Patent Application
20050240988
The present invention relates to a method of providing an accounting service in a mobile communication system by utilizing a separated accounting server.
Presently considered AAAC (authentication, authorization, accounting and charging) architectures deal with the handling of information required to ensure that a mobile node, mainly a mobile host, is correctly granted access to networking resources in an Internet domain, which it normally does not belong to. In addition, they deal with the data that are collected to provide charging for the service used by the mobile node.
Next to the underlying technology, the business model to be deployed has an impact on the AAAC architecture. This may be the service concept, i.e. which services shall be provided at which quality. However, also charging strategies like pre-paid charging, which gained a lot of subscribers in the GSM market, have different requirements to the AAAC architecture than traditional postpaid charging concepts. Especially the prepaid charging concept rises up timely critical policing requirements which could be both, provider-centric or subscriber-centric. So performance and scaleability issues play an important role on an open and scaleable AAAC architecture supporting various service provisioning concepts. Basically, the AAAC architecture can be regarded from two points of view: the user and the provider perspective. Without discussing it in any detail or explicitly the subscriber perspective is provided by his QoS and mobility requirements. User view's requirements are at some stages of interest, but the complexity of allowing for access and mobility will basically remain similar for the AAAC architecture.
Specifically,
Placed before this background, the present inventor recognized the object of the present invention to provide a method with which an accounting service in a mobile communication system can be performed, when the accounting part is separated from the authentication and authorization nodes.
Accordingly, there is provided a method of providing an accounting service in a mobile communication system, comprising the steps of accessing a chargeable functionality of said communication system by a user, by authenticating said user by a authentication/authorization server, and authorizing said access of said user by said authentication/authorization server; and indicating an accounting server for the user by said authentication/authorization server, wherein said accounting server is physically separated from said authentication/authorization server.
The mentioned chargeable functionality can be a visited network of said mobile communication system or a service of said mobile communication system.
As an implementation of the present invention said accessing step can be performed by sending an authentication/authorization request message from an authentication/authorization client to which said user is currently attached to said authentication/authorization server which replies by sending an authentication/authorization answer message to said authentication/authorization client, and wherein said answer message includes said indication of an accounting server for said user.
In this case, said authentication/authorization server can directly indicate said accounting server to said authentication/authorization client which is handling said user and keeps a corresponding account.
Consequently, there can be a further step of requesting an accounting for said chargeable functionality from said indicated accounting server by said authentication/authorization client.
According to the present invention, it is preferred that, during said accessing step, said authentication/authorization client receives a ticket indicating that said user has been granted to access said chargeable functionality, and said ticket is sent to said accounting server which checks whether accounting for said user is to be started.
In this case, said ticket can contain at least one of the information: to which user it belongs, when the access was granted, for how long the access was granted, and from which client the access was granted.
Moreover, said ticket is preferably signed by the authentication/authorization server so that it is verified to the accounting server that the authentication/authorization server really has made the ticket.
More details as well as advantages of the present invention are apparent from the following detailed description of the preferred embodiments thereof which are to be taken in conjunctions with the appended drawings.
The present invention is of a general nature and has been made in view of the 3GPP (3rd generation partnership project) and 3GPP2 systems. In 3GPP, the Diameter protocol, which is the protocol used in the AAA framework, is used in the IMS (IP multimedia subsystem) in the Cx interface which is between the I/S-CSCF (interrogating-/serving-call state control function) and the HSS (home subscriber service) for the AAA purposes. For charging purposes (for simplicity, charging may considered as being roughly the same as accounting), e.g. on-line charging, the Diameter protocol may be used in 3GPP. The charging nodes are separated from the authentication and authorization nodes which are the S-CSCF and the HSS.
When a user accesses a network (or a service, e.g. the session initiation protocol—SIP) the user is authenticated and together with that the network authorizes the access to the network, e.g. based on roaming agreements, etc. For this purpose, the AAA infrastructure can be used.
Reference is made to
In the message M2, the authentication/authorization server AA-S may indicate the accounting server ACC-1 for the user U where to send call detailed records (CDR) or which handles on-line charging services (e.g. pre-paid). Currently this is not possible in the Diameter protocol. This has the benefit that the authentication/authorization server AA-S can indicate directly the accounting server ACC-1 (out of several possible ones, indicated by ACC-1, ACC-2) which handles the user U and has the account for him/her.
As a preferred embodiment of the present invention, it is proposed that together with the above the authentication/authorization server AA-S gives a ticket to the authentication/authorization/accounting client AAA-C which needs to be send to the accounting server ACC-1 (message M3) to inform that the user U has been granted to access the network (or service). This ticket may contain information about:
Preferably, the ticket should be signed by the authentication/authorization server AA-S in order that the accounting server ACC-1 can verify that the authentication/authorization server AA-S really has made the ticket.
Because it is likely that the authentication/authorization server AA-S and the accounting server ACC-1 are in the same domain some of the shared secret mechanisms can be used within the home domain. Also a public key mechanism can be used. The authentication/authorization/accounting client AAA-C only has to pass the ticket to the accounting server ACC-1.
The accounting server ACC-1 uses the ticket to check whether it is okay to start accounting for the user U. If this kind of ticket is not send to the accounting server ACC-1 it does not know whether the user has been really authenticated and/or authorized for access by the (home) authentication/authorization server AA-S. In this case, the accounting server ACC-1 must rely on the authentication/authorization/accounting clients AAA-C. This may have a possible security thread, because there can be many authentication/authorization/accounting clients AAA-C in various places which can be connected to the AAA infrastructure via some brokers. This increases the thread for malicious users to enter the system.
It is remarked that, as indicated in
As mentioned above, the present invention allows to directly indicate the correct accounting server for the user if it is known in the authentication/authorization server, and the accounting server is provided separately to the authentication/authorization server. This allows to verify if the user was authenticated and authorized in the (home) authentication/authorization server by the separate accounting server.
What is described above is a method of providing an accounting service in a mobile communication system, comprising the steps of: accessing M1, M2 a chargeable functionality of said communication system by a user U, by authenticating said user U by a authentication/authorization server AA-S, and authorizing said access of said user U by said authentication/authorization server AA-S; and indicating M2 an accounting server ACC-1 for the user U by said authentication/authorization server AA-S, wherein said accounting server ACC-1 is physically separated from said authentication/authorization server AA-S.
While it is described above what is presently considered to be the preferred embodiments of the present invention, it is apparent to those skilled in the art that various modifications are possible without departing from the spirit and scope of the present invention.
| Filing Document | Filing Date | Country | Kind | 371c Date |
|---|---|---|---|---|
| PCT/IB02/02423 | 6/26/2002 | WO | 12/20/2004 |
