WO2001099334A1 - Method and apparatus for interfacing a network to an external element - Google Patents

Method and apparatus for interfacing a network to an external element Download PDF

Info

Publication number
WO2001099334A1
WO2001099334A1 PCT/US2001/014030 US0114030W WO0199334A1 WO 2001099334 A1 WO2001099334 A1 WO 2001099334A1 US 0114030 W US0114030 W US 0114030W WO 0199334 A1 WO0199334 A1 WO 0199334A1
Authority
WO
WIPO (PCT)
Prior art keywords
external element
communication network
external
access
network
Prior art date
Application number
PCT/US2001/014030
Other languages
French (fr)
Inventor
Robert Banks
Wesley Stuart Jones
Richard Malcolm
Original Assignee
Motorola, Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Motorola, Inc. filed Critical Motorola, Inc.
Priority to EP01930988A priority Critical patent/EP1303938A4/en
Publication of WO2001099334A1 publication Critical patent/WO2001099334A1/en

Links

Classifications

    • HELECTRICITY
    • H04ELECTRIC COMMUNICATION TECHNIQUE
    • H04LTRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00Network architectures or network communication protocols for network security
    • H04L63/10Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105Multiple levels of security

Definitions

  • the invention relates generally to communication networks, and more particularly, the invention relates to a method and apparatus for interfacing a communication network to an external element.
  • a communication network is typically designed to provide a vast array of functions and services to the users of the network.
  • new functions and features are conceived and developed that may enhance the communication network. Some of these new functions may lie outside the architecture of the existing communication network. Adaptation of these new functions to the communication network may require costly redesign and implementation of the communication network.
  • the communication network may be designed with a proprietary architecture and data structure that limits an ability to directly integrate these newly developed functions.
  • Feature extraction refers to the adaptability of the network to new services, features and functions that may be developed by virtually anyone including service providers, system operators, third party vendors and end- users.
  • FIG. 1 is a block diagram illustration of a communication network coupled to an external element by an apparatus in accordance with a preferred embodiment of the present invention.
  • FIG. 2 is a functional block diagram illustrating the interface of an external element to a communication network in accordance with a preferred embodiment of the present invention.
  • FIG. 3 is- a functional block diagram illustration of a services delivery element in accordance with a preferred embodiment of the invention.
  • FIG. 4 is a functional block diagram of a services delivery element in accordance with one of the preferred embodiments of the invention illustrating further functionality of the services delivery element.
  • FIG. 5 is a functional block diagram illustrating services invocation between a communication network and an external element in accordance with one of the preferred embodiments of the present invention.
  • FIG. 6 is a block diagram illustration of a communication network coupled to an external element by an apparatus in accordance with a preferred embodiment of the present invention.
  • a services delivery element forms an interface or operates as an interface device between an external element (such as an external end user's network feature server) and a communication network including both a core network and at least one access network.
  • the services delivery element provides access to the core network, access networks and subscriber devices within or connected to the access networks to which the external element is interfaced.
  • the services delivery element acts as a security proxy and a secure link point between the external element and the core network.
  • the services delivery element may also provide managed access by the external element to core network and access network resources.
  • the services delivery element may also recognize or identify trusted external elements; identify preferential external elements; provide secure access to subscriber data retained within the core network; identify and deny access by untrusted external elements; translate between the external element and the core network; and provide limited access to particular subsets of core network data and/or functions by the external element.
  • a core network 10 is interfaced to an access network 12.
  • the core network 10 may be a packet based communication network adapted to provide voice and data communication services via the access network 12, which may be a radio access network.
  • a radio access network provides wireless voice and data communication services to a mobile unit, such as the mobile unit 14, and may do so in accordance with virtually any wireless communication protocol.
  • the invention provides an interface for external elements to both the core network 10, the access network 12, and the mobile unit 14. To simplify the following discussion of the preferred embodiments of the invention, reference is made only to the core network 10.
  • API application program interfaces
  • FIG. 2 within the core network 10 is a variety of application program interfaces (API) 18, which interface services and functional components within the core network 10.
  • API 19 and API 20 are considered to be internal APIs, and as such have "trusted" status within the core network 10. That is, these APIs have access to the core network 10 without having to first authenticate and establish a secure interface with the core network.
  • external APIs 22 such as applications API 23 and services API 24. While only two external APIs 23 and 24 are shown, it should be understood that numerous external APIs might be provided.
  • External APIs 22 are considered “untrusted” APIs and do not have the same, direct access to the core network 10 as the trusted, internal APIs 18.
  • APIs 18 may be considered the "glue" of core network 10, which enable the features and services in the core network 10.
  • the internal APIs support the configuration of the communication between the network entities (not shown) within the core network 10.
  • the external APIs 22 are accessible to and configurable by third parties, e.g., services providers and, where appropriate, end users.
  • third parties e.g., services providers and, where appropriate, end users.
  • APIs 22 are the feature extraction pieces that enable third party developers to access and add features and services to the network.
  • the external APIs 22 interface with the internal APIs 18 to configure, communicate with and control the network to provide extensibility to the core network 10.
  • the external APIs 22 and internal APIs 18 are linked together via a services delivery element 26.
  • the services delivery element 26 segregates the sets of APIs, and has a primary purpose to provide security for the internal APIs from untrusted resources.
  • These services such as the Call Processing Language from the IPTEL working group of the Internet Engineering Task Force (IETF) or some features of the Wireless Application Protocol(WAP), enable end users to load executable code into the network. These services cannot be trusted and should not be granted direct access to the core network 10.
  • the internal APIs 18 are the system interfaces which enable features and services in the core network 10.
  • the internal APIs 18 address the configuration of and communication between the network entities inside both the core and access networks 10 and 12. These interfaces will not be directly accessible external to the core network 10.
  • FIG. 3 illustrates a functional architecture for the services delivery element 26 in accordance with a preferred embodiment of the invention.
  • the services delivery element 26 may include both a security services element 302 and a translation/API modules element 304.
  • FIG. 3 represents the functional elements of the services delivery element 26, and that in an actual physical embodiment of the services delivery element 26, these functional elements may reside in one or more components of the core network 10.
  • the security services element 302 provides authentication and validation services to potential service and feature providers of the network.
  • access to the core network 10 by external elements i.e., external APIs 22, are via a secure connection across a virtual private network (NPN) connection.
  • NPN virtual private network
  • the security services element 302 adds a wrapper on top of the internal API that will enable the external feature or service. This arrangement allows the external feature or service to have scalable access to the internal API 18, but through a secure technique. Access to the internal API 18 by the external elements ranges from no access to partial access to full access based on a variety of security variables.
  • variables include user based privileges (e.g., service options based on subscription information) and network variables (e.g., based on network usage and load). More generally speaking, the services delivery element 26 enables a layering of restrictions providing greater or lesser authorization to the external element based upon virtually any set of criteria, including without limitations those set forth above.
  • connection security between the external API 22 and the internal API 18 may be provided using the IP security protocol (IPSec) from the Internet Engineering Task Force (IETF).
  • IPSec IP security protocol
  • IETF Internet Engineering Task Force
  • ESP encapsulation payload
  • AH authentication header
  • the security delivery element 26 will provide access control, connectionless integrity, data origin authentication, rejection of replayed packets, and confidentiality services. These services will be available for both TCP and UDP streams.
  • the services delivery element 26 may be configured to communicate in
  • LPSec tunnel mode In this mode of operation, both the external API 22 and the internal API 18 will authenticate and encrypt the entire IP source packet and wrap a new IP header around them.
  • ESP in tunnel mode encrypts and optionally authenticates the entire inner IP packet, including the inner IP header.
  • AH in tunnel mode authenticates the entire inner IP packet and selected portions of the outer IP header.
  • the services delivery element 26/ external API 22 IPSec transmissions will be in tunnel mode, all of the hosts inside the core network 10 will communicate with the external API 22 without implementing IPSec.
  • the unprotected packets generated by core network elements are tunneled through the services delivery element 26 by tunnel security associations.
  • the internal APIs 18 may interact with the services delivery element 26 via the embedded security layer on the services delivery element 26. This level of security is implemented to authenticate and validate each particular external API 22.
  • the services delivery element 26 may be configured to recognize particular external APIs 22.
  • one third party vendor may have more access to the core network 10 than others. Such recognition may be based upon being a known services provider, type of service, or other criteria. Establishing such other criteria will be easily recognized by one having ordinary skill in the art.
  • the services API 24 will interact with the services delivery element 26 via the embedded Security Layer on the security delivery element 26. This level of security is implemented to authenticate and validate each particular external element, and provide an explicit security layer between the external elements and the core network 10.
  • External elements accessing the system via the External APIs 22 may be statically or dynamically associated with the core network 10.
  • the operator may configure the core network 10 so that the external API 22 associated with the external service remains statically connected to the core network 10 via this security technique at system initialization.
  • the core network 10 interrogates the external element.
  • the associated external API 22 registers with the service delivery element 26, and the services delivery element 26 will authenticate the external element and grant the particular external API 22 access privileges based on this authentication.
  • the external element becomes a trusted element by obtaining the security information. This implies that an additional layer of software must be considered in addition to the external API 22 or that the external API 22 has a local component, which adds the security parameter.
  • a failed security check results in the call to the external API 22 returning an exception.
  • the service delivery element 26 may apply additional or alternate treatments in the event of a failed security check.
  • the treatment applied may depend on the context of the security check failure. For example, a service usage accounting record may be created for the attempted service request. The record could be populated with specific information regarding the attempt and the reason for the security check failure, i.e., the denial of services.
  • additional treatments may be applied.
  • an external caller attempting to access the mobile unit 14, but denied access may be connected to a recorded announcement or progress tone to convey the reason that the access was not granted. The external caller might also be directed to a web page to provide additional information about the failed access attempt.
  • FIG. 4 An external feature server 402 and its associated services API 404 are coupled via a message layer 406 to a security layer 408.
  • the security layer 408 interfaces via the external services API 24 to the services delivery element 26.
  • a subscriber may attempt to access a given feature provided by the external element.
  • the core network 10 has access to the external element 402 via its associated API 404 and the security delivery element 26, but the subscriber does not have direct access, i.e., security rights, to the feature offerings of the external element.
  • the subscriber requests the feature and then the services delivery element 26 passes a token on behalf of the subscriber to the external element.
  • the token exchange shown pictorially in FIG. 5, occurs at the start of the service dialog to enable a particular feature server 502 and its associated services API 504 and the associated service data to support the feature.
  • Service data may be subscriber data such as profile information, location data, etc.
  • An access token 506 is passed between the external API 22 and the services API 504 containing the service request data. It will be appreciated that there may be multiple levels of security checks before this data can be delivered outside the core network 10.
  • the token exchange and associated authentication lasts for the duration of the dialogue. It should be noted that the dialogue might be a single service request or equivalent to a registration, which may persist over a number of hours.
  • the first external API call establishes the security relationship between the requestor and the external element. For the lifetime of the relationship, the subsequent external API calls are considered as being sourced by a trusted element. This assumes that the requestor has additional software to support the security check.
  • an external element may need to gain access to additional resources or data within the core network 10.
  • the service API 22 will allow an explicit renegotiation of the security relationship to expand the access granted the external element. This process may also be applied in a reverse fashion to limit the access granted to the external element.
  • the relationship may be aged to ensure release of the relationship after a predetermined time. This time out period may also be combined with some other criteria, such as inactivity. Once the time out period has expired the external element would be required to re-establish its secure relationship as described herein.
  • the services delivery element 26 includes translation functions 304 and API modules 306(FIG. 3) that translate the service requests from external elements to the known internal API services.
  • This translation function will operate similar to a broker function, a protocol adapter, or a protocol gateway function.
  • the available services will be determined by the authentication services of the security services offered by the services delivery element 26.
  • Java Telephony Application Interface JTAPI
  • JTAPI Java Telephony Application Interface
  • Other translation protocols that may be supported include PARLAY, Telephony Application Interface (TAPI), Java Advanced Intelligent Network (JAIN) and Telecommunication Information Networking Architecture (TINA), which are illustrated in FIG. 3.
  • the invention may be further illustrated by three use cases, of which two are illustrated in FIG. 6.
  • An external element 602 is hosted in the End User Services Network 604 co-located within the core network 10,
  • An external element 606 is located in or attached to a non-trusted, external network 608 such as the internet, and
  • An external element is located in a trusted or non- trusted external network such as a private service provider network (not shown in FIG. 6).
  • the end-user services network 604 is a trusted entity in a trusted network within the core network 10.
  • the relationship implies a trusted external element accessible over a trusted link.
  • the external element 602 is either imbedded in the trusted network or is represented as a trusted core network 10 entity. This case can be thought of as one where certain classes of services such as three-way voice calling, voice call forwarding, paging, electronic mail, and other
  • the external element 606 resides in a network 608 attached to the Internet. In this case neither the link to the network 608 where the external element 606 resides nor the external element 606 itself is considered trusted.
  • a secure link 610 between the core network 10 and the Internet point of attachment to the packet gateway 612 of the core network 10 must first be established followed by secure access between the mobile unit 14 and the external element 606. As shown in FIG. 6, the mobile unit 14 is provided access to the core network 10 via a trusted element, the services client 614 internal to the core network 10. If there is need for access to resources contained within the core network 10, secure access via security associations 616 is established between the internal APIs 18 and the external element 606, which would automatically invoke the security services in the services delivery element 26.
  • the external element resides in an external, trusted, private network. This allows statically or dynamically negotiated trust between networks and between an external element and the core network 10 internal APIs 18 to be negotiated jointly or independently using persistent (i.e., logically or physically) or short-lived link states.
  • the present invention has been described in terms of several preferred embodiments. It will be appreciated that the invention may be altered or changed without departing from its fair scope.
  • the invention may be applied where an external element, such as an external API, is utilized for remote configuration of elements associated with the core network.
  • an external element such as an external API
  • Such an implementation would find beneficial use in a system permitting subscriber profile provisioning from a device other than the subscriber device itself.
  • the layered restrictions possible through application of the services delivery element are advantageously utilized to increase or decrease authorization criteria, which may be leveraged to offer an external element for remote configuration.
  • an external element may have administrative access to the system from an untrusted source.
  • the preferred embodiments of the invention are intended to be illustrative and should not be taken as limiting of the broad scope of the invention set forth in -lithe following claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

A services delivery element (26) forms an interface between an external element (such as an external end user's network feature server) and a communication network including both a core network (10) and an access network (12). The services delivery element (26) provides access to the core network (10) and access networks (12) to which the external element is interfaced.

Description

METHODANDAPPARATUS FORINTERFACINGANETWORKTOAN
EXTERNALELEMENT
Field of the Invention The invention relates generally to communication networks, and more particularly, the invention relates to a method and apparatus for interfacing a communication network to an external element.
Background of the Invention A communication network is typically designed to provide a vast array of functions and services to the users of the network. At the same time, new functions and features are conceived and developed that may enhance the communication network. Some of these new functions may lie outside the architecture of the existing communication network. Adaptation of these new functions to the communication network may require costly redesign and implementation of the communication network. Moreover, the communication network may be designed with a proprietary architecture and data structure that limits an ability to directly integrate these newly developed functions.
Other desirable features and functions may be resident within other networks external to the communication network. Benefits may be derived from providing these features and functions within the communication network, or to at least permit users of the communication network to utilize these features and functions that reside on the external network.
Certain communication network architectures are designed with a view toward feature extraction. Feature extraction refers to the adaptability of the network to new services, features and functions that may be developed by virtually anyone including service providers, system operators, third party vendors and end- users.
To permit adaptation of newly developed functionality to the communication network, and/or to permit utilization of external network functionality by users of the communication network, it is necessary to interface the new functions to the communication network in a stable and secure manner. . Thus, there is a need for a method and apparatus for interfacing a network to an external element in a stable and secure manner.
Brief Description of the Drawings FIG. 1 is a block diagram illustration of a communication network coupled to an external element by an apparatus in accordance with a preferred embodiment of the present invention.
FIG. 2 is a functional block diagram illustrating the interface of an external element to a communication network in accordance with a preferred embodiment of the present invention.
FIG. 3 is- a functional block diagram illustration of a services delivery element in accordance with a preferred embodiment of the invention.
FIG. 4 is a functional block diagram of a services delivery element in accordance with one of the preferred embodiments of the invention illustrating further functionality of the services delivery element.
FIG. 5 is a functional block diagram illustrating services invocation between a communication network and an external element in accordance with one of the preferred embodiments of the present invention.
FIG. 6 is a block diagram illustration of a communication network coupled to an external element by an apparatus in accordance with a preferred embodiment of the present invention.
Detailed Description of the Preferred Embodiments A services delivery element forms an interface or operates as an interface device between an external element (such as an external end user's network feature server) and a communication network including both a core network and at least one access network. The services delivery element provides access to the core network, access networks and subscriber devices within or connected to the access networks to which the external element is interfaced. In accordance with a first aspect of the invention, the services delivery element acts as a security proxy and a secure link point between the external element and the core network. The services delivery element may also provide managed access by the external element to core network and access network resources. In addition to the above-described features, the services delivery element may also recognize or identify trusted external elements; identify preferential external elements; provide secure access to subscriber data retained within the core network; identify and deny access by untrusted external elements; translate between the external element and the core network; and provide limited access to particular subsets of core network data and/or functions by the external element.
With reference to FIG. 1, a core network 10 is interfaced to an access network 12. The core network 10 may be a packet based communication network adapted to provide voice and data communication services via the access network 12, which may be a radio access network. A radio access network provides wireless voice and data communication services to a mobile unit, such as the mobile unit 14, and may do so in accordance with virtually any wireless communication protocol. The invention provides an interface for external elements to both the core network 10, the access network 12, and the mobile unit 14. To simplify the following discussion of the preferred embodiments of the invention, reference is made only to the core network 10.
Referring to FIG. 1 and FIG. 2, within the core network 10 is a variety of application program interfaces (API) 18, which interface services and functional components within the core network 10. As shown in FIG. 2, for example, is a call model API 19 and a resource API 20. Each of API 19 and API 20 are considered to be internal APIs, and as such have "trusted" status within the core network 10. That is, these APIs have access to the core network 10 without having to first authenticate and establish a secure interface with the core network. Also illustrated in FIG. 2 are external APIs 22, such as applications API 23 and services API 24. While only two external APIs 23 and 24 are shown, it should be understood that numerous external APIs might be provided.
External APIs 22 are considered "untrusted" APIs and do not have the same, direct access to the core network 10 as the trusted, internal APIs 18. The internal
APIs 18 may be considered the "glue" of core network 10, which enable the features and services in the core network 10. As an example, the internal APIs support the configuration of the communication between the network entities (not shown) within the core network 10.
In contrast, the external APIs 22 are accessible to and configurable by third parties, e.g., services providers and, where appropriate, end users. The external
APIs 22 are the feature extraction pieces that enable third party developers to access and add features and services to the network. The external APIs 22 interface with the internal APIs 18 to configure, communicate with and control the network to provide extensibility to the core network 10. In accordance with a preferred embodiment of the invention, the external APIs 22 and internal APIs 18 are linked together via a services delivery element 26. The services delivery element 26 segregates the sets of APIs, and has a primary purpose to provide security for the internal APIs from untrusted resources.
Because the external APIs 22 connect to the core network 10, it is possible that mechanisms may be added to the core network 10 via these external APIs 22, that can be damaging or even totally destructive. Any service, not resident within the core network 10, that requires the execution of programmable code, that requires processing from a core network entity, or data access on behalf of a subscriber from the core, is considered external. These services, such as the Call Processing Language from the IPTEL working group of the Internet Engineering Task Force (IETF) or some features of the Wireless Application Protocol(WAP), enable end users to load executable code into the network. These services cannot be trusted and should not be granted direct access to the core network 10.
As discussed above, the internal APIs 18 are the system interfaces which enable features and services in the core network 10. The internal APIs 18 address the configuration of and communication between the network entities inside both the core and access networks 10 and 12. These interfaces will not be directly accessible external to the core network 10.
The services delivery element 26 protects the core network 10 from potentially destructive features and services, and further provides indirect access to the internal APIs 18. FIG. 3 illustrates a functional architecture for the services delivery element 26 in accordance with a preferred embodiment of the invention. The services delivery element 26 may include both a security services element 302 and a translation/API modules element 304. One of ordinary skill in the art will appreciate that FIG. 3 represents the functional elements of the services delivery element 26, and that in an actual physical embodiment of the services delivery element 26, these functional elements may reside in one or more components of the core network 10.
The security services element 302 provides authentication and validation services to potential service and feature providers of the network. In accordance with the preferred embodiments of the invention, access to the core network 10 by external elements, i.e., external APIs 22, are via a secure connection across a virtual private network (NPN) connection. The security services element 302 adds a wrapper on top of the internal API that will enable the external feature or service. This arrangement allows the external feature or service to have scalable access to the internal API 18, but through a secure technique. Access to the internal API 18 by the external elements ranges from no access to partial access to full access based on a variety of security variables. These variables include user based privileges (e.g., service options based on subscription information) and network variables (e.g., based on network usage and load). More generally speaking, the services delivery element 26 enables a layering of restrictions providing greater or lesser authorization to the external element based upon virtually any set of criteria, including without limitations those set forth above.
The connection security between the external API 22 and the internal API 18 may be provided using the IP security protocol (IPSec) from the Internet Engineering Task Force (IETF). Utilizing both the encapsulation payload (ESP) and authentication header (AH) services of IPSec, the security delivery element 26 will provide access control, connectionless integrity, data origin authentication, rejection of replayed packets, and confidentiality services. These services will be available for both TCP and UDP streams. The services delivery element 26 may be configured to communicate in
LPSec tunnel mode. In this mode of operation, both the external API 22 and the internal API 18 will authenticate and encrypt the entire IP source packet and wrap a new IP header around them. ESP in tunnel mode encrypts and optionally authenticates the entire inner IP packet, including the inner IP header. AH in tunnel mode authenticates the entire inner IP packet and selected portions of the outer IP header.
Since, as described, the services delivery element 26/ external API 22 IPSec transmissions will be in tunnel mode, all of the hosts inside the core network 10 will communicate with the external API 22 without implementing IPSec. The unprotected packets generated by core network elements are tunneled through the services delivery element 26 by tunnel security associations. The internal APIs 18 may interact with the services delivery element 26 via the embedded security layer on the services delivery element 26. This level of security is implemented to authenticate and validate each particular external API 22.
In accordance with the preferred embodiments of the invention, the services delivery element 26 may be configured to recognize particular external APIs 22. For example, one third party vendor may have more access to the core network 10 than others. Such recognition may be based upon being a known services provider, type of service, or other criteria. Establishing such other criteria will be easily recognized by one having ordinary skill in the art. In this arrangement, the services API 24 will interact with the services delivery element 26 via the embedded Security Layer on the security delivery element 26. This level of security is implemented to authenticate and validate each particular external element, and provide an explicit security layer between the external elements and the core network 10.
External elements (e.g., Feature Server 606 (FIG. 6)) accessing the system via the External APIs 22 may be statically or dynamically associated with the core network 10. For external services that are expected to be delivered to numerous subscribers the operator may configure the core network 10 so that the external API 22 associated with the external service remains statically connected to the core network 10 via this security technique at system initialization. In a dynamic case, when a subscriber requests a particular feature provided by an external element, the core network 10 interrogates the external element. The associated external API 22 registers with the service delivery element 26, and the services delivery element 26 will authenticate the external element and grant the particular external API 22 access privileges based on this authentication. At this point the external element becomes a trusted element by obtaining the security information. This implies that an additional layer of software must be considered in addition to the external API 22 or that the external API 22 has a local component, which adds the security parameter. A failed security check results in the call to the external API 22 returning an exception.
It will be appreciated that the service delivery element 26 may apply additional or alternate treatments in the event of a failed security check. The treatment applied may depend on the context of the security check failure. For example, a service usage accounting record may be created for the attempted service request. The record could be populated with specific information regarding the attempt and the reason for the security check failure, i.e., the denial of services. In the event the incoming request involves an external caller trying to reach the mobile unit 14 or access data held within the service delivery element 26, additional treatments may be applied. By way of example, an external caller attempting to access the mobile unit 14, but denied access, may be connected to a recorded announcement or progress tone to convey the reason that the access was not granted. The external caller might also be directed to a web page to provide additional information about the failed access attempt.
The foregoing arrangement is illustrated in FIG. 4. An external feature server 402 and its associated services API 404 are coupled via a message layer 406 to a security layer 408. The security layer 408 interfaces via the external services API 24 to the services delivery element 26.
Once the external element is trusted to the services delivery element 26 a subscriber may attempt to access a given feature provided by the external element. At this point, the core network 10 has access to the external element 402 via its associated API 404 and the security delivery element 26, but the subscriber does not have direct access, i.e., security rights, to the feature offerings of the external element. The subscriber requests the feature and then the services delivery element 26 passes a token on behalf of the subscriber to the external element. The token exchange, shown pictorially in FIG. 5, occurs at the start of the service dialog to enable a particular feature server 502 and its associated services API 504 and the associated service data to support the feature. Service data may be subscriber data such as profile information, location data, etc. An access token 506 is passed between the external API 22 and the services API 504 containing the service request data. It will be appreciated that there may be multiple levels of security checks before this data can be delivered outside the core network 10.
The token exchange and associated authentication lasts for the duration of the dialogue. It should be noted that the dialogue might be a single service request or equivalent to a registration, which may persist over a number of hours. The first external API call establishes the security relationship between the requestor and the external element. For the lifetime of the relationship, the subsequent external API calls are considered as being sourced by a trusted element. This assumes that the requestor has additional software to support the security check.
Once a security relationship has been established, an external element may need to gain access to additional resources or data within the core network 10. The service API 22 will allow an explicit renegotiation of the security relationship to expand the access granted the external element. This process may also be applied in a reverse fashion to limit the access granted to the external element. For long-lived security relationships, the relationship may be aged to ensure release of the relationship after a predetermined time. This time out period may also be combined with some other criteria, such as inactivity. Once the time out period has expired the external element would be required to re-establish its secure relationship as described herein.
Because services are being provided by external elements, each external element may not use a protocol that is entirely compatible with the internal APIs and/or the core network 10. The services delivery element 26 includes translation functions 304 and API modules 306(FIG. 3) that translate the service requests from external elements to the known internal API services. This translation function will operate similar to a broker function, a protocol adapter, or a protocol gateway function. The available services will be determined by the authentication services of the security services offered by the services delivery element 26. For example, Java Telephony Application Interface (JTAPI) may be supported external to the core network 10 via a translation function 304 within the services delivery element 26. Other translation protocols that may be supported include PARLAY, Telephony Application Interface (TAPI), Java Advanced Intelligent Network (JAIN) and Telecommunication Information Networking Architecture (TINA), which are illustrated in FIG. 3.
The invention may be further illustrated by three use cases, of which two are illustrated in FIG. 6.
1. An external element 602 is hosted in the End User Services Network 604 co-located within the core network 10,
2. An external element 606 is located in or attached to a non-trusted, external network 608 such as the internet, and
3. An external element is located in a trusted or non- trusted external network such as a private service provider network (not shown in FIG. 6).
In the first case, the end-user services network 604 is a trusted entity in a trusted network within the core network 10. In this case the relationship implies a trusted external element accessible over a trusted link. The external element 602 is either imbedded in the trusted network or is represented as a trusted core network 10 entity. This case can be thought of as one where certain classes of services such as three-way voice calling, voice call forwarding, paging, electronic mail, and other
"typical" services may be provisioned within the core network 10. As a result, trust is static and requires only service level access security per subscriber.
In the second case, the external element 606 resides in a network 608 attached to the Internet. In this case neither the link to the network 608 where the external element 606 resides nor the external element 606 itself is considered trusted. A secure link 610 between the core network 10 and the Internet point of attachment to the packet gateway 612 of the core network 10 must first be established followed by secure access between the mobile unit 14 and the external element 606. As shown in FIG. 6, the mobile unit 14 is provided access to the core network 10 via a trusted element, the services client 614 internal to the core network 10. If there is need for access to resources contained within the core network 10, secure access via security associations 616 is established between the internal APIs 18 and the external element 606, which would automatically invoke the security services in the services delivery element 26. The reverse case, where the external element 606 attempts unsolicited contact with a mobile unit 14, would require the external element establish a secure link with the core network 10 followed by successful security negotiation with the internal API 18 for service discovery. This would be necessary for actions such as subscriber endpoint location and discovery of subscriber device attributes and/or capabilities.
In the third case, the external element resides in an external, trusted, private network. This allows statically or dynamically negotiated trust between networks and between an external element and the core network 10 internal APIs 18 to be negotiated jointly or independently using persistent (i.e., logically or physically) or short-lived link states.
The present invention has been described in terms of several preferred embodiments. It will be appreciated that the invention may be altered or changed without departing from its fair scope. For example, the invention may be applied where an external element, such as an external API, is utilized for remote configuration of elements associated with the core network. Such an implementation would find beneficial use in a system permitting subscriber profile provisioning from a device other than the subscriber device itself. The layered restrictions possible through application of the services delivery element are advantageously utilized to increase or decrease authorization criteria, which may be leveraged to offer an external element for remote configuration. Thus, an external element may have administrative access to the system from an untrusted source. The preferred embodiments of the invention are intended to be illustrative and should not be taken as limiting of the broad scope of the invention set forth in -lithe following claims.

Claims

1. An apparatus for interfacing a communication network to an external element comprising: an interface device coupled to the communication network and the external element, the interface device comprising a processor adapted to operate responsive to a control program stored within a memory associated with the processor; and wherein the interface device is operable to recognize the external element, to negotiate a security level between the external element and the communication network, and to manage access by the external element to the communication network.
2. The apparatus of claim 1, wherein the security level defines a level of access of the external element to the communication network.
3. The apparatus of claim 1, wherein the interface device includes restriction criteria associated with varying degrees of authorization to the communication network by the external element.
4. The apparatus of claim 1, wherein the interface device is operable to provide one of access control, connectionless integrity, data origin authentication, replay packet rejection and confidentiality services.
5. The apparatus of claim 1 , wherein the interface device comprises an embedded security layer.
6. A method of interfacing a communication network to an external element comprising the steps of: providing an interface coupled between the communication network and the external element, recognizing the external element via the interface, negotiating a security level between the external element and the communication network, and metering access via the interface by the external element to the communication network in view of the security level.
7. The method of claim 6, wherein the security level defines a level of access of the external element to the communication network.
8. The method of claim 6, wherein the method comprises, based upon the security level, restricting access by the external element to at least one internal function of the communication network.
9. The method of claim 6, comprising, in response to a failure to negotiate a security level, providing an action responsive to the failure to negotiate a security level, wherein the action comprises one of creating a usage accounting record, providing a recorded message, and linking to a source of additional information.
10. The method of claim of claim 6, further comprising the step of translating data communicated between the external element and the communication network.
PCT/US2001/014030 2000-06-20 2001-05-01 Method and apparatus for interfacing a network to an external element WO2001099334A1 (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP01930988A EP1303938A4 (en) 2000-06-20 2001-05-01 Method and apparatus for interfacing a network to an external element

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
US09/597,315 2000-06-20
US09/597,315 US7451476B1 (en) 2000-06-20 2000-06-20 Method and apparatus for interfacing a network to an external element

Publications (1)

Publication Number Publication Date
WO2001099334A1 true WO2001099334A1 (en) 2001-12-27

Family

ID=24390999

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2001/014030 WO2001099334A1 (en) 2000-06-20 2001-05-01 Method and apparatus for interfacing a network to an external element

Country Status (3)

Country Link
US (1) US7451476B1 (en)
EP (1) EP1303938A4 (en)
WO (1) WO2001099334A1 (en)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1301006A1 (en) * 2001-10-05 2003-04-09 Microsoft Corporation Granular authorization for network user sessions

Families Citing this family (26)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20050131837A1 (en) * 2003-12-15 2005-06-16 Sanctis Jeanne D. Method, system and program product for communicating e-commerce content over-the-air to mobile devices
US8370269B2 (en) 2004-06-02 2013-02-05 Overstock.Com, Inc. System and methods for electronic commerce using personal and business networks
DE102005014522B4 (en) * 2005-03-30 2007-05-10 Siemens Ag Method and communication system for importing data into communication networks
EP1715625A1 (en) * 2005-04-22 2006-10-25 Alcatel Apparatuses for controlling service delivery using access-dependent information in a system comprising a core network subsystem
US7979891B2 (en) * 2006-05-09 2011-07-12 Oracle International Corporation Method and system for securing execution of untrusted applications
US8583480B2 (en) 2007-12-21 2013-11-12 Overstock.Com, Inc. System, program product, and methods for social network advertising and incentives for same
US9747622B1 (en) 2009-03-24 2017-08-29 Overstock.Com, Inc. Point-and-shoot product lister
US10362019B2 (en) 2011-07-29 2019-07-23 Amazon Technologies, Inc. Managing security credentials
US11444936B2 (en) 2011-07-29 2022-09-13 Amazon Technologies, Inc. Managing security credentials
US8863250B2 (en) 2012-02-01 2014-10-14 Amazon Technologies, Inc. Logout from multiple network sites
US10546262B2 (en) 2012-10-19 2020-01-28 Overstock.Com, Inc. Supply chain management system
US11023947B1 (en) 2013-03-15 2021-06-01 Overstock.Com, Inc. Generating product recommendations using a blend of collaborative and content-based data
US11676192B1 (en) 2013-03-15 2023-06-13 Overstock.Com, Inc. Localized sort of ranked product recommendations based on predicted user intent
US10810654B1 (en) 2013-05-06 2020-10-20 Overstock.Com, Inc. System and method of mapping product attributes between different schemas
US9602540B1 (en) * 2013-06-13 2017-03-21 Amazon Technologies, Inc. Enforcing restrictions on third-party accounts
US9483788B2 (en) 2013-06-25 2016-11-01 Overstock.Com, Inc. System and method for graphically building weighted search queries
US10929890B2 (en) 2013-08-15 2021-02-23 Overstock.Com, Inc. System and method of personalizing online marketing campaigns
US10475018B1 (en) 2013-11-29 2019-11-12 Amazon Technologies, Inc. Updating account data for multiple account providers
US10872350B1 (en) 2013-12-06 2020-12-22 Overstock.Com, Inc. System and method for optimizing online marketing based upon relative advertisement placement
US9807124B2 (en) 2014-09-08 2017-10-31 Level 3 Communications, Llc Lawful intercept provisioning system and method for a network domain
US10534845B2 (en) 2016-05-11 2020-01-14 Overstock.Com, Inc. System and method for optimizing electronic document layouts
US11514493B1 (en) 2019-03-25 2022-11-29 Overstock.Com, Inc. System and method for conversational commerce online
US11205179B1 (en) 2019-04-26 2021-12-21 Overstock.Com, Inc. System, method, and program product for recognizing and rejecting fraudulent purchase attempts in e-commerce
US11734368B1 (en) 2019-09-26 2023-08-22 Overstock.Com, Inc. System and method for creating a consistent personalized web experience across multiple platforms and channels
US11838375B2 (en) * 2020-11-12 2023-12-05 Harman International Industries, Incorporated Universal software communication bus
US11477644B2 (en) * 2020-11-30 2022-10-18 At&T Intellectual Property I, L.P. Network application programming interface guided service placement

Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5838768A (en) * 1996-10-03 1998-11-17 Telefonaktiebolaget L M Ericsson System and method for controlled media conversion in an intelligent network
US6012100A (en) * 1997-07-14 2000-01-04 Freegate Corporation System and method of configuring a remotely managed secure network interface

Family Cites Families (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5497463A (en) * 1992-09-25 1996-03-05 Bull Hn Information Systems Inc. Ally mechanism for interconnecting non-distributed computing environment (DCE) and DCE systems to operate in a network system
FI105309B (en) * 1997-06-24 2000-07-14 Nokia Mobile Phones Ltd Mobile communication systems
US6002941A (en) * 1997-12-17 1999-12-14 Motorola, Inc. Method and apparatus for implementing a service in a wireless communication system
FI980427A (en) * 1998-02-25 1999-08-26 Ericsson Telefon Ab L M Procedure, arrangement and device for verification
US7025209B2 (en) * 1998-05-29 2006-04-11 Palmsource, Inc. Method and apparatus for wireless internet access
FI108200B (en) * 1998-09-14 2001-11-30 Nokia Mobile Phones Ltd Switching the connection between mobile networks
US6285667B1 (en) * 1998-12-02 2001-09-04 Telefonaktiebolaget Lm Ericsson Page response on existing radio signaling channel
FI114768B (en) * 1999-03-11 2004-12-15 Nokia Corp An improved method and arrangement for transmitting information in a packet radio service
ATE300827T1 (en) 1999-09-07 2005-08-15 Swisscom Mobile Ag METHOD AND GATEWAY THAT ALLOW END-TO-END SECURED ACCESS TO WAP SERVICES
US6591417B1 (en) * 1999-12-30 2003-07-08 International Business Machines Corporation Method of and system for testing compatibility with an external API upgrade

Patent Citations (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US5838768A (en) * 1996-10-03 1998-11-17 Telefonaktiebolaget L M Ericsson System and method for controlled media conversion in an intelligent network
US6012100A (en) * 1997-07-14 2000-01-04 Freegate Corporation System and method of configuring a remotely managed secure network interface

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1303938A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1301006A1 (en) * 2001-10-05 2003-04-09 Microsoft Corporation Granular authorization for network user sessions
US7076797B2 (en) 2001-10-05 2006-07-11 Microsoft Corporation Granular authorization for network user sessions

Also Published As

Publication number Publication date
US7451476B1 (en) 2008-11-11
EP1303938A1 (en) 2003-04-23
EP1303938A4 (en) 2005-02-09

Similar Documents

Publication Publication Date Title
US7451476B1 (en) Method and apparatus for interfacing a network to an external element
US7954141B2 (en) Method and system for transparently authenticating a mobile user to access web services
EP1743465B1 (en) Method and system for access control in distributed object-oriented systems
US7441265B2 (en) Method and system for session based authorization and access control for networked application objects
US7941839B2 (en) Countermeasures to automated methods and processes for establishing media streaming connections through firewalls and proxy servers
US8176525B2 (en) Method and system for trusted contextual communications
US20070011322A1 (en) Method and system for providing access to web services
US20030177099A1 (en) Policy control and billing support for call transfer in a session initiation protocol (SIP) network
US20070079368A1 (en) Connection assistance apparatus and gateway apparatus
US20040177247A1 (en) Policy enforcement in dynamic networks
US20070143470A1 (en) Facilitating integrated web and telecommunication services with collaborating web and telecommunication clients
US11050716B1 (en) Secure communication method and system using network socket proxying
WO2022022253A1 (en) Service authentication method, apparatus, device and system, and storage medium
US20070165579A1 (en) Method and device for accessing a mobile server terminal of a first communication network by means of a client terminal of another communication network
KR20160043044A (en) Gateway device for terminating a large volume of vpn connections
US8539552B1 (en) System and method for network based policy enforcement of intelligent-client features
EP1402350B1 (en) Method and system for acces in open service architecture
Ackermann et al. Vulnerabilities and Security Limitations of current IP Telephony Systems
EP1104142A1 (en) Network access system
EP1161827B1 (en) Arrangement related to a call procedure
WO2005050422A1 (en) Apparatus for providing a service in an identity federation framework
EP1119140A1 (en) Proxy-based translation of filters for access to data networks
Ishihara et al. Open Service Platform Providing Services for Home Appliances
EP1813078A1 (en) Method and system for transparently authenticating a mobile user to access web services

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): KR

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): AT BE CH CY DE DK ES FI FR GB GR IE IT LU MC NL PT SE TR

121 Ep: the epo has been informed by wipo that ep was designated in this application
DFPE Request for preliminary examination filed prior to expiration of 19th month from priority date (pct application filed before 20040101)
WWE Wipo information: entry into national phase

Ref document number: 2001930988

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 2001930988

Country of ref document: EP