Method and device for authenticating a subscriber for utilizing services in a wireless lan (wlan)

The invention relates to a method and a device for Authentication of a participant for the claim Of services in a wireless LAN (WLAN) using Of an IP multimedia subsystem (IMS) of a mobile radio network.

From the magazine Funkschau 09/2002. Page 14-15 are procedures For authentication of WLAN subscribers in one Mobile network, namely the authentication via a NAI (Network Access Identifier) ​​and optionally a SIM card, as well as authentication with the IPv6 (Internet Protocol version 6) and a so-called SIM-6 mechanism. In general, an authentication of a wireless LAN Participant via an HTTP protocol.

WO 00/76249 A1 describes a method for authorizing a Internet protocol capable mobile device for access to the Internet Internet via a wireless LAN (WLAN), GSM or UMTS network. This involves sending an IP access request from the mobile device To an IP router via the access network. In response to receiving this access request to the IP router Will get an IP address routing prefix from the IP router The mobile device. The IP router only directs IP packets Then forward to the mobile device if he previously received an authorization message From a control point. The control point Monitors the payment (electronic cash) of the mobile Device for the use of the Internet.

US 2002/0062379 A1 describes the structure of a multimedia session In a mobile device having a session paket access beam (Session packet access bearer), which runs between The mobile device and an access point to a packet data network Via a radio access network. The access point Is connected to a multimedia system that Multimedia meeting services. By using the Session Packet Access is a multimedia session, Which includes a plurality of media data streams, in one Mobile device. Media packet access bearer between The mobile device and the access point.

The object of the present invention is to provide a subscriber A wireless LAN, which also participates in a mobile network In the use of services in a mobile network To efficiently authenticate.

The object is achieved according to the invention by the objects of the invention Independent claims relating to the procedure and the Device. Further developments of the invention are described in the Subclaims. The authentication according to the invention Using an IP multimedia subsystem The advantage that the authentication of a subscriber for Any services that are accessed via the wireless LAN Without installing a separate server for the Authentication in wireless LAN and without Separate connection to a corresponding instance in the Mobile radio network (eg HLR / HSS), which can be used by means of a (Interface) must be contacted, is carried out.

The invention will be described with reference to the accompanying drawings, in which: FIG Illustrated by way of example. Show in detail<dl tsize="7" compact="compact"><dt>FIG</dt><dd>The architecture with the interfaces between one Wireless LAN and an IP Multimedia Subsystem (IMS)</dd><dt>FIG</dt><dd>Such as WAGW's authentication result Use of your own P-CSCF / Policy Control function On-site with WLAN coverage</dd><dt>FIG</dt><dd>As the WAGW the authentication result by the CSCF / Policy Control Function of the IP Multimedia Subsystem (IMS)</dd><dt>FIG</dt><dd>As the WAGW by extended functionalities the Authentication result</dd></dl>

Figure 1 shows how the wireless LAN with an IP multimedia Subsystem (IMS) (3). A subscriber MT (6) of a Wireless LANs (10) is connected via an air interface (11) to the Wireless LAN in one place with wireless LAN coverage (hotspot) connected. For authentication, the MT (6) is received by the proxy Call State Control function node (P-CSCF) (1) an IP address (For example, by DHCP). The subscriber MT (6) can thereby itself Via SIP registration in IMS (3) without a prior bearer Level authentication (eg H / 2, authentication via the Air interface is optional). In IMS (3) The authentication takes place on the application side in the call state Control function node (CSCF) (4) via a SIP Registration message. Through the authentication the MT (6) access to specific profiles (eg WLAN profiles) Is granted. The CSCF (4) uses one per se for the IMS (3), however Not for a WLAN (10) Known authentication using the Home Subscriber System (HSS) (5) via the Cx interface. The P-CSCF (1) of the WLAN (10) receives the result of the authentication via a SIP Registration request (for example, 200 OK). This result is attributed to the WLAN Access Gateway (WAGW) (2). The WAGW (2) Controls access to services and monitors the Successful authentication in IMS (3). Wireless LAN (10) Is connected to the Gi interface or the Mm interface with the IMS (3). The Gi interface provides a Interface within the IP network (7) Thus special safety precautions. Be considered Also the geographical distance between the IMS (3) and the Place with the WLAN coverage. For the Mm interface, the Connection between the IMS (3) and the place with the WLAN Coverage (hotspot) over an IP multimedia network (Internet) (8th).

The authentication of an MT (6) in the IMS (3) takes place under Use the SIP protocol. The result of the Authentication in the IMS (3) is sent to the WAGW (2). For this purpose, there are three possibilities, which are described under FIG. 2, FIG. 3 And FIG.

FIG. 2 shows the WAGW (2) the authentication result By its own P-CSCF (1) / policy control function at the location With WLAN coverage (hotspot). In this case, the WLAN is (10) is provided with its own P-CSCF (1), which for this purpose , SIP messages to the corresponding instance in the IMS (3) (SIP registration request) and the WAGW (2) According to the authentication results of the IP Multimedia Subsystem (IMS) (SIP response). The P-CSCF (1) Communicates with the CSCF (4) in the IP multimedia subsystem A Gi interface or a Mm interface (via Internet (8th)). The P-CSCF (1) gives the WAGW (2) based on the Result The authentication (SIP registration) in the IMS (3), Instructions, such as the data traffic of an MT (6) by the WAGW (2). For example, the WAGW (2) can control the data flow to block. Using the Policy Control function, P-CSCF (1) the data traffic through the WAGW (2) and the Quantity and quality of the data flow of an MT (6) by the WAGW (2), restrict, increase or reject them. This Mechanism is imitated by the Go interface, the Between the P-CSCF of the IMS (3) and the gateway GPRS Support Node (GGSN) (9) is installed. This policy control function Can be a component of the P-CSCF (1) or its own Unit that is optional for the IP multimedia subsystem And the PS domain can be used. A possible policy protocol is COPS (RFC 2748, applied For the Go interface). The Go interface is used An IP transport and therefore, when implementing a Secure transmission of COPS messages within the Wireless LAN or a separate (isolated from traffic) Of participants within the wireless LAN) P-CSCF (1) and WAGW (2).

FIG. 3 shows how the WAGW (2) shows the result of the IMS Authentication from the CSCF (4) of the IMS (3) Of course. The CSCF (4) of the IMS (3) controls the WAGW (2) In the sense that it exercises policy functionality. Practice here But the P-CSCF of the IMS (3) controls the WAGW (2) Instead of a separate P-CSCF in the wireless LAN. The policy functionality controls the P-CSCF of the IMS (3) the traffic through the WAGW (2) and the Quantity and quality of the data flow of the MT (6) WAGW (2), restrict, increase or reject them. This Mechanism is imitated by the Go interface, the Between P-CSCF of the IMS (3) and the GGSN (9) of the PS domain Is installed. Between the CSCF (4) of the IMS (3) and the WAGW (2) of the wireless LAN (10) is used for secure data transmission A Go interface installed. The WAGW (2) can the SIP Messages that contain the authentication result The Gi interface or via the Mm interface to the CSCF (4) in the IMS (3).

FIG. 4 shows the WAGW (2) the authentication result Even evaluated. The WAGW (2) receives the result, Whether an authentication of the MT (6) took place in the IMS (3) and Which is the result of this. Subsequently, the WAGW (2) converts the result by completing subscriber data completely or Restricted. If the WAGW (2) with a Gi Interface, so it can Authentication (SIP registration) The CSCF (4) in the IMS (3). Otherwise the Mm Interface. So that the WAGW (2) the result of the Authentication (SIP messages), it is used in Form of an "application layer gateway". Thus, It is the result of a SIP authentication without the Use a CSCF (4) accordingly. The WAGW (2) Investigates the data packets on SIP messages (Registration requests and responses) and interprets the SIP registration replies corresponding to the filtering of Subscriber data. So that not every data packet from the WAGW (2) Must be opened, a precipitation process can be initiated on OSI Layer 3 (IP address) or OSI Layer 4 (port number) will. This is an IP address, a port number, or Other criterion for elimination is an occasion for the Data packet or a datagram to the next higher OSI layer Or whether the WAGW (2) can happen.