Method for controlling access rights in a mobile radio communications system

0001The present invention relates generally to mobile radio systems.

0002In general, mobile radio systems are covered by standards and for more information reference may be made to the corresponding standards published by the corresponding standardization bodies.

0003The general architecture of such a system is described briefly with the <figref idrefs="f0001">figure 1</figref>. Such a system comprises a mobile radio network 1 communicating with mobile terminals 2 and with external networks (not specifically illustrated). The network 1 itself includes a radio access network 3 (RAN for "Radio Access Network") primarily responsible for the transmission and for managing radio resources on the air interface between the network and mobile devices, and a core network 4 (or CN, for "Core network") responsible mainly for routing and managing communications.

0004The changing needs and technology generally lead to distinguish different types of systems, including second-generation systems and third generation systems.

0005A typical example of second generation system is GSM ( "Global System for Mobile communication"). Initially, the GSM was essentially intended to provide circuit-like services. packet type services were then introduced through the GPRS functionality ( "General Packet Radio Service").

0006In a system such as GSM for example, the mobile terminal is called MS ( "Mobile Station"), the radio access network (RAN) is comprised of subsets called BSS ( "base station subsystem"), and the core network (CN) must, for the domain associated with the circuit switched (or "CS domain" in English), the type of network elements 2G-MSC (where 2G stands for "2^nd Generation "and MSC stands for" Mobile Switching Center ") and, for the domain associated with the packet-switched (or" PS domain "in English), network elements type 2G-SGSN (where 2G is used to" 2^nd Generation "and SGSN stands for" Serving GPRS Support Node ").

0007A typical example of third generatio system n is the UMTS ( "Universal Mobile Telecommunication System").

0008In a system such as UMTS for example, the mobile terminal is called EU ( "User Equipment"), the radio access network (RAN) is called UTRAN ( "UMTS Terrestrial Radio Access Network"), and the network heart (or CN) must, for the domain associated with the circuit switched (or "CS domain" in English), type of network elements MSC 3G- (where 3G is used to "3^rd Generation "and MSC stands for" Mobile Switching Center ") and, for the domain associated with the packet-switched (or" CS domain "in English), network elements for 3G-SGSN kind (where 3G is used to" 3^rd Generation "and SGSN stands for" Serving GPRS Support Node ").

0009Both in second generation systems (such as GSM for example) in third generation systems (such as UMTS for example), the core network further includes data registries or databases of mobile users, such as in particular HLR ( "Home location Register") and VLR ( "Visitor location Register"), these registers or databases containing subscription data and user location data. For the circuit area, the VLR is usually associated with MSC, hence the use of the term MSC / VLR. For the packet domain, the VLR is usually integrated to the SGSN.

0010Both in second generation systems (such as GSM for example) in third generation systems (such as UMTS for example), a mobile terminal is further associated with a subscriber identity module, also called card SIM ( "Subscriber Identification Module") in the case of GSM for example, or SIM ( "Subscriber Identification Module") in the case of UMTS, for example.

0011In general, these systems have a cellular architecture, and mechanisms are provided for selecting a permanent best server cell.

0012In addition, to extend the geographical coverage of these systems and / or services offered, it is generally provided a plurality of networks or PLMNs, usually associated with different operators. Mechanisms are also provided to choose continuously improved server network if roaming agreements (or "roaming agreements") are provided between the operators concerned. We usually use the term home network or HPLMN (for "Home PLMN") to designate the network to which a user is subscription relationship, and visited network VPLMN or (for "Visited PLMN") to designate a different network HPLMN, under the cover of which is that user.

0013The document <nplcit id="ncit0001" npl-type="s"><text>PUETZ S ET AL: "SECURE interoperation BETWEEN 2G AND 3G MOBILE RADIO NETWORKS ', XP001016360</text></nplcit> addresses security aspects of interworking (or "interworking") 2G and 3G.

0014The document <patcit id="pcit0001" dnum="WO0225981A"><text>WO-A-02/25981</text></patcit> deals with homelessness (or "roaming") between 2G and 3G.

0015In addition, the cells of a given network are generally grouped by geographical areas, in a mobility management goal of users and control access rights. These regions are generally called location areas (or LA for "Location Area" in the case of the circuit domain) or routing areas (RA or, for "Routing Area" in the case of packet domain).

0016In what follows, we will consider, for example, if circuit area, and the mechanisms of selection or cell reselection used in standby mode (or "Idle Mode").

0017A mobile terminal is able to recognize, from the information provided in each cell, whether a new reselected by the mobile terminal cell belongs to the same location area as its current server cell. If so, the new cell becomes the new serving cell. Otherwise, the terminal prior notice to the network, through a procedure known location update, in order to control the right of the user to access the new cell.

0018As part of this location update procedure, the mobile terminal transmits to the network a message of said location update request, (or "Location Area Updating Request").

0019In the case of positive response of the network, the message returned from the network to the mobile terminal is a message of said location update acceptance (or "Location Area Updating Accept"). The user is then stored in the new location area, and re-selected cell becomes the new serving cell.

0020In the case of a negative response from the network, the message returned by the network to the mobile terminal is a message said location updating rejection (or "Location Area Updating Reject") indicating the reason for rejection.

0021Similarly a registration procedure is provided in the initial selection of a serving cell, to power the terminal.

0022Access rights can be controlled especially during a registration or location update procedure. Procedures or protocols are provided for this purpose, involving, in particular:<ul><li>signaling exchanges between the terminal and a core network server entity (such as a particular type of entity MSC / VLR to the circuit area)</li><li>signaling exchange between said server entity of the core network, and a database of mobile user database such as HLR ( "Home Location Register").</li></ul>

0023Moreover, at least in their initial stage of deployment, third generation networks will be additional to existing second generation infrastructures. In other words the same system may then comprise a second-generation radio access network and a radio access network of the third generation with recovery of the second-generation radio coverage by third-generation radio coverage. This allows particularly for services borne jointly by these two generations, such as in particular type of telephony services, continuity of service, benefiting from the existing coverage provided by a second generation network.

0024However, in this context, new problems may arise, which can be illustrated using the following example.

0025As part of the so-called roaming SIM functionality (or "SIM roaming") it is possible that a user has subscribed only for second-generation services (for example, in the following, GSM) inserts his card SIM in a third-generation terminal (for example, in the following, UMTS) and tries to access a PLMN (which may be either its HPLMN or a VPLMN with which the HPLMN has roaming agreements) via network radio access (UTRAN in this example) of the PLMN. Or it is possible that the operator wants to restrict access to the PLMN via the UTRAN only to users who have subscribed for UMTS. A problem to solve is then to ban a user who subscribes only for GSM to register in a PLMN via the UTRAN, leaving him the possibility to register in the PLMN via the network GSM radio access. It should be noted that this problem is more particulèrement in the case where the same PLMN code is used both for GSM and for UMTS.

0026The <figref idrefs="f0002">2</figref> thus illustrates as an example the case of location updating procedure in the case where a third-generation mobile terminal (denoted UE) associated with a second generation of SIM card (SIM 2G-rated) attempts to access a HPLMN via a third-generation radio access network (RAN noted UMTS). The PLMN may be either an HPLMN or a VPLMN. Both possibilities were illustrated by the letters A and B in<figref idrefs="f0002">2</figref>, The elements of the PLMN being considered in this case denoted UMTS RAN-A and 3G MSC / VLR-A, and the HLR HLR being denoted AB.

0027For example, the <figref idrefs="f0002">2</figref> corresponds to the case where configuration PLMN MSC / VLR dedicated to UMTS (denoted 3G MSC / VLR) are provided, in addition to MSC / VLR in GSM dedicated (rated 2G MSC / VLR).

0028The <figref idrefs="f0003">3</figref> is similar to the <figref idrefs="f0002">2</figref> (The same references are used in these two figures) and differs therefrom by the fact that it corresponds to the case of PLMN configuration where the same MSC / VLR (denoted 2G / 3G MSC / VLR) carries in common GSM and UMTS.

0029The location update procedure illustrated for example in the <figref idrefs="f0002">2</figref> includes the following steps.

0030In a step 1, the terminal UE transmits an update location request to a 3G MSC / VLR via the UMTS RAN. Consider for example the case where the location of update involves a change in MSC / VLR, and where the new MSC / VLR must previously examine the HLR to control access rights.

0031On receipt of this location update request, the 3G MSC / VLR does not know if there is a GSM or UMTS subscriber, and, in a step 2, so sends a corresponding request to the HLR.

0032In a step 3, a procedure (not recalled in detail) is carried out, by which the new MSC obtains the HLR subscription data, to be stored in the associated VLR.

0033As mentioned above, a problem to solve is then to ban a user who subscribes only for GSM to register in a PLMN via the UTRAN. In other words, a problem to solve is to find a means to 3G MSC / VLR to detect if the user is considered a subscriber GSM or UMTS subscriber. While the 3G MSC / VLR can not detect if the user is considered a subscriber GSM or UMTS subscriber, in a step 5 it sends to the EU a location update accept message (in assuming further that the subscription taken by the user does not have other restrictions, such as for example géograhiques restrictions preventing access to this new location area).

0034According to the current state of the 3GPP ( "3rd Generation Partnership Project"), subscription data transferred by the HLR to the 3G MSC / VLR do not contain information enabling the latter to detect whether the user is a GSM subscriber or a UMTS subscriber.

0035To allow the 3G MSC / VLR to detect whether the user is a subscriber GSM or a UMTS subscriber, it could be envisaged, for example as described in patent application <patcit id="pcit0002" dnum="WO02091784A"><text>WO 02/091784</text></patcit>, The HLR transmits to the 3G MSC / VLR subscription data including a list of authorized services (especially such as GSM, UMTS) in the current user.

0036However, such a solution is not optimal, especially because it increases the amount of traffic exchanged between HLR and 3G MSC / VLR, and in addition, as observed by the applicant, it is not used optimally existing procedures.

0037The present invention is intended to avoid such drawbacks. More generally one of the purposes of the present invention is to optimize the access rights control procedures, particularly in systems where different types of services can be offered, such as in particular second-generation services (such as in particular GSM services) and third generation services (such as in particular UMTS services).

0038An object of the present invention is a method for controlling access rights in a mobile radio system, the method comprising the steps of:<ul><li>a core network server entity receives a basic data of mobile users, various types of authentication data for the type of authorized services for such users,</li><li>said serving entity uses said authentication data to control access rights of said users according to the type of service authorized.</li></ul>

0039Another object of the present invention is a core network server entity for a mobile radio system, comprising means for carrying out such a method.

0040Other objects and features of the present invention will become apparent on reading the following description of an embodiment taken in conjunction with the accompanying drawings in which:<ul><li>the <figref idrefs="f0001">figure 1</figref> the general architecture of a mobile radio system,</li><li>the <figref idrefs="f0002">figures 2</figref> and <figref idrefs="f0003">3</figref> are intended to illustrate a problem solved by the invention,</li><li>the <figref idrefs="f0004">figures 4</figref> and <figref idrefs="f0005">5</figref> are intended to illustrate an example of a solution according to the present invention.</li></ul>

0041In the example illustrated in <figref idrefs="f0002">figures 2</figref> and <figref idrefs="f0003">3</figref>The present invention suggests, in particular, to solve the problem described above, a server entity of the core network (such as for example a server entity type MSC / VLR in the case of the circuit area) used to detect whether the user is a subscriber GSM or a UMTS subscriber, authentication data ( "authentication" in English), which data is also called authentication vectors and to implement an authentication procedure ( "authentication" in English).

0042For example, in the case of an update procedure of location as recalled in the example shown in <figref idrefs="f0002">figures 2</figref> and <figref idrefs="f0003">3</figref>, Said data (or vectors) authentication is received from the HLR, in proceedings (not recalled in detail) implementation in a marked step 4.

0043The invention suggests to take advantage of the fact that the data (or vectors) authentication are of different types depending on the type of service authorized, in this case following the licensed services correspond to second-generation services (eg GSM ) or third generation services (eg UMTS), as will now be recalled. The authentication data is requested by the MSC / VLR and provided by the HLR before the other subscription data.

0044Recall that the authentication procedure is a procedure whereby the network to check safely, the identity of a user.

0045The princiaples stages of this authentication process are summarized in the following, first to a second generation system (eg GSM).

0046The authentication procedure includes a parameter calculation called SRES (for "Signed Result"), using a calculation algorithm of this algorithm with as input parameters a secret key K associated with the user and a random value of a parameter called RAND ( "Random Number").

0047Such a calculation is made on the one hand in the network (in an authentication center AuC ( "Authentication Center" associated with the HLR), and secondly in the terminal (in the SIM card), using the same algorithm calculation and the same of this algorithm input parameters (the secret key K is known to both the network and the terminal, and the value of the RAND parameter is communicated by the terminal to the network).

0048The result of the calculation in the terminal is communicated to the network that checks if it matches the calculation that he himself made. If so, the authentication procedure ends positively.

0049In a third generation system (UMTS eg) the authentication procedure differs mainly from that well remembered for a second-generation system (eg GSM) by the following:<ul><li>In addition to calculating the SRES parameter as recalled previously, a calculation parameter called a MAC ( "Message Authentication Code") is also carried out using a calculation algorithm with as input parameters of the algorithm the parameters RAND and K mentioned above, as well as data components of a parameter called AUTN ( "Authentication token"). This calculation of the MAC parameter is performed firstly in the network and partly in the terminal, using the same calculation algorithm and the same of this algorithm input parameters, the AUTN parameter being further communicated to the terminal by the network.</li><li>Besides the fact that the network checks whether the SRES parameter it has calculated parameter matches the SRES received from the terminal, so as to enable it to verify, in a secure, the identity of the terminal, the terminal also checks whether the MAC parameter he calculated parameter corresponds to the MAC received from the server network, so as to enable it to verify, in a safe way, the identity of the server network.</li></ul>

0050In general, the verifications carried out in the network for the implementation of the authentication process are performed in a server entity of the core network, such as for example MSC / VLR for the case of the circuit area, on the basis authentication data provided to it by the HLR / AuC. These data (vectors) authentication are generally provided by the HLR / AuC to the MSC / VLR when a location update procedure involving a change of MSC / VLR. In addition, they are generally provided in sufficient numbers to avoid such a data transfer (or vectors) authentication whenever the MSC / VLR needs to implement the authentication procedure.

0051In the case of second generation licensed services (eg GSM) vector authentication (also called "triplet") has three components, namely (RAND, SRES, CK), the RAND and SRES parameters being those mentioned above above, and the CK parameter further corresponding to an encryption key (or "ciphering key").

0052In the case of third generation licensed services (eg UMTS) an authentication vector (also called "quintet") has five components, namely (RAND, AUTN, SRES, CK, IK), the RAND parameters AUTN, SRES, CK being those mentioned above, and also IK parameter corresponding to an integrity key (or "integrity key").

0053The present invention therefore suggests to take advantage of the fact that the data (or vectors) authentication are of different types depending on the type of service authorized, namely second generation services (eg GSM) and third generation services ( eg UMTS).

0054The <figref idrefs="f0004">figures 4</figref> and <figref idrefs="f0005">5</figref>Corresponding respectively to the examples shown in <figref idrefs="f0002">figures 2</figref> and <figref idrefs="f0003">3</figref>Show an example of solution according to the present invention.

0055The steps denoted 1 ', 2', 3 ', 4' illustrated in <figref idrefs="f0004">figures 4</figref> and <figref idrefs="f0005">5</figref> may be similar to steps 1, 2, 3, 4 illustrated in <figref idrefs="f0002">figures 2</figref> and <figref idrefs="f0003">3</figref>.

0056In the examples illustrated in <figref idrefs="f0004">figures 4</figref> and <figref idrefs="f0005">5</figref>, The 3G MSC / VLR detects, on the basis of data (or vectors) of authentication received from the HLR, if the user is a subscriber GSM or UMTS subscriber.

0057If authentication vectors correspond to triplets, the user is considered to be a GSM subscriber and the 3G MSC / VLR then sends the UE, in step 5 ', a location update rejection message.

0058Also, if the terminal is a dual mode terminal, noted EU / MS, the cause of rejection of the updated location via UMTS RAN is such that an update location can then be attempted via the GSM RAN, as illustrated by the following steps:<ul><li>In step 6 ', the terminal UE / MS transmits a location update request to a 2G MSC / VLR via the GSM access network.</li></ul>

0059On receipt of this location update request, the 2G MSC / VLR, in a step 7 ', sends a corresponding request to the HLR.

0060In step 8 ', a procedure is performed, by which the new MSC HLR obtains subscription data, stored in the VLR associated with it.

0061In step 9 ', a procedure is performed, by which the new MSC HLR obtains authentication data enabling it to implement an authentication procedure.

0062In a step 10 ', the 2G MSC / VLR transmits to the UE / MS a Location Update Accept message (assuming further that the subscription taken out by the user has no other restrictions such as, for example géograhiques restrictions preventing access to this new location area).

0063An object of the present invention is thus a method for controlling access rights in a mobile radio system, the method comprising the steps of:<ul><li>a core network server entity receives a basic data of mobile users, various types of authentication data for the type of authorized services for such users,</li><li>said serving entity uses said authentication data to control access rights of said users according to the type of service authorized.</li></ul>

0064Another object of the present invention is a waitress core network entity (such as for example a type of server entity MSC / VLR for the case of the circuit domain or SGSN for the case of packet domain), comprising means for carrying such a method.

0065Another object of the present invention is thus a server entity of the core network, comprising:<ul><li>means for receiving a basic mobile data users, various types of authentication data for the type of authorized services for such users,</li><li>means for using said authentication database to control access rights of said users according to the type of service authorized.</li></ul>

0066Such server entity may further comprise:<ul><li>means for, in response to that control access rights, carried out during the implementation of a procedure to access unauthorized services, issue a negative response, said negative response triggers the implementation of a procedure for access to authorized services.</li></ul>

0067These means can operate according to the method described above; their particular implementation presenting no particular difficulty in the art, such means need not be described here in more detail than by their function.