Patent Application
20130254395
Access to a network can include authentication and/or authorization procedures. According to some frameworks, black lists, grey lists, and white lists are used to grant or deny access to the network.
The following detailed description refers to the accompanying drawings. The same reference numbers in different drawings may identify the same or similar elements.
According to an exemplary embodiment, a network includes network devices (or network elements) and a subscriber data management system that cooperatively operate to regulate access to the network. According to an exemplary embodiment, the subscriber data management system includes an enhanced type allocation code (TAC) database and an enhanced identity policing database. According to an exemplary embodiment, an enhanced equipment identity registration device includes the enhanced type allocation code database and the enhanced identity policing database.
According to an exemplary embodiment, the enhanced type allocation code database stores, among other information, an enhanced type allocation code identifier. According to an exemplary implementation, the enhanced type allocation code identifier includes digits of an equipment identifier (e.g., digits of an International Mobile Equipment Identifier (IMEI)). For example, the enhanced type allocation code identifier may include the first 8-10 digits of the IMEI. Alternatively, the enhanced type allocation code identifier may include more than 10 digits (e.g., 14 digits or some other number of digits).
According to an exemplary embodiment, the enhanced type allocation code identifier correlates to other information pertaining to network access and/or network usage by a user. According to an exemplary implementation, the other information pertains to user device capability information. For example, the user device capability information may include information pertaining to the wireless bands in which the user device operates, information pertaining to the display capabilities of the user device (e.g., screen resolution, size, etc.), as well as other information, as described further below. Additionally, according to an exemplary implementation, the other information pertains to a user device class. The user device class indicates a class, a type, or a category of a user device. For example, the user device class may correlate with or indicate a type of service (e.g., a network service) a user device may use or access via the network.
According to an exemplary embodiment, the enhanced type allocation code identifier and information correlated therewith are used in determining network access. Additionally, according to an exemplary embodiment, the enhanced type allocation code identifier and information correlated therewith are used in providing a particular service or asset to a user. For example, application servers in a network may obtain user device capability information and/or user device class information and use this information to provide a service, a function, etc.
According to an exemplary embodiment, the identity policing database stores user identity information. For example, the user identity information may be implemented as an International Mobile Subscriber Identity (IMSI). According to an exemplary embodiment, information stored in the identity policing database correlates with information stored in the enhanced equipment identity registration database, as described herein.
According to an exemplary embodiment, an authentication, authorization, and accounting device or element is communicatively coupled to the enhanced equipment identity registration device in which the information stored in the enhanced equipment identity registration database is used for network access policing. According to an exemplary embodiment, a subscriber data management device is communicatively coupled to the enhanced equipment identity registration device in which the information stored in the enhanced equipment identity registration database is used for network access policing. For example, the subscriber data management device may be implemented as a home subscriber server.
While exemplary embodiments provided in this description may be implemented based on the use of a particular protocol, network architecture, platform, user identifier, device identifier, etc., such implementations are not intended to be restrictive or provide an exhaustive treatment, as such. In other words, the embodiments described herein may be implemented using other suitable protocols, network architectures, platforms, user identifiers, device identifiers, etc., which may not be specifically described.
User device 105 includes a device having the capability to communicate with other devices, networks, systems, and the like. For example, user device 105 may be implemented as a smartphone, a wireless telephone, an IP telephone, a Web access device, a personal digital assistant (PDA), a gaming device, a personal communication system (PCS) terminal, a pervasive computing device, a video playing device, a computer, a music playing device, and/or some other type of device (e.g., a portable device, a mobile device, a handheld device, a stationary device, a vehicle-based device, etc.). User device 105 may operate according to one or more other wireless and/or wired network standards.
Network 110 includes one or multiple networks. Network 110 may include a wireless network (e.g., mobile network, cellular network, non-cellular network, an ad hoc network, etc.). By way of example, network 110 may be implemented as a Long Term Evolution (LTE) network, an evolved High Rate Packet Data (eHRPD) network, a Global System for Mobile Communications (GSM) network, a Universal Mobile Telecommunication System (UMTS) network, a Wideband Code Division Multiple Access (WCDMA) network, an Ultra Mobile Broadband (UMB) network, a High-Speed Packet Access (HSPA) network, a Worldwide Interoperability for Microwave Access (WiMAX) network, an Institute of Electrical and Electronics Engineers (IEEE) 802.X network, a Evolution Data Optimized (EV-DO) network, a Code Division Multiple Access (CDMA)-based network, or some combination thereof. Network 110 may include a wired network. By way of example, network 110 may be implemented as an optical network, a coaxial network, or a combination thereof.
Equipment identity registration 145 includes a network device that maintains type allocation code information and equipment identity registration information. Equipment identify registration 145 is described further below.
As further illustrated, both MME 125 and AAA 135 are communicatively coupled to EIR 145 via an S13 interface, and HSS 140 and EIR 145 are communicatively coupled via a V13 interface. Also, central subscriber database 160 and an EIR database 170 are communicatively coupled via the V13 interface. Additionally, HSGW 115 and AAA 135 are communicatively coupled via an STa interface, HSS 140 and AAA 135 are communicatively coupled via an SWx interface, and AS 180 and HSS 140 are communicatively coupled via an Sh interface. According to other implementations, the connections and/or interfaces described and illustrated in
The type of devices included in network 110 having EIR 145, as illustrated in
Also, according to other implementations, one or more functions and/or processes described as being performed by a particular network device may be performed by a different device, or some combination of devices, which may or may not include the particular device.
TAC database 174 includes a database that stores make and model information pertaining to user devices. TAC database 174 also stores information pertaining to classes of user devices and information pertaining to user device capabilities.
E-TAC identifier field 205 stores an enhanced-TAC (e.g., e-TAC identifier) that indicates a make and a model of a user device. According to an exemplary implementation, the e-TAC identifier is based on the IMEI of the user device. For example, the e-TAC identifier may correspond to the first 8 digits of the IMEI, the first 9 digits of the IMEI, or the first 10 digits of the IMEI. According to another implementation, the e-TAC identifier corresponds to the IMEI. For example, the e-TAC identifier corresponds to the first 14 digits of the IMEI. As a further example, the e-TAC identifier may have a value between 25555555000000-25555555999999. According to such an implementation, a range of IMEIs (e.g., a starting IMEI value through an ending IMEI value) represents a make and a model of a user device. An IMEI of a user device, which is interpreted as the e-TAC identifier, that has a value within a particular range, will be attributed to the make and the model of the range. For example, assume that the range is 11111111111111-22222222222222 and user device 105 is associated with an e-TAC identifier that has a value of 12121211111111. Since the e-TAC identifier has a value within the range, user device 105 is attributed to the make and the model of the range 11111111111111-22222222222222. Additionally, in a degenerative case or an exceptional case, for example, in which the make and the model of user device 105 is rare, the e-TAC identifier may correspond to a single IMEI.
User device capabilities field 210 and user device class field 215 stores information that correlates with e-TAC identifier field 205. For example, user device capabilities field 210 stores information pertaining to a manufacturer of user device 105, the wireless band(s) that user device 105 operates, the size and/or resolution of a display associated with user device 105, the access technologies that user device 105 supports (e.g., LTE, etc.), operating system of user device 105, applications or programs of user device 105, etc. Additionally, for example, user device class field 215 stores information pertaining to a class of user device 105. For example, a class may indicate whether user device 105 is a smartphone, a machine-to-machine device, etc. User device 105 may belong to more than one user device class. Additionally, for example, a class of user device 105 may correlate with or indicate a type of service user device 105 may use in network 110.
Referring back to
IMEI policing database 178 includes a database that stores International Mobile Subscriber Identities (IMSIs). IMEI policing database 178 also stores information pertaining to the user device class and/or IMEIs.
IMSI field 250 stores an IMSI. User device class field 255 has been previously described. IMEI field 260 stores an IMEI. The IMEI may be 14, 15, or 16 digits.
User devices 105 may be granted or denied access to network 110 based on the information stored in EIR database 170, examples of which are discussed further below.
Referring to
Alternatively, according to another implementation, assume that IMEI policing database 178 does not include IMEI field 260. EIR 145 determines whether the user is granted access based on the e-TAC identifier. For example, referring to
In step (4), EIR 145 transmits an identity check response to MME 125. The identity check response includes data or information indicating whether access is accepted or denied. According to this exemplary scenario, it may be assumed that access to network 110 is granted to user device 105.
In step (5), user device 105 and HSS 140 communicate to perform authentication. HSS 140 may receive, for example, the IMEI of user device 105. In step (6), HSS 140 may retrieve e-TAC information to store in central subscriber database 160. For example, this may occur if the central subscriber database 160 does not include the e-TAC information. HSS 140 may store information correlated with the e-TAC identifier (e.g., user device capability information and/or user device class information). It may be assumed that user device 105 is successfully authenticated by HSS 140.
As an aside, the granting or denying of access by EIR 145 may be considered a first phase authorization that prevents service access to network 110. This first phase of authorization may include using a device identifier, a device class, and a user identifier associated with a subscription. If user device 105 is granted access to network 110, HSS may perform, for example, a more comprehensive authentication and authorization process (e.g., similar to an HLR) in which the subscription may be authenticated and specific services are checked and authorized to obtain services. In this regard, according to some scenarios, it may be possible that user device 105 may be granted access to EIR 145 and the user is rejected by HSS 140 because there is no subscription provisioned in HSS 140, etc.
In step (7), user device 105 communicates to AS 180. In step (8), AS 180 communicates with HSS 140 to retrieve e-TAC information. AS 180 may use the e-TAC information to provide a quality of service to the user of user device 105. By way of example, AS 180 may tailor a service to user device 105 based on the user device class information and/or the user device capability information.
Referring to
In step (5), EIR 145 transmits an Equipment Check Answer (ECA) to AAA 135. The ECA includes data or information indicating whether user device 105 is granted access to network 110. In step (6), AAA 135 transmits Diameter EAP Answer (DEA) to HSGW 115. The DEA indicates whether network access is granted or denied. In response, HSGW 115 transmits an attach response to user device 105 that indicates whether network access is granted or denied.
Processor 505 may include one or multiple processors, microprocessors, data processors, co-processors, application specific integrated circuits (ASICs), controllers, programmable logic devices, chipsets, field-programmable gate arrays (FPGAs), application specific instruction-set processors (ASIPs), system-on-chips (SoCs), central processing units (e.g., one or multiple cores), microcontrollers, and/or some other type of component that interprets and/or executes instructions and/or data. Processor 505 may be implemented as hardware (e.g., a microprocessor, etc.), a combination of hardware and software (e.g., a SoC, an ASIC, etc.), may include one or multiple memories (e.g., memory/storage 510), etc.
Processor 505 may control the overall operation or a portion of operation(s) performed by device 500. Processor 505 may perform one or multiple operations based on an operating system and/or various applications or programs (e.g., software 515). Processor 505 may access instructions from memory/storage 510, from other components of device 500, and/or from a source external to device 500 (e.g., a network, another device, etc.).
Memory/storage 510 may include one or multiple memories and/or one or multiple other types of storage mediums. For example, memory/storage 510 may include one or multiple types of memories, such as, random access memory (RAM), dynamic random access memory (DRAM), cache, read only memory (ROM), a programmable read only memory (PROM), a static random access memory (SRAM), a single in-line memory module (SIMM), a phase-change memory (PCM), a dual in-line memory module (DIMM), a flash memory, and/or some other type of memory. Memory/storage 510 may include a hard disk (e.g., a magnetic disk, an optical disk, a magneto-optic disk, a solid state disk, etc.), a Micro-Electromechanical System (MEMS)-based storage medium, and/or a nanotechnology-based storage medium. Memory/storage 510 may include drives for reading from and writing to the storage medium.
Memory/storage 510 may be external to and/or removable from device 500, such as, for example, a Universal Serial Bus (USB) memory stick, a dongle, a hard disk, mass storage, off-line storage, or some other type of storing medium (e.g., a compact disk (CD), a digital versatile disk (DVD), a Blu-Ray® disk (BD), etc.). Memory/storage 510 may store data, software, and/or instructions related to the operation of device 500.
Software 515 may include an application or a program that provides a function and/or a process. Software 515 may include firmware.
Communication interface 520 may permit device 500 to communicate with other devices, networks, systems, etc. Communication interface 520 may include one or multiple wireless interfaces and/or wired interfaces. Communication interface 520 may include one or multiple transmitters, receivers, and/or transceivers. Communication interface 520 may operate according to one or multiple protocols, standards, and/or the like.
Input 525 may permit an input into device 500. For example, input 525 may include a keyboard, a mouse, a display, a touchscreen, a touchless screen, a button, a switch, an input port, speech recognition logic, and/or some other type of visual, auditory, tactile, etc., input component. Output 530 may permit an output from device 500. For example, output 530 may include a speaker, a display, a touchscreen, a touchless screen, a light, an output port, and/or some other type of visual, auditory, tactile, etc., output component.
Device 500 may perform processes and/or functions, as described herein, in response to processor 505 executing software 515 stored by memory/storage 510. By way of example, instructions may be read into memory/storage 510 from another memory/storage 510 or from another device via communication interface 520. The instructions stored by memory/storage 510 may cause processor 505 to perform one or more processes described herein. Alternatively, for example, according to other implementations, device 500 may perform one or more processes described herein based on the execution of hardware (processor 505, etc.), the execution of firmware with hardware, or the execution of software and firmware with hardware.
Referring to
In block 610, a user identifier and a device identifier are obtained. For example, the request to attach includes an IMSI and an IMEI or an MEID.
In block 615, an e-TAC identifier is identified based on the IMEI or the MEID. For example, the network device transmits the IMSI and the IMEI or the MEID to EIR 145. EIR 145 identifies the e-TAC identifier based on the IMEI or the MEID. By way of example, depending on the implementation, the e-TAC identifier may correspond to the first 8-10 digits of the IMEI or the MEID, or the first 14 digits of the IMEI or the MEID, or all digits of the IMEI or the MEID.
In block 620, it is determined whether the IMSI is provisioned. For example, EIR 145 queries EIR database 170 to determine whether the IMSI received is provisioned in IMEI policing database 178. If it is determined that the IMSI is not provisioned (block 620-NO), then network access is granted (block 625). For example, an attach response is transmitted to user device 105 indicating that network access is granted. According to other implementations, network 110 may decide to deny access or take other actions based on network access policies or rules that are provisioned.
If it is determined that the IMSI is provisioned (block 620-YES), then it is determined whether an e-TAC identifier is provisioned (block 630). For example, EIR 145 transmits a query to EIR database 170 to determine whether the e-TAC identifier is provisioned. For example, TAC database 174 stores e-TAC identifiers.
If it is determined that the e-TAC identifier is not provisioned (block 630-NO), then network access is denied (block 635). For example, EIR 145 determines to deny access to user device 105. For example, an attach response is transmitted to user device 105 indicating that network access is denied.
If it is determined that the e-TAC identifier is provisioned (block 630-YES), then (referring to
In block 645, it is determined whether the user device class correlates with the IMSI. For example, EIR 145 determines whether the user device class correlates with the IMSI based on the response to a query.
If it is determined that the user device class correlates with the IMSI (block 645-YES), then network access is granted (block 650). For example, an attach response is transmitted to user device 105 indicating that network access is granted.
If it is determined that the user device class does not correlate with the IMSI (block 645-NO), then network access is denied (block 655). For example, an attach response is transmitted to user device 105 indicating that network access is denied.
Although
The foregoing description of embodiments provides illustration, but is not intended to be exhaustive or to limit the embodiments to the precise form disclosed. Accordingly, modifications to the embodiments described herein may be possible.
The terms “a,” “an,” and “the” are intended to be interpreted to include one or more items. Further, the phrase “based on” is intended to be interpreted as “based, at least in part, on,” unless explicitly stated otherwise. The term “and/or” is intended to be interpreted to include any and all combinations of one or more of the associated items.
In addition, while series of blocks have been described with regard to the processes illustrated in
The embodiments described herein may be implemented in many different forms of software, firmware, and/or hardware. For example, a process or a function may be implemented as “logic” or as a “component.” This logic or this component may include hardware (e.g., processor 505, etc.), a combination of hardware and software (e.g., software 515), a combination of hardware and firmware, or a combination of hardware, firmware, and software. The embodiments have been described without reference to the specific software code since software can be designed to implement the embodiments based on the description herein.
In the preceding specification, various embodiments have been described with reference to the accompanying drawings. It will, however, be evident that various modifications and changes may be made thereto, and additional embodiments may be implemented, without departing from the broader scope of the invention as set forth in the claims that follow. The specification and drawings are accordingly to be regarded as illustrative rather than restrictive.
In the specification and illustrated by the drawings, reference is made to “an exemplary embodiment,” “an embodiment,” “embodiments,” etc., which may include a particular feature, structure or characteristic in connection with an embodiment(s). However, the use of the phrase or term “an embodiment,” “embodiments,” etc., in various places in the specification does not necessarily refer to all embodiments described, nor does it necessarily refer to the same embodiment, nor are separate or alternative embodiments necessarily mutually exclusive of other embodiment(s). The same applies to the term “implementation,” “implementations,” etc.
No element, act, or instruction described in the present application should be construed as critical or essential to the embodiments described herein unless explicitly described as such.
