WO2004109980A1 - Procede d'autorisation d'acces aux utilisateurs dans un reseau local sans fil (wlan) - Google Patents

Procede d'autorisation d'acces aux utilisateurs dans un reseau local sans fil (wlan) Download PDF

Info

Publication number
WO2004109980A1
WO2004109980A1 PCT/CN2004/000614 CN2004000614W WO2004109980A1 WO 2004109980 A1 WO2004109980 A1 WO 2004109980A1 CN 2004000614 W CN2004000614 W CN 2004000614W WO 2004109980 A1 WO2004109980 A1 WO 2004109980A1
Authority
WO
WIPO (PCT)
Prior art keywords
access
wlan
user terminal
network
authorization
Prior art date
Application number
PCT/CN2004/000614
Other languages
English (en)
French (fr)
Inventor
Wenlin Zhang
Original Assignee
Huawei Technologies Co., Ltd.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co., Ltd. filed Critical Huawei Technologies Co., Ltd.
Priority to CA002523416A priority Critical patent/CA2523416A1/en
Priority to JP2006508099A priority patent/JP2006526917A/ja
Priority to EP04738215A priority patent/EP1633083A4/en
Publication of WO2004109980A1 publication Critical patent/WO2004109980A1/zh
Priority to US11/260,865 priority patent/US7519036B2/en
Priority to US12/389,030 priority patent/US8077688B2/en

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/0892—Network architectures or network communication protocols for network security for authentication of entities by using authentication-authorization-accounting [AAA] servers or protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]

Definitions

  • the present invention relates to authorization authentication technology in a network, and particularly to a method for performing access authorization on an access user in a wireless local area network operating network.
  • Wireless local area network includes a variety of different technologies.
  • IEEE 802.11b which uses the 2.4GHz frequency band and has a maximum data transmission rate of llMbps.
  • IEEE 802.llg and Bluetooth are also used in this frequency band.
  • Other new technologies such as IEEE 802.11a and ETSI BRAN Hiperlan2 both use the 5GHz frequency band and the highest transmission rate can reach 54Mbps.
  • WLANs are used to transmit Internet Protocol (IP) packet data packets.
  • IP Internet Protocol
  • the specific WLAN access technology it uses is generally transparent to the upper-layer IP.
  • Its basic structure uses an access point (AP) to complete the wireless access of the user terminal, and forms an IP transmission network through network control and connection of device connections.
  • AP access point
  • WLAN and various wireless mobile communication networks such as: GSM, Code Division Multiple Access (CDMA) system, Wideband Code Division Multiple Access (WCDMA) system, Time Division Duplex-Synchronous Code Division Multiple Access
  • GSM Global System for Mobile Communications
  • CDMA Code Division Multiple Access
  • WCDMA Wideband Code Division Multiple Access
  • TD-SCDMA2000 Time Division Duplex-Synchronous Code Division Multiple Access
  • 3GPP 3rd Generation Partnership Project
  • the user terminal may be connected to the Internet (Internet) or the intranet (Intranet) through the WLAN access network, and may also be connected to the home network of the 3GPP system or the access network of the 3GPP system through the WLAN access network.
  • the WLAN user terminal when the WLAN user terminal is locally accessed, it is connected to the 3GPP home network via the WLAN access network; when roaming, it is connected to the 3GPP access network via the WLAN access network, and some entities in the 3GPP access network are respectively homed to the 3GPP.
  • Corresponding entities in the network are interconnected, for example: a 3GPP authentication authorization and accounting (AAA) proxy in a 3GPP access network and a 3GPP authentication authorization and accounting (AAA) server in a 3GPP home network; a wireless local area network access gateway in the 3GPP access network (WAG) and the Packet Data Gateway in the 3GPP home network, etc., as shown in FIG.
  • AAA 3GPP authentication authorization and accounting
  • the 3GPP system mainly includes a home subscription user server (! 3 ⁇ 48) / home location register (110), a 3GPPAAA server, a 3GPPAAA proxy, a WAG, a packet data gateway, a charging gateway (CGw), and charging.
  • Information Collection System (CCF) and Online Charging System (OCS) The user terminal, the WLAN access network, and all entities of the 3GPP system together form a 3GPP-WLAN interactive network.
  • This 3GPP-WLAN interactive network can be used as a wireless local area network service system.
  • the 3GPP AAA server is responsible for user authentication, authorization, and charging, and collects and transmits the charging information sent by the WLAN access network to the charging system;
  • the packet data gateway is responsible for transferring user data from the WLAN access network to the 3GPP Data transmission of the network or other packet networks;
  • the billing system mainly receives and records user billing information transmitted from the network, and also includes OCS instructs the network to periodically transmit online fee information based on the fees of online billing users, and performs statistics and control.
  • the user terminal accesses a 3GPP-WLAN network
  • the user terminal sends an access request to a corresponding access authentication unit in the 3GPP-WLAN network via the WLAN access network; the access authentication unit receives the request After the authentication is performed, if the authentication is passed, all ports are simply opened to the user terminal.
  • the access authentication unit here usually refers to 3GPP AAA server.
  • the networking structure is much more complicated than the cylindrical networking structure shown in FIG. 1.
  • the operational wireless local area network refers to an operational and manageable wireless local area network, which can not only authenticate and authorize and charge users, but also provide users with one or more types of network access and network-based Services, such as: local hotel or airport internal LAN, LAN games and other LAN services and LAN access to provide different services; Internet access; 3GPP packet network-based services.
  • network-based Services such as: local hotel or airport internal LAN, LAN games and other LAN services and LAN access to provide different services; Internet access; 3GPP packet network-based services.
  • the main object of the present invention is to provide a method for user access authorization in a wireless local area network, which can control different user terminals to access under different restrictions, thereby enhancing the access control capability of the wireless local area network and improving the network Operational efficiency.
  • a method for user access authorization in a wireless local area network includes:
  • WLAN wireless local area network
  • the WLAN operating network while authenticating the WLAN user terminal, determines whether to allow the WLAN user terminal to access based on the authorization conditions that affect the access of the WLAN user terminal. If it is allowed, the access rule of the WLAN user terminal is determined according to the authorization condition; otherwise, the WLA user terminal is notified of the failure information.
  • the access rule of the WLAN user terminal is determined according to the authorization condition; otherwise, the WLA user terminal is notified of the failure information.
  • the method further includes: sending the determined access rule to one or more access rule implementation entities, and each access rule implementation entity controls access of the user terminal PT / CN2004 / 000614 approx.
  • the access authentication and authorization process of the WLAN user terminal is: After the WLAN user terminal initiates an access request to the WLAN operating network, the WLAN operating network first performs legality authentication on the currently accessed WLAN user terminal. Pass the authentication, and then determine whether the WLAN user terminal is allowed to access according to the authorization conditions; otherwise, send an access failure message to the WLAN user terminal.
  • the authorization conditions that affect WLAN user terminal access include: user account conditions, or user subscription information, or operating rules, or any combination of the three.
  • the user subscription information includes a name of a user accessing a network service. List.
  • the determination of the access rule is completed by an authentication, authorization and accounting (AAA) server in the WLAN operation network.
  • AAA authentication, authorization and accounting
  • the access rule is a restriction condition for determining the access area or path of the current access user terminal; or a restriction condition for determining the access time of the current access user terminal; or it is determined to be empty, that is, there is no access to the user terminal. Any restrictions.
  • the access rule implementing entity is: AAA, a charged LAN access gateway (WAG), or an access controller (AC), or an access point (AP), or a user terminal. If the implementing entity is a user terminal, the method further includes: after determining the access rule, the network sends the current WLAN user terminal access authentication and authorization success information together with the access rule that needs to notify the user terminal to the user terminal.
  • the WLAN operating network is a 3GPP-WLAN interactive network, or a 3GPP2-WLAN interactive network, or another operational WLAN with user subscription.
  • the key of the present invention lies in: When a WLAN user terminal accesses a wireless local area network to operate the network, while the network accesses and authenticates the user terminal, it is necessary to determine whether the user terminal is authorized according to the authorization conditions of the user terminal. Allow the user terminal to access, and further customize the corresponding access rules for the user terminal according to the authorization conditions, and then use the determined access rules to access the range, path, or time of the user in the subsequent process or subsequent service application. 2004/000614.
  • the method for user access authorization in a wireless local area network in addition to the legality authentication of the access control of the user terminal, other authorization conditions and access rules formulated according to the authorization conditions are required to perform access. Restriction, so that different WLAN user terminals can access the WLAN operating network according to different authorization conditions, and are subject to different access rules after access, thereby enhancing the access authorization capability of the wireless local area network;
  • the WLAN operating network processes the corresponding user terminals according to the access rule restrictions, and only allows services to be provided to the currently accessed user terminals within a limited range, path, or time, thereby improving the operability of the network, Operational efficiency, can provide the same user or different users with different access ranges, different access paths, or different access times for network access, which facilitates access management and provides differentiated services.
  • FIG. 1 is a schematic diagram of a network structure for interworking between a WLAN system and a 3GPP system;
  • FIG. 2 is a schematic diagram of a networking structure of a WLAN operation network
  • FIG. 3 is a schematic diagram of an access authentication and authorization flow of a WLAN operating network in the present invention
  • FIG. 4 is a schematic diagram of a WLAN operating network networking structure according to an embodiment of the present invention
  • FIG. 5 is an access authentication and authorization of the embodiment shown in FIG. 4 flow chart.
  • FIG. 2 is a schematic diagram of a networking structure of a WLAN operating network.
  • the WLAN in FIG. 2 is an operational WLAN.
  • the WLAN access network is not only directly connected to a wide area network, such as the Internet, Other corporate networks, wide area private networks, etc .; At the same time, it can also access different networks directly or through the operation network access gateway, such as: local hotels or local area networks within the airport, mobile operator networks such as 3GPP-PS, etc.
  • the mobile operator network may be a wide area network Or the local area network; the operation network access gateway is simultaneously connected to the current user terminal's home network, access network, and WLAN access authentication and authorization unit, such as a 3GPPAAA server.
  • a WL AN user terminal when a WL AN user terminal needs to obtain a certain service through the WL AN operating network, according to the principle of differentiated services, the user terminal may have been restricted at the time of signing the contract and cannot be accessed directly or through a gateway.
  • Access to certain networks such as: cannot access the internal LAN of the airport to which the WLAN access network is connected, can only access the Internet; or contract to access the Internet and a private network; or, dynamically based on the account information of the user terminal, Conditions such as operator management or operating rules restrict the WLAN user terminal from being able to access certain specific networks directly or through an access gateway within a certain time range or some area.
  • the user terminal when the user terminal accesses the WLAN operating network, the user terminal should limit the access rules according to the conditions that affect the authorization, and implement these access rules on the relevant switching or routing gateways of the network instead of Relying solely on the result of authentication, directly authorizes the access of the user terminal.
  • the access authorization described in the present invention does not refer to the service authorization related to the mobile network, but is performed before the service authorization to determine whether the user terminal is allowed to access or under what circumstances. Access to certain networks is allowed. As for whether the currently accessed WLAN user terminal can apply related services, a subsequent service authorization process is required to perform judgment processing. Take an example to illustrate that access authorization is different from service authorization. For example: A user terminal applies for Internet access service and two types of Internet access services are available in the current network. One is to directly access the Internet through a WLAN access network. The other is to access the Internet through a WLAN and then to the Internet through WAG.
  • the user terminal can arbitrarily choose or be authorized by the service to determine which service can be used; , 04 000614 If the current user terminal cannot be directly connected to the Internet through the WLAN access network, the user terminal can only access the Internet through WAG. Whether the user terminal can be allowed to access Internet services in the end requires service authorization to determine .
  • the access authorization process of the user terminal is shown in FIG. 3 and includes the following steps: Steps 301 to 302:
  • the network performs access authentication on the user terminal, specifically,
  • the access authentication and authorization unit in the network starts the legality authentication process between the user terminal and the network through the access control unit: the user terminal sends the authentication information required for authentication to the access authentication and authorization unit through the access control unit, After the access authentication and authorization unit obtains the relevant information of the user terminal, it completes the access authentication determination on its own. If the authentication is successful, it proceeds to the next step, otherwise it notifies the user terminal of the access authentication failure and ends the access authorization process.
  • the access control unit here may be an access controller (AC) in a WLAN access network, or an access gateway (WAG) of an operating network, or a combination of the two.
  • the access authentication and authorization unit may be 3GPP AAA server.
  • Step 303 After the user terminal access authentication is successful, the access authentication and authorization unit judges whether the user terminal is allowed to access according to the current user terminal's authorization conditions. If it is not allowed, it notifies the user terminal that the access authorization fails, and ends the current connection. Enter the authorization process; otherwise, further determine the current access rule of the user terminal according to the authorization conditions of the current user terminal, and the access rule refers to the restriction principles when the user terminal is authorized to access.
  • the authorization conditions include: user account conditions, or user contracting rules, or operator operating rules, or any combination of the foregoing three.
  • the access rule mainly refers to a limitation on a range or path of an access network, for example: an accessible gateway and a network connection area, and which network device can be accessed through; the rule may also include a restriction on access time.
  • the access authentication and authorization unit may also directly determine that the access rule is empty. In this case, it means that there is no special restriction on the access of the user terminal.
  • the user contracting rule may be a list of names of access services to which the user subscribes, for example, the Internet, a local gaming network, a Starbucks chain network, IPv6-Internet, and so on.
  • the access rule enforcement entity here refers to one or more network entities that can implement these rules, such as: 3GPP-AAA, service authorization unit, AC, AP, DHCP unit, operating network access gateway, etc.
  • the access authentication and authorization unit may also notify the user terminal of some or all of the determined access rules, so that the user understands or the user terminal can assist in implementing the described Access rules.
  • the notification of the access rule to the user terminal may be sent together with the notification of successful access authentication and authorization.
  • the access rule implementing entity such as the service authorization unit in FIG.
  • the service authorization unit 3 stores the rule after obtaining the access rule, and implements the access rule when the user terminal applies for the WLAN network service, such as: a service authorization unit According to the access rules, it can be determined whether the current user terminal is allowed to access the specified network range during this period and determine where to access from.
  • the service authorization unit and the access authorization unit are both in AAA.
  • the implementation of specific access rules can be implemented through existing methods such as filtering technology, IP allocation scheme, virtual local area network (VLAN), subnetting, virtual private network (VPN), and user-layer 2 isolation.
  • the access control unit may divide the user terminal currently requesting service into a subnet that conforms to the access rule by using VLAN technology or IP allocation mode; or assign an independent subnet address to the user terminal currently requesting service, It can only be in the range specified by the subnet or VLAN where the access is located.
  • a service authorization unit if a user requests a related service, the user first determines whether the requested service meets the requirements according to the access rules corresponding to the user terminal. If the access rule is violated, the request is rejected before the service authorization is determined. .
  • the access authorization process of the present invention is performed when a user accesses a WLAN operating network, and generally after the network completes identity legitimacy authentication for the currently accessed user terminal, as described in steps 301-305. Of course, you can also determine the current before the user authentication process. Accessing the authorization conditions of the user terminal and determining the access rules, and then performing identity legitimacy authentication, is only a relatively complicated process. When notifying the user terminal, the authentication and authorization results are generally notified in the same message, for example: the EAP-success message of the EAP protocol is used for notification; or they can be notified separately, for example: the authentication result is notified first and then the authorization result is notified.
  • the WLAN operation network described in the present invention refers to a 3GPP-WLA interactive network, or a 3GPP2-WLAN interactive network, or another operational WLAN network with a user subscription.
  • FIG. 4 shows a networking structure diagram of an embodiment of the present invention in actual application.
  • 3GPP-AAA is an access authentication and authorization unit, and the WLAN access part It is mainly composed of AC and AP, and AC, or WAG, or AC and WAG are access control units.
  • the WLAN operation network can directly provide local area network services for WLAN user terminals in some hot areas through the WLAN access section, such as airports, hotels, etc. 41, and Internet access services. 42;
  • the WLAN operation network can also connect to the WAG through the WLAN access section.
  • Entering a 3GPP operating network provides 3GPP network specific services 43 for WLAN user terminals.
  • the operating network also includes HSS / HLR, which is used to store various information of user terminals, such as subscription information.
  • the 3GPP network specific services 43 that WLAN user terminals can obtain through the WLAN operating network include: The Internet access service 431 provided by the 3GPP network operator through WAG, which can provide a wider range of hotspot areas than direct Internet access. Bandwidth, that is, in the case of providing the same service, the Internet access service 431 is faster than the Internet access service 42, but the charge may be higher.
  • the characteristic local area network service 432 mainly refers to the operator's own private network that can provide user terminals with internal services such as management or game interaction.
  • Mobile services based on the mobile network packet domain for example: various services 433 of the roaming network VPLMN; various services of the home network HPLMN 434, the various services described here include at least the IP multimedia subsystem (IMS- IP Multimedia Subsystem), short message (SMS), multimedia short message (MMS), location service (LCS) and other mobile network specialty industries 4 business.
  • IP multimedia subsystem IMS- IP Multimedia Subsystem
  • SMS short message
  • MMS multimedia short message
  • LCS location service
  • other mobile network specialty industries 4 business for example: various services 433 of the roaming network VPLMN; various services of the home network HPLMN 434, the various services described here include at least the IP multimedia subsystem (IMS- IP Multimedia Subsystem), short message (SMS), multimedia short message (MMS), location service (LCS) and other mobile network specialty industries 4 business.
  • SMS short message
  • MMS multimedia short message
  • LCS location service
  • Steps 501 to 502 When user terminal A requests access to the 3GPP-WLAN network shown in FIG. 4, the AC sends an access request and information required for authentication to 3GPP-AAA, and 3GPP-AAA verifies the legitimacy of the identity of user terminal A. If the authentication succeeds, continue to determine the authorization conditions of the user terminal A, and execute step 503; otherwise, return the access authentication failure information to the user terminal A, and end.
  • Step 503 The 3GPP-AAA determines whether user terminal A is allowed to access according to all the authorization conditions of user terminal A. If not, the 3GPP-AAA returns the access authorization failure information to user terminal A, and ends; 3GPP-AAA determines the access rules of user terminal A according to the authorization conditions of user terminal A. Then, according to the subscription rules of user terminal A, the access rules of user terminal A are determined to "access the Internet only at the hotspot local".
  • Step 504 The 3GPP-AAA notifies the user terminal A of the access authentication and authorization success information and step 5 (the determined access rule, and notifies the AC of the WLAN access network, and the AC implements the access rule.
  • Step 505 The AC stores the determined access rule, and when the user terminal A requests the Internet service, the AC learns that the user terminal can only access the local Internet in the hotspot area according to the pre-stored access rule, and then judges the user. Whether terminal A is currently in a hotspot area, if so, directly access the local Internet through the AC; otherwise, the AC divides user terminal A into a subnet that can only access the hotspot local Internet through VLAN technology or IP allocation, or give users Terminal A assigns an address of an independent subnet, which can only access the local internet, so that user terminal A can only access the local Internets
  • Embodiment two Embodiment two:
  • the access authorization process of user terminal B and the user in the first embodiment The access authorization process of terminal A is basically the same, except that in step 503, the access rule of user terminal B is determined as "allow access through WAG, and local hotspot access is not allowed.”
  • Internet access service 42 cannot be used, and only Internet access service 431 can be used. That is, the 3GPP operation network can only be accessed through WAG, and the Internet access service provided by the 3GPP operation network can be used for good services.
  • the access authorization process of user terminal C and the access of user terminal A in the first embodiment is basically the same, except that in step 503, the access rule of user terminal C is determined as "the roaming service network cannot be accessed.” Based on this access rule, user terminal C has more access rights. According to its The service request can access a variety of different networks connected to the LAN access network, but the roaming mobile network is not allowed to access.
  • This access rule can be implemented in WAG, allowing users to not access the roaming business network; Directly implemented in 3GPP-AAA.
  • user terminal C When user terminal C requests related services, first determine whether the requested service access meets the access rules according to the access rules corresponding to user terminal C. If it does not, user terminal C Currently in a roaming network and requesting a service provided by the roaming network, the request is rejected before the service authorization is determined, Then, continue to carry out authorized business judgment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Small-Scale Networks (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Description

无线局域网中用户接入授权的方法 技术领域
本发明涉及网絡中的授权认证技术， 特别是指一种在无线局域网运 营网络中对接入用户进行接入授权的方法。 发明背景
由于用户对无线接入速率的要求越来越高， 无线局域网 （WLAN, Wireless Local Area Network )应运而生， 它能在较小范围内提供高速的 无线数据接入。 无线局域网包括多种不同技术， 目前应用较为广泛的一 个技术标准是 IEEE 802.11b, 它采用 2.4GHz频段， 最高数据传输速率可 达 llMbps， 使用该频段的还有 IEEE 802. llg和蓝牙 （ Bluetooth )技术， 其中， 802.11g最高数据传输速率可达 54M ps。 其它新技术诸如 IEEE 802.11a和 ETSI BRAN Hiperlan2都使用 5GHz频段， 最高传输速率也可 达到 54Mbps。
尽管有多种不同的无线接入技术，大部分 WLAN都用来传输因特网 协议 ( IP )分组数据包。 对于一个无线 IP 网络， 其采用的具体 WLAN 接入技术对于上层的 IP —般是透明的。 其基本的结构都是利用接入点 ( AP )完成用户终端的无线接入， 通过网络控制和连接设备连接组成 IP 传输网络。
随着 WLAN技术的兴起和发展， WLAN与各种无线移动通信网， 诸如： GSM、 码分多址（CDMA ) 系统、 宽带码分多址（WCDMA ) 系 统、 时分双工-同步码分多址（TD-SCDMA ) 系统、 CDMA2000 系统的 互通正成为当前研究的重点。 在第三代合作伙伴计划（3GPP )标准化组 织中， 用户终端可以通过 WLAN的接入网络与因特网 （ Internet )、 企业 内部互联网（Intranet )相连， 还可以经由 WLAN接入网络与 3GPP系统 的归属网络或 3GPP系统的访问网络连接， 具体地说就是， WLAN用户 终端在本地接入时， 经由 WLAN接入网絡与 3GPP的归属网络相连； 在 漫游时， 经由 WLAN接入网络与 3GPP的访问网络相连， 3GPP访问网 絡中的部分实体分别与 3GPP归属网络中的相应实体互连， 比如： 3GPP 访问网络中的 3GPP认证授权计费 （AAA )代理和 3GPP归属网络中的 3GPP认证授权计费（AAA )服务器； 3GPP访问网络中的无线局域网接 入关口 （ WAG ) 与 3GPP 归属网络中的分组数据关口 （ Packet Data Gateway )等等， 如图 1所示。
参见图 1 所示， 在 3GPP 系统中， 主要包括归属签约用户服务器 ( !¾8 ) /归属位置寄存器（110 )、 3GPPAAA服务器、 3GPPAAA代理、 WAG, 分组数据关口、 计费关口 （CGw ) /计费信息收集系统（CCF )及 在线计费系统（ OCS )。 用户终端、 WLAN接入网络与 3GPP系统的所有 实体共同构成了 3GPP-WLAN交互网络， 此 3GPP-WLAN交互网络可作 为一种无线局域网服务系统。 其中， 3GPP AAA服务器负责对用户的鉴 权、授权和计费，对 WLAN接入网络送来的计费信息收集并传送给计费 系统； 分组数据关口负责将用户数据从 WLAN接入网絡到 3GPP网络或 其他分組网络的数据传输； 计费系统主要接收和记录网络传来的用户计 费信息，还包括 OCS根据在线计费用户的费用情况指示网络周期性的传 送在线费用信息， 并进行统计和控制。
一般情况下， 当 WLAN用户终端接入 3GPP- WLAN网络时， 该用 户终端经由 WLAN接入网向 3GPP-WLAN网络中相应的接入鉴权单元 发接入请求； 接入鉴权单元收到请求后进行鉴权， 如果鉴权通过， 则简 单的开放所有端口给该用户终端， 这里的接入鉴权单元通常指 3GPP AAA服务器。 但是， 对于运营性盾的无线局域网来说， 其组网结构要比 图 1所示的筒化组网结构复杂的多。 这里， 所说的运营性无线局域网是 指可运营、 可管理的无线局域网， 不仅能对用户进行认证授权和计费， 还能为用户提供一种或一种以上的网络接入和基于网络的服务， 比如： 本地的酒店或机场内部的局域网、 局域网络游戏等各种局域网络业务以 及能够提供不同业务的局域网絡的接入； Internet接入； 基于 3GPP分组 网的业务。
由于运营性无线局域网能同时接入到不同的局域网， 运营规则也比 较复杂 , 可能根据用户的帐户情况、 接入时刻情况进行不同的接入规则 要求。 如此， 只采用传统的根据鉴权结果接入授权的方式对于运营来说 是不可控、 不便于运营的。 发明内容
有鉴于此， 本发明的主要目的在于提供一种无线局域网中用户接入 授权的方法， 能够控制不同的用户终端按不同的限制条件接入， 进而增 强无线局域网的接入控制能力， 提高网络的运营效率。
为达到上述目的， 本发明的技术方案是这样实现的：
一种无线局域网中用户接入授权的方法， 该方法包括：
无线局域网（WLAN )用户终端接入 WLAN运营网络时，该 WLAN 运营网络在对该 WLAN用户终端鉴权的同时， 根据影响该 WLAN用户 终端接入的授权条件判断是否允许该 WLAN用户终端接入， 如果允许， 则才 据所述的授权条件确定该 WLAN用户终端的接入规则； 否则，通知 WLA 用户终端失败信息。
该方法进一步包括： 将所确定的接入规则发送至一个或一个以上接 入规则实施实体中， 由各个接入规则实施实体对用户终端的接入进行制 P T/CN2004/000614 约。
上述方案中， WLAN用户终端的接入鉴权和授权过程是： WLAN用 户终端向 WLAN运营网络发起接入请求后， WLAN运营网络先对当前 接入的 WLAN用户终端进行合法性鉴权认证， 如果鉴权通过，再根据授 权条件判断是否允许该 WLAN用户终端接入； 否则， 向该 WLAN用户 终端发送接入失败信息。
其中， 所述影响 WLAN用户终端接入的授权条件包括： 用户帐户情 况、 或用户签约信息、 或运营规则， 或三者的任意组合， 这里， 所述用 户签约信息包含用户接入网络服务的名称列表。 所述接入规则的确定由 WLAN运营网络中的认证授权计费 （AAA )服务器完成。
所述接入规则为确定当前接入用户终端接入区域或路径的限制条 件； 或为确定当前接入用户终端接入时间的限制条件； 或被确定为空， 即对用户终端的接入没有任何限制条件。
所述接入规则实施实体为： AAA、 充线局域网接入关口 （WAG )、 或接入控制器（AC )、 或接入点 （AP )、 或用户终端。 如果实施实体为 用户终端，则该方法进一步包括：确定接入规则之后，网络将当前 WLAN 用户终端接入鉴权授权成功信息与需要通知用户终端的接入规则同时发 送给用户终端。
上述方案中， 所述 WLAN运营网络为 3GPP-WLAN交互网络， 或 为 3GPP2-WLAN交互网络， 或其它具有用户签约的运营性 WLAN。
由上述方案可以看出， 本发明的关键在于： 当 WLAN用户终端接入 无线局域网运营网络时， 在网络对该用户终端进行接入、 鉴权的同时， 要根据该用户终端的授权条件判断是否允许该用户终端接入， 并根据授 权条件进一步对该用户终端定制相应的接入规则， 然后在后续过程或后 续服务申请中通过所确定的接入规则对用户可接入的范围、 路径或时间 2004/000614 进行限制。
因此， 本发明所提供的无线局域网中用户接入授权方法， 对用户终 端的接入控制除了合法性鉴权以外， 还要判断其他授权条件以及根据授 权条件制定的接入规则来进行接入的限制，以使不同 WLAN用户终端按 照不同的授权条件接入 WLAN运营网络，且接入后受不同接入规则的制 约， 从而增强了无线局域网的接入授权能力； 另外， 在 WLAN用户终端 向 WLAN运营网絡申请服务时， WLAN运营网络对相应用户终端按照 接入规则限制进行处理， 只允许在限定的范围、 路径或时间内为当前接 入用户终端提供服务， 进而可提高网络的可运营能力、 运营效率， 能够 为同一用户或不同用户提供不同接入范围、 不同接入路径或不同接入时 间的网絡接入， 便于接入管理和提供差丹化服务。 附图简要说明
图 1为 WLAN系统与 3GPP系统互通的网络结构示意图；
图 2为 WLAN运营网络的一种组网结构示意图；
图 3为本发明中 WLAN运营网络的接入鉴权授权流程示意图； 图 4为本发明一实施例的 WLAN运营网絡组网结构示意图； 图 5为图 4所示实施例的接入鉴权授权流程图。 实施本发明的方式
为使本发明的目的、 技术方案和优点表达得更加清楚明白， 下面结 合附图及具体实施例对本发明再作进一步详细的说明。
图 2为 WLAN运营网络的一种组网结构示意图， 如图 2所示， 图 2 中的 WLAN为运营性质的 WLAN, 在该 WLAN运营网络中， WLAN接 入网不仅直接连接广域网， 如 Internet、 其它企业网、 广域的专网等等； 同时还可以直接或通过运营网接入关口接入到不同的网络， 比如： 本地 酒店或机场内部的局域网、 诸如 3GPP-PS的移动运营商网络等等， 所述 的移动运营商网络可以是广域网或局域网； 运营网接入关口同时连接当 前用户终端的归属网络、访问网络以及 WLAN的接入鉴权授权单元， 如 3GPPAAA服务器。
对于 WL AN用户终端来说，当某个 WL AN用户终端需要通过 WL AN 运营网络获取某种服务时， 根据差异化服务原则， 该用户终端可能在签 约时就已经被限制不能直接或通过关口接入某些网络， 比如： 不能接入 WLAN接入网所连接的机场内部局域网，只能接入 Internet;或者签约接 入 Internet和某个专网； 或者， 动态地根据该用户终端的帐户信息、 或运 营商管理、或运营规则等条件， 限定该 WLAN用户终端不能直接或通过 接入关口，在某个时间范围或某些区域范围内接入某些特定网络。 那么， 在该用户终端接入 WLAN运营网络时，就应该根据影响授权的条件对该 用户终端进行接入规则的限定， 并把这些接入规则实施在网絡的相关交 换或路由关口上， 而不是仅仅依靠鉴权的结果就直接授权用户终端的接 入。
在实际的应用过程中， 本发明所述的接入授权并不是指移动网相关 的业务授权， 而是在业务授权之前进行的， 用来决定用户终端是否被允 许接入或在何种情况下允许接入某些网絡，至于当前接入的 WLAN用户 终端是否能应用相关业务， 还需要后续的业务授权过程进行判断处理。 举个例子来说明接入授权与业务授权是不同的， 比如： 某个用户终端申 请 Internet接入服务且当前网络中可提供两种 Internet接入服务， 一个是 通过 WLAN接入网直接接入 Internet, 另一个是通过 WLAN接入网， 再 通过 WAG接入 Internet,那么，如果对当前用户终端没有任何接入限制， 该用户终端就可以任意选择或由业务授权来确定可采用哪种服务；但是， 04 000614 如果限制当前用户终端不能通过 WLAN接入网直接接入 Internet, 则该 用户终端只能通过 WAG接入 Internet的方式， 而该用户终端最终是否能 被允许 Internet服务， 还需要业务授权来决定。
本发明对用户终端的接入授权过程参见图 3所示，包括以下的步骤： 步骤 301 302: 当 WLAN用户终端请求接入网络时， 网络对该用户 终端进行接入鉴权， 具体说就是， 网络中的接入鉴权授权单元通过接入 控制单元开始用户终端与网络之间的合法性认证过程： 用户终端通过接 入控制单元向接入鉴权授权单元发送鉴权所需的认证信息， 接入鉴权授 权单元得到用户终端的相关信息后， 在自身完成接入鉴权判定， 如果鉴 权成功， 则进入下一步， 否则通知用户终端接入鉴权失败， 结束本接入 授权流程。 这里的接入控制单元可以是 WLAN接入网中的接入控制器 ( AC ), 或是运营网络的接入关口 （WAG ), 或是两者的组合； 接入鉴 权授权单元可以是 3GPP AAA服务器。
步骤 303: 用户终端接入鉴权成功后， 接入鉴权授权单元根据当前 用户终端的授权条件判断是否允许该用户终端接入， 如果不允许， 则通 知用户终端接入授权失败， 结束本接入授权流程； 否则， 根据当前用户 终端的授权条件进一步确定当前接入用户终端的接入规则 , 该接入规则 是指授权用户终端接入时有哪些限制原则。 所述的授权条件包括： 用户 帐户情况、 或用户签约规则、 或运营商运营规则、 或前述三项的任意组 合。 所述的接入规则主要指接入网络范围或路径的限制， 比如： 可以接 入的关口和网络连接区域， 可以经由哪个网络设备接入； 该规则还可以 包括接入时间的限制。接入鉴权授权单元也可以直接确定接入规则为空， 此种情况表示对该用户终端的接入不作任何特殊限制。
其中，所述的用户签约规则可以是用户签约的接入服务的名称列表， 比如： Internet、 本地游戏网络、 星巴克连锁网络、 IPv6-Internet等等。 N2004/000614 步骤 304: 接入规则确定后， 接入鉴权授权单元一方面通知用户终 端和接入控制单元用户终端接入鉴权和授权成功， 并在自身存储所确定 的接入规则； 另一方面则将所确定的接入规则通知到各个接入规则实施 实体， 这里的接入规则实施实体是指可以实施这些规则的一个或多个网 络实体， 比如： 3GPP-AAA、 业务授权单元、 AC、 AP、 DHCP单元、 运 营网絡接入关口等等， 接入鉴权授权单元还可以将所确定的部分或全部 接入规则通知给用户终端， 使用户了解或由用户终端能够辅助实施所述 的接入规则。 其中， 向用户终端通知接入规则可与接入鉴权授权成功的 通知一起发送。 - 步骤 305: 接入规则实施实体， 比如图 3 中的业务授权单元， 得到 接入规则后存储该规则，并在用户终端经过自身申请 WLAN网络服务时 实施该接入规则， 如： 业务授权单元可根据接入规则判断是否允许当前 用户终端在该时段接入指定的网络范围并确定应该从哪儿接入。 通常， 业务授权单元和接入授权单元都在 AAA中。
具体接入规则的实施可通过过滤技术、 IP 分配方案、 虚拟局域网 ( VLAN )、 子网划分、 虚拟私人网络（VPN )、 用户层 2 隔离等现有方 法实施。 比如： 接入控制单元可通过 VLAN技术或 IP分配方式， 把当 前请求服务的用户终端划分到一个符合接入规则的子网中； 或给当前请 求服务的用户终端分配一个独立子网的地址， 使其只能在接入所在子网 或 VLAN规定的范围。 当由业务授权单元实施时， 如果用户请求相关业 务， 则先根据该用户终端对应的接入规则判断其请求的业务是否符合要 求， 如果违反接入规则， 则在业务授权判断之前就拒绝该请求。
本发明的接入授权过程是在用户接入 WLAN运营网络时进行的，一 般在网络对当前接入用户终端完成身份合法性鉴权认证之后， 如步骤 301-305 所描述的。 当然也可以在用户鉴权认证过程之前， 先判断当前 接入用户终端的授权条件并确定接入规则 , 然后再做身份合法性鉴权认 证， 只是相对过程要复杂一些。 通知用户终端时， 一般在同一条消息中 通知鉴权和授权结果， 比如： 通过 EAP协议的 EAP-success消息进行通 知； 也可以分别通知， 比如： 先通知鉴权结果再通知授权结果。 本发明 中所述的 WLAN运营网络是指 3GPP-WLA 交互网络,或 3GPP2-WLAN 交互网络， 或其他有用户签约的运营性 WLAN网络。
图 4所示为本发明在实际应用中一实施例的组网结构图， 如图 4所 示，该 3GPP-WLAN交互运营网络中 , 3GPP-AAA为接入鉴权授权单元， WLAN接入部分主要由 AC和 AP构成， AC、 或 WAG、 或 AC和 WAG 为接入控制单元。 WLAN运营网絡可以通过 WLAN接入部分直接在一 些热点地区， 比如机场、 宾馆等为 WLAN用户终端提供局域网服务 41、 Internet接入月艮务 42; WLAN运营网络还可以通过 WLAN接入部分和 WAG接入到 3GPP运营网中为 WLAN用户终端提供 3GPP网特定服务 43。 该运营网络中还包括 HSS/HLR, 用于存储用户终端的各种信息， 如 签约信息。
再参见图 4, WLAN用户终端通过 WLAN运营网络能获取的 3GPP 网特定服务 43包括： 3GPP网络运营商通过 WAG提供的 Internet接入服 务 431， 该服务可提供比热点地区直接接入 Internet更宽的带宽， 也就是 说， 在提供同样业务的情况下， Internet接入服务 431比 Internet接入服 务 42速度更快， 但收费可能更高。 特色局域网服务 432， 主要是指运营 商自己的私有网络能为用户终端提供管理或游戏等内部交互的特色业 务。 基于移动网络分组域（PS )的移动业务， 比如： 漫游地网络 VPLMN 的各类业务 433; 归属地网络 HPLMN的各类业务 434, 这里所述的各类 业务至少包括 IP多媒体子系统（ IMS-IP Multimedia Subsystem )、 短消息 ( SMS )、 多媒体短消息（MMS )、 位置业务（LCS )等移动网络特色业 4 务。
实施例一：
基于图 4所示的组网结构， 假定用户终端 A只签约了热点地区的本 地 Internet服务， 其用户签约信息的接入授权列表中只有 Internet服务， 那么， 如图 5所示， 对用户终端 A的接入授权过程是：
步骤 501 502:用户终端 A请求接入图 4所示 3GPP-WLAN网络时， 通过 AC发送接入请求和认证所需信息给 3GPP-AAA, 由 3GPP-AAA对 用户终端 A的身份合法性进行鉴权， 如果鉴权通过， 继续对该用户终端 A的授权条件进行判断， 执行步骤 503; 否则， 向用户终端 A返回接入 鉴权失败信息， 结束。
步骤 503: 3GPP-AAA根据用户终端 A的所有授权条件， 判断是否 允许用户终端 A接入， 如果不允许， 贝 U 3GPP-AAA向用户终端 A返回 接入授权失败信息， 结束； 如果允许， 贝 3GPP-AAA根据用户终端 A的 授权条件确定用户终端 A的接入规则， 那么， 根据用户终端 A的签约规 则， 用户终端 A的接入规则确定为 "仅接入热点本地的 Internet"。
步骤 504: 3GPP-AAA将接入鉴权和授权成功信息以及步驟 5( 确 定的接入规则同时通知用户终端 A，并通知 WLAN接入网的 AC,由 AC 实施该接入规则。
步骤 505: AC收到所确定的接入规则后存储， 当该用户终端 A请求 Internet服务时， AC根据预先存储的接入规则获知该用户终端只能在热 点区域接入本地 Internet,再判断用户终端 A当前是否处于热点区域，如 果是， 直接通过 AC接入本地 Internet; 否则， AC通过 VLAN技术或 IP 分配方式把用户终端 A划分到一个只能接入热点本地 Internet的子网， 或给用户终端 A 分配一个独立子网的地址， 该子网只允许接入本地 internet, 从而使用户终端 A只能接入本地 Internets 实施例二：
基于图 4所示的组网结构， 假定对用户终端 B只允许通过 WAG接 入， 不允许进行热点本地接入， 如图 5所示， 用户终端 B的接入授权过 程与实施例一中用户终端 A的接入授权过程基本相同， 只是在步骤 503 中， 用户终端 B的接入规则确定为 "允许通过 WAG接入， 不允许进行 热点本地接入，，。 这样， 在步骤 505中， AC会控制并分配用户终端 B只 接入 WAG, 而不允许用户终端 B 连接其它网络。 当用户终端 B 申请 Internet服务时， 就不能使用 Internet接入服务 42, 而只能使用 Internet 接入服务 431 , 即： 只能通过 WAG接入 3GPP运营网， 使用 3GPP运营 网提供的 Internet接入月良务。 实施例三：
基于图 4所示的组网结构， 假定对用户终端 C不允许接入漫游地移 动业务网络， 如图 5所示， 用户终端 C的接入授权过程与实施例一中用 户终端 A的接入授权过程基本相同， 只是在步骤 503中， 用户终端 C的 接入规则确定为 "漫游地业务网络不能接入，，。 基于该接入规则， 用户终 端 C拥有较多地接入权利， 根据其业务请求可以接入 LAN接入网连 接的多种不同网络， 只是漫游地移动网絡不允许接入。 该接入规则可以 在 WAG 中进行实施， 使用户不能接入漫游地业务网络； 也可以在 3GPP-AAA中直接实施。 比如： 当用户终端 C请求相关业务时， 先根据 用户终端 C对应的接入规则，判断其请求的业务接入是否符合接入规则， 如果不符合， 即用户终端 C当前处于漫游地网络中且请求的是该漫游网 络中提供的业务， 则在业务授权判断之前就拒绝该请求， 否则， 继续进 行业务授权判断。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限制本发明的 保护范围。

Claims

权利要求书
1、一种无线局域网中用户接入授权的 ^法，其特征在于该方法包括： 无线局域网（ WLAN )用户终端接入 WLAN运营网络时，该 WLAN 运营网络在对该 WLAN用户终端鉴权的同时， 根据影响该 WLAN用户 终端接入的授权条件判断是否允许该 WLAN用户终端接入， 如果允许， 则根据所述的授权条件确定该 WLAN用户终端的接入规则； 否则， 通知 WLAN用户终端失败信息。
2、 据权利要求 1所述的方法， 其特征在于， 该方法进一步包括： 将所确定的接入规则发送至一个或一个以上接入规则实施实体中实施对 用户终端接入的制约。
3、 才艮据权利要求 1或 2所述的方法， 其特征在于， 该方法进一步包 括： WLAN用户终端向 WLAN运营网络发起接入请求后， WLAN运营 网络先对当前接入的 WLAN用户终端进行合法性鉴权认证，如果鉴权通 过， 再根据授权条件判断是否允许该 WLAN用户终端接入； 否则， 向该 WLAN用户终端发送接入失败信息。
4、 根据权利要求 1所述的方法， 其特征在于， 所述影响 WLAN用 户终端接入的授权条件包括： 用户帐户情况、 或用户签约信息、 或运营 规则， 或三者的任意组合。
5、 根据权利要求 1所述的方法， 其特征在于， 所述接入规则的确定 由 WLAN运营网络中的认证授权计费 （AAA )服务器完成。
6、根据权利要求 1所述的方法， 其特征在于， 所述接入规则为确定 当前接入用户终端接入区域或路径的限制条件。
7、 根据权利要求 1所述的方法， 其特征在于， 所述接入规则为确定 当前接入用户终端接入时间的限制条件。
8、 根据权利要求 1所述的方法， 其特征在于， 所述接入规则被确定 为空。
9、 根据权利要求 2所述的方法， 其特征在于， 所述接入规则实施实 体为： AAA、 无线局域网接入关口 （WAG )、 或接入控制器 （AC )、 或 接入点 （AP )、 或用户终端。
10、 根据权利要求 9所述的方法， 其特征在于， 该方法进一步包括： 确定接入规则之后，网络将当前 WLAN用户终端接入鉴权授权成功信息 与需要通知用户终端的接入规则同时发送给 WLAN用户终端。
11、 根据权利要求 1所述的方法， 其特征在于， 所述 WLAN运营网 络为 3GPP-WLAN交互网络， 或为 3GPP2-WLAN交互网络。
12、 根据权利要求 4所述的方法， 其特征在于， 所述用户签约信息 包含用户接入网络服务的名称列表。
PCT/CN2004/000614 2003-06-06 2004-06-07 Procede d'autorisation d'acces aux utilisateurs dans un reseau local sans fil (wlan) WO2004109980A1 (fr)

Priority Applications (5)

Application Number Priority Date Filing Date Title
CA002523416A CA2523416A1 (en) 2003-06-06 2004-06-07 A method of user access authorization in the wlan
JP2006508099A JP2006526917A (ja) 2003-06-06 2004-06-07 無線ローカルエリアネットワークにおけるユーザアクセス承認方法
EP04738215A EP1633083A4 (en) 2003-06-06 2004-06-07 METHOD FOR USER ACCESS AUTHORIZATION IN WLAN
US11/260,865 US7519036B2 (en) 2003-06-06 2005-10-27 Method of user access authorization in wireless local area network
US12/389,030 US8077688B2 (en) 2003-06-06 2009-02-19 Method of user access authorization in wireless local area network

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CNB031409776A CN1266891C (zh) 2003-06-06 2003-06-06 无线局域网中用户接入授权的方法
CN03140977.6 2003-06-06

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US11/260,865 Continuation US7519036B2 (en) 2003-06-06 2005-10-27 Method of user access authorization in wireless local area network

Publications (1)

Publication Number Publication Date
WO2004109980A1 true WO2004109980A1 (fr) 2004-12-16

Family

ID=33494607

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2004/000614 WO2004109980A1 (fr) 2003-06-06 2004-06-07 Procede d'autorisation d'acces aux utilisateurs dans un reseau local sans fil (wlan)

Country Status (7)

Country Link
US (2) US7519036B2 (zh)
EP (1) EP1633083A4 (zh)
JP (1) JP2006526917A (zh)
CN (1) CN1266891C (zh)
CA (1) CA2523416A1 (zh)
RU (1) RU2316903C2 (zh)
WO (1) WO2004109980A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007044969A3 (en) * 2005-10-12 2007-06-14 Cingular Wireless Ii Llc Architecture that manages access between a mobile communications device and an ip network

Families Citing this family (55)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR100667333B1 (ko) * 2004-12-16 2007-01-12 삼성전자주식회사 홈 네트워크에서 디바이스 및 사용자 인증 시스템 및 방법
CN100571134C (zh) 2005-04-30 2009-12-16 华为技术有限公司 在ip多媒体子系统中认证用户终端的方法
US7646355B2 (en) * 2005-05-04 2010-01-12 Sandwave Ip, Llc Enclosure with ground plane
CN100461942C (zh) * 2005-05-27 2009-02-11 华为技术有限公司 Ip多媒体子系统接入域安全机制的选择方法
WO2007011632A1 (en) * 2005-07-14 2007-01-25 Sandwave Ip, Llc Virtual cells for wireless networks
DE102005046742B4 (de) * 2005-09-29 2007-08-16 Siemens Ag Zugangselement und Verfahren zur Zugangskontrolle eines Netzelements
US20070143613A1 (en) * 2005-12-21 2007-06-21 Nokia Corporation Prioritized network access for wireless access networks
US20070167171A1 (en) * 2005-12-30 2007-07-19 Mediacell Licensing Corp Determining the Location of a Device Having Two Communications Connections
US8504678B2 (en) * 2005-12-30 2013-08-06 Sandwave Ip, Llc Traffic routing based on geophysical location
US8582498B2 (en) * 2006-03-07 2013-11-12 Sandwave Ip, Llc Service subscription using geophysical location
US7720464B2 (en) * 2006-03-28 2010-05-18 Symbol Technologies, Inc. System and method for providing differentiated service levels to wireless devices in a wireless network
US20070280481A1 (en) * 2006-06-06 2007-12-06 Eastlake Donald E Method and apparatus for multiple pre-shared key authorization
US8046019B2 (en) * 2006-08-04 2011-10-25 Futurewei Technologies, Inc. Method and system for optimal allocation of uplink transmission power in communication networks
US8406170B2 (en) * 2006-11-16 2013-03-26 Telefonaktiebolaget Lm Ericsson (Publ) Gateway selection mechanism
CN101453339B (zh) * 2006-11-20 2011-11-30 华为技术有限公司 一种网络融合策略计费控制架构的系统及处理方法
CN1976309B (zh) * 2006-12-22 2010-08-18 杭州华三通信技术有限公司 无线用户接入网络服务的方法、接入控制器和服务器
US8325654B2 (en) 2006-12-28 2012-12-04 Futurewei Technologies, Inc. Integrated scheduling and power control for the uplink of an OFDMA network
EP2153621B1 (en) * 2007-04-27 2018-12-26 Telefonaktiebolaget LM Ericsson (publ) A method and a device for improved service authorization
US20080270571A1 (en) * 2007-04-30 2008-10-30 Walker Philip M Method and system of verifying permission for a remote computer system to access a web page
CN105472572B (zh) 2007-09-10 2020-01-07 蜂窝通信设备有限责任公司 封闭订户组的访问控制
CN101232424B (zh) * 2008-03-04 2010-06-30 中国移动通信集团设计院有限公司 接入方法、接入系统、信任服务中心、网络互信平台
US9009310B1 (en) 2008-06-12 2015-04-14 Hlt Domestic Ip Llc System and method for provisioning of internet access services in a guest facility
US8594333B2 (en) * 2008-09-05 2013-11-26 Vixs Systems, Inc Secure key access with one-time programmable memory and applications thereof
US9668139B2 (en) * 2008-09-05 2017-05-30 Telefonaktiebolaget Lm Ericsson (Publ) Secure negotiation of authentication capabilities
GB2465664B (en) 2008-11-27 2011-02-09 Lg Electronics Inc Method of determining an access mode of cell in a wireless communication system
KR100968022B1 (ko) * 2008-11-27 2010-07-07 엘지전자 주식회사 무선 통신 시스템상에서 셀의 접속 모드를 판단하는 방법
CN101873627A (zh) 2009-04-22 2010-10-27 华为技术有限公司 切换控制方法、装置和系统
CN102056265A (zh) * 2009-11-10 2011-05-11 中兴通讯股份有限公司 限制mtc设备接入和通信的方法、移动管理单元及网关单元
JP4790057B2 (ja) * 2009-12-04 2011-10-12 株式会社エヌ・ティ・ティ・ドコモ 移動通信方法及び交換局
CN102118836A (zh) * 2009-12-31 2011-07-06 华为技术有限公司 网络管控实现方法及系统、管控通信装置
DE102010008852B4 (de) 2010-01-04 2011-09-01 Init Innovative Informatikanwendungen In Transport-, Verkehrs- Und Leitsystemen Gmbh Verfahren, Auswerterechner und Bordcomputer zur Beeinflussung einer Lichtsignalanlage
CN101909331A (zh) * 2010-08-02 2010-12-08 中国电信股份有限公司 一种移动数据业务控制方法、系统、终端和服务器
CN101895962A (zh) * 2010-08-05 2010-11-24 华为终端有限公司 Wi-Fi接入方法、接入点及Wi-Fi接入系统
GB201018633D0 (en) * 2010-11-04 2010-12-22 Nec Corp Communication system
EP2538627A1 (de) * 2011-06-21 2012-12-26 Siemens Aktiengesellschaft Verfahren zum Betreiben eines Engineering-Systems mit Benutzeridentifikation und Vorrichtung
KR101439534B1 (ko) * 2011-09-16 2014-09-12 주식회사 케이티 ＡＣ와 ＡＰ의 연동 기반의 ＷｉＦｉ 로밍에서의 웹 리다이렉트 인증 방법 및 장치
KR101844211B1 (ko) 2011-12-28 2018-05-15 삼성전자주식회사 가전기기의 네트워크 시스템 및 그 네트워크 설정 방법
CN103516704A (zh) * 2012-06-30 2014-01-15 北京神州泰岳软件股份有限公司 一种ims客户端接入管理方法和系统
US9344452B2 (en) * 2012-07-19 2016-05-17 Sprint Communications Company L.P. User control over WiFi network access
WO2014026714A1 (en) * 2012-08-15 2014-02-20 Telefonaktiebolaget L M Ericsson (Publ) Methods and apparatus for enabling load steering in heterogeneous radio access networks
CN102932913B (zh) * 2012-10-24 2018-10-26 南京中兴新软件有限责任公司 获取mab终端接入位置的方法、服务器、网关及系统
RU2534935C2 (ru) * 2012-12-25 2014-12-10 Закрытое акционерное общество "Лаборатория Касперского" Система и способ адаптивного управления и контроля действий пользователя на основе поведения пользователя
US8793207B1 (en) 2013-01-24 2014-07-29 Kaspersky Lab Zao System and method for adaptive control of user actions based on user's behavior
CN104080172B (zh) * 2013-03-29 2018-12-21 上海诺基亚贝尔股份有限公司 一种接入网络系统中wlan资源管理的方法、装置及其系统
US9646342B2 (en) 2013-07-19 2017-05-09 Bank Of America Corporation Remote control for online banking
US9519934B2 (en) 2013-07-19 2016-12-13 Bank Of America Corporation Restricted access to online banking
WO2015081492A1 (zh) * 2013-12-03 2015-06-11 华为终端有限公司 一种网络切换方法及终端
US9055062B1 (en) * 2014-08-08 2015-06-09 Google Inc. Per-user wireless traffic handling
KR101966574B1 (ko) * 2015-02-05 2019-04-05 크리프트존 노스 아메리카, 아이엔씨. 멀티-터널링 가상 네트워크 어댑터
CN105243318B (zh) * 2015-08-28 2020-07-31 小米科技有限责任公司 确定用户设备控制权限的方法、装置及终端设备
CN105430651A (zh) * 2015-11-02 2016-03-23 上海斐讯数据通信技术有限公司 检测非法无线接入点的方法及系统
US11070392B2 (en) 2017-10-27 2021-07-20 Hilton International Holding Llc System and method for provisioning internet access
CN110830534B (zh) 2018-08-10 2022-02-08 维沃移动通信有限公司 Lan服务的控制方法和通信设备
CN110971572A (zh) * 2018-09-29 2020-04-07 北京华为数字技术有限公司 鉴权方法、服务器及客户端
LU102763B1 (en) * 2021-04-08 2022-10-10 Microsoft Technology Licensing Llc Data protection with online account validation

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
KR20010090038A (ko) * 2001-08-21 2001-10-18 (주) 대성디지탈테크 무선랜 네트워크 시스템 및 그 운용방법
US20020037708A1 (en) * 2000-09-22 2002-03-28 Roke Manor Research Limited Access authentication system
CN1453953A (zh) * 2002-04-23 2003-11-05 华为技术有限公司 一种无线局域网和移动网络的融合方法
CN1474535A (zh) * 2002-08-08 2004-02-11 深圳市中兴通讯股份有限公司 基于无线局域网与码分多址系统相结合的鉴权计费方法

Family Cites Families (30)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6442588B1 (en) * 1998-08-20 2002-08-27 At&T Corp. Method of administering a dynamic filtering firewall
US6430741B1 (en) * 1999-02-26 2002-08-06 Hewlett-Packard Company System and method for data coverage analysis of a computer program
ES2320724T3 (es) * 1999-10-22 2009-05-28 Nomadix, Inc. Sistemas y procedimientos para la gestion dinamica del ancho de banda por abonado en una red de comunicaciones.
DE60132430T2 (de) * 2000-02-22 2009-01-22 Nortel Networks Ltd., St. Laurent Verfahren und system zur steuerung eines drahtlosen paketvermittelten sprachanrufs
AU2001251701A1 (en) * 2000-02-25 2001-09-03 Identix Incorporated Secure transaction system
JP3823674B2 (ja) 2000-03-27 2006-09-20 株式会社日立製作所 プロトコル変換を伴う通信方法および通信制御装置
CA2384890A1 (en) 2000-07-27 2002-02-07 Ipwireless, Inc. Use of radius in umts to perform hlr function and for roaming
JP4567173B2 (ja) 2000-11-07 2010-10-20 エヌ・ティ・ティ・コミュニケーションズ株式会社 集線・接続システム、集線・接続方法及び集線・接続装置
JP3929693B2 (ja) 2000-11-20 2007-06-13 株式会社日立製作所 通信システム
US7136912B2 (en) * 2001-02-08 2006-11-14 Solid Information Technology Oy Method and system for data management
US7120129B2 (en) * 2001-03-13 2006-10-10 Microsoft Corporation System and method for achieving zero-configuration wireless computing and computing device incorporating same
CA2443688A1 (en) 2001-04-09 2002-10-17 Colubris Networks Inc. Authentication and encryption method and apparatus for a wireless local access network
US6594483B2 (en) 2001-05-15 2003-07-15 Nokia Corporation System and method for location based web services
US7370365B2 (en) * 2001-09-05 2008-05-06 International Business Machines Corporation Dynamic control of authorization to access internet services
WO2003024128A1 (en) * 2001-09-12 2003-03-20 Telefonaktiebolaget Lm Ericsson (Publ.) Arrangements and method in mobile internet communications systems
ATE497215T1 (de) 2001-10-29 2011-02-15 Nokia Corp Verfahren und gerät zur steuerung von einem benutzer in einem netzwerk bereitgestellten informationen
US7068610B2 (en) * 2002-02-26 2006-06-27 Unruh Lincoln J System and method for reliable communications over multiple packet RF networks
US6947725B2 (en) * 2002-03-04 2005-09-20 Microsoft Corporation Mobile authentication system with reduced authentication delay
US7430667B2 (en) * 2002-04-04 2008-09-30 Activcard Ireland Limited Media router
US20030233580A1 (en) * 2002-05-29 2003-12-18 Keeler James D. Authorization and authentication of user access to a distributed network communication system with roaming features
WO2003107224A1 (en) * 2002-06-18 2003-12-24 Arizona Board Of Regents, Acting For Arizona State University Assignment and management of authentication & authorization
US20040010713A1 (en) * 2002-07-12 2004-01-15 Vollbrecht John R. EAP telecommunication protocol extension
EP1523847A2 (en) * 2002-07-15 2005-04-20 Teledigital, Inc. Wireless telephone usage management
US6957067B1 (en) 2002-09-24 2005-10-18 Aruba Networks System and method for monitoring and enforcing policy within a wireless network
US8077681B2 (en) * 2002-10-08 2011-12-13 Nokia Corporation Method and system for establishing a connection via an access network
US7242676B2 (en) * 2002-10-17 2007-07-10 Herman Rao Wireless LAN authentication, authorization, and accounting system and method utilizing a telecommunications network
US7310307B1 (en) * 2002-12-17 2007-12-18 Cisco Technology, Inc. System and method for authenticating an element in a network environment
JP4270888B2 (ja) * 2003-01-14 2009-06-03 パナソニック株式会社 Ｗｌａｎ相互接続におけるサービス及びアドレス管理方法
US20040156340A1 (en) * 2003-02-10 2004-08-12 Telefonaktiebolaget L M Ericsson (Pub1) Method, system and packet data access node for prepaid quota provision
US20040156372A1 (en) * 2003-02-12 2004-08-12 Timo Hussa Access point service for mobile users

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20020037708A1 (en) * 2000-09-22 2002-03-28 Roke Manor Research Limited Access authentication system
KR20010090038A (ko) * 2001-08-21 2001-10-18 (주) 대성디지탈테크 무선랜 네트워크 시스템 및 그 운용방법
CN1453953A (zh) * 2002-04-23 2003-11-05 华为技术有限公司 一种无线局域网和移动网络的融合方法
CN1474535A (zh) * 2002-08-08 2004-02-11 深圳市中兴通讯股份有限公司 基于无线局域网与码分多址系统相结合的鉴权计费方法

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP1633083A4 *

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
WO2007044969A3 (en) * 2005-10-12 2007-06-14 Cingular Wireless Ii Llc Architecture that manages access between a mobile communications device and an ip network
US9775093B2 (en) 2005-10-12 2017-09-26 At&T Mobility Ii Llc Architecture that manages access between a mobile communications device and an IP network

Also Published As

Publication number Publication date
EP1633083A4 (en) 2006-09-13
US20090158442A1 (en) 2009-06-18
RU2316903C2 (ru) 2008-02-10
CN1266891C (zh) 2006-07-26
CN1553656A (zh) 2004-12-08
US20060109826A1 (en) 2006-05-25
JP2006526917A (ja) 2006-11-24
US8077688B2 (en) 2011-12-13
RU2005134506A (ru) 2006-06-10
EP1633083A1 (en) 2006-03-08
US7519036B2 (en) 2009-04-14
CA2523416A1 (en) 2004-12-16

Similar Documents

Publication Publication Date Title
WO2004109980A1 (fr) Procede d'autorisation d'acces aux utilisateurs dans un reseau local sans fil (wlan)
JP4383456B2 (ja) 新しいパブリックランドモバイルネットワークにアクセスするｗｌａｎの移動端末のための方法及びシステム
EP1916867B2 (en) A method for managing the local terminal equipment to access the network
JP4445974B2 (ja) 多種類の運営ネットワークを含む環境内で運営ネットワークを無線ｌａｎの利用者端末が再度選択する方法
US20030171112A1 (en) Generic wlan architecture
WO2006002601A1 (fr) Procede pour l'etablissement de la connexion de session par les utilisateurs de reseau local sans fil
US20040087304A1 (en) Integrated web cache
WO2005018140A1 (fr) Procede permettant a un terminal d'utilisateur d'acceder rapidement au reseau de rattachement dans un reseau local sans fil
WO2006000149A1 (fr) Procédé d'application d'une authentification d'accès d'un utilisateur wlan
WO2005057858A1 (fr) Procede de selection par un terminal d'abonne de la passerelle de paquets de donnees dans un reseau local sans fil
WO2005055518A1 (fr) Procede d'etablissement de tunnel de services dans un reseau wlan
WO2007019771A1 (en) An access control method of the user altering the visited network, the unit and the system thereof
WO2005039110A1 (fr) Analyse du traitement d'acces a un service selectionne dans un reseau local radio
WO2005004403A1 (fr) Procede de traitement d'informations selectionnees reseau au niveau du terminal d'utilisateur dans un reseau local sans fil
WO2006122487A1 (fr) MÉTHODE ET SYSTÈME POUR CHANGER LA QdS DANS UN I-WLAN
WO2005069533A1 (fr) Procede d'acquisition d'identification utilisateur permanente par passerelle de donnees par paquets (pdg) d'un reseau local (wlan)
WO2004114588A1 (en) Method for transmitting traffic data to wireless local area network users
WO2005004384A1 (fr) Procede de rejet d'alternative pour information de selection de reseau d'un terminal utilisateur dans un reseau local sans fil
WO2005071981A1 (fr) Methode interactive de determination par un terminal d'abonne d'informations de selection d'un reseau local sans fil
WO2007082479A1 (fr) Procédé et système destinés à établir un tunnel dans un wlan
Zhang et al. Virtual operator based AAA in wireless LAN hot spots with ad-hoc networking support
WO2005062631A1 (fr) Procede de redirectionnement de passerelle de donnees en paquets dans un reseau local sans fil
Li et al. Public access mobility LAN: extending the wireless Internet into the LAN environment
WO2005074192A1 (fr) Procede de collecte d'adresse de passerelle de donnees paquets (pdg) pour terminal utilisateur sur reseau local sans fil (wlan)
WO2005074193A1 (fr) Procede destine au terminal utilisateur permettant de d'acquerir des informations de paquet

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ NA SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
WWE Wipo information: entry into national phase

Ref document number: 2523416

Country of ref document: CA

WWE Wipo information: entry into national phase

Ref document number: 2004738215

Country of ref document: EP

WWE Wipo information: entry into national phase

Ref document number: 11260865

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2006508099

Country of ref document: JP

WWE Wipo information: entry into national phase

Ref document number: 2005134506

Country of ref document: RU

WWP Wipo information: published in national office

Ref document number: 2004738215

Country of ref document: EP

WWP Wipo information: published in national office

Ref document number: 11260865

Country of ref document: US