Patent Application
20090150976
This invention relates generally to wireless communication networks, and more particularly, to a method and system for internet protocol (IP) service negotiation and authorization among various network entities.
Wireless network technologies, such as Worldwide Interoperability for Microwave Access (WiMAX), and the like, provide various IP services (e.g., simple IP, Proxy Mobile IP (PMIP) and Client Mobile IP (CMIP), including IP version 4 (IPv4) or IP version 6 (IPv6)) to users of mobile devices within networks involving multiple network entities. CMIP and PMIP are used by a mobile device to continue an IP session, even when a host attachment point changes due to movement of the mobile device. CMIP allows a mobile device to keep its transport connection opened and continue to be reachable while moving. PMIP was developed in part to eliminate signaling overhead, reduce software complexity/cost and require no network interface to change an IP address when the mobile device changes to a new router, for example. IPv4 refers to an early version of IP that is widely deployed, with the later version IPv6 providing updates and enhancements thereto.
With the increasing popularity of mobile devices, there exists a need to allow users to attach to various domains, depending on their current location. A user may require access to resources being provided by a visited network different than their home network. The need for service from a visited network requires, in many models, negotiation and authorization between the mobile device and the visited network.
Therefore, there is a need in the art to provide a method and system for IP service capability negotiation and authorization among different network entities. In addition, there is a need to leverage the network access authentication and authorization process to negotiate the appropriate IP service among various network entities using remote authentication protocols.
The presently disclosed embodiments are directed to solving one or more of the problems presented in the prior art, described above, as well as providing additional features that will become readily apparent by reference to the following detailed description when taken in conjunction with the accompanying drawings.
One embodiment of the present disclosure is directed to a method for negotiating and authorizing one or more internet protocol (IP) services among a plurality of network entities in a wireless communication system. The method includes receiving one or more parameters of an access service network at a home connectivity service network of a mobile station; authorizing one or more IP services by the home connectivity service network, based on the one or more parameters; and transmitting network configuration information related to the authorized one or more IP services to the access service network.
Another embodiment of the present disclosure is directed to a system for negotiating and authorizing one or more IP services among a plurality of network entities in a wireless communication system. The system includes a transceiver module configured to receive one or more parameters of an access service network at a home connectivity service network of a mobile station. This system may further include a home server unit configured to authorize one or more IP services by the home connectivity service network, based on the one or more parameters, and to transmit, via the transceiver module, network configuration information related to the authorized one or more IP services to the access service network.
Yet another embodiment of the present invention is directed to a system for negotiating and authorizing one or more IP services among a plurality of network entities in a wireless communication system. The system includes means for receiving one or more parameters of an access service network at a home connectivity service network of a mobile station; and means for authorizing one or more IP services by the home connectivity service network, based on the one or more parameters; and means for transmitting network configuration information related to the authorized one or more IP services to the access service network.
Yet another embodiment of the present disclosure is directed to a wireless communication system configured to negotiate and authorize one or more IP services among a plurality of network entities. The system includes a mobile station, and an access service network configured to request authentication from the mobile station. The system may further include a transmitter unit coupled to the mobile station configured to transmit an Extensible Authentication Protocol (EAP) start message to the access service network in response to the request; an authenticator unit coupled to the access service network configured to transmit one or more parameters of the access service network to a home connectivity service network of a mobile station. The system may further include a home server unit coupled to the home connectivity service network configured to authorize one or more IP services, based on the one or more parameters, and to transmit network configuration information related to the authorized one or more IP services to the authenticator unit, wherein the home server unit is further configured to authenticate the mobile station; and a computer-readable memory coupled to the access service network configured to store the transmitted network configuration information, wherein the access service network is configured to determine at least one of the one or more authorized IP service to provide to the mobile station.
Yet another embodiment of the present disclosure is directed to a mobile station in a wireless communication system. The mobile station includes a transmitter unit configured to transmit a start message to an access service network in response to an authentication request. In response to the start message, the access service network is configured to transmit one or more parameters of the access service network to a home connectivity service network of the mobile station, and to determine at least one IP service to provide to the mobile station, based on authorization from the home connectivity service network.
According to certain embodiments, the authenticator unit is further configured to transmit one or more parameters of the access service network to an authenticator proxy unit in a visited connectivity service network, wherein the authenticator proxy unit is configured to transmit the one or more parameters of the access service network and one or more parameters of the visited connectivity service network from the visited connectivity service network to the home connectivity service network.
Thus, embodiments disclosed herein provide a method and system for IP service capability negotiation and authorization among different network entities, which allow users of mobile devices to attach to various visited networks, depending on their current location.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and are merely intended to provide further explanation of the claimed subject matter.
The features, nature and advantages of the present disclosure will become more apparent from the detailed description set forth below when taken in conjunction with the drawings in which like reference characters identify correspondingly throughout and wherein:
In the following description of exemplary embodiments, reference is made to the accompanying drawings which form a part hereof, and in which it is shown by way of illustration specific embodiments in which the invention may be practiced. It is to be understood that other embodiments may be utilized and structural changes may be made without departing from the scope of the present invention.
The word “exemplary” is used herein to mean “serving as an example or illustration.” Any aspect or design described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other aspects or designs.
Reference will now be made in detail to aspects of the subject technology, examples of which are illustrated in the accompanying drawings, wherein like reference numerals refer to like elements throughout.
It should be understood that the specific order or hierarchy of steps in the processes disclosed herein is an example of exemplary approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged while remaining within the scope of the present disclosure. The accompanying method claims present elements of the various steps in a sample order, and are not meant to be limited to the specific order or hierarchy presented.
A WiMAX network, for example, can provide Simple IP, CMIP or PMIP services (IPv4 or IPv6) to an end user based on service provider business requirements, subscriber profiles, network architecture and network entity capability information. According to an embodiment of the present disclosure, in order to provide a successful user service session, several major network entities may be involved, including an access service network (ASN), a visited connectivity service network (V-CSN) and/or a home connectivity service network (H-CSN). Each network entity may contain multiple IP service related functional entities, which may represent specific IP service capabilities from this network entity. Whether the Simple IP service, PMIP or CMIP service is invoked by the network for a given user, may often depend on network IP service capability negotiation results among the ASN, V-CSN and H-CSN along with a home operator policy.
According to the embodiment depicted in
The wireless communication network of
The exemplary mobile station 100 depicted in
Mobile station 100 may further include processor module 210, which may be implemented, or realized, with a general purpose processor, a content addressable memory, a digital signal processor, an application specific integrated circuit, a field programmable gate array, any suitable programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof, designed to perform the functions described herein. In this manner, a processor may be realized as a microprocessor, a controller, a microcontroller, a state machine, or the like. A processor may also be implemented as a combination of computing devices, e.g., a combination of a digital signal processor and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a digital signal processor core, or any other such configuration. Processor module 210 may comprise processing logic that is configured to carry out the functions, techniques, and processing tasks associated with the operation of mobile station 100.
Furthermore, the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in firmware, in a software module executed by processor module 210, or in any practical combination thereof. A software module may reside in computer-readable storage 220, which may be realized as RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. In this regard, computer-readable storage 220 may be coupled to processor module 210 such that processor module 210 can read information from, and write information to, computer-readable storage 220. As an example, processor module 210 and computer-readable storage 220 may reside in their respective ASICs. The computer-readable storage 220 may also be integrated into the processor module 210. In an embodiment, the computer-readable storage 220 may include a cache memory for storing temporary variables or other intermediate information during execution of instructions to be executed by processor module 210. Computer-readable storage 220 may also include non-volatile memory for storing instructions to be executed by processor module 210.
Computer-readable storage 220 may include a frame structure database (not shown) in accordance with an exemplary embodiment of the invention. Frame structure parameter databases may be configured to store, maintain, and provide data as needed to support the functionality of a wireless communication system in the manner described below. Moreover, a frame structure database may be a local database coupled to processor module 210, or may be a remote database, for example, a central network database, and the like. A frame structure database may be configured to maintain, without limitation, frame structure parameters as explained below. In this manner, a frame structure database may include a lookup table for purposes of storing frame structure parameters.
Of course, one of ordinary skill in the art would realize that the above-described mobile station 100 is merely one example, and various combinations of components, as well as other additional components, may be included without departing from the scope of the present disclosure.
Of course, one of ordinary skill in the art would realize that the above-described ASN 120 is merely one example, and various combinations of components, as well as other additional components, may be included without departing from the scope of the present disclosure.
Of course, one of ordinary skill in the art would realize that the above-described CSN 130 or 140 is merely one example, and various combinations of components, as well as other additional components, may be included without departing from the scope of the present disclosure.
From operation 500, the process continues to operation 510, where processor module/server module 410 of H-CSN 130 authorizes one or more IP services to be provided to mobile station 100, based on the one or more parameters of ASN 120. That is, processor module/server module 410 of H-CSN 130 determines which IP services ASN 120 may provide based on the IP capabilities of ASN 120.
From operation 510, the process continues to operation 520, where processor module/server module 410 of H-CSN 130 transmits, via transceiver module 300, network configuration information related to the authorized one or more IP services to ASN 120. Processor module/server module 410 returns an EAP-Success message embedded in a RADIUS Access-Accept message to the authenticator module 330 of ASN 120. Network configuration information such as the home agent (HA) IP address, DHCP Server IP address, Core Router (CR) IP address, etc., may be included in the RADIUS Access-Accept message. Together with additional mobile station 100 parameters, ASN 120 IP service configuration attributes may also be included in the RADIUS Access-Accept message. These IP service configuration attributes will be used by ASN 120 as indication(s) of which IP service(s) has been authorized by processor module/server module 410 of H-CSN 130.
From operation 520, the process continues to operation 530, where the ASN 120 stores the network configuration information in computer-readable storage 320, and authenticator module 330 authenticates mobile station 100 at operation 540. According to certain embodiments, authenticator module 330 may also extract the EAP-Success message from RADIUS message and pass it onto to mobile station 100 to complete the access authentication operation. Once mobile station 100 is authenticated, the process continues to operation 550, where ASN 120 determines at least one of the one or more authorized IP services to provide to mobile station 100, depending on the stored IP service configuration parameters.
As exemplary determinations by ASN 120 regarding which IP services to provide to mobile station 100, if ASN 120 receives either visited Home Agent version 4 (vHAv4) or home Home Agent version 4 (hHAv4) attributes in the RADIUS Access Accept message, ASN 120 may store these HAv4 attributes locally and make them available to be used later for either CMIPv4 or PMIPv4 services to mobile station 100. If ASN 120 receives either vHAv6 or hHAv6 attributes in the RADIUS Access Accept message, ASN 120 may store these HAv6 attributes locally and make them available to be used later for CMIPv6 services to mobile station 100. If ASN 120 receives either visited local mobility agent (vLMA) or home local mobility agent (hLMA) attributes in the RADIUS Access Accept message, ASN 120 may store these attributes locally and make them available to be used later for PMIPv6 services to mobile station 100. If ASN 120 receives either visited Core Router (vCR) or home Core Router hCR) attributes in the RADIUS Access Accept message, ASN 120 may store these attributes locally and make them available to be used later for Simple IPv4 or Simple IPv6 services to mobile station 100. If ASN 120 receives DHCP Server attributes in the RADIUS Access Accept message, ASN 120 may store these attributes locally and make them available to be used in a DHCP signaling transaction later. It also may indicate that DHCP Relay functionality should be enabled for mobile station 100. If ASN 120 does not receive DHCP Server attributes in the RADIUS Access Accept message, it indicates that DHCP Proxy functionality should be enabled for mobile station 100. Of course, the present invention is not limited to these IP service determinations, and various IP services and combinations thereof may be provided to mobile station 100 without departing from the scope of the present disclosure.
From operation 600, the process continues to operation 610, where processor module/server module 410 of H-CSN 130 returns an authentication success message to ASN 120 if mobile station 100 is successfully authenticated by the H-CSN 140. As noted above, the authentication success message may be an EAP-success message embedded in the RADIUS Access Accept message, for example.
At operation 710, proxy authenticator module 430 transmits, via transceiver module 400, the one or more parameters of ASN 120 and one or more parameters of V-CSN 140 in the RADIUS Access Request message to processor module/server module 410 of H-CSN 130. The one or more parameters of V-CSN 140 may include, for example, possible IP Network Capabilities such as, DHCPv4 Server, DHCPv6 Server, HAv4, HAv6, LMA with IPv4 transport, LMA with IPv6 transport, CR with IPv4 transport and CR with IPv6 transport. Proxy authenticator module 430 may attach a vHA, vLMA, vCR, or vDHCP Server address to the RADIUS Access Request message. Similarly, the remaining procedural steps of
As exemplary determinations by ASN 120 regarding which IP services to provide to mobile station 100 when a V-CSN 140 exists, if ASN 120 receives vHAv4 or hHAv4 attributes, it indicates that H-CSN 130 has authorized to provide CMIPv4 and PMIPv4 service. If ASN 120 receives vHAv6 or hHAv6 attributes, it indicates that H-CSN 130 has authorized to provide CMIPv6 service. If ASN 120 receives vLMA or hLMA attributes, it indicates that H-CSN 130 has authorized to provide PMIPv6 service. If ASN 120 receives vCR or hCR attributes, it indicates that H-CSN 130 has authorized to provide Simple IPv4 or Simple IP service. If ASN 120 receives V-CSN 140 or H-CSN 130 DHCP Server attributes, it indicates that H-CSN 130 has authorized to use DHCP Relay functionality in ASN 120. If ASN 120 does not receive V-CSN 140 or H-CSN 130 DHCP Server attributes, it indicates that H-CSN 130 has authorized to use DHCP Proxy functionality in ASN 120. Of course, the present invention is not limited to these IP service determinations, and various IP services and combinations thereof may be provided to mobile station 100 without departing from the scope of the present disclosure.
For exemplary purposes, RADIUS Type 26 is depicted throughout
Embodiments of the present invention are directed to transmitting one or more parameters of an access service network to a home connectivity service network of a mobile station; authorizing one or more IP services by the home connectivity service network, based on the one or more parameters; and transmitting network configuration information related to the authorized one or more IP services to the access service network. Further, embodiments described herein are capable of transmitting one or more parameters of the access service network to a visited connectivity service network; and transmitting the one or more parameters of the access service network and one or more parameters of the visited connectivity service network from the visited connectivity service network to the home connectivity service network
Thus, the methods and systems described herein provide for IP service capability negotiation and authorization among different network entities. In addition, embodiments of the present invention are capable of leveraging the network access authentication and authorization process to negotiate the appropriate IP service among various network entities using remote authentication protocols.
Although the present invention has been fully described in connection with embodiments thereof with reference to the accompanying drawings, it is to be noted that various changes and modifications will become apparent to those skilled in the art. Such changes and modifications are to be understood as being included within the scope of the present invention as defined by the appended claims.
Terms and phrases used in this document, and variations thereof, unless otherwise expressly stated, should be construed as open ended as opposed to limiting. As examples of the foregoing: the term “including” should be read as mean “including, without limitation” or the like; the term “example” is used to provide exemplary instances of the item in discussion, not an exhaustive or limiting list thereof; and adjectives such as “conventional,” “traditional,” “normal,” “standard,” “known” and terms of similar meaning should not be construed as limiting the item described to a given time period or to an item available as of a given time, but instead should be read to encompass conventional, traditional, normal, or standard technologies that may be available or known now or at any time in the future. Likewise, a group of items linked with the conjunction “and” should not be read as requiring that each and every one of those items be present in the grouping, but rather should be read as “and/or” unless expressly stated otherwise. Similarly, a group of items linked with the conjunction “or” should not be read as requiring mutual exclusivity among that group, but rather should also be read as “and/or” unless expressly stated otherwise. Furthermore, although items, elements or components of the disclosure may be described or claimed in the singular, the plural is contemplated to be within the scope thereof unless limitation to the singular is explicitly stated. The presence of broadening words and phrases such as “one or more,” “at least,” “but not limited to” or other like phrases in some instances shall not be read to mean that the narrower case is intended or required in instances where such broadening phrases may be absent.
This application claims priority to U.S. Provisional Patent Application No. filed on Dec. 3, 2007, entitled “IP SERVICE CAPABILITY NEGOTIATION AND AUTHORIZATION SCHEME”, the content of which is incorporated by reference herein in its entirety.
| Number | Date | Country | |
|---|---|---|---|
| 60992063 | Dec 2007 | US |
