Patent Application
20060160524
This invention relates generally to network communications and more particularly to mobile Internet Protocol calls.
It is known that some network communications ordinarily require authentication to receive network support. For example, when a mobile station seeks to initiate a mobile Internet Protocol call, a network element will contact an authentication server (preferably an Authentication, Authorization and Accounting (AAA) server) to ascertain whether that mobile station has authorization to use the network in the requested fashion. Upon confirming the authenticated status of the mobile station, the network element will respond with a corresponding authorization that in turn aids in facilitating the network's support of the requested mobile Internet Protocol call.
Sometimes, however, for any number of reasons, such authentication servers may be inoperable, unavailable, or otherwise unreachable. When this occurs, absent any other provision, such a network element will be unable to fully confirm the authorized status of the mobile station and will not allow the mobile station the requested network access. The network, in turn, will deny the requested mobile Internet Protocol call service to the mobile station.
To ameliorate, at least to some extent, such a situation, it is known to configure a Packet Data Serving Node (PDSN) to selectively operate in an alternative mode of operation. In particular, the PDSN can be configured to permit unauthorized simple Internet Protocol calls in the absence of explicit authorization when the PDSN is without ready access to an authentication server. This accommodation does, indeed, aid in resolving some aspects of the indicated problem. Unfortunately, however, the solution is incomplete.
For example, the present solution only addresses PDSN's. Other network elements can also serve as a network access server, however, such a home agent. Furthermore, by its very nature, this solution presents certain financial risks insofar as its implementation provides for a mode of operation whereby users gain access to the services of a communication network without authorization. Notwithstanding this risk, the present solution does little to provide comfort or control to a network administrator regarding its operation.
The above needs are at least partially met through provision of the method and apparatus to facilitate the support of communications that require authentication when authentication is absent described in the following detailed description, particularly when studied in conjunction with the drawings, wherein:
Skilled artisans will appreciate that elements in the figures are illustrated for simplicity and clarity and have not necessarily been drawn to scale. For example, the dimensions and/or relative positioning of some of the elements in the figures may be exaggerated relative to other elements to help to improve understanding of various embodiments of the present invention. Also, common but well-understood elements that are useful or necessary in a commercially feasible embodiment are often not depicted in order to facilitate a less obstructed view of these various embodiments of the present invention. It will also be understood that the terms and expressions used herein have the ordinary meaning as is accorded to such terms and expressions with respect to their corresponding respective areas of inquiry and study except where specific meanings have otherwise been set forth herein.
Generally speaking, pursuant to these various embodiments, a network element such as a home agent has at least two modes of operation. A first mode of operation requires authentication information from an authentication server when supporting a mobile Internet Protocol call. A second mode of operation does not require authentication information from an authentication server when supporting a mobile Internet Protocol call. The network element is then configured and arranged to switch to the second mode of operation as a function, at least in part, of the lack of available authentication services and/or administrative preference.
In a preferred approach, pursuant to the second mode of operation, the network element is able to provide a successful response to a mobile Internet Protocol registration reply notwithstanding a present utter lack of any available authentication service. If desired, the network entity, when operating in the second mode of operation, can process a Network Access Identifier (NAI), or some other form of identification, as proffered by the mobile station to determine whether a corresponding domain name is supported by, for example, the corresponding home agent. When the domain name is unsupported, the mobile Internet Protocol call request can be denied notwithstanding that the network element is otherwise above to permit an unauthorized mobile Internet Protocol call.
If desired, when operating in the second mode of operation, a network element such as a PDSN or a home agent can provide for corresponding record keeping with respect to at least some mobile Internet Protocol calls as are supported without authentication information from an authentication server. Such records can be locally maintained and/or transmitted to an accounting server.
So configured, network elements other than a PDSN are able to support unauthorized calls in the absence of an authentication capability. It is also possible to provide for at least a limited degree of authentication by considering the mobile station's indicated domain name and, in any event, the disclosed ability to maintain accounting records regarding permitted unauthorized calls that can be used for any number of beneficial administrative purposes that presently go unmet with present relevant solutions.
These and other benefits may become clearer upon making a thorough review and study of the following detailed description. Referring now to the drawings, and in particular to
This process 100 also provides 102 this network element with a second mode of operation that does not require authentication information from an authentication server when supporting a mobile Internet Protocol call. For example, pursuant to the second mode of operation the network element may be able to respond to a mobile Internet Protocol registration request with a mobile Internet protocol registration reply indicating success notwithstanding the absence of authentication from an authentication server.
Referring momentarily to
Referring again to
If desired, upon switching to (or otherwise selecting) the second mode of operation, this process 100 can also provide for corresponding record keeping 105 with respect to at least some mobile Internet Protocol calls as are supported without authentication information from an authentication server. For example, records can be maintained with respect to corresponding accounting information (such as, but not limited to, the identification of participating mobile stations, individual and aggregate call statistics regarding network resource usage, and so forth).
Such records can be locally maintained by the network element and/or can be transmitted to an accounting server of choice. For example, such accounting information can be transmitted to an accounting server using a Remote Authentication Dial-In User Service (RADIUS) message such as a message having an acct-authentic attribute (and/or a vendor specific attribute) set to a predetermined value that represents (by common agreement, standardization, or other convention) support of a non-authorized mobile Internet Protocol call.
These teachings can be realized and enabled in a variety of ways. Referring now to
The mobile Internet Protocol call processor 301 also preferably operably couples to a mode of operation selector 305 that serves to direct selection of or switching to a given one of the provisioned modes of operation. Pursuant to one approach, this mode of operation selector 305 is responsive to the detected availability of authentication services. Pursuant to another approach, this mode of operation selector 305 comprises a user interface and is responsive to user inputs as correspond to an evinced administrative preference.
So configured, and where the mobile Internet Protocol call processor 301 is configured and arranged to use either of the first and second modes of operation in accordance with the selections of the mode of operation selector 305, the network element 300 is readily configured and/or programmed to support the above-described processes. This, in turn, permits the mobile Internet Protocol call processor 301 to use the second mode of operation to respond to a mobile Internet Protocol registration request with a mobile Internet Protocol registration reply indicating success notwithstanding an absence of authorization by an authentication server. If desired, the mobile Internet Protocol call processor 301 can also determine whether a given mobile station's request provides a supported domain name in order to permit a local override of the blanket authorization that is otherwise effected by the second mode of operation.
The above-described apparatus can also be supplemented, if desired, with a records maintenance capability 306 to permit a corresponding PDSN, home agent, or other network access server to locally store or transmit information (such as accounting information) regarding unauthorized calls that have nevertheless been authorized as per the dictates of the second mode of operation.
An illustrative example appears at
So configured, a network is more fully able to support continued operation and service notwithstanding an absence of authentication server capability. In addition to supporting unauthorized (or, viewed another way, unauthorizable) communications, these teachings also permit at least some degree of control by at least ascertaining whether a proffered domain name is supported and further provide for the optional development and maintenance of corresponding accounting information as pertains to the support of unauthorized mobile Internet Protocol calls.
Those skilled in the art will recognize that a wide variety of modifications, alterations, and combinations can be made with respect to the above described embodiments without departing from the spirit and scope of the invention, and that such modifications, alterations, and combinations are to be viewed as being within the ambit of the inventive concept.
