WO2005086014A1 - Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm - Google Patents

Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm Download PDF

Info

Publication number
WO2005086014A1
WO2005086014A1 PCT/US2004/005119 US2004005119W WO2005086014A1 WO 2005086014 A1 WO2005086014 A1 WO 2005086014A1 US 2004005119 W US2004005119 W US 2004005119W WO 2005086014 A1 WO2005086014 A1 WO 2005086014A1
Authority
WO
WIPO (PCT)
Prior art keywords
user device
rlm
wlan
network
authentication request
Prior art date
Application number
PCT/US2004/005119
Other languages
English (en)
Inventor
Mayank S. Chaudhary
Allam Zaheer Ahmed
Nishi Kant
Chih-Hsin Alan Chuang
Michael W. Ritter
Original Assignee
Azaire Networks Inc.
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Azaire Networks Inc. filed Critical Azaire Networks Inc.
Priority to PCT/US2004/005119 priority Critical patent/WO2005086014A1/fr
Publication of WO2005086014A1 publication Critical patent/WO2005086014A1/fr

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W60/00—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration
    • H04W60/04—Affiliation to network, e.g. registration; Terminating affiliation with the network, e.g. de-registration using triggered events
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/08—Access security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/12—Setup of transport tunnels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W76/00—Connection management
    • H04W76/10—Connection setup
    • H04W76/15—Setup of multiple wireless link connections
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W84/00—Network topologies
    • H04W84/02—Hierarchically pre-organised networks, e.g. paging networks, cellular networks, WLAN [Wireless Local Area Network] or WLL [Wireless Local Loop]
    • H04W84/10—Small scale networks; Flat hierarchical networks
    • H04W84/12—WLAN [Wireless Local Area Networks]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/02—Terminal devices
    • H04W88/06—Terminal devices adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W88/00—Devices specially adapted for wireless communication networks, e.g. terminals, base stations or access point devices
    • H04W88/16—Gateway arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W92/00—Interfaces specially adapted for wireless communication networks
    • H04W92/02—Inter-networking arrangements

Definitions

  • the present invention relates to interworking of wireless local area networks (WLANs) with cellular networks in order to provide connectivity for packet data services for cellular networks, particularly GSM-based cellular networks.
  • WLANs wireless local area networks
  • the invention also relates to techniques to overlay security and privacy onto network elements that do not provide such.
  • FIG. 1 illustrates the conventional OSI model applied to an IEEE 802.11 and Internet Engineering Task Force (IETF) stack for a wireless LAN.
  • IETF Internet Engineering Task Force
  • GSM/GPRS services are based on completely different standards and provide many features not found in the IETF and IEEE 802.1 lb stacks.
  • IETF systems do not yet provide the functionality needed to support GSM services.
  • IETF protocols do not provide a secure authentication system for interoperation with the GSM authentication system, accounting functions are in different formats, allocation of customer IP addresses is handled at a different layer of the networking stacks, roaming features are incompatible, and the IETF does not specify a micro-mobility handover protocol such as that which is detailed in GSM.
  • the typical GSM service would simply deploy two separate systems and consolidate billing afterwards. This solution is undesirable, because it is difficult for the GSM operator to manage two disparate customer databases, provide two different servers and clients for each additional service they wish to deploy, and manage two entirely different network systems with different network management systems.
  • routers typically support routing layer IETF standards such as, but not limited to, Routing Internet Protocol (RIP), and they typically use IETF standards-based authentication and accounting systems that incorporate protocols such as, but not limited to, Remote Access Dial In User Service (RADIUS).
  • RIP Routing Internet Protocol
  • RADIUS Remote Access Dial In User Service
  • a method and system are provided for integrating a WLAN radio access network into a GSM/GPRS core network wherein gateways are added that function to transparently transport services between two dissimilar types of networks such as WLAN and GSM.
  • a further aspect of the invention is secure authentication.
  • the system according to the invention has two network elements, a Radio Link Manager (RLM) and a Radio Access Controller (RAC), and a software application, a Multi-Link Client (MLC) to control the functionality of the integrati on.
  • the MLC resides on a user device such as, but not limited to, a Laptop, PDA, or cellular telephone.
  • the WLAN Radio Access Network comprises a client radio, wliich is typically either built into a client computing device or installed via a PCMCIA car ⁇ l, and an Access Point (AP), which provides translation of the wireless signals from the client radio onto a wired networking protocol.
  • AP Access Point
  • the Radio Link Manager is located between the AP and the Core Network (CN) and provides an endpoint for a. secure connection from the MLC software on the client computing device.
  • the RLM forwards authentication messages from the MLC to the RAC.
  • the RAC provides protocol stacks and interworking functions in order to allow the MLC to talk to a Home Location .Register (HLR), which is a standard network element in the GSM core network that handles authentication.
  • HLR Home Location .Register
  • the RLM and the MLC set up a "tunnel" employing Point-to-Point Protocol (PPP) Over Ethernet (PPPOE), and alL of the data packets received on this tunnel are forwarded by the RLM to the Gateway GPRS Support Node (GGSN), a standard network element in the GSM/GPRS network t at provides interconnection to the Internet or other packet data network.
  • PPP Point-to-Point Protocol
  • PPOE Point-to-Point Protocol
  • GGSN Gateway GPRS Support Node
  • the RLM sets up a tunnel using GPRS Tunneling Protocol (GTP) from the RLM to the GGSN.
  • GTP GPRS Tunneling Protocol
  • a datalink tunnel could be from the RLM to an Internet gateway that has tunneling capabilities and address assignment capabilities as part of a global packet data network.
  • GRE Generic Routing Encapsulation
  • IP in IP tunneling IP in IP tunneling
  • L2TP Layer 2 Transport Protocol
  • Mobile IP Mobile IP
  • Metricom's Ricochet Tunneling Protocol related to disparate mesh networks.
  • the two networks can interoperate seamlessly, allowing a customer to continue receiving all of the networking services currently available under GSM regardless of the radio access network that is utilized at a given time.
  • Figure 1 depicts the network stack for the IEEE WLAN specifications and the network stack specified by the IETF for the Internet protocol and compares it to the OSI model of networking. (Prior Art)
  • Figure 2 depicts an ipRAN for WLAN architecture according to the invention.
  • Figure 3 depicts a GSM network as upgraded to support GPRS and WLAN according to the present invention.
  • Figure 4 depicts user equipment necessary in a specific embodiment of the present invention.
  • Figure 5 depicts messages passed between the various elements of the ipRAN for
  • WLAN and the GSM/GPRS core network for authentication of a customer.
  • Figure 6 depicts a preferred embodiment of the packet formats in the RR protocol between a Radio Link Manager and a Radio Access Controller.
  • the present invention is a method and apparatus for connecting a Wireless Local Area Network Radio Access Network (WLAN RAN) to a GSM cellular telephone system that is upgraded with GPRS capabilities.
  • WLAN RAN Wireless Local Area Network Radio Access Network
  • the GSM network must add a Serving GPRS Support Node (SGSN) 304 as well as a Gateway GPRS Support Node (GGSN) 326 as shown in Figure 3.
  • SGSN Serving GPRS Support Node
  • GGSN Gateway GPRS Support Node
  • the cellular system Before a GPRS upgrade, the cellular system supports voice calls that are routed from a Base Station Controller (BSC) 303 to a Mobile Switching Center (MSC) 327 and thence onto the Public Switched Telephone Network (PSTN) 329.
  • BSC Base Station Controller
  • MSC Mobile Switching Center
  • PSTN Public Switched Telephone Network
  • PDN Packet Data Network
  • a user device 301 supports a GPRS radio air link 313 and sends packets to a Basestation Transmitter Server (BTS) 302.
  • BTS Basestation Transmitter Server
  • the BTS 302 forwards the packets over a direct connection 14 to one of the BSCs 303 using frame relay or other protocol.
  • the BTS 302 and BSC 303 also handle voice calls and all of the additional complexity required for such traffic.
  • Data packets are always routed through the direct connection 315 to a SGSN 304.
  • the SGSN 304 then routes the data packets through the network connection 317 to the GGSN 326, typically using GTP over internet protocols.
  • the SGSN 304 also regulates and records the Quality of Service (QOS) of the data packet connection and the number of packets and duration of connections as defined in GPRS protocols.
  • QOS Quality of Service
  • the SGSN 304 transmits this information over a direct connection 316 to a Charging Gateway Function 305 in order to allow users to be billed according to the Quality of Service (QOS).
  • the SGSN 304 also relays the authentication protocol from a Subscriber Identity Module (SIM) 417 ( Figure 4) inside the User Equipment (UE) 301 to a Home Location Register (HLR) 311 over a Signaling System 7 (SS7)-type network 324 using Mobile Application Part (MAP) protocol.
  • SIM Subscriber Identity Module
  • HLR Home Location Register
  • SS7-type network 324 Mobile Application Part
  • the GGSN 326 routes the data packets over the network 319 typically using the Internet protocol to a Public Data Network (PDN) 306, typically the Internet.
  • PDN Public Data Network
  • the data packet sent from the UE 309 supporting WLAN is eventually sent to the PDN 306.
  • the data packet is sent over a WLAN air link 322 from the UE 309 to a WLAN Access Point (AP) 308.
  • the AP 308 forwards the packet to a Radio Link Manager (RLM) 307 over the bridged network 321, typically Ethernet, but possibly over DSL, fiber, or other suitable physical medium.
  • RLM 307 forwards the data packet over network 320, typically using GTP over the Internet Protocol (GTP/IP), to the GGSN 326.
  • GTP/IP Internet Protocol
  • the GGSN 326 then forwards the data packets to the packet data network 306 over the network connection 319, typically using the Internet Protocol.
  • the network elements for providing interworking functions to WLAN split the data packets and control packets of the protocols from the UE 301 at the RLM 307 to the different network elements only as needed.
  • the authentication packets are routed to the Radio Access
  • the RAC 310 over the network connection 325, typically using the RLM to RAC (RR) protocol over the Internet protocol.
  • the RAC 310 forwards the authentication packets to the HLR 311 over the SS7 network 323 using MAP.
  • the authentication protocol operates from the UE supporting WLAN 309 using its SIM card via the Multi- Link Client software.
  • the GGSN 326 sends charging data over the direct connection 318 to the Charging Gateway Function 305.
  • the Charging Gateway Function records the total connection time and quantity of data packets sent by the UE 309 or 301 to the PDN 306.
  • the RAC 310 emulates the SGSN 304 for the connection to the HLR 311, while the SGSN 304 connection to the Charging Gateway Function is not needed for WLAN, because there are no QOS capabilities in the WLAN air link. In this manner, provisioning of the WLAN service for a particular user can be entered into the HLR 311 in the same manner that the user's GPRS service is entered. Billing can also be done at the Charging Gateway Function 305 in an exactly analogous manner.
  • the WLAN RAN can be connected to a GSM/GPRS core network with no modifications to the core network or to any procedures that are used to manage and provision services on said core network.
  • the interworking elements between the WLAN and the core GSM/GPRS network include an MLC (Multi- Link Client) which is software on the client hardware 201, an RLM (Radio Link Manager) 206 which is the routing and control point for authentication and data flow, and the RAC (Radio Access Controller) 207, which is the interworking element for authentication and provisioning.
  • MLC Multi- Link Client
  • RLM Radio Link Manager
  • RAC Radio Access Controller
  • the user equipment UE is a computing device with a WLAN radio, such as, but not limited to, a Personal Data Assistant (PDA) 202, a cellular telephone 203 or a laptop 204.
  • a WLAN radio such as, but not limited to, a Personal Data Assistant (PDA) 202, a cellular telephone 203 or a laptop 204.
  • An air link 218 used by the WLAN radio embedded in the computing devices 202, 203, or 204 may be based on the IEEE 802.1 lb specification or may be based on any other air link that can be translated onto a bridged network via the Access Point (AP) 204.
  • AP Access Point
  • Examples of other air link protocols and radios that may be used are the IEEE 802.1 la or 802,1 lg specifications, the HIPERLAN specification, or some other air link yet to be determined.
  • the AP 204 supports the IEEE 802. ID bridging protocol specification. This protocol can be run using the physical layer of Ethernet on the network 214 through a bridge or hub 205 that forwards packets over the network 215 to the RLM 206.
  • the network 215 can also use Ethernet, but the bridge or hub 205 may be replaced with a DSL (Digital Subscriber Line) modem 219 and a remote DSLAM (Digital Subscriber Line Access Manager) 221 connected by a twisted pair copper wire 220, as long as the packet appears on network 215 just as it did on network 214 and as long as the IEEE 802. ID bridging protocol specification is met between both physical network connections 214 and 215, in order for both to appear as one bridged network to the RLMs 206.
  • DSL Digital Subscriber Line
  • a remote DSLAM Digital Subscriber Line Access Manager
  • the UE 201, 202, or 203 is shown in detail in Figure 4.
  • the UE 201 has a device case 414 containing a CPU (Central Processing Unit) 402 that communicates over a connection or bus 410 with non- volatile storage 403 where various programs in the form of software instructions control the several devices 405, 406, 404, and 417, and perform their functions in the UE by being interpreted by the CPU instruction-by-instruction.
  • the Multi-Link Client software is stored in the UE non- volatile storage 403 as well.
  • the CPU 402 may copy the programs to Random Access Memory 401 over a connection or bus 409, or may run the programs directly from non-volatile storage 403.
  • the user equipment typically has, but is not required to have, an output device 404, such as a screen or a speaker that communicates over connection 412 to the CPU 402.
  • This output device 404 can be controlled by the programs resident in non-volatile memory 403 or random access memory 401.
  • the device typically has, but is not required to have, an input device 405 such as a keyboard, a mouse, or a microphone that communicates to the CPU 402 over connection 413. This input device 405 can be controlled by the programs resident in non- volatile memory 403 or random access memory 401.
  • the UE device must have a WLAN radio 406 or equivalent that is connected to the CPU 402 over a connection or bus 411 and connected to an antenna 407 over connection 408, typically but not necessarily outside the device box 414.
  • the device has a SIM reader 416 connected to the CPU 402 via connection 415 that can accept a SIM card 417 and send and receive information from the SIM card 417. [31] In a specific embodiment, this SIM Card information is sent to the CPU 402 over connection or bus 415.
  • the SIM Reader 416 may be embedded in the device case 414, or may be external to the device case 414.
  • An appropriate method is used to invoke and run the software program called the MLC (Multi-Link Client), on user equipment 201, 202, or 203 such as, but not limited to, the user of the equipment clicking on an icon on a screen (output device 404) using a mouse (input device 405), or in an alternative embodiment, a program pre-installed on the user equipment may recognize a signal from the WLAN radio 406 sent over the connection 411 to the CPU 402 that alerts the MLC software to the fact that the WLAN radio 406 can attach itself to an AP 204.
  • MLC Multi-Link Client
  • a button (input device 405) may be pressed or some other method may be used as would be evident to one skilled in the art of computer design and programming.
  • the MLC once notified that the data connection should be started, now attempts to authenticate itself to the HLR 217, which is part of the core GSM network.
  • the networks 214 and 215 should be bridged Ethernet networks by a bridge or hub 205 as the Multi-Link Client software uses Point to Point Protocol Over Ethernet (PPPOE) to set up a tunnel from the UE 201, 202 or 203 to an RLM 206.
  • PPOE Point to Point Protocol Over Ethernet
  • a different protocol could be used to encapsulate the data packets sent over the air link 218 that included the same required functionality: the ability to locate an RLM 206 that provides a tunnel server that can terminate a tunnel originated in the MLC and the ability to send the packets over the tunnel through an AP 204.
  • An example of another protocol method that would work to tunnel packets from the UE 201, 202, or 203 to the RLM 206 is the Layer 2 Transport Protocol (L2TP).
  • L2TP Layer 2 Transport Protocol
  • GRE Generic Routing Encapsulation
  • IP IP in IP tunneling
  • Mobile IP Mobile IP
  • Metricom's Ricochet Tunneling Protocol related to disparate mesh networks. There may be other examples that are equivalent but not foreseeable at the present time.
  • the MLC on the UE 201 , 202, or 203 acts as an L2TP Access Client and the network 214 and 215 is a routable network that uses the Internet protocol.
  • a set of routers replace the bridge or hub 205 and functions to transport packets between the AP 204 and the RLM 206.
  • the RLM acts as an L2TP Network Server.
  • the MLC is configured with the IP address of the RLM 206.
  • the MLC uses a standard Domain Name Service (DNS) Query to find the RLM 206. This query provides the required functionality; it finds the RLM 206 and allows for the tunneling of packets from the UE 201, 202, or 203 to the RLM 206.
  • DNS Domain Name Service
  • the AP 204 acts as a bridge, forwarding all data packets on the airlink 218 onto the bridged network 214 and forwarding all data packets from the bridged network 214 to the correct UE 201, 202, or
  • the WLAN radio 406 in the user equipment 201, 202, or 203 sends packets over the connection 408 to the antennae 407 over the air link 218 which are received by the AP
  • the WLAN radio 406 uses IEEE 802.11 protocol in order to attach to one of the APs 204. Once the WLAN radio 406 is attached to an AP 204, it notifies the CPU 402 over the connection 413 and informs the device driver software resident in the non- olatile memory 403 or Random Access Memory (RAM) 401.
  • the device driver software uses standard signaling through the CPU 402 and bus 409 or 410 to notify the MLC software of the attachment event.
  • the MLC then sends out a PPPOE Active Discovery Initiation (PADI) packet to the device driver that causes the WLAN radio 406 to send it to the AP 204.
  • PADI PPPOE Active Discovery Initiation
  • All of the RLMs 206 desirous of accepting a connection will respond to the PADI packet with a unicast PPPOE Active Discover Offer (PADO) response packet addressed to the UE 201, 202, or 203.
  • PADO PPPOE Active Discover Offer
  • the PADO packet is received by the UE 201, 202, or 203 and forwarded to the MLC.
  • the MLC has registered with the device driver of the WLAN Radio 406 to receive copies of all of these types of packets.
  • the PADO packets contain the IEEE MAC address of the RLMs 206. In this manner, the MLC can discover the address of the RLMs 206.
  • the MLC now uses this address over the bridged networks 214 and 215 and air link 218 in order to set up a PPPOE tunnel between itself and its chosen RLM 206.
  • the MLC uses PPP encapsulated in the PPPOE protocol in order to negotiate a PPP connection with the RLM 206 using the source address of the PADO packet.
  • the MLC and the RLM 206 use an extensible authentication protocol, such as PPP or 802. IX, to pass the information required to authenticate the SIM card 417 to the HLR 208, as well as authenticate the RLM 206 to the MLC.
  • information in the form of unique keys are provided by the HLR 208 to the RLM 206 and by the SIM card 417 to the MLC to enable them to set up a secure connection between the two devices. Every packet is encrypted with the unique key known only to the RLM 206 and the MLC.
  • the MLC then acts as a firewall for the UE 201, 202, or 203 and drops all packets except those correctly encrypted with the unique key.
  • the RLM 206 also acts as a firewall and drops all packets from network 215 except those correctly encrypted with the unique keys from UE 201 , 202, or 203.
  • the MLC drops all packets not coming from the PPPOE tunnel of the RLM 206, there is no method for any other UE 201, 202, or 203, or any device, such as a hub or bridge 205 to inject packets that will be received by the UE, thus securing it from any attacks of any devices connected to the core network connection 212 or bridged network 214 and 215 or the air link 218, providing secure public packet forwarding for the UE 201, 202, or 203 and freeing the customer from worries of attack or abuse of the UE 201, 202, or 203.
  • messages are passed between the various network elements in the WLAN RAN and the core GSM/GPRS network for authentication of the customer's SIM card on the UE 520 to the HLR 523.
  • These messages authorize that the customer can use WLAN and start billing and include the set- up messages used to create end-to-end tunnels from the UE 520 to the RLM 521 and from the RLM 521 to the GGSN 524 , where data traffic is received and transmitted.
  • the UE 520 finds the RLM 521 using PPPOE discovery packets and encapsulates PPP packets in this protocol in order to transport them between the UE 520 and the RLM 521.
  • Figure 5 shows packet communication between the separate network elements: the UE 520, the RLM 521 , the RAC 522, the HLR 523, and the GGSN 524. Time increases from top to bottom. A separate number labels each packet or message with an arrowed line from the network element originating the packet and ending with the network element receiving the packet. [39] Figure 5 also shows ordering of the packets. Packets that are sent earlier in time are closer to the top of the diagram. Figure 5 also shows the names of selected protocols used between the UE 520 and the RLM 521, for informational purposes only.
  • the devices use PPP to send packets back and forth and to negotiate authentication and other network configuration needed to make the UE 520 a fully participating network element in the packet data network attached to the GGSN 524.
  • PPP Packet Control Protocol
  • CHAP Challenge Authentication Protocol
  • IPCP IP Control Protocol
  • Other protocols such as 802. IX may be used also.
  • the packets or messages in each protocol are grouped together for informational purposes, with labels going down the left side of the diagram.
  • the MLC on the UE 520 uses PPP to negotiate the LCP configuration option type 0x20, with length 18 containing the International Mobile Subscriber Identifier (IMSI) and the LCP configuration option type 0x21 with a length of 18 bytes for the nonce, a pseudo-random number 16 bytes long that varies in each instance as unpredictably as possible, by sending the PPP LCP configuration option packet 501 to the RLM 521.
  • IMSI International Mobile Subscriber Identifier
  • RLM 521 receives the LCP options and remembers the nonce (a random number used for challenge) for later use. It then forwards the IMSI to the RAC 522 in the Attach Request packet 502 of the RAC to RLM (RR) protocol as described in Table 2.
  • the RR protocol as depicted in Figure 6 and Table 1 in a specific embodiment, has an 8 bit version number, followed by an 8 bit message number, followed by a 16 bit length, in bytes of the message payload to follow, followed by the 32 bit identifier of the UE 520 as assigned by the RLM 521 and which consists of 20 bits of RLM 521 unique identification and 12 bits of unique identification for the UE 520 assigned by the RLM 521 , followed by the message payload itself.
  • Table 1 [44] The message number in the RR protocol for each of the messages between the RAC and the RLM is listed in Table 1. The payloads of the Attach Request packet 502 for the RR protocol between the RAC and the RLM are described in Table 2.
  • the RAC 522 forwards the Attach Request to the HLR 523, all communications using the MAP protocol over an SS7 network.
  • the HLR 523 either rejects the request with an Attach Reject 516a, if, for instance the customer has not paid their bill or the customer's cellular operator does not have a roaming agreement with this network operator; or asks the SIM card to authenticate itself by sending an Authentication Request packet 516 including the Kc, a key generated by secret parameters known only to the HLR and the SIM card, using A8 type GSM authentication protocols and one or more RANDs, a random number of 64 bits, and the Signed Response (SRES) that can be authenticated using A5 type authentication protocols, which proves that the HLR knows the secret shared with the SIM card and is used to provide authentication of the SIM card to the operator's network.
  • the RAC 521 forwards the information in the Authentication Request packet 516 using the Authentication Request packet 503 of the RR protocol between
  • Table 5 shows reasons for rejecting the Attach Request and field value to place in Attach Reject packet's Reject_Code field. If the RLM receives the Authentication Request 503 it forwards the PPP LCP Accept message 504 to the UE 520 that allows the PPP client to continue its state machine and respond to authentication requests. If the RLM 521 receives the Authentication Reject message 503a it forwards the PPP LCP Reject message 504a to the UE 520 that then terminates the PPP negotiation.
  • the PPP state machine at the RLM 521 After sending the PPP LCP Accept 504 message to the UE 520, the PPP state machine at the RLM 521 initiates a CHAP session by sending a challenge packet 505 in the preferred embodiment using the LCP configuration option type 3, authentication protocol value 0xc223 for CHAP.
  • the Algorithm field we use the value 0x88 for SIM- based authentication to designate our algorithm as described below.
  • the Challenge field data sent to the UE 520 in packet 505 from the RLM 521 consists of two 16 byte random numbers and the MAC_RAND, which is a signed version of the two random numbers combined with the nonce, the two Kcs, the IMSI, and the two SRESs using the shah-1 algorithm, a hash algorithm.
  • Other hash algorithms, such as MD- 5 may also be used.
  • a Kc can be generated by the MLC on the UE 520 from each RAND sent in message 503 to the RLM 521 and forwarded to the UE 520 in the CHAP challenge message 505 by sending each RAND to the SIM card 417 and getting a Kc as the response generated by the GSM algorithm A8.
  • the UE 520 can then verify that the information in message 505 was signed correctly; if this is successful, it proves to the UE 520 that the RLM 521 was able to talk to the HLR 523 and knows the Kc, thus authenticating the RLM 521 is a legitimate interworking box for the customer's operator.
  • the MLC in the UE 520 responds with the CHAP response message 506 that includes the MAC_SRES, which is a signed version of the two SRESs, the two Kcs, the nonce, and the IMSI sent to the RLM 521 in message 503 using the shah-1 algorithm.
  • the UE 520 generates each SRES from the RAND sent to it in message 505 that was forwarded from the value in the RAND field of the Authentication Request packet 503 at the same time it generated the Kcs from the SIM card 417.
  • the RLM 521 receives the MAC_SRES it verifies that the MAC_SRES was signed correctly by the UE 520 thus verifying that the UE 520 has the correct SIM card 417, thus authenticating the customer's UE 520 to the RLM 521 or proving that the UE 520 could not authenticate itself by noticing the MAC_SRES was not signed correctly.
  • the RLM 521 then forwards this authentication fact to the RAC 522 with an Authentication Response packet 507, the payload of which is shown in Table 6.
  • the RAC 522 then responds to the RLM 521 with an Attach Accept message 508 indicating it understood the authentication fact. Assuming a successful authentication, the RLM 521 sends a PDP Context Activation message 509 to the GGSN 524 over the GTP control protocol to inform the GGSN that a GTP tunnel should be set up for the UE 520 allowing the UE 520 to attach to the packet data network. The RLM 521 then sends a CHAP Success message 510 to the UE 520 to verify that the authentication was done correctly or a CHAP Failure message 510a if authentication was not successful.
  • the RLM 521 then sends an Attach Complete message 511 to the RAC 522 so that it can complete its state machine and store the parameters of the UE 520 attach to be used for handover in the future.
  • the GGSN 524 When the GGSN 524 is finished activating the GTP tunnel it sends a PDP Context Response message 512 to the RLM 521 which then sends the IP assignment information in message 513 to the UE 520, including the information necessary for the UE 520 to send IP packets to the PDN 306.
  • the RLM 521 forwards notification of the GTP tunnel's successful creation to the RAC 522 in order to allow the RAC 522 to update its state machine and store the parameters of the UE 520 's tunnel to be used for handover in the future.
  • Table 7 describes the payload of the attach accept packet.
  • the UE 520 has by this procedure now been successfully authenticated by the GSM/GPRS core network and has a pair of tunnels set up for it, the first, using PPPOE, is between the MLC on the UE 520 and the RLM 521; the second, using GTP, is between the RLM 521 and the GGSN 524.
  • the PPPOE tunnel uses default encryption based on AES with the unique shared keys based on Kc, the nonce, and the IMSI which guarantees that packets sent by the UE 520 cannot be spoofed by anyone else on any network and that the packets are private and cannot be snooped by anyone else on the path from the UE 520 to the RLM 521.
  • the RLM 521 takes the IP packets received from the UE 520 on the PPPOE tunnel that are successfully decoded and places them in the GTP tunnel to the GGSN 524.
  • the GGSN 524 takes those packets and sends them to the PDN 306.
  • Data packets addressed to the UE 520 are received by the GGSN 524 who, for connecting to the packet data network of the Internet, advertises a public route to the IP address assigned to the UE 520.
  • the GGSN 524 places those packets in the GTP tunnel and sends them to the RLM 521.
  • the RLM 521 takes those packets, encrypts them and forwards them to the UE 520 over the PPPOE tunnel.
  • the MLC on the UE 520 takes the received packets over the PPPOE tunnel, and after successfully decrypting them, passes them up the stack to other processes on the UE 520, thus providing a packet data network connection, typically an internet connection, to the UE 520.
  • a packet data network connection typically an internet connection
  • the preferred embodiment of the invention provides for secure, authenticated access to packet data networks through an operator's unmodified core GSM/GPRS network for a UE 520 that only has a WLAN radio 416 and SIM card reader 416 and SIM card 417.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

L'invention concerne un procédé et un système d'intégration d'un réseau d'accès radio WLAN dans un réseau central GSM/GPRS, dans lesquels sont ajoutées des passerelles qui transportent de manière transparente des services entre les deux réseaux. Selon un autre aspect, l'invention porte sur l'authentification sûre. Le système possède deux éléments de réseau: un gestionnaire de liaison radio (RLM) et un contrôleur d'accès radio (RAC), une application logicielle, un client multiliaison (MLC) qui commande la fonctionnalité de l'intégration et de l'authentification. Le MLC réside sur un dispositif d'utilisateur. Le RAC fournit des piles de protocoles et des fonctions d'interfonctionnement afin de permettre au MLC de parler à un enregistreur de localisation nominal (HLR). Le RML et le MLC établissent un 'tunnel' à l'aide de, par exemple, PPP sur Ethernet (PPPOE), et tous les paquets de données reçus sur ce tunnel sont retransmis par le RLM au noeud de support GPRS de passerelle (GGSN) sur un autre tunnel à l'aide du protocole de tunnelisation GPRS (GTP).
PCT/US2004/005119 2004-02-20 2004-02-20 Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm WO2005086014A1 (fr)

Priority Applications (1)

Application Number Priority Date Filing Date Title
PCT/US2004/005119 WO2005086014A1 (fr) 2004-02-20 2004-02-20 Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
PCT/US2004/005119 WO2005086014A1 (fr) 2004-02-20 2004-02-20 Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm

Publications (1)

Publication Number Publication Date
WO2005086014A1 true WO2005086014A1 (fr) 2005-09-15

Family

ID=34920940

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/US2004/005119 WO2005086014A1 (fr) 2004-02-20 2004-02-20 Procede et systeme d'interconnexion sure et transparente d'un reseau d'acces radio wlan a un reseau central gprs/gsm

Country Status (1)

Country Link
WO (1) WO2005086014A1 (fr)

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040082366A1 (en) * 2001-04-23 2004-04-29 Nokia Corporation Method and system for implementing a signalling connection in a distributed radio access network
US20040093418A1 (en) * 2002-11-13 2004-05-13 Jukka Tuomi Update of subscriber profiles in a communication system
US6741868B1 (en) * 1999-07-30 2004-05-25 Curitell Communications Inc. Method and apparatus for interfacing among mobile terminal, base station and core network in mobile telecommunications system
US20040105413A1 (en) * 2002-07-02 2004-06-03 Interdigital Technology Corporation System and method for tight inter-working between wireless local area network (WLAN) and universal mobile telecommunication systems (UMTS)
US6766377B1 (en) * 2000-08-24 2004-07-20 3Com Corporation Media gateway proxy

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6741868B1 (en) * 1999-07-30 2004-05-25 Curitell Communications Inc. Method and apparatus for interfacing among mobile terminal, base station and core network in mobile telecommunications system
US6766377B1 (en) * 2000-08-24 2004-07-20 3Com Corporation Media gateway proxy
US20040082366A1 (en) * 2001-04-23 2004-04-29 Nokia Corporation Method and system for implementing a signalling connection in a distributed radio access network
US20040105413A1 (en) * 2002-07-02 2004-06-03 Interdigital Technology Corporation System and method for tight inter-working between wireless local area network (WLAN) and universal mobile telecommunication systems (UMTS)
US20040093418A1 (en) * 2002-11-13 2004-05-13 Jukka Tuomi Update of subscriber profiles in a communication system

Similar Documents

Publication Publication Date Title
US7155526B2 (en) Method and system for transparently and securely interconnecting a WLAN radio access network into a GPRS/GSM core network
EP1330073B1 (fr) Méthode et dispositif pour contrôler l'accès d'un terminal sans fil dans un réseau de communication
AU2005236981B2 (en) Improved subscriber authentication for unlicensed mobile access signaling
RU2304856C2 (ru) Способ и система, предназначенные для установления соединения через сеть доступа
CA2249830C (fr) Systeme de selection d'installations d'interfonctionnement incorpore a un reseau
EP1502388B1 (fr) Système, appareil et procédé d'authentification à base de module SIM et de cryptage dans un accès à un réseau local radio
EP1770940B1 (fr) Procédé et dispositif pour établir une connexion de communication entre un dispositif mobile et un réseau
JP5209475B2 (ja) Ｓｉｍカードを有する個人用アクセスポイント
JP2004507973A (ja) 総称的ｗｌａｎアーキテクチャ
US20030139180A1 (en) Private cellular network with a public network interface and a wireless local area network extension
KR20050092405A (ko) Ｗｌａｎ 상호접속에서의 서비스 및 어드레스 관리 시스템및 방법
WO2005115028A1 (fr) Procédé pour une communication sur un réseau étendu sans fil sur ip et l’internet
KR20060031813A (ko) Ｃｄｍａ 시스템에서 이동ｉｐ 버전 6 서비스 지원하기위한 방법, 시스템 및 장치
JP2010213357A (ja) ２つの無線ネットワークのインターフェースを確立する方法
JPH11275157A (ja) 最適ルーティングシステム
JP2006520962A (ja) 異なるユーザ装置を収容可能なフレキシブルｗｌａｎアクセスポイントアーキテクチャ
JP2010104029A (ja) Ｗｌａｎタイトカップリング解決法
US20060179474A1 (en) Authentication of a wlan connection using gprs/umts infrastructure
Park Wireless internet access for mobile subscribers based on the GPRS/UMTS network
US20060009197A1 (en) Call setting method for packet exchange network
WO2006003630A1 (fr) Procede et systeme pour etablir une retrocompatibilite entre protocoles pana et ppp dans un reseau de paquets de donnees
KR100746872B1 (ko) 식별자에 의해 지정된 패킷 데이터 전송 표준의 세션이용을 허가하는 방법 및 장치
RU2292648C2 (ru) Система, устройство и способ, предназначенные для аутентификации на основе sim и для шифрования при доступе к беспроводной локальной сети
CN100591032C (zh) 通过ip网络传送信息的方法及其设备和终端
US20110078764A1 (en) Tight coupling signaling connection management for coupling a wireless network with a cellular network

Legal Events

Date Code Title Description
AK Designated states

Kind code of ref document: A1

Designated state(s): AE AG AL AM AT AU AZ BA BB BG BR BW BY BZ CA CH CN CO CR CU CZ DE DK DM DZ EC EE EG ES FI GB GD GE GH GM HR HU ID IL IN IS JP KE KG KP KR KZ LC LK LR LS LT LU LV MA MD MG MK MN MW MX MZ NA NI NO NZ OM PG PH PL PT RO RU SC SD SE SG SK SL SY TJ TM TN TR TT TZ UA UG US UZ VC VN YU ZA ZM ZW

AL Designated countries for regional patents

Kind code of ref document: A1

Designated state(s): BW GH GM KE LS MW MZ SD SL SZ TZ UG ZM ZW AM AZ BY KG KZ MD RU TJ TM AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HU IE IT LU MC NL PT RO SE SI SK TR BF BJ CF CG CI CM GA GN GQ GW ML MR NE SN TD TG

121 Ep: the epo has been informed by wipo that ep was designated in this application
NENP Non-entry into the national phase

Ref country code: DE

WWW Wipo information: withdrawn in national office

Country of ref document: DE

122 Ep: pct application non-entry in european phase