# US 7,610,038 B2 · Service in wlan inter-working, address management system, and method > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 7,610,038 B2 - Document ID: US7610038B2 - Status: Granted - Kind: B2 - Application number: 10/541,447 - Filed: 2004-04-14 - Published: 2006-09-21 - Granted: 2009-10-27 - Earliest claimed: 2003-01-14 - Assignees: Panasonic Corporation - Inventors: Pek-Yew Tan; Hong Cheng; Chee Bing Tan - Web page: https://patentgrep.com/patent/US7610038B2 ## CPC - H04W 8/26: Network addressing or numbering for mobility support - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 61/5038: for local use, e.g. in LAN or USB networks, or in a controller area network [CAN] - H04L 61/5084: Providing for device mobility (network addressing or numbering for mobility support in wireless networks H04W8/26; mobile IP H04W80/04) - H04L 63/0428: {wherein the data content is protected, e.g. by encrypting or encapsulating the payload} - H04W 8/183: {Processing at user equipment or user record carrier} - H04W 12/02: Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] - H04W 12/06: Authentication - H04W 12/08: Access security - H04W 12/086: using security domains - H04W 72/04: Wireless resource allocation - H04W 76/12: Setup of transport tunnels - H04W 74/00: Wireless channel access - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract The present invention provides a solution to the mobile terminal address management in the WLAN inter-working. By using the access control framework, the mobile terminal could obtain the address, and setup the tunnel together with the granting of service access. The management process would be shielded by the inherent encryption and protection of the access control process, and thus does not need extra security setup procedures to be performed. The invention also provides a method for the terminal to obtain address that binds to the session, using a fine grain service authorization procedure. The terminal could maintain multiple addresses when accessing multiple parallel sessions. The address management is also integrated with the policy control mechanisms. The policy control would provide means for the terminal and its home network to configure the WLAN when necessary after an address alternation. QoS, or tunnelling information would be modified and provisioned according to the new status using channels available in the existing policy control procedures. By this, a smooth address transition in the roaming time could be achieved, and QoS interruption could be minimized. ## Claims ### Claim 1 A system for managing address allocation of a mobile terminal in WLAN inter-working without depending on local WLAN access control, wherein a secure end-to-end service authorization signalling between the mobile terminal and a controller in a home domain of the mobile terminal that has access to user subscription information is used for address management, whereby the controller can manage the address allocation based on service authorization information. ### Claim 2 A system for managing a tunnel used by a mobile terminal in WLAN inter-working without depending on local WLAN access control, wherein a secure end-to-end service authorization signalling between the mobile terminal and a controller in a home domain of the mobile terminal that has access to user subscription information is used for tunnel management, whereby the controller can manage the tunnel based on service authorization information. ### Claim 3 A system for managing address allocation of a mobile terminal and a tunnel used by a mobile terminal in WLAN inter-working without depending on local WLAN access control, wherein a secure end-to-end service authorization signalling between the mobile terminal and a controller in a home domain of the mobile terminal that has access to user subscription information is used for address and tunnel management, whereby the controller can manage the address allocation and the tunnel based on service authorization information. ### Claim 4 (depends on 1, 2, 3) The system according to any one of claims 1 to 3, wherein security association derived from a local WLAN access control procedure for encrypting and protecting a signalling message is used for protecting a signalling message for the WLAN inter-working. ### Claim 5 (depends on 1, 2, 3) The system according to any one of claims 1 to 3, wherein domain information of the mobile terminal is used for deciding the location of the controller in the home domain of the mobile terminal. ### Claim 6 (depends on 1, 2, 3) The system according to any one of claims 1 to 3, wherein the mobile terminal embeds its domain information in a message, and an intermediary node between the mobile terminal and the controller accesses the domain information and forwards the message based on the domain information, whereby the intermediary node decides an address for forwarding the message to the controller. ### Claim 7 (depends on 1, 3) The system according to claim 1 or 3 wherein i. a predefined wildcard value is used in an address allocation request and an address allocation reply for supporting stateless address configuration at the mobile terminal, ii. an address type list is included in the address allocation request and the address allocation reply for supporting different address types at the mobile terminal, and iii. an address prefix is included in an address management message for supporting multiple address allocation for the mobile terminal. ### Claim 8 (depends on 1, 3) The system according to claim 1 or 3 wherein i. the mobile terminal generates an identifier that uniquely identifies a service access session, ii. the service access session identifier is included in an address message sent between the mobile terminal and the controller for binding address allocation operation with the service access session, iii. the controller traces an address which the mobile terminal uses for the service access session, and iv. the controller retrieves the address used by the mobile terminal for the service access session by using the service access session identifier. ### Claim 9 (depends on 8) The system according to claim 8 wherein the controller uses a backend server for storage and maintenance of the mobile terminal's address which is used for the service access session. ### Claim 10 (depends on 8) The system according to claim 8 wherein i. the controller creates a new entry with the mobile terminal's identifier and the service access session's identifier as an index when the entry does not exist in a controller's record, ii. the controller stores the entry with the address which is allocated for the mobile terminal for the service access session, and iii. the controller deletes the entry when the mobile terminal terminates the services access session, whereby the controller can maintain the address configuration of the mobile terminal in the WLAN inter-working. ### Claim 11 (depends on 1, 3) The system according to claim 1 or 3 wherein i. an address allocation request and a corresponding service access request are grouped in the service authorization information for supporting multiple address allocation for different services access sessions of the mobile terminal, and ii. the controller obtains different address configurations based on the different service access requests of the mobile terminal, whereby simultaneous service sessions are allowed for the mobile terminal. ### Claim 12 (depends on 11) The system for supporting multiple address configurations for multiple services sessions according to claim 11, wherein i. the mobile terminal maintains a local database of the service access session information with the corresponding address configuration, and ii. the mobile terminal uses different addresses to access different services by multiplexing addresses using the service access session identifiers. ### Claim 13 (depends on 1, 2, 3) The system for allowing adjustment of policy settings according to any one of claims 1 to 3, wherein i. the controller modifies policy configuration for providing service to the mobile terminal by setting an interface with a policy server, and ii. policy setting is adapted on a control node for providing service to the mobile terminal in WLAN by having the controller triggering policy signalling to the control node through policy control framework. ### Claim 14 (depends on 13) The system according to claim 13 wherein a set of message format used for information exchange between a service authorizer which authorizes service and a policy server, the set of message format comprising: i. a operation identifier part that indicates operation to be taken by the policy server; ii. a mobile terminal identifier part that includes an identifier of the mobile terminal; iii. a mobile terminal location information part that includes location information of the mobile terminal for adapting policy settings based on the location information; iv. a mobile terminal service information part that includes service type of the service, and session identifier of the service if necessary; v. a tunnel setting information part that includes tunnel setting information used by the mobile terminal for accessing the service; and vi. an address information part that includes address information of the mobile terminal for accessing the service. ### Claim 15 A method for managing address allocation of a mobile terminal for accessing service in WLAN inter-working without depending on local WLAN access control comprising: i. a step in which the mobile terminal sends an address management request together with a secure end-to-end service authorization request to a controller in a home domain of the mobile terminal that has access to user subscription information; ii. a step in which the controller allocates an address for the mobile terminal to access service based on the service authorization request and the user subscription information; and iii. a step in which the controller sends address management information to the mobile terminal with the secure end-to-end service authorization signalling. ### Claim 16 A method for managing address allocation of a mobile terminal for accessing service in WLAN inter-working without depending on local WLAN access control comprising: i. a step in which the mobile terminal sends an tunnel management request together with a secure end-to-end service authorization request to a controller in a home domain of the mobile terminal that has access to user subscription information; ii. a step in which the controller decides tunnel configuration for the mobile terminal to access service based on the service authorization request and the user subscription information; and iii. a step in which the controller sends tunnel configuration information to the mobile terminal with the secure end-to-end service authorization signalling. ### Claim 17 A method for managing address allocation of a mobile terminal for accessing service in WLAN inter-working without depending on local WLAN access control comprising: i. a step in which the mobile terminal sends an address and tunnel management request together with a secure end-to-end service authorization request to a controller in a home domain of the mobile terminal that has access to user subscription information; ii. a step in which the controller decides an address and tunnel configuration for the mobile terminal to access service based on the service authorization request and the user subscription information; and iii. a step in which the controller sends information on the address and the tunnel configuration to the mobile terminal with the secure end-to-end service authorization signalling. ### Claim 18 (depends on 15, 16, 17) The method according to any one of claims 15 to 17, wherein security association derived from a local WLAN access control procedure for encrypting and protecting a signalling message is used for protecting a signalling message for the WLAN inter-working. ### Claim 19 (depends on 15, 16, 17) The method according to any one of claims 15 to 17, wherein domain information of the mobile terminal is used for deciding the location of the controller in the home domain of the mobile terminal. ### Claim 20 (depends on 15, 16, 17) The method according to any one of claims 15 to 17, wherein the mobile terminal embeds its domain information in a message, and an intermediary node between the mobile terminal and the controller accesses the domain information and forwards the message based on the domain information, whereby the intermediary node decides an address for forwarding the message to the controller. ### Claim 21 (depends on 15) The method according to claim 15 further comprising a step in which the address to be used by the mobile terminal for accessing the service is negotiated between the controller and an address management entity in a network that provides the service requested by the mobile terminal. ### Claim 22 (depends on 15) The method for reducing service interruption of the mobile terminal according to claim 15, further comprising: i. a step in which the mobile terminal includes a specific address in an address allocation request sent to the controller in its home network; and ii. a step in which the controller allocates the address to be used according to the address allocation request from the mobile terminal and information about the service accessed by the mobile terminal. ### Claim 23 (depends on 16, 17) The method for supporting multiple tunnel types and directions according to claim 16 or 17, further comprising: i. a step in which the mobile terminal includes a list of tunnel types in a tunnel request message sent to the controller; and ii. a step in which the mobile terminal and the controller include tunnel direction information in the tunnel request message and tunnel configuration message. ### Claim 24 (depends on 16, 17) The method for managing the tunnel configuration of the mobile terminal according to claim 16 or 17, comprising a step in which a tunnel configuration to be used by the mobile terminal for accessing the service between the controller and an actual tunnel end point in a network that provides the service requested by the mobile terminal. ### Claim 25 (depends on 16, 17) The method for managing the tunnel configuration of the mobile terminal according to claim 16 or 17, further comprising: i. a step in which the controller communicates with a management entity in the WLAN managing tunnels used by the mobile terminal for accessing the service; and ii. a step in which the management entity in the WLAN enables or disables the tunnel according to a communication result with the controller. ### Claim 26 (depends on 16, 17) The method for setting up a network based site to site tunnel for the mobile terminal to access the service according to claim 16 or 17, further comprising: i. a step in which the controller communicates with a tunnel management entity in the WLAN to identify and configure a tunnel end point in the WLAN; and ii. a step in which the controller communicates with a tunnel management entity in a network providing the service for the mobile terminal to identify and configure the tunnel end points in the network. ### Claim 27 (depends on 16, 17) The method according to claim 16 or 17 comprising a step in which the controller communicates with a backend server in the mobile terminal's home network for the user's subscription information. ### Claim 28 (depends on 15, 17) The method according to claim 15 or 17, wherein the mobile terminal uses a set of message format, the set of message format comprising: i. a home domain information part that includes the mobile terminal's home domain information accessible to all network nodes; ii. a user's identity information part that is only accessible by a node authorizing a service request; iii. a service request information part that contains one or more service requests only accessible by the node authorizing the service request; iv. a WLAN identifier information part; and v. a address request information part that contains one or more address requests corresponding to the service request. ### Claim 29 (depends on 16, 17) The method according to claim 16 or 17, wherein the mobile terminal uses a set of message format, the set of message format comprising: i. a mobile terminal's home domain information part; ii. a user's identity information part that is only accessible by the node authorizing a service request; iii. a service request information part that contains one or more service requests only accessible by the node authorizing the service request; iv. a WLAN identifier information part that includes a WLAN identifier; and v. a tunnel configuration request information part that includes one or more tunnel configuration requests corresponding to the service request. ### Claim 30 (depends on 21) The method according to claim 21, wherein the controller uses a set of message format, the set of message format comprising: i. a part of an identifier of the mobile terminal's home network; ii. a part of an identifier of the service session, regarding a service request; iii. a part of an identifier of the mobile terminal in the service request; iv. a service request information part that includes one or more service requests; and v. a address configuration request information part that includes one or more address configuration requests corresponding to the service request. ### Claim 31 (depends on 24) The method according to claim 24, wherein the controller uses a set of message format, the set of message format comprising: i. a part of an identifier of the mobile terminal's home network; ii. a part of an identifier of the service session regarding a service request; iii. a part of an identifier of the mobile terminal in the service request; iv. a service request information part that includes one or more service requests; and v. a tunnel configuration request information part that includes one or more tunnel configuration requests corresponding to the service request.