Telecommunications network and method for time-based network access

ES 2 811 509 T3

DESCRIPTION

Telecommunication network and time-based network access method

FIELD OF THE INVENTION

The invention relates to the field of telecommunications. In particular, the invention relates to a telecommunications network and to a method for allowing access to said telecommunications network.

BACKGROUND OF THE INVENTION

The last decades have seen an ever-increasing demand for telecommunications network data capacity. Telecommunications service providers have adapted their networks to provide expanded GSM services, such as GPRS and 3G services, and continue to provide new services to meet the demands of their customers.

Telecommunications providers have made attempts to influence the behavior of their customers in order to use network resources effectively. As an example, mobile data subscriptions are currently offered using volume-based billing, possibly in combination with an upper volume limit, forcing customers to consider the amount of data to be transmitted. through a network. However, the control of client behavior and / or terminal data transmission and therefore the use of network resources is still limited.

There is a need in this art for a telecommunications network upgrade and a method for regulating the use of network resources.

From WO 01 / 55861A a method and a system for controlling access to a telecommunications network is known. EP 1681815 discloses a data communication restriction method for flat rate users. The data communication restrictions method comprises the steps of monitoring the data communication status of a flat rate user, and determining whether the demand number or communication quantity during a predetermined period exceeded a predetermined threshold; setting the flat rate user as a restricted object of communication when it is determined that the threshold was exceeded; and transmitting a communication restriction signal including information on the communication restriction period to a mobile terminal of the restricted flat rate user, when the restricted flat rate user requested access again; in the course of which the data communication of the restricted flat rate user mobile terminal is restricted during the communication restriction period.

SUMMARY OF THE INVENTION

A telecommunications network configured to provide communication access for a plurality of terminals is provided. Each terminal comprises a unique identifier to access the telecommunications network. The unique identifier is preferably associated with a subscription of the terminal, eg, the identifier of a SIM (IMSI) that is available in the terminal. The telecommunications network comprises a register, an access request receiver and an access module. The registry is configured to store the unique identifier of at least one terminal in combination with at least one access authorization time interval or its equivalent, during which access is allowed for the terminal. The access request receiver is configured to receive the access request to access the telecommunications network from the terminal. The access request can contain the unique identifier or a temporary identifier. The access module is configured to deny access to the terminal if the access request is received outside the access time interval or its equivalent.

A registry and a service controller entity, for use in such a network, are also offered in this regard.

A computerized method of controlling access to a telecommunications network is also provided. The telecommunications network is configured to allow access for a plurality of terminals, each terminal comprising a unique identifier to access the telecommunications network. The telecommunications network comprises a register configured to store the unique identifier of at least one terminal in combination with at least one access authorization time slot or its equivalent. An access request is received from the terminal to access the telecommunications network. The access request can contain the unique identifier or a temporary identifier. In a further step, the access authorization time interval for the terminal is verified, using the unique identifier. Access to the telecommunications network, for said terminal, is denied if the access request is received outside of said time interval.

A computer program and a support medium for said computer program, comprising parts of program codes configured to execute the method, are also offered in this regard.

Also, a terminal is provided for use in the system and the corresponding method.

ES 2 811 509 T3

It should be noted that an access authorization time slot equivalent includes an access denial time slot that identifies a time slot during which an access request must be denied to access the telecommunications network.

The access demand can be a circuit switched access demand, a packet switched access demand, or a combined demand.

The stages of accessing a telecommunications network are standardized in eg 3 GGP TS 23.060 (Release 7). It should also be noted that access to the telecommunications network can be denied at various stages of access. The first phase of demanding access to the network usually involves a network connection procedure that comprises several stages. In a preferred embodiment, access to the telecommunications network is denied by denying the terminal's connection to the network. Denial, in this phase, provides optimized resource savings.

Another phase of network access involves establishing a PDP context. The establishment of the PDP context can be denied. Although the connection to the preceding network already involved the use of network resources, the prohibition of establishing a PDP context prevents the effective use of the telecommunications network and the consequent savings of resources. It should be noted that the prohibition determined by the operator (ODB) as such for access to a telecommunications network is already described in document 3GGP TS 23.015 V.7.0.0. The possibility of prohibition allows network operators to deny access to particular destinations for some subscribers.

By providing the option of specifying one or more time intervals during which access to the telecommunications network is allowed for a particular terminal or group of terminals, network operator planning and control of the use of the terminals is facilitated. network resources. Denying or blocking access, during intervals of time, can be advantageous in several situations. In particular, some machine-to-machine (M2M) applications do not require immediate data transmission. If these applications are prevented from demanding one or more network resources during, for example, peak load hours, network resources can be saved. Such subscriptions can be offered, for example, at a lower subscription rate.

M2M applications typically involve hundreds or thousands of devices that only rarely require access to a telecommunications network. One example involves the electronic reading of, for example, electricity supply meters in the homes of a large customer base.

There are embodiments that provide a suitable place in the telecommunications network to make the combinations of terminal identifiers and associated time slots available.

There are embodiments that provide a dynamic time slot (and possibly an implicit or virtual time slot) in the course of which access to the telecommunications network is allowed / prohibited. These embodiments contribute to the optimal use of network resources.

There are embodiments that provide improved use of network resources.

There are embodiments that provide the option of informing the terminal of the access authorization time interval. Such information should only be transmitted to the terminal in question. Furthermore, allowing only a single authentication saves network resources and saves energy for the terminals.

There are embodiments that ensure that the decision whether or not to allow access (connection to the network or establishment of the PDP context) to the telecommunications network is incorporated at a low level of the telecommunications network, eg, in the SGSN node, thus reducing the consumption of network resources. Other solutions, such as the implementation of access authorization time rules on a RADIUS server would require various network functions, mobility management and establishment of a Packet Data Protocol (PDP) context, and hence thus, unnecessary consumption of network resources in case it was determined that the terminal accessed the telecommunications network outside the access authorization time interval.

There are embodiments that allow the transmission of information to the terminal. Such information may include information regarding the applicable access authorization time interval. Possibly, the information may include control information to control the operation of the terminal. The control information may, for example, control the terminal to go into operation during a time interval where the network load is expected to be low. An authentication procedure is preferably performed for this terminal.

There are embodiments that provide higher level authentication, eg, at a GGSN node, during the access authorization time interval.

ES 2 811 509 T3

In the following, embodiments of the invention will be described in more detail. It should be noted, however, that these embodiments cannot be construed as limiting the scope of protection for the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS

In the drawings:

Figure 1 represents a schematic illustration of a telecommunications network according to an embodiment of the present invention;

Figure 2 represents an HLR, an SGSN and a GGSN of the telecommunications network represented in Figure 1;

Figures 3A to 3D represent various time diagrams of methods for using the telecommunications system depicted in Figure 1 and

Figure 4 represents a schematic illustration of a terminal for use with the telecommunications network depicted in Figure 1.

DETAILED DESCRIPTION OF THE DRAWINGS

Figure 1 represents a schematic illustration of a packet service telecommunications network 1 in combination with a plurality of terminals AD that can access the telecommunications network 1 for data communication.

The telecommunications network 1 comprises a cellular radio access network 2 containing a base transceiver station 3 and a base station controller 4. The radio access network is connected to a mobile core network containing a serving controller entity 5, a registry 6 and a gateway 7 that provides access to another network 8.

The serving controller entity 5 may be a serving GPRS support node (SGSN) or other entity. The SGSN node 5 controls the connection between the telecommunications network 1 and the terminals AD. It should be noted that the telecommunications network can contain a plurality of SGSN nodes, where each of the SGSNs is usually connected to the base station controllers 3 in such a way that they can provide a packet service for terminals through several stations. base 3.

Register 6 may be a home location register (HLR) or other register (such as a residential subscriber server for IMS).

The gateway 7 may be a GPRS gateway support node (GGSN) for, for example, the Internet network. Other outside networks include a corporate network or other operator network. The GGSN node 7 is connected to the SGSN node 5 through a core network.

The access for the terminals AD to the telecommunications network 1 involves several access phases.

The first phase involves the phase during which a terminal AD makes a connection to the telecommunications network 1. In this phase, various communication stages are performed, including authentication stages, as provided, by way of example, in 3GGP TS 23.060 (Release 7). The authentication steps perform a security function and involve the exchange of an authentication triplet (for GPRS) or a quintet (for UMTS).

At a later stage, a packet data protocol (PDP) context may be established to support traffic flows through the telecommunications network 1. A PDP protocol context typically includes radio access support provided between a terminal A and SGSN node 5 and packet switched data channels or tunnels provided between SGSN node 5 and GGSN node 7. A session between terminal A and another party would then transmit the established PDP context. A PDP context can transmit more than one traffic flow, but all traffic flows within a particular PDP context are treated the same with respect to their transmission over the telecommunications network 1.

In operating conditions, terminal A can indicate after the network connection phase, in a message requesting the activation of the PDP context in the network, an access point name (APN) for the selection of an access point. reference for a specific external network 8. The SGSN node 5 can send a PDP context creation request to the selected GGSN node 7, for example, based on the access point name given by the terminal A or to a GGSN node, by default, known to the SGSN 5. Subsequently, the PDP context is activated by assigning a PDP context data structure in the SGSN 5 that is used by the terminal A and the GGSN 7 that serves the subscriber access point. The data structure contains an IP address of terminal A, the IMSI of the terminal

ES 2 811 509 T3

A and the tunnel IDs at nodes SGSN 5 and GGSN 7. The tunnel ID identifier is a number assigned by the GGSN 7 that identifies data related to a particular PDP context.

Various features can be controlled by the SGSN 5 during a communications session. This control can be based on the information associated with the subscription and stored in the HLR 6. The information can be retrieved from the HLR 6 to the SGSN 5 to allow control at the SGSN level.

In particular, and referring now to Figure 2, the HLR 6 contains a unique identifier associated with the subscription for each terminal AD, eg, the IMSI stored in the SIM of the terminal AD. Each terminal AD has been assigned a time slot during which access to the telecommunications network 1 will be authorized.

In this example, for terminals A and B, access will be authorized between 08:00 and 11:00 in the afternoon. For terminal C, access will be authorized between 00:00 and 05:00 in the morning. These time intervals are typically off-peak intervals for most days of the year. Terminal batches can be defined and assigned to a particular interval of off-peak hours. For terminal D, a variable time interval xy is programmed, depending on the network load experienced by, or predicted for, the telecommunications network 1. If the network load falls below, or is expected to fall below , from a particular threshold, access to terminal D is authorized.

Of course, the time slots can also be related to the time windows during which access to the telecommunications network 1 is denied, eg access denial time slots. Multiple time slots can be assigned to a terminal.

In order to control the use of resources of the telecommunications network 1, the SGSN 5 contains several modules to carry out the operations described below in greater detail. It should be noted that one or more of these modules can be implemented as software modules running on a processor (not shown). The SGSN 5 also contains memory and storage means (not shown) to carry out these operations in a way generally known to those skilled in the art.

The SGSN 5 comprises an access request receiver 20 configured to receive an access request from the terminals AD to access the telecommunications network 1. The access request of a terminal contains the IMSI of the SIM available in this terminal.

The SGSN node 5 has an access module 21 configured to deny access for a terminal to the telecommunications network 1 if the access request is received outside of the access authorization time intervals for that terminal (or within the interval of denial of access). Denial of access can be related to connecting to the network or establishing the context of the PDP protocol.

Furthermore, the SGSN node 5 comprises a data retrieval module 22. The data retrieval module 22 is configured to retrieve data from the HLR 6, in particular, the applicable access authorization time interval associated with the terminals AD from which the access request was received. However, it should be noted that the SGSN 5 itself can be preconfigured with respect to particular terminals and therefore already comprises the access authorization time slots for these terminals. This can be especially advantageous for stationary terminals.

The SGSN node 5 further comprises a PDP context establishment module 23 and an authenticator 24.

The SGSN node 5 may also have a network load monitor 25 configured to monitor the network load of the telecommunications network 1. The network load information can also be obtained from other sources, for example, other SGSNs or nodes. the HLR of the telecommunications network 1. Network monitoring can be real-time and / or based on the predicted network load using mathematical models and historical data to obtain an appropriate load expectation.

The operation of the telecommunications network 1, and in particular the SGSN node 5, will now be described with reference to Figures 3A to 3D.

In Figure 3A, the access request receiver 20 of the SGSN node 5 receives a connection request from the terminal A at 07:00 pm in step 30. In order to process this connection request, the SGSN node You need the IMSI of the SIM available in the terminal. The connection request may contain this IMSI or a P-TMSI assigned to terminal A via an SGSN node. The P-TMSI is used to prevent the transmission of the IMSI over the radio path as far as possible for security reasons. If the P-TMSI provided by terminal A is known at the SGSN node, the SGSN is able to derive the IMSI. Alternatively, for a P-TMSI provided by terminal A that is not known to the (new) SGSN, the IMSI is provided by the old SGSN or the terminal itself upon request of the new SGSN. The IMSI is used by the data retrieval module 22 to retrieve the access authorization time interval (08:00 - 11:00 pm) from the HLR 6 to the SGSN node 5 in step 31.

ES 2 811 509 T3

The access authorization time slot can be communicated from the HLR 6 to the SGSN node 5 in a variety of ways.

The connection request 30 is usually followed by an authentication check, step 31. The access authorization time slot can be transmitted to the SGSN node 5 with the authentication triplet or quintet.

The authentication procedure of the network connection phase is usually followed by a location update procedure. First, an update location request 32 is transmitted from the SGSN node 5 to the HLR 6. The access authorization time slot may also be transmitted to the SGSN node 5 in a post-insert subscriber data message from the HLR. 6 (stage 33). The network connection phase ends with a connection acceptance message to terminal A (step 34).

After the completion of the networking phase (which may comprise additional steps mentioned in the previous paragraphs), a PDP protocol context is established. Terminal A requests the establishment of the PDP protocol context in a PDP protocol context request in wake-up 35.

Regardless of the mode of obtaining the access authorization time interval, the access module of SGSN 5 determines that the access request was received outside the access authorization time interval. Consequently, a PDP context is not established (indicated by the cross in step 36). Terminal A is informed of the denial in step 37.

It should be noted that the authenticator 24 of the SGSN node 5 may or may not have an authenticated terminal A in the above situation. Authentication is required if the connection access time interval is transmitted from HLR 6 to SGSN node 5 in response to update location message 32. However, authentication should not be performed if the access authorization time interval obtained in SGSN 5 with authentication triplet / quintet. An authentication is preferred if the denial message 37 to terminal A contains information regarding the access authorization time interval.

The SGSN node 5 understands or obtains and maintains the data of the failed access request. This can be done, for example, by storing the time interval in combination with the IMSI of terminal A or by a time indicator of terminal A in combination with some indication of time.

Another access request at a time outside the time window of 08:00 - 11:00 pm (stage 38), which contains, again, or is followed by the IMSI of terminal A, can then be denied directly (stage 39) . Again, authentication will not take place.

In Figure 3B, terminal A's network connection is received at 09:00 in the afternoon. Steps 40 to 45 correspond to steps 30 to 35. Since the network connection demand is now within the time slot allotted for access for terminal A, the access module 21 controls the PDP context establishment module. 23 of SGSN node 5 to establish a PDP protocol context with terminal A and to establish a PDP tunnel with GGSN node 7. In particular, step 46 involves a PDP context request creation and step 47 involves a PDP context response creation in a manner known as such. In step 48, terminal A is informed by a PDP context accept activity message. Terminal A can now follow another authentication procedure (step 49) using, for example, a RADIUS server in the other network 8.

The network load monitoring module 25 of the SGSN node 5 can monitor the network load of (or a part of) the telecommunications network 1 or output a predicted network load. The network load can be compared to a load threshold in order to assess the existence of a low network load situation at a particular time or time interval.

In Figure 3C, steps 50 to 53 correspond to steps 30 to 33 depicted in Figure 3A. The authentication of the terminal D is performed and in step 54, the terminal D is informed of a time interval xy during which a low network load is expected. The information includes control data to control the terminal D so that it again accesses the telecommunications network 1 (step 55) in said low network load time interval. A PDP protocol context can be established immediately (steps 56-58) and access to the RADIUS server is allowed.

As indicated above, the denial of access to the telecommunications network 1 is preferably carried out during connection to the network. Figure 3D depicts, at step 60, a network connection message from terminal A containing an IMSI. Next, an authentication procedure is performed (step 61) during which the access authorization time interval is received at the SGSN node 5. The access authorization time interval and the IMSI is stored in the SGSN node 5. Alternatively, the access authorization time interval is obtained in the location update procedure (steps 62 and 63). The network connection is denied in step 64.

As indicated above, the SGSN node 5 can, by itself, comprise preconfigured information regarding the access authorization time interval for terminal A. Alternatively, the SGSN node uses the

ES 2 811 509 T3 authenticator 24 to authenticate terminal A and to provide terminal A with information regarding the access authorization time interval in step 61.

Figure 4 represents a schematic illustration of terminal A. Terminal A comprises a transceiver module 70 for communicating with telecommunications network 1. Furthermore, terminal A has an access demand module 71. The access request module is configured to receive information regarding the access authorization time interval from the telecommunications network 1 through the transceiver module 70 and to transmit an access request to the telecommunications network only at a time within of the access authorization time interval.

It should be noted that the telecommunications network described above and the corresponding system are especially suitable for saving resources. There may be other methods to influence the access behavior of the terminals, but these are considered to waste more resources.

As an example, a network provider may allow access to the network at all times, but charge a high (very high) fee for data sent outside of peak load times. This does not provide any incentive for the user to remove the connection (that is, the PDP protocol context) for the network. It only provides an incentive not to send data during the high cost load rush hour. However, an active PDP protocol context still consumes too many resources in the core and mobile radio network in addition to requiring an IP address. It also requires that the terminal be connected to the network, which means that all kinds of mobility management features must be established. In addition, this solution requires a more complicated billing system that allows you to charge higher rates at certain times.

Another example would include blocking access to the terminal during peak load hours as a rule on a RADIUS server. However, the network resources would already be consumed before access is blocked by the RADIUS server. The terminal is already allowed to connect to the network, which means that the SGSN would have retrieved information from the HLR and is performing mobility management functions. Furthermore, the terminal has been allowed to establish a PDP protocol context. If the RADIUS server denied the request for access to the outside data network, the GGSN node would not accept the PDP context and the tunnel would be operationally removed. However, the connection to the network will continue if no further action has been taken.