Telecommunications network and method for time-based network access

[0001] The invention relates to the field of telecommunications. In particular, the invention relates to a telecommunications network and a method of allowing access to said telecommunications network.

BACKGROUND OF THE INVENTION [0002] The past decades have been marked by the increasing demand for data capacity of telecommunications networks. Telecommunications providers have adapted their networks to provide extended GSM services, such as GPRS, and 3G services, and continue to provide further services to meet their customers' expectations.

[0003] Telecommunications providers have attempted to influence their customers' behavior in order to efficiently use network resources. For example, today, a subscription for mobile data is offered based on invoicing based on the volume of data, with the option of connecting with volume limitation, thus forcing customers to consider the amount of data sent over the network. However, controlling client behavior and / or terminal data transmission and thus the use of network resources is still limited.

[0004] There is a need in the art for an improved telecommunications network and a method of regulating the use of network resources.

[0005] In the field of (telecommunications) Internet, WO 01/55861 is a system for controlling access to the Internet comprising a gateway server. The gateway server includes a database of profiles correlated with profile identifiers, where each profile has an access criterion, and programming directing profile access after receiving the profile identifier.

Summary of the Invention [0006] A telecommunications network is proposed, configured to provide communication access to a plurality of terminals according to independent claims 1 and 20. Each terminal has a unique identifier for accessing the telecommunications network. Preferably the unique identifier is associated with the terminal subscription, e.g. a SIM identifier (IMSI) which is available in the terminal. The telecommunications network includes a register, an access request receiver and an access module. The registry is configured to store the unique identifier of at least one terminal in combination with at least one time period for granting access, or an equivalent thereof, during which access for the terminal has been allowed. An access request receiver is configured to receive an access request terminal for access to a telecommunications network. The access request may contain a unique identifier or a temporary identifier. The access module is configured to deny access to the terminal if an access request is received outside the access time interval or equivalent.

[0007] A register and operating controller for use in such a network are also proposed.

[0008] A computer-made method for controlling access to a telecommunications network is also proposed. The telecommunications network is configured to allow access to many terminals, each containing a unique identifier for access to the telecommunications network. The telecommunications network includes a register configured to store the unique identifier of at least one terminal in combination with at least one time period for granting access or its equivalent. An access request for access to the telecommunications network is received from the terminal. The access request may contain a unique identifier or a temporary identifier. In the next stage, the time interval for granting access to the terminal is verified using a unique identifier. Access to the telecommunications network for said terminal is refused if the access request is received outside the time interval.

[0009] A computer program and a medium of such a computer program containing fragments of program code configured to perform the method are also proposed.

[0010] A terminal for use in the system and method is also proposed.

[0011] It should be noted that the equivalent of the access time period includes the access denied period identifying the time period during which the access request for access to the telecommunications network is to be rejected.

[0012] The access request may be a switched circuit access request, switched packet access request or a mixed request.

[0013] Steps to gain access to the telecommunications network are standardized in e.g. document 3 GGP TS 23.060 (7th edition). It should be noted that access to the telecommunications network may be denied at various stages of access. The first phase of the network access request usually involves a network join procedure with several steps. Preferably, access to the telecommunications network is refused by refusing to join the terminal network. Denial in this phase ensures optimized resource saving.

[0014] The further phase of network access involves establishing a PDP context. Establishment of a PDP context may be refused. Although pre-network attachment has already involved the use of network resources, prohibiting the establishment of a PDP context prevents the efficient use of telecommunications networks, and thus saves resources. It should be noted that the determination of operator exclusion (ODB) for access to a telecommunications network as such is already described in 3GGP TS 23.015, V. 7.0.0. The exclusion option allows network operators to deny specific subscribers access to specific recipients of the connection.

[0015] By providing the option of specifying one or more time periods during which access to a telecommunications network is allowed for a particular one

- 3 terminal or group of terminals, network planning and controlling by the network operator is facilitated. Denying or blocking access during time periods can confirm your suitability in various situations. In particular, some machine applications (M2M) do not require immediate data transmission. If these applications are stopped from requesting one or more network resources during e.g. peak load hours, it is possible to save network resources. Such subscriptions may e.g. be offered with a lower subscription fee.

[0016] M2M applications typically include hundreds or thousands of devices that rarely require access to telecommunications networks. For example, they involve electronic reading of e.g. electricity meters in the homes of a large customer base. The invention provides a dynamic time period (and possibly a virtual or putative time period) during which access to the telecommunications network is allowed / denied. This affects the optimal use of network resources.

[0017] Embodiments according to claims 6 and 25 provide a suitable location in the telecommunications network for providing a combination of terminal identifier (s) and associated time interval (s).

[0018] The embodiments of claims 11 and 28 provide improved use of network resources.

[0019] The embodiments of claims 12 and 29 provide improved use of network resources.

[0020] The embodiments of claims 13 and 30 provide the option of informing the terminal of the time interval for granting access. Such information should only be sent to the terminal in question. In addition, enabling only single authentication saves network resources and saves terminal power.

[0021] The embodiments of claims 9, 10, 14 and 27 and 31 ensure that the decision whether to provide or not provide access (or network connection or establishment of a PDP context) to the telecommunications network is embedded at a low level of the telecommunications network, e.g. SGSN, reducing the consumption of network resources. Other solutions, such as the implementation of access granting time rules in a RADIUS server, require several network functions, mobility management and packet data protocol (PDP) context configuration, and thus, unnecessarily consume network resources in the event that a terminal with access to the telecommunications network is outside the time period for granting access.

[0022] Embodiments of claims 15 and 32 allow the transmission of information to a terminal. Such information may include information about the applicable time period for granting access. Alternatively, the information may include control information to control the operation of the terminal. The control information may, for example, control the recording terminal during a time interval in which the network load is expected to be low. Preferably, the authentication procedure is performed for this terminal.

[0023] The embodiments of claims 16 and 33 provide a higher level of authentication, e.g., in a GGSN, during an access grant time interval.

[0024] In the following, embodiments of the invention will be described in detail. However, it should be understood that these embodiments cannot be understood as limiting the scope of protection of the present invention.

Brief description of the drawings [0025] In the drawings:

Fig. 1 is a schematic illustration of a telecommunications network according to an embodiment of the present invention;

Fig. 2 shows the HLR, SGSN and GGSN of the telecommunications network of Fig. 1;

Figures 3A-3D show different time diagrams of how to use the telecommunications system of Figures 1 and

Fig. 4 is a schematic illustration of the terminal for use with the telecommunications network of Fig. 1.

Detailed Description of the Drawings [0026] Fig. 1 is a schematic illustration of a packet service telecommunications network 1 in connection with a plurality of AD terminals that can access telecommunication network 1 for data communications.

[0027] The telecommunications network 1 comprises a radio access network 2 comprising a base transceiver station 3 and a base station controller 4. The radio access network is connected to a mobile backbone network comprising a servicing controller 5, register 6 and gateway 7 providing access to the further network 8.

[0029] The serving controller 5 may be an auxiliary GPRS serving node (SGSN) or other entity. SGSN 5 controls the connection between telecommunications network 1 and AD terminals. It should be noted that a telecommunications network may contain multiple SGSNs, each of which SGSN is usually connected to base station controllers 3 in such a way that they can provide packet service for terminals via several base stations 3.

[0030] Register 6 may be a home location register (HLR) or other register (such as a home subscriber server for IMS).

[0031] Gateway 7 may be a node serving a GPRS gateway (GGSN) e.g. to the Internet. Other external networks include the corporate network or another operator network. GGSN 7 is connected to SGSN 5 via a backbone network.

[0032] Access to AD terminals to telecommunications network 1 includes a number of access phases.

[0033] The first phase includes the phase during which the AD terminal connects to the telecommunications network 1. In this phase various communication stages are carried out, including the stage

- 5 authentication, as described in 3GGP TS 23.060 (7th edition). The authentication steps perform the security function and require the exchange of a triplet (for GPRS) or a quintet (for UMTS) authentication.

[0034] In a next phase, the packet data protocol (PDP) context may be established to carry the traffic stream over the telecommunications network 1. The PDP context typically includes transfer of radio access provided between terminal A and SGSN 5 and packet switched data channels or tunnels provided between SGSN 5 and GGSN 7. The session between terminal A and another entity will then continue in the established PDP context. A PDP context can carry more than one traffic stream, but all traffic flows within a given PDP context are treated the same when it comes to their transmission over telecommunications network 1.

[0035] In operation, terminal A after the network joining phase may indicate, in the message requesting PDP context activation in the network, the access point name (APN) for selecting a reference point relative to a particular external network 8. SGSN 5 may send a request to create a PDP context to GGSN 7 selected e.g. based on the access point name given by Terminal A or based on the default GGSN known by SGSN 5. Later, the PDP context is activated by allocating the PDP context data structure in SGSN 5, which is used by terminal A and GGSN 7 serving the subscriber access point. The data structure includes the IP address of terminal A, IMSI of terminal A and the tunnel identifier in both SGSN 5 and GGSN 7. The tunnel identifier is a number assigned by GGSN 7 that identifies data associated with a particular PDP context.

[0036] Various functions may be controlled by SGSN 5 during a communication session. Such control may be based on subscription-related information stored in HLR 6. Information can be searched from HLR 6 to SGSN 5 to enable control at SGSN level.

In particular, now with reference to Fig. 2, the HLR 6 contains a unique identifier associated with the subscription for each AD terminal, e.g. IMSI stored in the SIM of the AD terminal. Each AD terminal is assigned a time interval during which access to telecommunications network 1 will be allocated.

[0038] In this example, for terminals A and B, access will be allocated between 20:00 and 23:00. Access for terminal C will be granted between 00:00 and 5:00. These time intervals are usually outside the peak intervals for most days of the year. Terminal batches can be defined and assigned a specific time interval outside of peak hours. A variable time interval xy is planned for terminal D, depending on the network load experienced by or expected for telecommunications network 1. If the network load drops below or is expected to fall below a certain threshold, access is granted to terminal D.

[0039] Of course, the time intervals may also be associated with time slots during which access to the telecommunications network 1 is prohibited, i.e.

- 6 periods of access being denied. Multiple time intervals can be assigned to the terminal.

[0040] To control the use of telecommunications network resources 1, SGSN 5 includes several modules for performing the operations described in detail below. It should be noted that one or more of these modules may be implemented in the form of program modules running on a processor (not shown). SGSN 5 also includes a memory and data carrier (not shown) for carrying out these operations in a manner generally known to the person skilled in the art.

[0041] SGSN 5 includes an access request receiver 20 configured to receive an access request from the AD terminals for access to a telecommunications network 1. The terminal access request includes an IMSI SIM card available in this terminal.

[0042] SGSN 5 has an access module 21 configured to refuse access to the telecommunications network terminal 1 if the access request is received outside the time slot (s) for granting access to that terminal (or during the access denied interval). Access denied may be associated with joining the network or establishing a PDP context.

[0043] In addition, SGSN 5 includes a data search module 22. The data search module 22 is configured to search for data from the HLR 6, in particular the valid time interval for granting access associated with the AD terminals from which the access request has been received. It should be noted, however, that SGSN 5 itself may be pre-configured for specific terminals and thus already contain the time interval (s) for granting access for these terminals. This can be particularly advantageous for stationary terminals.

[0044] SGSN 5 also includes a PDP context establishment module and an authentication element 24.

[0045] SGSN 5 may also have a network load monitor 25 configured to monitor the load on the telecommunications network 1. Information on the network load may also be obtained from other sources, e.g. other SGSN or HLR of the telecommunications network

1. Network monitoring can be done in real time and / or based on the expected network load using mathematical models and historical data to obtain correct load prediction.

[0046] The operation of the telecommunications network 1, in particular SGSN 5, will now be described with reference to Figures 3A-3D.

[0047] In Fig. 3A, the receiver 20 of access request to the SGSN node 5 in step 30 receives a join request from terminal A at 19:00. To process this access request, SGSN needs an IMSI SIM card available in the terminal. The join request may contain either this IMSI or P-TMSI assigned to terminal A by SGSN. P-TMSI is used to solicit the IMSI radio path as much as possible for security reasons. If the P-TMSI provided by terminal A is known in SGSN, SGSN

- 7 can search for IMSI. Alternatively, for P-TMSI provided by terminal A, which is not known by the (new) SGSN, IMSI is provided either by the old SGSN or the terminal itself at the request of the new SGSN. IMSI is used by the data search module 22 to search for the time interval for granting access (20:00 - 23:00) from HLR 6 to SGSN 5 in step 31.

[0048] The access grant time interval may be communicated from HLR 6 to SGSN 5 in various ways.

[0049] After the request to join 30, authentication check is usually followed, step 31. The time interval for granting access may be sent to SGSN 5 by means of an authentication triplet or quartet.

[0050] The post-phase authentication procedure is usually followed by a location update procedure. First, a location update request 32 is sent from SGSN 5 to HLR 6. The time interval for granting access can also be sent to SGSN 5 in the next subscriber data insertion message from HLR 6 (step 33). The network joining phase ends with the message of accepting joining the terminal A (step 34).

[0051] After completing the network connection phase (which may contain further steps than those mentioned in the previous paragraphs), a PDP context is established. Terminal A requests the establishment of a PDP context in the request to activate the PDP context 35.

[0052] Regardless of how the access grant time period is obtained, the SGSN node access module determines that the access request has been received outside the access grant time interval. As a result, the PDP context is not established (which is marked with a cross in step 36). Terminal A is informed of the refusal in step 37.

[0053] It is noted that the authenticating element 24 of the SGSN node 5 may or may not authenticate the terminal A in the above situation. Authentication is required if the access grant time interval is sent from HLR 6 to SGSN 5 in response to the location update message 32. However, authentication should not be completed if the access grant time interval is obtained in SGSN 5 with the help of an authentication triplet / quintet. Authentication is preferred if the denial 37 message to terminal A contains information regarding the time interval for granting access.

[0054] SGSN 5 includes or obtains and manages failed access request data. This can be done e.g. by storing a time interval in connection with the IMSI of terminal A or by temporarily flagging terminal A in combination with some time stamp.

[0055] Another time-out access request outside the window 20: 00-23: 00 (step 38), again containing or following the IMSI of terminal A, may then be rejected directly (step 39). Authentication will not be performed again.

[0056] In Fig. 3B, the network connection of the terminal is received at 21:00. Steps 40-45 correspond to steps 30-35. Because the network join request is now in the time interval allocated for access for terminal A, access module 21 controls the PDP context establishing module 23 of node 5 to establish the PDP context with terminal A and to establish the PDP tunnel with GGSN 7. Specifically, step 46 includes a request to create a PDP context and step 47 to create a PDP context response in a manner known per se. At step 48, terminal A is informed by the PDP context activation acceptance message. Terminal A can now perform the next authentication procedure (step 49) using e.g. a RADIUS server in a downstream network 8.

[0057] The SGSN node network load monitor module 25 may monitor the load on the telecommunications network (or part of the network) 1 or output the expected network load. Network load can be compared with load reduction to estimate the occurrence of a low network load situation over a given period of time or period.

[0058] In Fig. 3C, steps 50-53 correspond to steps 30-33 of Fig. 3A. The terminal D is authenticated and in step 54 the terminal D is informed of the time interval xy during which low network load is expected. The information includes control information for controlling terminal D, such that it gains access to telecommunications network 1 again (step 55) during such a low network load period. The PDP context can be established immediately (steps 56-58) and access to the RADIUS server is enabled.

[0059] As mentioned above, access to the telecommunications network 1 is preferably denied when the network is connected. Fig. 3D shows in step 60 a network join message of terminal A containing IMSI. Then, the authentication procedure is performed (step 61), during which the access grant time interval is received in SGSN 5. The access grant time interval and IMSI are stored in SGSN 5. Alternatively, the time interval for granting access is obtained during the location update procedure (steps 62 and 63). Network attachment is refused at step 64.

[0060] As mentioned earlier, SGSN 5 may itself contain preconfigured access time information for terminal A. Alternatively, SGSN uses the authentication module 24 to authenticate terminal A to provide terminal A with information about access time interval in step 61.

[0061] Fig. 4 is a schematic illustration of terminal A. Terminal A includes a transceiver module 70 for communication with a telecommunications network 1. Terminal A also has an access request module 71. The access request module is configured to receive information regarding the time interval for granting access from telecommunications network 1 through the transceiver module 70 and for transmitting a request for access to the telecommunications network only during the time period for granting access.

[0062] It should be noted that the above-described telecommunications network and system are particularly suitable for saving resources. There may be other approaches to affect terminal access behavior, but they are thought to be wasting more resources.

[0063] For example, a network provider may allow access to the network at all times, but charge a (very) high fee for data sent off-peak. This does not provide an incentive for the user to terminate the connection (i.e. PDP context) to the network. This provides an incentive not to send data during expensive peak hours. However, the active PDP context still consumes a large amount of resources in the mobile radio network and backbone, as well as requiring an IP address. It also requires a network-connected terminal, which means that all types of mobility management functions should be available. In addition, this solution requires a more complex invoicing system that allows you to charge higher fees at certain times.

[0064] Another example would include blocking terminal access during rush hour using a rule on the RADIUS server. However, network resources would already be consumed before access was blocked by the RADIUS server. The terminal has already been given permission to access the network, which means that SGSN would already receive information from HLR and perform mobility management functions. In addition, the terminal was enabled to establish a PDP context. If the RADIUS server rejected the request to access the external data network, GGSN would not accept the PDP context and the tunnel would be closed. However, joining the network would continue if no additional steps were taken.

Prepared and verified

Grażyna Palka Patent Attorney