Telefonaktiebolaget Lm Ericsson (publ)

Optis Wireless Technology, LLC

John Michael Walker

Mats Näslund

Fredrik Lindholm

Gunnar Mildh

Stefan Rommer

Susana Fernandez Alonso

Gunnar Rydnell

György Miklós

Juan Antonio Sanchez Herrero

Lars-Bertil Olsson

Ann-Christine Sander

David Castellanos

Stephen Terrill

Göran Hall

Luis Barriga

Mattias Wahlqvist

Francisco Cortes Gomez

Avelina Pardo-Blazquez

Maria Esther Terrero Díaz-Chirón

Anders Åhlén

Manuel Cardeno

Jorge Hernandez Vazquez

Zdravko Jukic

Alfredo Gonzalez

Anna Maria Lopez Nieto

Jesus-Angel De Gregorio

Hans Rönneke

Mats NÄSLUND

Francisco Cortes-Gomez

Mats Näslud

Anders Ahlén

An authentication method comprises providing a set of N plural number of master keys both to a user terminal () and to home network entity () and, when performing an authentication key agreement (AKA) transaction for an application, selecting one of the N number of master keys to serve as a master key for use both at the user terminal and the home network entity for deriving further keys for the application. For example, when performing an authentication key agreement (AKA) transaction for a first application, the method involves randomly selecting one of the N number of master keys to serve as a first master key for use both at the user terminal and the home network entity for deriving further keys for the first application; but when 10 performing an authentication key agreement (AKA) transaction for another application, the method involves randomly selecting another one of the N number of master keys to serve as master key for use both at the user terminal and the home network entity for deriving further keys for the another application.

Application specific master key selection in evolved networks

A method for operating a communication network includes at least two radio access networks (--) in which a user equipment () can simultaneously be registered and, for each of the at least two radio access networks (--), a serving entity (--) in the control plane. The method including the steps of assigning (s) a master role to one serving entity (-) and a slave role to the other serving entity (-) or entities; and when a serving entity (-) to which a slave role is assigned has to perform control plane signalling (s), transmitting (s), by the serving entity, a signalling message to the serving entity (-) to which the master role is assigned, so as to perform (s) the control plane signalling Servers acting as serving entities, systems including such servers, and computer programs executable on the servers are also disclosed.

Method for controlling a communication network, servers and system including servers, and computer programs

A method of authenticating a user who is a subscriber of a home network, authenticated in a first network, for accessing a service in a second network. This method includes: authenticating the user in the first network with a first authentication method selected in an authentication server; reserving resources for the service towards a rules enforcement device; requesting control rules for the resources towards a control rules server; submitting towards the control rules server information about the first authentication method; determining at the control rules server whether a further authentication of the user with a further authentication method is required; and instructing from the control rules server towards the authentication server to force the further authentication of the user with the further authentication method.

Selection of successive authentication methods

The present invention is aimed to provide a mechanism whereby a Public Service Identity identifying a service, which runs in an application service, may be created in a network both dynamically by the application server and statically by an O & M system, the means and method for the dynamic creation harmonizing with those for the static creation, and allowing a similar behavior of the network with minimum impact when the service is invoked. Therefore, the present invention provides a new method, a new central entity in the network, and enhanced Home Subscriber Server and application server, all co-operating to carry out the different embodiments for the invention.

Provision of public service identities

A method and telecommunication node for authenticating with an IP Multimedia Subsystem (IMS) network, a nomadic user in an access network. The node receives from the access network, an access identifier defining a mobile terminal's physical location. In response, the node retrieves from a database, a registered access identifier associated with the user and determines whether the received identifier matches the registered identifier. If the identifiers match, the node authenticates the user in the IMS network. If the identifiers do not match, the node performs an alternate authentication method.

Authentication in an IP multimedia subsystem network where an in-use line identifier (LID) does not match a registered LID

Data related to a subscriber in a communications network is to be retrieved. A first Generic User Profile (GUP) server receives an incoming request for the subscriber related data from a data consumer in a first communication domain and determines that the data is located in a second communication domain. An outgoing request for the data is then transmitted to a second GUP server in the second communication domain via an interface. The second GUP server then retrieves the requested subscriber related data from a network repository and transmits the requested data to the first GUP server, which forwards the requested data to the data consumer. Service access to subscriber data located in other domains than the GUP Server is enabled, for example when the subscriber is roaming. The subscriber related data can also be distributed in both the first and second communication domain.

Method and apparatus for inter network retrieval of user related data

A user equipment (UE) attaches to a first access network, intending to access a packet data network (PDN) via a telecommunications system, and is assigned a PDN System Architecture Evolution (SAE) Gateway (GW). The identity of the PDN SAE GW is registered so that, if the UE attaches to another access network, triggering a new attach procedure, the identity is retrieved. A determination is then made whether the previously-assigned PDN SAE GW may be used for the present communications and, if so, it is reassigned. The identity of the PDN SAE GW is registered in an anchor node, which is in a preferred embodiment a Home Subscriber Server (HSS). If the previously-assigned PDN SAE GW cannot be used, or if the PDN SAE GW must be changed, then the communication is reassigned to a new PDN SAE GW.

Method and system for global anchor registration

A traffic plane entity (e.g., user plane entity (UPE), serving gateway (S-GW)) and method are described herein for allocating a unique identifier (e.g., UPE/S-GW UE-Context-Id) which identifies and unifies a set of bearers within a UE context that is associated with a given UE. In operation, the traffic plane entity can then send the allocated unique identifier to another entity (e.g., mobility management entity (MME)) which at a subsequent time re-sends the unique identifier back to the traffic plane entity along with a request to have the traffic plane entity perform a specific operation or procedure on the bearers associated with the UE context of the given UE. Upon receiving the request, the traffic plane entity uses the unique identifier to perform the requested operation or procedure simultaneously on all of the bearers associated with the UE context of the given UE.

Mechanism to uniquely identify and unify a user's set of packet bearer contexts in a mobile telecommunications network

A method and an apparatus for controlling a communication established between terminals through a telecommunications system. When a malfunction event related to a communication () established between terminals is detected (), a determination () is made in the telecommunications system of a faulty terminal and a non-faulty terminal, according to the malfunction event. Subsequently, the telecommunications systems determines () whether a terminal is registered for a user identifier which was registered through the faulty terminal, or which is related to it by subscription and, in that case, it establishes () a new communication between said registered terminal and the non-faulty terminal. The user of the non-faulty terminal can rely on the telecommunications system to recover automatically the lost communication, without trying to attempt a new communication request with an uncertain result.

Method and apparatus for controlling communications

A server in a home domain for managing the authentication of clients that are subscribers of the home domain, but are attached to a visited domain. Based on knowledge of the type of security being used in an access network of the visited domain, the server determines whether a given client is to be authenticated by the visited domain or the home domain. The server then signals the result to the visited domain.

Method and apparatus for determining an authentication procedure

A method and apparatus in a telecommunication network for triggering services provided to a user. A service control node in the user's home network domain utilizes filter criteria, which may be derived from the user's user profile, to trigger the services. The service control node selects at least one filter criterion depending on the criterion's relevance to the user. Alternatively, the service control node is provided with at least one filter criterion not stored in the user profile.

Methods, apparatuses and software for providing the service control node with filter criteria

A mechanism enabling users roaming in a visited network to specify whether they prefer to dial numbers belonging to their home network in local format or in international format from the visited network. Restrictions based on the type of call, and the geographic locations and preferences of the users involved in the call, are correspondingly applied. Information about the location of the user, taking into account the access location and user preferences, is sent from a home subscriber server to a serving call session control function entity, both in the home network of the user.

Apparatus and method for differentiating services in multimedia networks to roaming subscribers

The present invention is aimed to the provision of a mechanism whereby roaming users can specify whether they prefer to dial numbers belonging to the home network in local format or in international format from the visited network where they are roaming so that the treatment of restrictions based on the type of call, and depending on both user's geographical location and preferences, are correspondingly applied. Therefore, the present invention provides for a new method whereby information about a location of the user, taking into account the access location and user preferences, is sent from a home subscriber server to a serving call session control function entity, both in the home network for the user.

A method and network node for terminating an IP Multimedia Subsystem (IMS)-enabled communication service involving a user terminal, which has been allocated an IP address by an access network used by the terminal to access the communication service. Upon determining that the IP address is no longer allocated to the user by the access network, the node terminates the IMS communication service.

Methods and apparatuses for terminating an IP multimedia subsystem service when IP address is no longer allocated to the user

An apparatus and method for providing Single Sign-On services to a user when accessing a selected Service Provider from a plurality of Service Providers. An Authentication Provider authenticates the user at with a user-identity, provides the user with a token as proof of the authentication, and assigns a temporary alias-identity to the user for use when the user accesses the selected Service Provider. The Authentication Provider and the selected Service Provider link the assigned alias-identity and the user-identity to identify the user at respective sites. The user accesses the selected Service Provider by presenting the token along with a local user-identity valid for the selected Service Provider. When the user attempts a subsequent access at the selected Service Provider, the user is identified by the shared alias-identity, if the user allowed permanent linking. If the user did not allow permanent linking, the process is repeated for each subsequent access.

Growing community of inventors

The Hague, Netherlands

John Michael Walker