPD access unit 304 may, for example, provide UMF data that can then be used to complete the process of connecting to a home network. In some embodiments, the local PSPD access unit 304 may include a password identification unit 402 for use when connecting to a home network by password verification or an access list unit 404 for use when connecting to a home network based on AO identifier 102. In some embodiments, the local PSPD access unit 304 may include both a password identification unit 402 and an access list unit 404, as shown in FIG. In accordance with various embodiments, each of these blocks 402, 404 can be used to perform a secure DLIP process or an ACD process in which the AO 102 connects to a home network that can operate under limited access conditions, such as a ZGA mode.

5 illustrates exemplary operations for establishing a connection to a home network through an AMD / DLIP operation using password authentication. As shown, in the first operation 504, the user can set the authentication procedure and / or password procedure in the DRC 108 of the home network. As noted above, such a process may involve configuring a username / password combination or some other identification, such as an IAU. Although only one ARD 108 is shown in FIG. 5, in some embodiments, the user may, but is not required to, configure multiple ARDS in home or corporate networks containing more than one ARD. This can be achieved, for example, by manually configuring multiple ARDSs or by configuring a special node in the home network that can be responsible for identifying and / or distributing the identification to all relevant nodes. In various embodiments, a web interface or other suitable means may be used to configure the desired (s) AEC node (s) with identification data. Additionally, if necessary, multiple username / password pairs can be configured.

In the next operation 506, the user can save the password (identification data) on the AO 102. The password (identification data) can be correlated with the password data configured in the ARD 108 in operation 504. Therefore, the AO 102 can save the data set that should be used when requesting identification to access your home network. In operation 508, a request for access to a local network is sent from AO 102 to UMM 502 of the NSMSP (public land mobile network). As described in detail below, such a request can be sent together with the connection process when AO 102 can establish a connection with UMCS 502 NSMSOP, or in conjunction with a request for connectivity to the PSPD when AO is already connected with UUM 502 NSMOSOP.

When UMM 502 NSMOSOP receives a request for access to a local network, UMM 502 NSMOSOP can perform actions to provide access to a local network. For example, as shown in operation 510 of FIG. 5, the UMTS 502 of the NSMOPS can issue a message to the local network to initiate procedures for connecting the AO 102 to the local network, including the DRC 108.

Upon receiving a message initiating the procedures for connecting the AO 102 to the local network, the DRU 108 can initiate an identification procedure to complete the process of providing the AO 102 the requested access to the home network of the DRU 108. For example, the DRU can load a password or other data from its memory (not shown) identifications associated with AO 102. As shown in FIG. 5, in operation 512, the DRC can send a wireless message to AO 102, requesting data related to a downloaded password or other identification based on procedures established in era tio 504, 506.

In operation 514, the AO 102, if it has been properly configured and received the correct data, may issue an identification message to the DRU 108 including data allowing the ADD to recognize that the AO 102 is configured with the correct password or other identification. If the data obtained as a result of operation 514 is recognized to be correct, DRU 108 may then initiate further procedures to complete the establishment of a connection with AO 102.

In other embodiments, the process of establishing a connection to a home network using a DLIP or UDD may involve modifying existing procedures as defined in Technical Specification 23.401 v 10.5.0; Third Generation Partnership Project; Group services and system aspects of technical specifications; Extensions of the General Packet Radio Broadcasting System (GPRS) for access to the Next Generation Universal Terrestrial Radio Access Network (USTD-PP) (E-UTRAN); September 2011

6 illustrates exemplary signaling operations for identification in a home network in accordance with further embodiments. The set of operations shown in FIG. 6 is a modification of the operations defined in § 5.10.2 of TC 23.401, which describes a request for the possibility of connecting a packet data network. The terms “operations” and “signaling operations” as used herein may refer to the performance of tasks defined by messages or other signals and / or the act of sending messages or other signals between different nodes, as shown in the drawings. In particular, the operations shown in FIG. 6 illustrate a scenario in which an AO can establish a connection to the PDP to the home network through what is defined in § 5.10.2 as the “requested by the AO to connect the PDP”. In order to ensure the safe access of the AO to the home network in various embodiments of the procedure according to § 5.10.2 TS 23.401, the PPTPs have been changed in order to identify the user of the AO requesting access in the home network. In the example of FIG. 6, the operations in bold are modified or supplemented procedures based on standard procedures in accordance with § 5.10.2.

In particular, the embodiment of FIG. 6 provides for identification between the ARD and the AO during a message exchange reconfiguration of the OAI connection (radio resource control). Thus, as a rule, operations 1-7 and 10-16 of FIG. 6 can be performed as defined in § 5.10.2, while operation 8. reconfiguration of the OAI connection and operation 9. reconfiguration of the OAI connection is completed modified or supplemented. Thus, at the time of sending the message, reconfiguration of the OAI connection with the DRV to AO DRV may request identification using a password or a combination of user password, or other similar combination of data sent by AO to determine whether to give AO access to the home network. Further, at the time of sending the message, reconfiguration of the URS connection is completed. The AO can issue identification data to the DRC. In embodiments based on the use of a shared password, the credentials issued by the AO do not necessarily contain the shared password itself, but may contain data indicating that the AO has a shared password. Accordingly, the process illustrated by the operations of FIG. 6 allows the ALE to provide an AO, which may be located away from the home network, convenient access to the home network through an established set of procedures, while limiting access to the home network for security by request password identification.

In other embodiments, when the AO performs an initial connection procedure to connect to the PSPD, the transmission of the connection signal of the CRM can be modified to allow the identification of the AO in the home network.

7 illustrates an example signaling for identification in a home network in accordance with other embodiments. The set of operations shown in Fig. 7 is a modification of the operations defined in § 5.3.2.1 TS 23.401 PPTP, which describes the initial connection of USTD-PP. In order to ensure that the home network is accessible to the AO during the initial connection procedure, the operations defined in § 5.3.2.1 of the TS 23.401 PPTP are changed to request identification before the requesting AO is allowed to connect to the home network. As in the case of FIG. 6, in FIG. 7, the operations in bold are modified or supplemented procedures with respect to standard procedures according to § 5.3.2.1.

In particular, the embodiment of FIG. 7 provides for the identification between the ARD and the AO during the reconfiguration of the OAI connection, which may occur in operations 18 and 19. Thus, as a rule, operations 1-17 and 20-26 of FIG. 7 can be performed as defined in § 5.3.2.1, while operations 19. reconfiguration of the OAI connection and operation 9. reconfiguration of the OAI connection are completed, modified or supplemented. As shown in FIG. 7, while sending the message “reconfiguring the OAI connection” from the ADR to the AO, the DRC can request a password or other identification from the AO to determine if the AO is allowed access to the home network. Further, at the time of sending the message “reconfiguration of the OAI connection is completed”, the AO may issue the IDC identification data.

For the procedure described above, illustrated in general terms in FIGS. 6 and 7, during an ODR connection reconfiguration operation, when the DRC requests a password identification, the AO, having received a password identification request, can load the requested data in various ways. For example, in some embodiments, the AO may display a message asking for a password to be entered into the AO via the user interface. For example, a request to a user to enter a password may be in the form of a dialog box displayed on the display, or the request may be audible. In other embodiments, the AO, upon receipt of a password request, can automatically read the password stored in the AO, for example, in a configuration memory, so that identification can take place automatically without user intervention. It should be noted that, according to various embodiments, various combinations of identification data may be requested and provided. In the case of identification at the enterprise based on IAU according to these embodiments, methods of identification are possible both by username and password, and based on certificates.

In further embodiments providing password authentication for an AO gaining access to the home network, at least some of the identification procedures may be conducted between the requesting AO and the UM. In such embodiments, a set of procedures and / or password identification data may be configured in the UM by the leading party of the home network. Once the UMM is configured using the proper identification procedure (s), the requesting AO can be identified by the UMM during the procedure, such as requesting connectivity.

FIG. 8 illustrates exemplary signaling operations for identification in a home network, corresponding to further embodiments, using identification facilitated by UM. As in the case of FIG. 6, the set of operations shown in FIG. 8 is a modification of the operations defined in § 5.10.2 TS 23.401 PPTP. In the example of FIG. 8, operations in bold also represent modified or supplemented procedures with respect to standard procedures according to § 5.10.2. As in the case of the identification procedure, which is carried out by means of the DRC, illustrated in general terms in FIG. 6, the procedures according to the embodiment of FIG. 8 also include modification or addition of the following operations: 8. “Reconfiguration of the OAI connection” and 9. “Reconfiguration URS connections completed. ” However, since UMF is involved in the identification procedure, these additional messages can also be modified: 7. “Request for data transfer settings / Confirmation of connectivity with PSPD” and 10. “Response to request for data transfer settings” can also be modified to include password data as shown. The last two messages pass between the ASM and the DRU and are used to transmit identification data between the ASM and the AO, which is communicatively connected with the DRU, with the help of messages the reconfiguration of the OAI connection and 9. the reconfiguration of the OAI connection is completed. Thus, the message “Request for setting up data transfer / Confirmation of the possibility of connecting to the PSPD” can be modified or supplemented so as to transmit a password request. Similarly, the message "Response to the request for transferring data settings" can be modified or supplemented so as to transmit a response to the request for the password, which is sent by the DRC from the data transmitted by the AO in the message "Reconfiguration of the ODS connection completed."

In further embodiments, in which the AO is identified in the home network during the request for connection to the PSPD procedure, identification may occur during initial operations. For example, returning to Fig. 8, we note that identification can occur or be initiated between operation 1. Request for connectivity to the PDPD, which is sent to the UMM, and operation 2. Create a communication session request. The identification process may occur in parallel with operations 2-6. In some embodiments, new SSR and S1 messages (messages between the ADR and the core network) may be added to support the identification process.

FIG. 9 illustrates exemplary signaling operations for identification in a home network in accordance with further embodiments. As in the case of FIGS. 6 and 8, the set of operations shown in FIG. 9 is a modification of the operations defined by § 5.10.2 TS 23.401 PPTP. In the example of FIG. 9, operations in bold also represent modified or supplemented procedures with respect to standard procedures according to § 5.10.2. In this case, a set of identification operations is added after operation 1. Request for connectivity to the PSPD. Operation 1a. The identification request in the PSPD is performed by the UUM, which sends a request to the JSC. In the example shown, the AO can respond using operation 1b. The PSPD response, which can be sent to the DRUV in cases where the DRUV requests authentication to access its network.

10 illustrates exemplary signaling operations for identification in a home network during an initial connection procedure in accordance with other embodiments. In the example of FIG. 10, the depicted operations also illustrate modified or supplemented procedures with respect to standard procedures in accordance with § 5.3.2.1 of TC 23.401 PPTP. In this case, a set of identification operations is added after operation 2. Attach the request. Operation 2a. The identification request in the PSPD is performed by the UUM, which sends a request to the JSC. In the example shown, the AO can respond using operation 1b. The PSPD response, which can be sent to the UMM in cases where the UMM is configured to identify the requesting AO in its network. It should be noted that in some embodiments, other messages S1 and OAI may be added to provide identification after operation 2. In addition, in further embodiments, identification may occur between the AO and the DRC in cases where the DRC is configured using identification data (procedures).

In other embodiments of the identification in the home network using the password, the DRC can initiate the identification by receiving a request for connectivity to the PSPD (i.e., sending the received request for connectivity to the PSPD to the UMF). In such embodiments, new S1 messages may not be needed, and only new URM messages may be required for identification.

In other embodiments, instead of applying password-based procedures, access control to the home network may include an access list containing data related to devices that are allowed access to the home network. The access list may be based on a suitable AO identifier, such as the International Mobile Subscriber Identity Identification (MIMA) (IMSI) that each AO is equipped with. In one embodiment, the DRC host can configure using the web interface or other suitable node a MIMA list that is allowed to connect to the home network. In some embodiments, such a list may constitute a closed subscriber group.

However, since the DRU, as a rule, cannot recognize the MIMA of the AO device requesting the ability to connect to the PSPD, therefore, the DRU may not be able to perform access control based on the MIMA of the requesting AO device. Accordingly, according to various embodiments, when the AO transmits a request for connectivity to the PSPD, the DRU may receive a command to download the MIMA list corresponding to devices that are allowed to be identified in the home network, and may forward this list to the UM for identification. In some embodiments, the MIMA approved list may be submitted to the UMMA in message S1, which includes a request message to connect to the PSPD SSD (Network Access Service, NAS) (either SI message of the initial AO or message S1 on the uplink of the SSD transport protocol ) Upon receipt of the message, the UUM can verify the received list of approved MIMA with MIMA requesting AOs, which the UUM can determine during normal signal transmission procedures.

11 illustrates an example signaling for identification in a home network, corresponding to further embodiments using access list-based identification. As in the case of FIG. 6, the set of operations shown in FIG. 11 is a modification of the operations defined in § 5.10.2 TS 23.401 PPTP. In the example of FIG. 8, operations in bold are modified or supplemented operations relative to standard procedures in accordance with § 5.10.2. In the example shown, step 1. A request for connectivity to the PSPD can be received by the DRC. The operation “Request for connectivity to the PSPD” may notify the ARD that the device whose identification information may be unknown (at least for the ARD) is trying to access the home network of the ARD. Accordingly, DRUV can download the list of MIMA devices authorized to access the home network, and can enclose this list in a message sent in operation 1a, “Request connectivity to the PSPD with the MIMA list”, as shown further in FIG. 11.

When the UMC receives a message containing a list of approved MIMA, the UMM can take different actions. If MIMA AO requesting connectivity is not included in the list of approved MIMA, UUM may respond to the message "Request connectivity to the PSPD with the MIMA list" with the message "Connectivity to the PSPD is denied" (not shown in Fig. 11). However, if the MIMA of the requesting AO is present in the list of approved MIMA, the UMM may, in response to ((Request the possibility of connecting to the PSPD, ”start the execution of the following operations 2-6 in Fig. 11 to complete the process of access of the requesting AO to the home network.

In further embodiments, when a connectivity to a home network is requested as part of an initial connection request, identification in the home network can be scheduled during operations such as the “Connection Request” and “Initial Context Setting / Connection Acceptance Request” exchanges, as shown on Fig. In particular, FIG. 12 illustrates exemplary signaling operations for identification in a home network during initial connection request operations based on admission list management. The set of operations shown in Fig. 12 is a modification of the operations defined in § 5.3.2.1 TS 23.401 PPTP, and, as with the previous drawings, the operations in bold are modified or supplemented procedures relative to standard procedures for §5.3.2.1.

As suggested by FIG. 12, during the initial operation 1. A “connection request” when the AO sends a message to the ARD, the receipt of the “connection request” message notifies the ARD that the device whose identification information may not be known (at least for the ARD) trying to access DROV home network. Accordingly, DRUV can download the list of MIMA devices authorized to access the home network, and can enclose this list in a message sent in operation 2. “Connection request with the MIMA list”, which is a modification of the standard message “Connection request”.

If the MIMA of the requesting AO is not included in the list of permitted MIMA, the UUM can respond to the "Connection request with the MIMA list" using the message "Connection request is denied" (not shown in Fig. 12). However, if the MIMA of the requesting AO is present in the list of permitted MIMA, the UMA may, in response to the connection request, start the execution of subsequent operations 3-26 of FIG. 12 to complete the process of access of the requesting AO to the home network. The operations “Request to set the initial context / Connection accepted” and “Reconfiguration of the OCR connectivity” can also be modified, as shown.

In further embodiments, the valid MIMA list may be preconfigured by the user in the UMM PSPD of the user, and not in the DRC of the home network. When a connection request or a request for connectivity is initiated by AO, standard operations can still be changed, for example, such as shown in Figs. 11 and 12, with the exception that during the connection process, the admission list data cannot be transmitted from the DRC , since this data is constantly stored at UUM.

As noted above, home networks with multiple nodes can be configured so that identification occurs in more than one node. In some embodiments, where the home network includes multiple ARDs and multiple local gateways (LNs), it may not be practical or impossible for the user to configure authentication separately for each ARD. According to the present embodiments, the execution of this scenario can be approached in various ways. In one embodiment, the identification can be configured on the first ARD, and the first ARD further extends this identification to the other ARDs of the home network. In this case, the responsibility for the subsequent identification of the requesting AO may lie with the DRC.

In other embodiments, the authentication may be configured in the MIA, wherein the configuration may occur through any ADR of the home network that initially receives the identity from the user and then passes the identity to the MMA. In these latter embodiments, the UMM may be responsible for identifying the requesting AO so that the requesting AO can be identified on any of the home network DRCs.

This includes a set of flowcharts of algorithms, which are exemplary principles for implementing innovative aspects of the disclosed system and architecture. While in order to simplify the explanation, one or more of the principles shown here, for example, in the form of a block diagram of an algorithm or a block diagram, are shown and described as a sequence of actions, it must be understood and taken into account that the principles are not limited by the order of actions, since some actions can be performed in a different order and (or) in parallel with other actions other than those shown and described here. For example, specialists in this field will understand and take into account that the principle can be represented differently - in the form of a series of interrelated states or events, for example, in the form of a state diagram. In addition, not all actions shown in principle may be required for a new implementation.

13 illustrates an example flowchart 1300 of an algorithm. At a block 1302, a LAN connection request received from an AO is forwarded to a mobility management node in a network, such as a public land mobile network. At block 1304, an identification request is sent to the AO in response to a connection request. An identification request may be sent after receiving a message from the UMM, such as a message with a request to configure data transfer. An identification request may be sent for output to a user interface, for example, an AO user interface. At block 1306, the requested identification data is received. At a block 1308, the AO connects to the local network.

14 illustrates another exemplary flowchart 1400. In block 1402, a “Request for connectivity to the PSPD” message is received from the AO, which is connected to the first packet data network. At a block 1404, a “Possibility of connecting to the PSPD” request message is sent via the UMD of the core network of the public land mobile network. At block 1406, a data transfer setup request message is received. At block 1408, it is determined whether identification is requested in the second packet data network. If not, the process proceeds to block 1410, where the message "reconfiguration of the OAI connection" is received. Then, the process proceeds to block 1412, where “reconfiguration of the OAI connection is complete” is issued. If authentication is requested, the process proceeds to block 1414. At block 1414, the message "reconfiguration of the OAI connection" is received, including a request for identification by password. At a block 1416, a “RRM Connection Reconfiguration Complete” message is issued along with the requested identification.

FIG. 15 is a diagram of an exemplary embodiment of a system, in particular, FIG. 15 is a diagram showing a platform 1500, which may include various elements. For example, FIG. 15 shows that the platform (system) 1510 may include a processor (graphics core) 1502, a chipset 1504 (a platform controller-concentrator (CCP)), an input / output device 1506, a random access memory (RAM) 1508 (such as dynamic RAM (ROM)) and read only memory (ROM) 1510, electronic display devices 1520, display backlight 1522 and various other platform components 1514 (e.g., fan, cross-flow fan, radiator, data transfer module system, system cooling eniya body, valves, and so on). System 1500 may also include a wireless communications chip 1516 and a graphics device 1518. Embodiments, however, are not limited to these elements.

As shown in FIG. 15, an input / output device 1506, RAM 1508, and ROM 1510 are connected to a processor 1502 using a chipset 1504. Chipset 1504 may be connected to processor 1502 via bus 1512. Accordingly, bus 1512 may include multiple lines.

The processor 1502 may be a central processing unit containing one or more processor cores, and may include any number of processors having any number of processor cores. The processor 1502 may include a processor unit of any type, such as, for example, a CPU, a multiprocessor unit, a computer with a reduced instruction set (RISC), a stream processing processor, a computer with a full command system (CPSD) (CISC) ), digital signal processor (DSP) (DSP), and so on. In some embodiments, the processor 1502 may be a plurality of individual processors located on separate integrated circuits. In some embodiments, processor 1502 may be an integrated graphics processor, while in other embodiments, processor 1502 may be a graphics core or cores.

FIG. 16 illustrates an embodiment of an example computing system (architecture) 1600 suitable for implementing the various embodiments described above. The terms “system”, “device” and “component” used in this application are intended to refer to a computer-related object, which is either hardware or a combination of hardware and software, or software, or executable software, examples of which are given in the approximate 1600 computer architecture. For example, a component can be, among other things, a process executable in a processor, a processor, a hard disk, and a plurality of drives (for optical and (or) magnetic media), an object, an executable program, a thread of execution, a program and (or) a computer. As an illustration, a component can be either an application executed by a server or a server. One or more components may be contained in the process and / or thread of execution, and the component may be localized on one computer and / or distributed between two or more computers. Further, the components can be communicatively connected to each other by means of communication of various types to coordinate actions. Coordination may involve unidirectional or bidirectional data exchange. For example, components can transmit data in the form of signals transmitted by communication. Data can be implemented as signals distributed over various signal lines. In such distributions, each message is a signal. Further embodiments, however, may use data messages. Such data messages may be sent over various connections. Exemplary connections include parallel interfaces, serial interfaces, and bus interfaces.

In one embodiment, computer architecture 1600 may comprise or be implemented as part of an electronic device. Examples of electronic devices may include, but are not limited to, a mobile device, a personal digital assistant, a mobile computer device, a smartphone, a cell phone, a portable telephone, a one-way pager, a transceiver pager, a message sending device, a computer, a personal computer (PC) (PC) , desktop computer, laptop, laptop, handheld computer, tablet computer, server, server array or server pool, web server, network server, Internet server, workstation, mini computer, computer control system computer, supercomputer, network access device, web device, distributed computing system, multiprocessor systems, processor-based systems, consumer electronics, programmable electronics, television, digital television, set-top box, radio access point, base station , subscriber station, mobile subscriber center, radio network controller, router, hub controller, gateway, bridge, switch, car, or a combination thereof. Embodiments are not limited in this context.

Computer architecture 1600 includes various typical computing elements, such as one or more processors, coprocessors, memory blocks, microchips, controllers, peripherals, interfaces, oscillators, clock devices, video cards, audio cards, multimedia input / output components, and so on. Embodiments, however, are not limited in implementation by the 1600 computer architecture.

As shown in FIG. 16, computer architecture 1600 includes a processor unit 1604, a system memory 1606, and a system bus 1608. The processor unit 1604 may be any of various commercially available processors. Dual microprocessors and other multiprocessor architectures may also be used as processor unit 1604. System bus 1608 provides an interface for system components, including, but not limited to, system memory 1606 to processor unit 1604. System bus 1608 may be any of a variety of bus designs, which can then be interconnected with a memory bus (with or without a memory controller), a peripheral bus, and a local bus using any of a variety of commercially available bus architectures.

Computer architecture 1600 may comprise or implement various finished products. The finished product may contain computer-readable storage media for storing various forms of programming logic. Examples of computer-readable storage media may include any tangible medium capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writable or rewritable memory, and so on. Examples of programming logic may include executable computer program instructions executed using any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, etc. P.

System memory 1606 may include computer-readable storage media of various types in the form of one or more high-speed memory devices, such as read-only memory (ROM), random access memory (RAM), dynamic RAM (RAM) (DRAM) ), DOUBLE-SPEED DOSE (DOSE) (DDRAM), synchronous DOSE (SDOZ) (SDRAM), static RAM (RAM) (SRAM), programmable ROM (EPROM) (PROM), erasable programmable ROM (EPROM) (EPROM), Electrically Erasable Programmable ROM (EEPROM) (EEPROM), flash memory, memory a device on a polymer, such as a memory on a ferroelectric polymer, memory on amorphous semiconductors, a memory on phase transitions or a ferroelectric memory, a memory based on silicon oxide nitride-silicon oxide (KONOK, SONOS), magnetic or optical cards, or any other type of carrier suitable for storing data. In the illustrated embodiment shown in FIG. 16, system memory 1606 may include non-volatile memory 1610 and / or non-volatile memory 1612. A basic input / output system (BSI) (BIOS) may be stored on non-volatile memory 1610.

Computer 1602 may include various types of computer-readable storage media in the form of one or more low-speed memory blocks, including an internal hard disk drive (HDD) 1614, a magnetic diskette drive (DMD) 1616 for reading from or writing to a removable magnetic disk 1618 and an optical drive 1620 for reading from or writing to a removable optical disk 1622 (e.g., a CD-ROM or DVD). The HDD 1614, DMD 1616 and the optical disk drive 1620 can be connected to the system bus 1608 using the 1624 HDD interface, the DMD interface 1624 and the optical disk drive interface 1626, respectively. The HDD interface 1624 for external drive implementations may include a universal serial bus (USB), IEEE 1294, or both, but at least one of these interface technologies.

Drives and related computer-readable media provide volatile and non-volatile storage of data, data structures, computer-executable instructions, and so on. For example, a number of program modules may be stored on disks in memory blocks 1610, 1612, including an operating system 1630, one or more application programs 1632, other program modules 1634, and program data 1636.

A user may enter commands and data into computer 1202 via one or more wired and wireless input devices, such as a keyboard 1638, and a positioning device such as a mouse 1640. Other input devices may include a microphone, an infrared (IR) remote controls, joystick, game pad, touch pen, touch pad or the like. These and other input devices are often connected to the processor unit 1604 via an input device interface 1642, which is connected to the system bus 1608, but can be connected via other interfaces, such as a parallel port, IEEE 1294 serial port, game port, USB port, IR interface and so on.

A monitor 1644 or other type of display device is also connected to the system bus 1608 via an interface, such as a video adapter 1646. In addition to the monitor 1644, the computer typically includes other peripheral output devices such as speakers, printers, and so on.

Computer 1602 may operate in a network environment using logical connections through wires and / or wireless communication with one or more remote computers, such as remote computer 1648. Remote computer 1648 may be a workstation, server computer, router, personal computer, laptop computer , an entertainment device on a microprocessor, a peer-to-peer device or other commonly used network node, and, as a rule, includes many or all of the elements described in ide with a computer 1602, although for the sake of brevity, only a storage device 1650 is shown. The logical connections shown include the possibility of a wired (wireless) connection to a local area network (LAN) 1652 and / or larger networks, for example, a global computer network ( WAN) (WAN) 1654. Similar network environments, including LANs and WANs, are ubiquitous in offices and enterprises and provide enterprise-wide computer networks, such as an intranet, and they can all be connected to a global communications network, such as the Internet .

When used in a LAN network environment, the computer 1602 is connected to the LAN 1652 through a wired and / or wireless communication network interface or adapter 1656. The adapter 1656 can provide wired and / or wireless communication with the LAN 1652, which may also include a wireless access point hosted to communicate with the wireless functionality of adapter 1656.

When used in a dhw network environment, computer 1602 can include a modem 1658 or connect to a dhw 1654 communication server, or have other means of communicating with a UDC 1654, for example, via the Internet. The modem 1658, which may be internal or external, as well as a wired and / or wireless device, is connected by a system bus 1608 via an input device interface 1642. In a networked environment, program modules depicted in connection with a computer 1602, or parts thereof, may be stored on a remote memory 1650. It will be appreciated that the network connections shown are exemplary and other means of establishing a communication channel between the computers may be used.

Computer 1602 is adapted to communicate with wired and wireless devices or nodes using the IEEE 802 family of standards, such as wireless devices that are functionally located in wireless communication (e.g., IEEE 802.11 over-the-air modulation methods), e.g., a printer, scanner, desktop, and ( or) a portable computer, a pocket computer (PDA), a communications satellite, any equipment or place to which a label is recognized that is recognized wirelessly (for example, a self-service terminal, newsstand, toilet), and a telephone. This includes at least wireless technologies such as Wi-Fi, WiMax and Bluetooth ™. Thus, communication can be a predetermined structure, as is the case with a standard network, or simply situational communication between at least two devices. Wi-Fi networks use radio technologies called IEEE 802.11x (a, b, g, n, etc.) to provide safe, reliable, fast communications. A Wi-Fi network can be used to connect computers to each other, to the Internet, and to wired networks (which use media and features related to IEEE 802.3).

Embodiments may also, at least in part, be implemented as instructions recorded on a long-term machine-readable medium that can be read and executed by one or more processors to enable the operations described herein to be performed.

Some embodiments may be described using the expression “one embodiment” or “an embodiment”, as well as derivatives thereof. These terms mean that a particular feature, structure, or characteristic described in connection with an embodiment is included in at least one embodiment. The expression “in one embodiment”, occurring at various places in the specification, does not necessarily refer to the same embodiment each time. Further, some embodiments may be described using the expression “coupled” or “connected,” as well as derivatives thereof. These terms are not necessarily used synonymously. For example, some embodiments may be described using the terms “connected” and / or “connected” to indicate that two or more elements are in direct physical contact with each other. The term “coupled,” however, may also mean that two or more elements are not in direct physical contact with each other, but still cooperate or interact with each other.

It is emphasized that the attached abstract allows the reader to quickly determine the essence of the technical disclosure. It is attached with the understanding that it will not be used to interpret or narrow the scope or meaning of the claims. In addition, in the foregoing detailed description, it can be seen that various features are grouped together in a single embodiment in order to simplify the disclosure. This disclosure method should not be interpreted as a reflection of the idea that the claimed embodiments require more features than are summarized in each claim. On the contrary, as reflected in the following claims, the subject matter lies in less than all the features of a single disclosed embodiment. Thus, the following claims are hereby incorporated into the Detailed Description, with each claim being independent as a separate embodiment. In the appended claims, the terms “comprising” and “in which” are used as colloquial equivalents of the respective terms “comprising” and “characterized in that”, respectively. In addition, the terms “first”, “second”, “third”, etc. are used only as designations and should not impose numerical requirements on the objects they define.

Described above includes examples of the disclosed architecture. Of course, it is impossible to describe all conceivable combinations of components and (or) principles, but the average person skilled in the art will be able to understand that many further combinations and combinations are possible. Accordingly, the new architecture should cover all such changes, modifications and variations that do not depart from the spirit and scope of the attached claims.

Claims (26)

1. A device comprising:
- transceiver;
- a processor circuit associated with a transceiver; and
- an access unit to a local packet data network operating on a processor circuit in order to:
- plan the transfer from the transceiver to the mobility management node (UUM) of a request from a user equipment (PO) for access to a local network;
- generate an identification request for sending to the joint-stock company; and
- receive identification data sent in response to an identification request. 2. The device according to claim 1, wherein the access request comprises a request for connectivity to a packet data network (PSPD) for transfer to a mobility management node of a public land mobile network. 3. The device according to claim 2, an access unit to a local packet data network operating on a processor circuit in order to:
- forward the identification request by password during the message reconfiguration of the radio resource control connection (ODR); and
- verify the identification data received in response to the message reconfiguring the OAI connection. 4. The device according to claim 3, an access unit to a local packet data network operating on a processor circuit, so that:
- plan the transmission of the received identification data by the transceiver to the UUM. 5. The device according to claim 1, containing an access unit to an external packet data network to maintain a connection to an external packet data network, while the connection to the local network is active. 6. The device according to claim 2, an access unit to a local packet data network operating on a processor circuit in order to:
- identify the password authentication request from the mobility management node; and
- forward the password authentication request in the data transfer settings request message. 7. The device according to claim 1, an access unit to a local packet data network operating on a processor circuit, so that:
- load a password from the device’s memory in response to an access request. 8. The device according to claim 1, wherein the access request contains a message for forwarding in the connection request to the UM. 9. The device according to claim 1, an access unit to a local packet data network operating on a processor circuit, so that:
- plan the transmission of the access request by the transceiver to the UUM;
- generate an identification request for connecting AO to the local network in response to an access request; and
- verify the identification data sent in response to the identification request. 10. The device according to claim 1, an access unit to a local packet data network operating on a processor circuit, so that:
- upload a list of international mobile subscriber identity (MIMA) devices that are allowed access to the local packet data network in response to an access request; and
- forward the list to UUM. 11. The device according to claim 10, wherein the access request comprises a request for connectivity to a packet data network (PSPD) for sending to a UUM. 12. The device according to claim 11, wherein the access request contains a message for forwarding in the connection request to the UM. 13. A system comprising:
- transceiver;
- processor circuit;
- an access unit to a local packet data network operating on a processor circuit in order to:
- plan the transfer from the transceiver to the mobility management node (UUM) of a request for access to the local network from user equipment (software);
- generate an identification request for sending to the joint-stock company; and
- receive identification data sent in response to an identification request; and
- a wired interface for connecting the system to the local network. 14. The system of claim 13, comprising an access unit to an external packet data network for maintaining a connection to an external packet data network, while the connection to the local network is active. 15. The system of claim 13, an access unit to a local packet data network operating on a processor circuit to download a password from a device memory in response to a request for access to a local network. 16. The system according to item 13, the access unit to the local packet data network operating on the processor circuit to develop instructions for displaying the identification request manually. 17. At least one computer-readable recording medium containing instructions that, when executed, cause the system to:
- plan to transmit to the mobility management node (UMM) a request for access to the local network received from user equipment (software);
- generate an identification request for sending to the joint-stock company; and
- receive identification data received in response to an identification request. 18. The machine-readable recording medium according to claim 17, containing instructions that, if executed, force the system:
- generate a password authentication request during the message reconfiguration of the radio resource control connection (ODR); and
- verify the identification data received in response to the message reconfiguring the OAI connection. 19. The computer-readable recording medium according to claim 17, containing instructions that, if executed, cause the system to schedule the transmission of identification data to the UM. 20. The computer-readable recording medium according to claim 17, containing instructions that, if executed, cause the system to maintain a connection to an external packet data network while the connection to the local network is active. 21. The machine-readable recording medium according to claim 17, containing instructions that, if executed, force the system:
- recognize the password request from the mobility management node; and
- plan to include a password authentication request in the data transfer setup request message. 22. The machine-readable recording medium according to claim 17, containing instructions that, if executed, cause the system to load a passport from the device’s memory in response to a request for access to the local network. 23. A method comprising the steps of:
- receive a request from the user equipment of the AO for access to the local packet data network;
- plan to transmit the access request to the mobility management node (UMM);
- send an identification request to AO; and
- receive identification data in response to an identification request. 24. The method according to item 23, containing the stages in which:
- send a password-based identification request during a radio resource management connection (RRM) reconfiguration message; and
- verify the identification data received in response to messages reconfiguring the connection OA. 25. The method according to item 23, containing the stage on which they plan to transfer to the PAF received identification data. 26. The method according to item 23, containing the stages in which:
- recognize the password request from the UUM; and
- plan to include a password authentication request in the data transfer setup request message.

Images