WO2018149482A1

WO2018149482A1 - Providing access to a device

Info

Publication number: WO2018149482A1
Application number: PCT/EP2017/053277
Authority: WO
Inventors: Zhigang QU; Antti Tapio LEIVO
Original assignee: Nokia Solutions And Networks Oy
Priority date: 2017-02-14
Filing date: 2017-02-14
Publication date: 2018-08-23

Abstract

A method, a system and an apparatus in a mobile communication network are disclosed. The method comprises receiving (200) information on a private Internet Protocol (IP] address allocated for a device attached to the network and the identity of the device, creating (202) a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix, receiving (204) a request for the IP address of the device, the request comprising the domain name and the address of the source of the request, transmitting (206) to a network address table entity a rule comprising a destination address, the address of the source of the request and the private address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and as a response to the request, transmitting (208) the destination address to the source of the request.

Description

PROVIDING ACCESS TO A DEVICE

Technical Field

The exemplary and non-limiting embodiments of the invention relate generally to communications.

Background

The use of mobile communications has increased greatly in recent decades and is the growth is expected to continue as more and more services utilise mobile communication networks. One growing sector is Internet of Things (IoT], where devices or machines communicate over Internet with other respective apparatuses, being not necessarily under continuous human control. In addition, privacy issues have been important.

Communication between devices in Internet is based on Internet Protocol (IP] addresses. Until recently, IP version 4 addresses have been used. In recent years, IP v6 addresses have been taken into use. However, majority of addresses are still according to IPv4. The amount of different IPv4 addresses is limited, and that is one reason why private IP addresses have been used. Private IP addresses may be used in local or private networks, for example. When communicating with an outside network, a network address table (NAT] may be configured to map the private address to a public address enabling thus communication between different networks.

IP addresses may be static or dynamic. Dynamic addresses are typically valid per session, for example. An address is given to a device when a network connection with the device is established. Whenever a session expires and a new ses- sion is created, the IP address may change. One problem related to dynamic private addresses is that accessing a device which has dynamic private address. A device with such an address may initiate a connection with a device or server in the Internet, but accessing such a device from the Internet is not a simple task. Brief description

According to an aspect of the present invention, there is provided a method as claimed in claim 1, an apparatus as claimed in claim 6, a system as claimed in claim 11 and a computer program product embodied on a distribution medium as claimed in claim 12. One or more examples of implementations are set forth in more detail in the accompanying drawings and the description below. Other features will be apparent from the description and drawings, and from the claims.

Brief description of the drawings

In the following the invention will be described in greater detail by means of preferred embodiments with reference to the attached [accompanying] drawings, in which

Figure 1 illustrates an example of communication environment where embodiments of the invention may be applied;

Figure 2 is a flowchart illustrating an embodiment;

Figures 3A and 3B are signalling charts illustrating an embodiment;

Figure 4 illustrates an example of obtaining an alias for domain name prefix;

Figure 5 illustrates a simplified example of an apparatus applying some embodiments of the invention.

Detailed description of some embodiments

Embodiments are applicable to any base station, user equipment (UE], server, corresponding component, and/or to any communication system or any combination of different communication systems that support required functionality.

The protocols used, the specifications of communication systems, servers and user terminals, especially in wireless communication, develop rapidly. Such development may require extra changes to an embodiment. Therefore, all words and expressions should be interpreted broadly and they are intended to illustrate, not to restrict, embodiments.

Many different radio protocols to be used in communications systems exist. Some examples of different communication systems are the universal mobile telecommunications system (UMTS] radio access network (UTRAN or E-UTRAN], long term evolution (LTE, known also as E-UTRA], long term evolution advanced (LTE-A], 5th generation mobile networks, Wireless Local Area Network (WLAN] based on IEEE 802.11stardard, worldwide interoperability for microwave ac-cess (WiMAX], Bluetooth®, personal communications services (PCS] and systems using ultra-wideband (UWB] technology. IEEE refers to the Institute of Electrical and Electronics Engineers. Figure 1 illustrates an example of communication environment where embodiments of the invention may be applied. The environment comprises a device 100. The device may in general be a communicating device such as a mobile phone, user equipment, user terminal, personal computer, tablet, or any other de- vice capable for communicating with a communication network. In an embodiment, the device is an IoT device. The device comprises an identifier. Examples of suitable identifiers are International Mobile Subscriber Identity IMSI, Mobile Equipment Identifier MEID, International Mobile Station Equipment Identity IMEI, and Mobile Station International Subscriber Directory Number MSIDSN. In general, the identifier may be any other unique identity for a device or a subscriber (user of the device}. For using secure connection, a virtual private network VPN server software may be installed ad running in the device.

The environment further comprises Public Data Network PDN Gateway 102, P-GW. In general, a P-GW provides connectivity from the device 100 to other networks. The P-GW also provides devices Internet Protocol addresses. In an embodiment, the P-GW provides the devices a dynamic private IP addresses.

A DNS server 104 provides translation from numeric IP addresses to domain names, which are easier to use. A Network Address Table NAT entity 106 maintains a data base of IP addresses and may be configured to map IP address space into another address space, thus hiding, for example, internal addresses from outside networks. In this example, we may assume that the NAT entity has a pool of public IP addresses 88.114.39.2-15, for example.

The IoT device 100 may reside behind a firewall 108 regarding Internet 110. The firewall may be configured to allow access to the IP addresses 88.114.39.2-15, in this example

It may be that an apparatus 112 such as a computer may need to communicate with the device 100. Thus, it needs to be able to initiate a TCP (Transmission Control Protocol] connection to the device 100. A TCP connection can be used in setting up a secure VPN tunnel so that the apparatus 112 can access the data in the IoT device, for example. It is common to utilised DNS technology for finding out the IP address of a node. However, the IP addresses used by DNS servers are relative static. The IP addresses for a domain name could be changed, but not very dynamically. Thus, ordinary DNS technology cannot be applied for the dynamic private IP addresses used in mobile networks. This is problematic especially when IPv4 addresses are used. IPv6 addresses do not have this problem.

The flowchart of Figure 2 and the signalling charts of Figures 3 A and 3 B illustrate an example of an embodiment where a domain name is used to access the device 100 which has a dynamic private IP address, which is unknown to the apparatus 112. The numeric values (such as addresses] are merely illustrative examples.

When the IoT device 100 is switched on or is to be connected to network, is first attached itself to the network. In this example we may assume that the device 100 has MSIDSN 12345678 as its identity. The device transmits a message 300 to the P-GW 102, the message comprising the identity (MSISDN] of the device.

The P-GW 102 is configured to allocate a dynamic private Internet Protocol (IP] address for the device 100 and transmit 302 information on the IP address to the device 102. Let us assume in this example that the dynamic private IP address of the device is 10.144.34.31

The P-GW is configured to transmit 304 information on the private IP address allocated for the device 100 to the DNS server 102. The information comprises the IP address and the identity of the device.

The DNS server is configured to receive 200 the information. The DNS server is further configured to create 202 a domain name for the device 100 on the basis of the information. In an embodiment, the domain name comprises a prefix identifying the device and a pre-configured postfix. The postfix of the domain name is typically selected by the operator of the mobile network. Let us assume in this example that the postfix is iot.nokia.com.

The prefix may be the MSISDN, 12345678 in this example. In an embodiment, instead of MSISDN, the prefix of the domain name may IMSI, MEID, IMEI or any other unique identity for the device or the subscriber (user of the device].

When the apparatus 12 wishes to communicate with the device 100, is sends a request 306 to the DNS server 104 for the IP address of the device, the request comprising the domain name and the address of the apparatus. In this example we may assume that the IP address of the apparatus 112 is 205.112.10.17.

The DNS server 104 receives 204 the request. The request may arrive in the DNS server directly or via other DNS servers.

The DNS server is configured to transmit 206 to a network address table entity a rule 308. The rule may comprise a destination address (the address with which the apparatus 112 will use as address of the device 100 (in this example 88.114.39.2], the address of the apparatus 112 (in this example 205.112.10.17], and the private address of the device 100 (in this example 88.114.39.2]. The rule further may comprise instructions to map the traffic coming from the address of the apparatus 112 and addressed to the destination address to the private address of the device 112 and vice versa.

As a response to the request, the DNS server is configured to transmit 208 the destination address 310 to the apparatus 112.

After the apparatus 112 has received the IP address, the apparatus can send 312 IP packets to the NAT entity 106 for setting up TCP (and possibly VPN connections}.

When the NAT entity 106 has received packet from the apparatus 112, it uses the NAT rule received from the DNS server to forward 314 the packets to IoT device 100.

When the IoT device 100 detaches from the network, the P-GW 102 is configured to inform DNS server 104 to remove the IP address and domain name of the device.

Compared with existing dynamic DNS technology, the proposed solution has many advantages. For example, the DNS server 104 does not need to authenticate the users for updating DNS records. It increases safety when the DNS records can be only updated by an internal network element within a private network. The service can be available for all of subscribers of an Access Point Name, so that subscribers do not need to open a dynamic DNS account.

As described above, the prefix of the domain name may MSISDN, IMEI or any other identity unique to the device or subscriber. While MSISDN or corresponding identities are not a problem for machine to machine type of communication, they are not so easily memorised and handled by human beings. In an embod- iment, alias may be created for the prefix, which could be configured when the subscription of the MSISDN is made. The alias may be alphanumeric string, for example.

When an operator provides a SIM card for a subscriber, the subscriber may request to have an alias for his/her SIM card. The alias has to be unique within the scope of the operator and will be saved into SPR, Subscription Profile Repository.

Referring to Figure 4, when a device 100 using the SIM card attaches 300 into the network, P-GW 102 may be configured to use Gx Interface to send 400 a CCR, Credit Control Request, initial message to PCRF (Policy and Charging Rules Function] 402. The PCRF may use Sp Interface 404 with SPR 406 for getting subscriptions of the SIM. The SPR transmits 408 the subscription information to the PCRF, the information includes many items, and one of the items in this case may be the alias of the SIM.

The PCRF may add a new Attribute Value Pair, AVP, on top of existing AVPs into the CCA, Credit Control Answer, with Attribute name: Domain-name-pre- fix and Attribute value: the alias of the SIM and transmit a response 410 to P-GW.

The prefix alias can be sent to P-GW from PCRF by adding a new AVP, and then P-GW informs the alias to the DNS server.

In an embodiment, an operator can have a web portal for updating subscriber information. Subscribers can update their prefix alias of domain name via the portal. In the web portal, a web application can be included for updating DNS configuration. The P-GW can add a new HTTP header for the HTTP requests sent to the web application for indicating the MSISDN of the subscriber. The web application can check if the Domain-Name-Prefix is unique, and update DNS database if so.

Figure 5 illustrates an embodiment. The figure illustrates a simplified example of an apparatus applying embodiments of the invention. In some embodiments, the apparatus may be a DNS server 104.

It should be understood that the apparatus is depicted herein as an example illustrating some embodiments. It is apparent to a person skilled in the art that the apparatus may also comprise other functions and/or structures and not all described functions and structures are required. Although the apparatus has been depicted as one entity, different modules and memory may be implemented in one or more physical or logical entities.

The apparatus of the example includes a control circuitry 500 config- ured to control at least part of the operation of the apparatus.

The apparatus may comprise a memory 502 for storing data. Furthermore the memory may store software 504 executable by the control circuitry 500. The memory may be integrated in the control circuitry.

The apparatus may further comprise a first interface circuitry 506 con- figured to connect the apparatus to other devices and network elements of communication system, for example to P-GW.

The apparatus may further comprise a second interface circuitry 508 configured to connect the apparatus to other devices and network elements of communication system, for example to NAT entity. First and second interfaces may be implemented with the separate or the same hardware. The software 504 may comprise a computer program comprising program code means adapted to cause the control circuitry 500 of the apparatus to receive information on a private Internet Protocol (IP] address allocated for a device attached to the network and the identity of the device; create a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix; receive a request for the IP address of the device, the request comprising the domain name and the address of the source of the request; transmit to a network address table entity a rule comprising a destination address, the address of the source of the request and the pri- vate address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and as a response to the request, transmit the destination address to the source of the request.

In an embodiment, the apparatus in a mobile communication network comprises: means for receiving information on a private Internet Protocol (IP] address allocated for a device attached to the network and the identity of the device; means for creating a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix; means for receiving a request for the IP address of the device, the request comprising the domain name and the address of the source of the request; means for transmitting to a network address table entity a rule comprising a destination address, the address of the source of the request and the private address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and means for transmitting, as a response to the request, the destination address to the source of the request.

In an embodiment, a system in a communication system comprises a gateway apparatus and a network apparatus, where the gateway apparatus comprises means for receiving identity of a device attaching itself to the communica- tion network, means for allocating a private Internet Protocol (IP] address for a device; and means for transmitting information on the private Internet Protocol (IP] address and the identity of the device to the network apparatus; and the network apparatus comprises means for receiving information on a private Internet Protocol (IP] address allocated for a device attached to the network and the iden- tity of the device, means for creating a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix, means for receiving a request for the IP address of the device, the request comprising the domain name and the address of the source of the request, means for transmitting to a network address table entity a rule comprising a destination address, the address of the source of the request and the private address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and means for transmitting, as a response to the request, the destination address to the source of the request.

It will be obvious to a person skilled in the art that, as the technology advances, the inventive concept can be implemented in various ways. The invention and its embodiments are not limited to the examples described above but may vary within the scope of the claims.

Claims

1. A method in a mobile communication network, the method comprising:

receiving information on a private Internet Protocol (IP] address allocated for a device attached to the network and the identity of the device;

creating a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix;

receiving a request for the IP address of the device, the request comprising the domain name and the address of the source of the request;

transmitting to a network address table entity a rule comprising a destination address, the address of the source of the request and the private address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and

as a response to the request, transmitting the destination address to the source of the request.

2. A method according to claim 1, further comprising:

receive an alias for the identity of the device; and

using the alias as the prefix of the domain name of the device.

3. A method according to claim 1, wherein the prefix of the domain name is one of the following:

- International Mobile Subscriber Identity,

- Mobile Equipment Identifier,

- International Mobile Station Equipment Identity.

4. A method according to claim 1, wherein the rule has a given period of validity and the response to the request comprises the same period of validity.

5. A method according to any preceding claim, further comprising: receive information that the private IP address is no longer valid for the device;

remove the domain name of the device on the basis of the information.

6. An apparatus in a mobile communication network, the apparatus comprising

at least one processor, and

at least one memory comprising a computer program code, wherein the at least one memory and the computer program code are configured, with the at least one processor, to cause the apparatus of a wireless network to perform operations comprising:

receive information on a private Internet Protocol (IP] address allocated for a device attached to the network and the identity of the device;

create a domain name for the device on the basis of the information, the domain name comprising a prefix identifying the device and a pre-configured postfix;

receive a request for the IP address of the device, the request comprising the domain name and the address of the source of the request;

transmit to a network address table entity a rule comprising a destination address, the address of the source of the request and the private address of the device and a instructions to map the traffic coming from the address of the source of the request and the addressed to the destination address to the private address of the device and vice versa; and

as a response to the request, transmit the destination address to the source of the request.

7. An apparatus of claim 6, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus further to perform:

receive an alias for the identity of the device; and

using the alias as the prefix of the domain name of the device.

8. An apparatus of claim 6 or 7, wherein the prefix of the domain name is one of the following:

- International Mobile Subscriber Identity,

- Mobile Equipment Identifier,

- International Mobile Station Equipment Identity.

9. An apparatus according to claim 6, wherein the rule has a given pe- riod of validity and the response to the request comprises the same period of validity.

10. An apparatus of any preceding claim 6 to 9, the at least one memory and the computer program code configured to, with the at least one processor, cause the apparatus further to perform:

receive information that the private IP address is no longer valid for the device;

remove the domain name of the device on the basis of the information.

11. A system in a communication system comprising a gateway apparatus and a network apparatus,

the gateway apparatus being configured to

receive identity of a device attaching itself to the communication net- work;

allocate a private Internet Protocol (IP] address for a device; and transmit information on the private Internet Protocol (IP] address and the identity of the device to the network apparatus;

the network apparatus being configured to

12. The system of claim 11, wherein the network apparatus is configured to receive an alias for the identity of the device; and using the alias as the prefix of the domain name of the device.

13. The system of claim 11, wherein the prefix of the domain name is one of the following:

wherein the network apparatus is configured to

- International Mobile Subscriber Identity,

- Mobile Equipment Identifier,

- International Mobile Station Equipment Identity.

14. The system of claim 11, wherein the rule has a given period of validity and the response to the request comprises the same period of validity.

15. A computer program product embodied on a distribution medium readable by a computer and comprising program instructions which, when loaded into an apparatus, execute a computer process comprising:

16. The computer program product according to claim 15, the process further comprising:

receiving an alias for the identity of the device; and

using the alias as the prefix of the domain name of the device.

17. The computer program product according to claim 15, wherein the prefix of the domain name is one of the following:

- International Mobile Subscriber Identity,

- Mobile Equipment Identifier,

- International Mobile Station Equipment Identity.

18. The computer program product according to claim 15, the process further comprising:

receiving information that the private IP address is no longer valid for the device;

removing the domain name of the device on the basis of the information.