System and Method for Femto ID verification

A network component for supporting identity verification in messages from a radio station to a gateway, the network component comprising:

• at least one processor;
• and
• a computer readable storage medium storing programming for execution by the at least one processor, the programming including instructions to:
• establish an Internet Protocol Security (IPsec) connection for authentication with a security gateway;
• send client certificate information on the IPsec connection to the security gateway;
• receive an Internet Protocol (IP) address assigned by the security gateway in association with the client certificate information;
• establish a S1 connection for control messages with a second gateway;
• and
• send the IP address and an identity (ID) of the network component on the S1 connection, the ID and IP address enabling the second gateway to identify the radio station.

A method for enabling identity verification in messages from a radio station to a gateway, the method comprising:

• establishing, at a security gateway, an Internet Protocol Security (IPsec) connection for authentication with a radio station;
• receiving, at the security gateway, client certificate information on the IPsec connection from the radio station;
• assigning, at the security gateway, an Internet Protocol (IP) address for the radio station;
• and
• sending, from the security gateway to a Domain Name System (DNS), an update for mapping between the IP address and a DNS name derived from a Subject Alternative Name (SAN) for the radio station, the mapping between the IP address and the derived DNS name enabling a second gateway to identify messages on a S1 connection between the radio station and the second gateway.

A network component for enabling identity verification in messages from a radio station to a gateway, the network component comprising:

• at least one processor;
• and
• a computer readable storage medium storing programming for execution by the at least one processor, the programming including instructions to:
• establish an Internet Protocol Security (IPsec) connection for authentication with a Femto cell;
• receive client certificate information on the IPsec connection from the Femto cell;
• assign an Internet Protocol (IP) address for the Femto cell;
• and
• update a mapping between the IP address and a Subject Alternative Name (SAN) for the Femto cell at a Domain Name System (DNS), the mapping between the IP address and the SAN enabling a Femto gateway to identify messages on a S1 connection between the Femto cell and the Femto gateway.

A method for identity verification in messages from a radio station to a gateway, the method comprising:

• establishing, at a gateway, a first connection for control messages with a radio station;
• receiving, at the gateway, a first Internet Protocol (IP) address and an identity (ID) of the radio station on the first connection;
• looking up the ID at a Domain Name System (DNS);
• receiving from the DNS a second IP address mapped to the ID, the mapping of the second IP address to the ID being previously added according to a DNS update from a security gateway that authenticated the radio station via a second connection;
• and
• verifying whether the second IP address from the DNS matches the first IP address from the radio station.

A network component for identity verification in messages from a radio station to a gateway, the network component comprising:

• at least one processor;
• and
• a computer readable storage medium storing programming for execution by the at least one processor, the programming including instructions to:
• establish a S1 connection for control messages with a Femto cell;
• receive a first Internet Protocol (IP) address and a Femto cell identity (ID) on the S1 connection;
• look up the Femto cell ID at a Domain Name System (DNS);
• receive from the DNS a second IP address mapped to the Femto cell ID, the mapping of the IP address to the Femto cell ID being previously added according to a DNS update from a security gateway that authenticated the Femto cell via an Internet Protocol Security (IPsec) connection;
• and
• verify whether the second IP address from the DNS matches the first IP address from the Femto cell.