WO2009007612A1

WO2009007612A1 - Method and server for managing access to a telecommunication network

Info

Publication number: WO2009007612A1
Application number: PCT/FR2008/051180
Authority: WO
Inventors: Eric Barault; Armand Vandenbussche
Original assignee: France Telecom
Priority date: 2007-06-29
Filing date: 2008-06-27
Publication date: 2009-01-15

Abstract

The server (20) of the invention can be connected to a telecommunication network (100), and comprises: a means (24) for receiving an access request to the network (100) transmitted by a terminal (10) via a first gateway (31); a means (11) for receiving from said request an identifier (IP31) of the gateway (31); a means (11) for obtaining from said identifier (IP31) a profile (P10) of the user of the terminal (10); a means (11) for obtaining from the profile (P10) an identifier (IP32) of a second access gateway (32) to the network (100); a means (11) for comparing the identifiers (IP31, IP32); and a means (14) for sending a message (OK, NOK) to the terminal (10) representative of a state of the first gateway (31) for the server (20), the message being selected based on the result of the comparison.

Description

Method and server for managing access to a telecommunications network

BACKGROUND OF THE INVENTION The invention lies in the field of access management to a telecommunications network.

In the context of the invention, and in a nonlimiting manner, this network may be a mobile telecommunications network, for example of the GSM, UMTS or CDMA type, or an IP network. In known manner, users can directly access these networks, using a terminal implementing the adapted protocol.

But, it is more and more common for users to access these networks through an access network. Such an access network may for example be constituted, without limitation, by a WiFi network.

In this document, we will call "gateway" the interconnection equipment between the access network and the main network. Such a gateway can be managed by the end user (residential gateway) or by the operator in the case of an access network of the "hot spot" type.

With the deployment of WiFi type residential networks and hot spots, it is increasingly common for a terminal to be under the coverage of several access networks. When the case occurs, it is necessary to provide an access network selection mechanism. The document EP 1 681 794 proposes to record, at the terminal, the identifiers of the access networks which have a direct connection with the nominal network of the user. When the terminal is under the coverage of several access networks, it checks whether the identifier of at least one of these access networks corresponds to one of those registered in this terminal. If several access networks correspond to this criterion, the terminal selects the access network according to predefined priority rules in the terminal.

This solution has several disadvantages. First of all, it requires the user to record the access network identifiers in his terminal. Most importantly, predefined priority rules at the terminal level do not allow the operator to dynamically manage network resources.

Object and summary of the invention

The object of the invention is in particular to solve the aforementioned drawbacks of the state of the art by proposing a mechanism for managing access to a telecommunications network that is transparent to the user and that allows efficient administration of resources for the operator. .

According to a first aspect, the invention relates to a method of managing access to a telecommunications network that can be implemented by a server connected to this network, this method comprising a step of receiving an access request. to the network, transmitted by a terminal via a first access gateway to the network. This process comprises:

a step of obtaining, from the request, an identifier of the first gateway;

a step of obtaining, from this identifier, a profile of a user of the terminal;

a step of obtaining, from this profile, an identifier of a second access gateway to the network;

a step of comparing the identifiers; and

a step of sending to the terminal a message representative of a state of the first gateway for the server, this message being chosen according to the result of the comparison.

Correlatively, the invention relates to a server that can be connected to a telecommunications network, this server comprising means for receiving a network access request transmitted by a terminal via a first gateway. This server includes:

means for obtaining, from the request, an identifier of the first gateway;

means for obtaining, from this identifier, a profile of a user of the terminal; means for obtaining, from this profile, an identifier of a second access gateway to the network;

means for comparing these identifiers; and

means for sending to the terminal a message representative of a state of the first gateway for the server, this message being chosen according to the result of the comparison.

In an embodiment according to the invention, the second gateway is the gateway that the server favors, at a given time, for the accesses of the terminal in question to the network. In this case, the message sent by the server indicates to the terminal that it can access the network via the first gateway, if it corresponds to the second gateway.

In another embodiment according to the invention, the second gateway is a forbidden gateway for the accesses of the terminal in question to the network. In this case, the message sent by the server indicates to the terminal that it can access the network via the first gateway, if it does not correspond to the second gateway.

According to the invention, and advantageously, the identifiers of the gateways allowed and / or prohibited for access to the network by a terminal are managed centrally and are accessible by the server. It is therefore not necessary that the user configures his terminal with such identifiers. This solution allows dynamic management of these identifiers by an operator in particular.

The server according to the invention can be placed at different points of the network, the only requirements being that it receives the access request sent by the terminal, and that it has the means to obtain the identifier of this gateway. preferred.

In particular and without limitation, the server according to the invention may be a DSLAM device (DSL access entity) to which the first gateway is connected.

The server according to the invention is therefore able to determine if the current gateway (the first gateway through which the terminal actually accesses the network) is the preferred gateway or not and to send the terminal a message representative of this fact. According to a second aspect, the invention relates to a method of access to a telecommunications network that can be implemented. implemented by a terminal comprising a step of sending, via a first gateway, a network access request to a server connected to the network.

This method comprises: a step of receiving, from the server, a message representative of a state of the first gateway for the server;

a step of searching, based on this message, for a second network access gateway; and if successful:

- A step of sending, via the second gateway, a network access request to the server.

Correlatively, the invention relates to a terminal comprising means for sending, via a first gateway, to a server connected to a telecommunications network, a request for access to the network. This terminal comprises:

means for receiving, from the server, a message representative of a state of the first gateway for this server;

search means, according to this message, of a second network access gateway; and if successful: - means for sending, via the second gateway, a network access request to the server.

The terminal according to the invention is adapted to receive the message sent by the server, this message containing information that the terminal is connected to the network via the gateway preferred by the server at this time or not.

If this is not the case, the terminal according to the invention searches if it is under the coverage of another gateway network access and, if it is the case, it sends a new request for network access to the server via this other gateway. Of course, according to the invention, if the server determines that the terminal is finally connected to the network via the gateway preferred by the server, the terminal continues to access the network via this gateway.

In a particular embodiment of the invention, if the terminal fails in its search for a new access gateway to the network, it connects to the network via the first gateway, or via the gateway from which it receives the best signal.

In a particular embodiment of the invention, the first and second gateways are connected to the network and the identifiers of the first and second gateways are the addresses of these gateways in the network.

In this embodiment, the server according to the invention can directly obtain the address of the first gateway from the access request sent by the terminal. In a particular embodiment, the access management method according to the invention comprises a terminal authentication step using a secret function and a secret received in the access request.

This step advantageously allows the server to verify the identity of the terminal from which it has received the access request.

Similarly, in a particular embodiment of the invention, the access method according to the invention comprises a server authentication step using a secret function and a content of said message. This feature advantageously allows the terminal to verify that the message has actually been issued by the authorized server.

Very advantageously, in a particular embodiment in which the identifier of the second gateway is obtained from a table, this method comprises: a step of obtaining at least one parameter representative of a state at least one network access gateway; and

a step of updating the identifier of the second gateway in the table according to this parameter.

This feature allows the server according to the invention to dynamically manage so-called privileged gateways.

Indeed, the server can for example obtain parameters representative of the load of different access gateways of the network and privilege, for a given user, the least loaded gateway at a given time. In a particular embodiment, the different steps of the access method and the access management method are determined by computer program instructions.

Accordingly, the invention also relates to: a computer program on an information medium, this program being capable of being implemented in a server or more generally in a computer, this program comprising instructions adapted to the implementing the steps of an access management method as described above; and a computer program on an information medium, this program being capable of being implemented in a terminal or more generally in a computer, this program comprising instructions adapted to the implementation of the steps of a access method as described above. These programs can use any programming language, and be in the form of source code, object code, or intermediate code between source code and object code, such as in a partially compiled form, or in any other form desirable shape. The invention also relates to a computer readable information medium, and comprising instructions of the computer programs as mentioned above.

The information carrier may be any entity or device capable of storing the program. For example, the medium may comprise storage means, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a floppy disk or a disk. hard.

On the other hand, the information medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio or by other means. The program according to the invention can be downloaded in particular on an Internet type network.

Alternatively, the information carrier may be an integrated circuit in which the program is incorporated, the circuit being adapted to execute or to be used in the execution of the process in question.

BRIEF DESCRIPTION OF THE DRAWINGS Other features and advantages of the present invention will emerge from the description given below, with reference to the accompanying drawings which illustrate an embodiment having no limiting character. In the figures:

- Figure 1 shows, schematically, a terminal and a server according to the invention, in their environment, in a particular embodiment of the invention;

FIG. 2 represents, in flowchart form, the main steps of an access management method according to the invention, in a particular embodiment; and FIG. 3 represents, in flowchart form, the main steps of an access method according to the invention, in a particular embodiment.

DETAILED DESCRIPTION OF THE EMBODIMENT FIG. 1 shows a terminal 10 and a server 20 according to the invention, in a particular embodiment of the invention.

The server 20 is connected to the referenced operator network

In the exemplary embodiment described here, the server 20 has the conventional architecture of a computer. It comprises in particular a processor 21, a random access memory 22, a read-only memory 23 and communication means 24 with the network of the operator 100.

The read-only memory 23 constitutes a computer-readable recording medium 20 on which a computer program P2 is recorded which includes instructions for executing the steps of an access management method according to the invention. the main steps of this process being shown in FIG.

The ROM 23 of the computer 20 also includes a computer program FS adapted to calculate a secret function. In the example described here, the server 20 according to the invention also stores a table 25 in a rewritable non-volatile memory 26.

This table comprises two records 251, 252. The first record, 251, associates with the terminal 10 a profile

PlO of the user of this terminal.

The record 252 associates with the user profile PlO the IP address ₃₂ , on the operator network 100, of an access gateway 32 to this network 100. In accordance with the invention, this gateway 32 is the gateway that the operator privileges, at a given moment, for the accesses of the terminal 10 to the network 100.

In FIG. 1, three gateways 31, 32, 33 for access to the network 100 are shown. Each of these access gateways 31, 32, 33 defines an access network referenced respectively RA1, RA2, RA3.

In the example of FIG. 1, the terminal 10 is both under cover of the access gateways 31 and 32, and it is assumed that it has established a CA communication with the residential gateway 31 to access the network 100 In the exemplary embodiment described here, the terminal 10 has the conventional architecture of a computer. It has a processor 11, a random access memory 12, a read-only memory 13, means 14 for communication with the gateways 31, 32, 33 and a rewritable non-volatile memory 15 in which a secret SlO is stored. This secret SlO may for example be stored in the non-volatile memory rewritable by the manufacturer of the terminal 10.

The read-only memory 13 constitutes a recording medium readable by the terminal 10 on which is recorded a computer program P1 comprising instructions for executing the steps of an access method according to the invention and whose main steps are shown in flow chart form in Figure 2.

In the embodiment described here, the read-only memory 13 also comprises a computer program FS able to calculate a secret function similar to the computer program of the same name that can be implemented by the server 20. In the embodiment described here, each of the access gateways 31, 32, 33 comprises: a first network card 3 for communicating within the access networks RA1, RA2, RA3 with the terminal 10; and a second network card 4 for communicating, on the network 100, with the server 20.

It will be assumed that the addresses of these gateways 31, 32, 33 on the network 100 are respectively IP3i, IP32 and IP33.

We will now describe with reference to Figures 2 and 3 the main steps of the access management method and the access method according to the invention in this embodiment.

As previously stated, we will assume that the terminal 10 has established a communication CA with the access gateway 31 to access the network 100. During a first step FlO, the terminal 10 sends, to the server 20, a request of access to the network 100 via the first gateway 31.

In the embodiment described here, this access request comprises an identifier 10 of the terminal 10 and the secret SlO of this terminal stored in its rewritable non-volatile memory 15.

We will assume that this access request is received by the server 20 during a step ElO of a first process A of the access management method according to the invention.

In known manner, this access request includes the IP address ₃₁ of the first gateway 31 on the network 100.

During a step E20, the server 20 according to the invention obtains this IP address ₃₁ (current address).

During a step E30, the server 20 executes the computer program FS to calculate a secret from the identifier 10 contained in the request.

Then the computer program FS checks, during an E40 test, whether the secret result of this calculation is identical or not to the secret SlO received in the access request, and authenticates the terminal 10 according to the result of this comparison. If the authentication fails, the result of the test E40 is negative and the access management method according to the invention, in this embodiment, ends.

We will assume here that authentication succeeds. In this case, the test E40 is followed by a step E50 during which the server 20 obtains the profile PlO of the user of the terminal 10 from the identifier 10 of this terminal.

In the embodiment described here, it obtains this profile PlO by reading the record 251 of the table 25. Then, during a step E60, the server 20 according to the invention obtains, by reading the second record 252. of table 25, the IP address ₃₂ of the preferred gateway for this user.

During a step E70, the server 20 according to the invention compares the address of the current IP gateway ₃₁ with the address of the preferred gateway IP32. Then, during a step E80, the server 20 sends a message to the terminal 10.

In the embodiment described here, this message comprises:

the identifier 20 of the server 20;

- an OK or NOK status; and a secret obtained from the identifier 20 and this status.

In this embodiment, the OK status is chosen by the server 20, when the comparison E70 made it possible to determine that the terminal 10 was accessing the network 100 via the privileged gateway.

The NOK status is chosen otherwise. The sending step E80 of this message completes the process A of the access management method according to the invention in this embodiment.

The message sent by the server 20 in step E80 is received, in this embodiment, by the terminal 10 during a step F20.

This step F20 is followed, in this example, by a step F30 during which the terminal 10 authenticates the server 20 by using the different fields contained in this message (server identifier 20, status OK / NOK and secret) and the program FS computer stored in the ROM 13 of the terminal 10.

If, during an F40 test, the terminal 10 determines that the authentication of the server 20 has failed, the access method according to the invention ends, in this embodiment. If the authentication succeeds, the test F40 is followed by an F50 test in which the terminal 10 determines whether it accesses the network 100 via the preferred gateway or not, depending on the OK / NOK status received in the message. If the status is OK, that is to say if the terminal accesses the network via the gateway preferred by the operator, the access management process ends.

In the example described here, this is not the case since during step E70 the server 20 determined that the IPs ₁ and IP32 addresses were different.

In this case, the test F50 is followed by a step F60 during which the terminal 10 searches if it is under the cover of a second gateway.

In this case, this is the case, since the terminal is also under the cover of the gateway 32.

The test F70 is then followed by a step F80 during which the terminal 10 breaks the communication CA with the first gateway 31, establishes a communication with the second gateway 32 and sends the server 20 a new access request to the network 100 via this gateway 32.

Those skilled in the art will understand that this new access request is received by the server 20 during the step ElO already described, that the server determines, during the step E70, that the gateway 32 used for the access is actually the preferred gateway, which causes, during a step E80, sending a message with an OK status to the terminal 10.

This message will be received by the terminal 10 during the step F20.

In the embodiment described here, if the step F60 of searching for a new gateway fails, the result of the test F70 is negative, and the terminal 10 connects to the network 100, via the first gateway 31 .

In the embodiment described here, the access management method according to the invention comprises a second process B consisting mainly of a two-stage loop E90, E95. In step E90, the server 20 obtains parameters representative of the load of the gateways 31, 32, 33.

Then, during a step E95, the server 20 stores in the record 252 of the table 25, the address of the least loaded gateway.

Thus, the operator can dynamically control the gateway he favors for access to the network 100 by the terminal 10.

The access management method according to the invention makes it possible, as has been demonstrated, to dynamically manage the network access gateways for the terminal of a given user, without this user having to manually configure his terminal.

Claims

A method for managing access to a telecommunications network (100) that can be implemented by a server

(20) connected to said network, said method comprising a step (ElO) for receiving an access request to said network (100), sent by a terminal (10) via a first access gateway (31) to said network ( 100), said method being characterized in that it comprises: - a step (E20) of obtaining from said request, an identifier (IP ₃ i) of said first gateway (31);

a step (E50) of obtaining, from said identifier (IP ₃₁ ), a profile (PlO) of a user of said terminal (10);

a step (E60) of obtaining, from said profile (PlO), an identifier (IP ₃₂ ) of a second access gateway (32) to said network (100);

a step (E70) for comparing said identifiers (IP31, IP ₃₂ ); and

a step (E80) for sending to said terminal (10) a message (OK, NOK) representative of a state of said first gateway (31) for said server (20), said message being chosen according to the result of said comparison (E70).

2. Access management method according to claim 1, wherein said first (31) and second (32) gateways are connected to said network (100), characterized in that said identifiers (IP _3I , IP ₃₂ ) of the first and second second gateways are the addresses of said gateways in said network (100).

3. Access management method according to claim 1 or 2, characterized in that it further comprises a step (E30) of authentication of said terminal (10) using a secret function (FS) and a secret ( SlO) received in said request.

4. Access management method according to any one of claims 1 to 3, wherein said identifier (IP32) of said second gateway (32) is obtained from a table (25), characterized in that it comprises : a step (E90) of obtaining at least one parameter representative of a state of at least one access gateway (31, 32, 33) to said network (100); and

a step (E95) for updating said identifier (IP ₃₂ ) of the second gateway (32) in said table (25) according to said parameter.

A computer program (P2) comprising instructions for performing the steps of the access management method according to any one of claims 1 to 4 when said program is executed by a computer (20).

A computer-readable recording medium (23) (20) on which a computer program (P2) is recorded including instructions for executing the steps of the access management method according to any one of the Claims 1 to 4.

A server (20) connectable to a telecommunications network (100), said server (20) having means (24) for receiving an access request to said network (100), transmitted by a terminal (10). ) via a first gateway (31), said server (20) being characterized in that it comprises:

means (11) for obtaining, from said request, an identifier (IP31) of said first gateway (31);

means (11) for obtaining, from said identifier (IP ₃₁ ), a profile (PlO) of a user of said terminal (10); means (11) for obtaining, from said profile (PlO), an identifier (IP ₃₂ ) of a second access gateway (32) to said network (100);

means (11) for comparing said identifiers (IP _3I , IP ₃₂ ); and

means (14) for sending to said terminal (10) a message (OK, NOK) representative of a state of said first gateway (31) for said server (20), said message being chosen according to the result of said comparison (E70).

8. A method for accessing a telecommunications network that can be implemented by a terminal (10) comprising, a step (FlO) sending, via a first gateway (31), a request access to said network (100) for a server (20) connected to said network (100), said method being characterized in that it comprises:

a step (F20) receiving, from said server (20), a message (OK, NOK) representative of a state of said first gateway (31) for said server (20);

a step (F60) of searching, as a function of said message, of a second gateway (32) for access to said network (100); and if successful (F70):

a step (F80) of sending, via said second gateway (32), an access request to said network (100) to said server (20).

9. Access method according to claim 8, characterized in that it comprises, in case of failure (F70) said search step (F60), a step (F90) of connection to said network (100) via said first bridge (31).

10. Access method according to claim 8 or 9, characterized in that it further comprises a step (F30) of authentication of said server using a secret function (FS) and a content of said message.

11. Computer program (Pl) comprising instructions for performing the steps of the method of access according to any one of claims 8 to 10 when said program (Pl) is executed by a computer (10).

Computer-readable recording medium (13) (10) on which is recorded a computer program (P1) comprising instructions for executing the steps of the access method according to any one of claims 8. to 10.

13. Terminal (10) comprising means for sending, via a first gateway (31), a server (20) connected to a telecommunications network (100), an access request to said network (100), said terminal ( 10) being characterized in that it comprises: - means (14) for receiving, from said server (20), a message (OK, NOK) representative of a state of said first gateway (31) for said server (20);

means (11) for searching, according to said message, for a second gateway (32) for accessing said network (100); and if successful (F70):

means (14) for sending via said second gateway (32) an access request to said network (100) to said server (20).