Nokia Solutions and Networks Oy

Nokia Technologies Oy

Teliasonera Ab

Nokia Siemens Networks Oy

Telia Company Ab

Jouni Korhonen

Teemu Ilmari Savolainen

Gyorgy Tamas Wolfner

Anders Jan Olof Kall

Seppo Ilmari Vesterinen

Matti Einari Laitila

Hannes Tschofenig

Gabor Bajko

Basavaraj Patil

Markus Isomäki

Sami Ala-Luukko

Tero Jalkanen

Ilkka Keisala

Kai Väänänen

Antti Mäkelä

There are provided measures for supporting an authentication to an external packet data network over an untrusted access network, said measures exemplarily comprising authenticating a user equipment to a communication network providing connectivity for the user equipment across an unsecured access network in response to a first authentication request, wherein the authentication request is an authentication request of a key information exchange mechanism and includes authentication data, receiving a second authentication request for authenticating the user equipment towards a packet data network external to the communications network. The measures may further comprise creating a binding update message including the authentication data and identity information of the user received from the user equipment.

External authentication support over an untrusted network

A second internet protocol network is logically connected to a packet data network connection provided between a user equipment and a first internet protocol network over a radio access network, the second internet protocol network located on a data path from the first internet protocol network to the user equipment. The first internet protocol network represents the highest level internet protocol point of attachment to the packet data network connection. Router advertisements are sent from the second internet protocol network to the user equipment over the radio access network via the packet data network connection.

Link model for multi-prefix packet system bearer

There is provided a mechanism for establishing a single PDN connection with plural IP addresses and breakout or terminating points. When a communication connection provided with multiple IP addresses via a multi-address bearer connection is established, an indication is prepared for indicating a terminating point represented by a network element of the cellular communication network where data traffic, based on one of the multiple IP addresses, is branched to another network being different to the cellular communication network by means of an IP based communication link The indication element is sent to the communication network by means of a PDCP signaling e.g. as a new PDU type code. In the network, it is decided whether a local receiving network element is indicated as a terminating point, wherein in this case a breakout connection to another network being different to the cellular communication network by the IP based communication link is established.

Mechanism for establishing packet data network connection with multiple IP addresses

A method and apparatus for synthesized address prefix detection is provided. One example method includes generating a request for a first protocol address record of a name that has been assigned an address in accordance with a second protocol, causing the request to be sent to a domain name system server, and analyzing a response to the request for the first protocol address record to determine whether the domain name system server generated a synthesized address for the name in accordance with the first protocol. Similar and related example methods and example apparatuses are also provided.

Method and apparatus for synthesized address detection

Various methods for determining network entity timeout values to improve keep-alive signaling are provided. One example method may comprise providing for transmission of a request for a timeout value associated with a keep-alive timer. The method of this example embodiment may further comprise receiving a response to the request, wherein the response comprises an indication of the timeout value of the keep-alive timer. Additionally, the method may further comprise determining an expiration time of the keep-alive timer based at least in part on the timeout value. The example method may further comprise providing for transmission of a keep-alive data packet prior to the determined expiration time. Similar and related example methods, example apparatuses, and example computer program products are also provided.

Method and apparatus for keep-alive signalling

A mechanism for routing in a network is described. The mechanism comprising receiving a request from a node; obtaining, based on the received request, an identifier relevant to said node; allocating a first local prefix; setting a first timer indicating a length of time the first local prefix or an address comprising the first local prefix is valid; setting a second timer indicating a length of time the first local prefix or the address comprising the first local prefix is preferred when the first local prefix or the address is valid; and sending a first message comprising said identifier, said first local prefix and said first timer to a network element.

Apparatus and method for routing in a network

Apparatus, method, system and computer program product for server failure handling A mechanism for a first apparatus is described. The mechanism comprising receiving, from a first apparatus, a first authentication request comprising an user identity and an identity of said first apparatus, wherein said first apparatus being capable for provide authentication related service with respect to said user identity; determining if a third apparatus, originally associated with said user identity for providing authentication related service, is available for providing said service; registering said first apparatus as the server associated with said user identity for providing authentication related service, if said third apparatus is not available; sending a response to said first apparatus to acknowledge the first authentication request.

Apparatus, method, system and computer program product for server failure handling

An apparatus and a method are provided, by which a gateway function between a first network and a second network is carried out, a packet is received from a network node located in the second network, wherein the packet comprises a source address which topologically does not belong to the second network, the received packet is encapsulated in a new packet, and the new packet is sent to the first network.

Method for automatic tunneling of IPV6 packets with topologically incorrect source addresses

The invention relates to a method, an element, and a system for providing access authentication for a user using user equipment (-) communicating () in a first communications network (-) accepting a first type of identification to a second communications network (--) accepting a second type of identification. In the invention, an identifier comprising a first part and a second part is received (); a corresponding second part is retrieved () from a database (BSF) by using the first part; the received second part is compared with the retrieved corresponding second part; and if they are the same, the user equipment (-) is provided with access authentication to the second communications network (--).

Network access authentication for user equipment communicating in multiple networks

The invention relates to a method for optimizing routing to a first user equipment (T, T) roaming in a visited network (OP B, OP C) in a communications system comprising at least a home network (OP A), a visited network (OP B, OP C) and a relaying network (IPX, IPX, IPX, IPX, IPX). The method of the invention comprises storing (----) a location information of a first user equipment (T, T) to a database (DB) external to the home network (OP A) and the visited network (OP B, OP C), the location information being associated with an identification information of the first user equipment (T, T); receiving (--) a message from a second user equipment (T, T); recognizing (-) at least one identification information of the first user equipment (T, T) in the message; comparing (--) the identification information stored in the database (DB) with the identification information received in the message; and if the both identification information matches, routing (--) a communication according to the location information of the first user equipment (T, T).

Optimisation method and device in communication networks

A method, apparatus, computer program, and system is provided to redirect an internet protocol mobility session establishment request. According to certain embodiments of the invention, the request message is redirected from an original local mobility anchor ('LMA') to an alternative LMA. According to certain embodiments of the invention, this redirection provides load balancing between the LMAs.

IPv6 anycast-based load balancing and redirection functionality for PMIPv6

An apparatus for providing route information to a device(s) may include a processor and memory storing executable computer program code that cause the apparatus to at least perform operations including receiving route information from a network device defining rules for devices for connection to a network(s). The computer program code may further cause the apparatus to convert the route information into a type of packet data to obtain route selection information corresponding to the route information. The route selection information is generated on behalf of a device(s) that is unable to communicate with the network device to use the route information to select an interface(s) for communication of content. The computer program code may further cause the apparatus to provide the route selection information to the device to utilize the route information to select an interface(s) for communication of data. Corresponding methods and computer program products are also provided.

Method and apparatus for enabling provision of routing information and network selection information to one or more devices

There is provided an intra-realm AAA (authentication, authorization and accounting) fallback mechanism, wherein the single global realm may be divided in one or more sub-realms. The thus presented mechanism exemplarily comprises detecting a failure of an authentication server serving at least one authentication client within a first sub-realm of a single-realm authentication system, and routing authentication messages of the at least one authentication client to a fallback authentication server within a second sub-realm of the single-realm authentication system, wherein routing may exemplarily comprise sub-realm based source routing.

Growing community of inventors

Riihimäki, Finland

Jouni Korhonen