Method and apparatus for providing authentication, authorization and accounting to roaming nodes

Abstract

Traditional circuit-switched cellular systems first authorise the mobile terminal and then secure the wireless access link between the cellular radio access network and the users mobile terminal. The IP protocol is then allowed to run as an application over that access link. Internet access systems traditionally use an unsecured access link and use IP messaging to authorise the Mobile Node (IP host) on the mobile terminal, and the resulting communications. Cellular systems therefore authorise and secure at layer 2 (with respect to IP) whilst Internet systems authorise and secure at layer 3 in general. An Internet compliant cellular system needs to potentially authorise and secure both the MACand IP layers and traditionally this is done with two phases using two independent AAA systems (Authentication, Authorisation and Accounting) with L3 following L2 which results in unnecessary complexity, cost and delay when gaining access to a communications network. This invention proposes an integrated process with the order reversed whereby L2 follows L3. The L3 process treats the wireless link as any normal IP access link, and the L3 authorisation provides L3 processing, but also includes the L2 terminal authentication identifiers so that the L2 security parameters can also be returned. This means that the wireless link and the IP layer are not secured until after the L3 authorisation has completed and therefore the first IP messages that trigger authorisation are sent insecurely. This invention also provides methods to avoid these insecure messages presenting any opportunities to an attacker. Finally, the inventions include methods to enable L3 before L2 authorisation when a user is roaming in a foreign network. These enable different types of AAA servers in the foreign domain to work with different types of AAA servers in the home domain provide dynamic assignment of foreign mobility agents and the associated security associations between home and foreign mobility agents, as well a temporary account in the foreign domain. These methods apply both to standard MIP as well as Nested MIP, and to different types of Mobile Node apparatus and a range of user, host and terminal authentication models.

Dependencies are inferred from the claim text.