Methods and apparatuses to provide secure communication between an untrusted wireless access network and a trusted controlled network
View Patent ↗A secure communication channel between an access point (AP) device associated with a wireless network and a mobile gateway (GW) device of a packet core network is established. Data is exchanged between the wireless network and the packet core network through the secure channel. A client device (UE) is authenticated through the secure communication channel. Device identity information is received from the AP device. A session request is sent to the packet core network. An IP address for the device is received from the packet core network. The communication between the AP device and the packet core network becomes secure without need to run an IP secure protocol on the UE that saves the battery power on the UE. Establishing the fully secure communication between the UE and the packet core network while saving the UE power provides a significant advantage for the mobile technology world.
1. A machine-implemented method, comprising:
coupling a user equipment (UE) to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to a mobile gateway (MGW) device;
establishing a secure communication channel between an access point (AP) device associated with a wireless network and the MGW device coupling the AP device with a packet core network, wherein the AP device is communicably coupled to the UE in the wireless network and wherein the MGW device is further communicably coupled to a mobile network gateway of the wireless network;
authenticating, by a mobile network operator's authentication process, the UE through the established secure communication channel between the MGW device and the AP device, while the UE is roaming in the wireless network;
generating a mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE;
storing the mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE at the MGW device;
provisioning an assigned IP address from the MGW device to the UE using the secure communication channel;
mapping, by the MGW device, other IP addresses to the assigned IP address; and
in response to a packet received from the AP device via the secure communication channel, transmitting by the MGW device the packet to the packet core network, wherein the packet is originated from the UE of the wireless network, wherein the MGW manages the mobility of the UE to allow the UE to securely roam between wireless networks operated by the mobile network operator and between the wireless networks and the cellular network, and wherein the assigned IP address is used for both communication with the wireless networks and the cellular network,
wherein the MGW device determines whether the UE is attempting to establish a connection with the Internet or operator services of the mobile network operator.
2. The method of claim 1 , wherein the secure communication channel is an IP secure (IPSec) tunnel established prior to authentication of the UE by the MGW device using the AP device.
3. The method of claim 1 , wherein the wireless network is a WiFi network controlled by the AP device.
4. The method of claim 1 , wherein in response to the packet received from the UE, the AP device is configured to encrypt the packet using an encryption method compatible with the secure communication channel and to transmit the encrypted packet to the MGW device via the secure communication channel.
5. The method of claim 4 , further comprising:
decrypting the encrypted packet by the MGW device; and
transmitting from the MGW device the decrypted packet to a P-GW/GGSN of the packet core network via a GTP tunnel.
6. The method of claim 5 , further comprising:
in response to a second packet received from the P-GW/GGSN of the packet core network, encrypting by the MGW device the second packet using an encryption method compatible with the secure communication channel; and
transmitting the encrypted second packet to the AP device via the secure communication channel.
7. The method of claim 6 , wherein the AP device is configured to decrypt the encrypted second packet and to transmit the second packet to the UE over the wireless network, such that the UE does not have to handle additional IPSec functionality and the UE battery life is enhanced.
8. The method of claim 1 , further comprising:
receiving by the MGW device a device identity associated with the UE encrypted by the AP device;
sending a session request to the packet core network based on the identity;
receiving a session response from the packet core network, the session response including an IP address allocated by the packet core network; and
assigning the IP address to the UE.
9. A non-transitory machine-readable storage medium storing instructions therein, which when executed by a data processing system, cause the data processing system to perform operations comprising:
coupling a user equipment (UE) to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to a mobile gateway (MGW) device;
establishing a secure communication channel between an access point (AP) device associated with a wireless network and the MGW device coupling the AP device with a packet core network, wherein the MGW device is further communicably coupled to a mobile network gateway of the packet core network;
wherein the AP device is communicably coupled to the UE of the wireless network;
authenticating, by a mobile network operator's authentication process, the UE through the established secure communication channel between the MGW and the AP device, while the UE is roaming in the wireless network;
generating a mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE;
storing the mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE at the MGW device;
provisioning an assigned IP address from the MGW device to the UE using the secure communication channel;
mapping, by the MGW device, other IP addresses to the assigned IP address; and
in response to a packet received from the AP device via the secure communication channel, transmitting by the MGW device the packet to the packet core network, wherein the packet is originated from the UE of the wireless network, wherein the MGW manages the mobility of the UE to allow the UE to securely roam between wireless networks operated by the mobile network operator, and wherein the assigned IP address is used for both communication with the wireless networks and the cellular network,
wherein the MGW device determines whether the UE is attempting to establish a connection with the Internet or operator services of the mobile network operator.
10. The non-transitory machine-readable storage medium of claim 9 , wherein the secure communication channel is an IP secure (IPSec) tunnel established prior to authentication of the UE by the MGW device using the AP device.
11. The non-transitory machine-readable storage medium of claim 9 , wherein the wireless network is a WiFi network controlled by the AP device.
12. The non-transitory machine-readable storage medium of claim 9 , wherein in response to the packet received from the UE, the AP device is configured to encrypt the packet using an encryption method compatible with the secure communication channel and to transmit the encrypted packet to the MGW device via the secure communication channel.
13. The non-transitory machine-readable storage medium of claim 12 , wherein the method further comprises:
decrypting the encrypted packet by the MGW device; and
transmitting from the MGW device the decrypted packet to a P-GW/GGSN of the packet core network via a GTP tunnel.
14. The non-transitory machine-readable storage medium of claim 13 , wherein the method further comprises:
in response to a second packet received from the P-GW/GGSN of the packet core network, encrypting by the MGW device the second packet using an encryption method compatible with the secure communication channel; and
transmitting the encrypted second packet to the AP device via the secure communication channel.
15. The non-transitory machine-readable storage medium of claim 14 , wherein the AP device is configured to decrypt the encrypted second packet and to transmit the second packet to the UE over the wireless network, such that the UE does not have to handle IPSec security functionality and the UE battery life is thereby enhanced.
16. The non-transitory machine-readable storage medium of claim 9 , wherein the method further comprises:
receiving by the MGW device a device identity associated with the UE encrypted by the AP device;
sending a session request to the packet core network based on the identity;
receiving a session response from the packet core network, the session response including an IP address allocated by the packet core network; and
assigning the IP address to the UE.
17. A network element, comprising:
a processor; and
a memory coupled to the processor for storing instructions, which when executed from the memory, causes the processor to:
couple a user equipment (UE) to a radio access network controller of a radio access network, wherein the radio access network controller is communicably coupled to a mobile gateway (MGW) device;
establish a secure communication channel with an access point (AP) device that is communicably coupled to the UE in a wireless network, wherein the MGW device is further communicably coupled to a mobile network gateway of the wireless network;
authenticate, by a mobile network operator's authentication process, the UE through the established secure communication channel between the MGW device and the AP device, while the UE is roaming in the wireless network;
generate a mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE;
store the mapping between an Internet Protocol (IP) access identifier and a mobile subscriber identifier for the UE at the MGW device;
provision an assigned IP address from the MGW device to the UE using the secure communication channel;
map, by the MGW device, other IP addresses to the assigned IP address; and
in response to a packet received from the AP device via the secure communication channel, transmit the packet to a packet core network, wherein the packet is originated from the UE of the wireless network, wherein the MGW manages the mobility of the UE to allow the UE to securely roam between wireless networks operated by the mobile network operator, and wherein the assigned IP address is used for both communication with the wireless networks and the cellular network,
wherein the MGW device determines whether the UE is attempting to establish a connection with the Internet or operator services of the mobile network operator.
18. The network element of claim 17 , wherein the secure communication channel is an IP secure (IPSec) tunnel established prior to authentication of the UE by the MGW device using the AP device.
19. The network element of claim 17 , wherein the wireless network is a WiFi network controlled by the AP device.
20. The network element of claim 17 , wherein in response to the packet received from the UE, the AP device is configured to encrypt the packet using an encryption method compatible with the secure communication channel and to transmit the encrypted packet to the network element via the secure communication channel.
21. The network element of claim 20 , wherein the processor is further configured to:
decrypt the encrypted packet by the MGW device; and
transmit from the MGW device the decrypted packet to a P-GW/GGSN of the packet core network via a GTP tunnel.
22. The network element of claim 21 , wherein the processor is further configured to:
in response to a second packet received from the P-GW/GGSN of the packet core network, encrypt by the MGW device the second packet using an encryption method compatible with the secure communication channel; and
transmit the encrypted second packet to the AP device via the secure communication channel.
23. The network element of claim 17 , wherein the AP device is configured to:
decrypt the encrypted second packet; and
transmit the second packet to the UE over the wireless network, such that the UE does not have to handle IPSec security functionality and UE battery life is enhanced.
24. The network element of claim 17 , wherein the processor is further configured to:
receive by the MGW device a device identity associated with the UE from the AP device;
send a session request to the packet core network based on the identity;
receive a session response from the packet core network, the session response including an IP address allocated by the packet core network; and
assign the IP address to the UE.
25. The method of claim 1 , wherein the MGW device determines whether the UE is attempting to establish a communication path to the Internet or to the packet core network.
26. The method of claim 1 , wherein the MGW devices determines whether to divert data directly to the Internet.