Femto personal policy server

An access point detects a presence of a first device having a device identifier in a femtozone associated with the access point. The access point matches the device identifier with a first personal policy server identifier associated with a corresponding first personal policy profile comprising a first set of rules and retrieves the first personal policy profile corresponding to the first personal policy server identifier. The access point applies the first set of rules in the first personal policy profile.

CROSS-REFERENCE TO RELATED APPLICATION

This patent application relates to U.S. application Ser. No. 12/347,201, entitled “Femto Personal Proxy Application Client” and filed concurrently herewith. The contents of U.S. application Ser. No. 12/347,201, entitled “Femto Personal Proxy Application Client” are hereby incorporated by reference into this application as if set forth herein in full, and may be combined with any of the features described herein.

TECHNICAL FIELD

This description relates to access terminal authorization at private access points in wireless networks.

BACKGROUND

Cellular wireless communications systems, for example, are designed to serve multiple wireless-enabled devices distributed over a large geographic area by dividing the area into regions called “cells” or “cell areas”. At or near the center of each cell area, a network-side access device (e.g., an access point or base station) is located to serve client devices located in the cell area and is commonly referred to as an “access terminal”. Examples of access terminals include wireless-enabled devices such as cellular telephones, laptops, personal digital assistants (PDAs), and/or other user equipment (e.g., mobile devices). An access terminal generally establishes a call, also referred to as a “communication session,” with an access point to communicate with other entities (e.g., servers) in the network.

SUMMARY

In an aspect, an access point detects a presence of a first device having a device identifier in a femtozone associated with the access point. The access point matches the device identifier with a first personal policy server identifier associated with a corresponding first personal policy profile comprising a first set of rules, and retrieves the first personal policy profile corresponding to the first personal policy server identifier. The access point applies the first set of rules in the first personal policy profile.

The access point may deactivate the first predefined set of rules in the first personal policy profile when the presence of the first device is not detected.

The access point may also match the device identifier associated with the first device with an identifier associated with a corresponding second personal policy profile that comprises a second predefined set of rules when the presence of the first device is not detected. The access point may retrieve the second personal policy profile using the second personal policy server identifier and apply the second predefined set of rules in the second personal policy.

Implementations may include one or more of the following.

The first device may include a handset.

The first set of rules in the first personal policy profile may include a first set of parameters and values associated with the parameters, wherein the first set of parameters has at least a first parameter and a second parameter, the first parameter corresponding to first set of applications and the second parameter being a second device identifier, the second device identifier identifying one device selected from a group comprising the first device, a second device attached to a home network associated with the access point, and a network server communicating with the access point, the identified device being the device where the set of application runs.

The first set of rules in the first personal policy profile may include changing values of usage flags associated with the software applications in the first set of applications from the “on” state to an “off” state. The first set of rules in the first personal policy profile may also include a second set of parameters and values associated with the second set of parameters, wherein the second set of parameters may include parameters to change the user preference associated with the software applications in the first set of applications. The second set of parameters may also include priorities and traffic descriptors to apply to traffic generated by the first device as the traffic is processed in the access point. The second set of parameters may also include a description of a digital right management that is applied to traffic generated by the first device.

The first set of rules in the first personal policy profile may also include a set of routes of digital data communications that are made available in the access point to traffic generated by the first device.

In an aspect, a method comprises steps as outlined above.

In another aspect, a computer program product, tangibly embodied in a computer readable medium, is operable to cause a data processing apparatus to perform operations comprising the steps of the method above.

In yet another aspect, an apparatus can be configured to perform the steps outlined above.

DETAILED DESCRIPTION

In wireless communication networks generally, geographic areas served by access points, also referred to as “service areas,” may vary in size, may include smaller service areas, and/or may be located within larger service areas. Larger geographic areas that include one or more smaller service areas are referred to as “macrocell areas,” and an access point that serves a macrocell area is referred to as a “macrocell.” Within a macrocell area, one or more access points may be located to serve smaller geographic areas, referred to as “femtocell areas”, or “femtozones.” An access point that serves a femtozone is referred to as a “femtocell access point.” A macrocell, for example, may provide coverage to an area of a few blocks, while a femtocell access point may provide coverage to an area spanning a floor of a building, a house, or an office space.

Global System for Mobile communications/Wideband Code Division Multiple Access (GSM/WCDMA) wireless communication networks (e.g., 2G/3G macro networks) have been implemented and are in operation globally. However, one motivation for providing “femtocell access points” in such 2G/3G macro networks is that the coverage of those macro networks is often poor indoors, which may cause, e.g., service disruption (e.g., a dropped telephone call) to users of devices at home and inside buildings. Femtocell access points, also known as, e.g., “home” base stations, private access points, or simply “femtocells”, provide complementary indoor coverage to 2G/3G macro networks for service continuity. Femtocell access point (FAP) implementations may also serve as a new service platform to enable mobile wireless broadband applications and home entertainment.

A private access point may include, for example, a femtocell access point or a picocell access point. A private access point may be installed anywhere, for example, a home, an office, a public space, or a restaurant. For ease of description, private access points will be described hereinafter as femtocell access points or FAPs.

Referring toFIG. 1, a radio access network (RAN)100includes multiple macro access points or “macrocells”108,110, and112located in macrocell areas102,104, and106, respectively. The macrocell areas102,104, and106can include one or more femtocell access points (FAPs). The macrocells108,110, and112are each configured to communicate with a device over an airlink. For example, macrocell108communicates with device116over an airlink109. Macrocells108,110, and112are connected over a backhaul connection (e.g., backhaul connection118aor118b) to a radio network controller (RNC) which in turn communicates with the service provider's core network122, e.g., via RNC120aor120b, which may be one or more physical devices at different locations.

The RAN100is configured to support various mobile wireless access technologies, examples of which include Universal Mobile Telecommunications System (UMTS) and Code Division Multiple Access (CDMA) 2000. The 1xEV-DO protocol has been standardized by the Telecommunication Industry Association (TIA) as TIA/ELA/IS-856, “CDMA2000 High Rate Packet Data Air Interface Specification,” 3GPP2 C.S0024-0, Version 4.0, Oct. 25, 2002, which is incorporated herein by reference. Revision A to this specification has been published as TIA/EIA/IS-856A, “CDMA2000 High Rate Packet Data Air Interface Specification,” 3GPP2 C.S0024-A, Version 2.0, July 2005. Revision A is also incorporated herein by reference. Revision B to this specification has been published as TIA/EIA/IS-856-B, 3GPP2 C.S0024-B and is also incorporated herein by reference. Other wireless communication standards may also be used. Although this description uses terminology from the 3GPP's UMTS standards, the same concepts are applicable to other wireless communication standards, including CDMA 1xEV-DO, CDMA2000, WiMax, WiBro, WiFi, and the like.

The following sections of the 3GPP Standard are hereby incorporated by reference in their entirety:3GPP Technical Specification 25.331 version 8.3.0 Release 8, 2008-07, Universal Mobile Telecommunications System (UMTS); Radio Resource Control (RRC); Protocol specification;3GPP Technical Specification 25.304 version 7.6.0 Release 7, 2008-07, Universal Mobile Telecommunications System (UMTS); User Equipment (UE) procedures in idle mode and procedures for cell reselection in connected mode;3GPP Technical Specification 25.133 version 8.3.0 Release 8, 2008-06, Universal Mobile Telecommunications System (UMTS); Requirements for support of radio resource management (FDD);3GPP Technical Specification 24.008 version 7.9.0 Release 7, 2007-10, Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); Mobile radio interface Layer 3 specification; Core network protocols; Stage 3; and3GPP Technical Specification 23.122 version 7.9.0 Release 7, 2007-06, Digital cellular telecommunications system (Phase 2+); Universal Mobile Telecommunications System (UMTS); Non-Access-Stratus (NAS) functions related to Mobile Station (MS) in idle mode.

FIG. 2shows a femtocell deployment in the macrocell service area102of the RAN100ofFIG. 1. The service area102of macrocell108includes femtocell areas240a,240b, and240cserved by femtocell access points (FAPs)242a,242b, and242c, respectively. Hereinafter, the femtocell access points242a,242b, and242care referred to as “FAPs242a,242b, and242c.” Although, only three FAPs are shown inFIG. 2, in practice a macrocell area can include many more FAPs. For example, a macrocell area could include hundreds, thousands, or hundreds of thousands of FAPs.

A femtocell server244is in communication with one or more of the FAPs242a-c.The femtocell server244maintains active associations between devices such as devices116a,116b, and116cand the FAPs242a-cso that a hand-in request from the macrocell108(or other components of the mobile core network) can be directed to the correct FAP. One or more of the FAPs242a-cand the femtocell server244may be combined as a single device. In early deployment, the femtocell server244may present a similar, conventional system interface as that of RNC120to the existing core network infrastructure122. References to the core network122may in some cases be a shorthand for a reference to the femtocell server244, and in some implementations, certain functions of the core network122may be included in the femtocell server244and vice versa. For example, when reference is made to a FAP accessing stored information from the core network122, all or part of the information might be stored on the core network122and/or the femtocell server244.

Femtocell access point systems typically perform some type of closed access control. Closed access control means, e.g., that access to each femtocell access point is limited in some fashion, i.e., not every device may “camp” on the femtocell and/or utilize the services of the femtocell. For example, an owner of a FAP may like to control which devices are allowed to camp on and register with the core network122via the FAP to use normal service (e.g., non-emergency service).

Devices may be “authorized” or “not authorized” (“unauthorized”) to camp on and/or use services of a FAP. Each FAP of the FAPs242a-cmay include an authorization list, or “access control list”, which may be stored in memory on the FAP. See, e.g., access control lists (ACLs) stored on respective FAPs242a,242b,242cinFIG. 2. The access control list for a particular FAP includes identities of devices that are authorized on that FAP. Devices that are not identified on the access control list of a particular FAP are not authorized on that FAP. A particular device may be authorized on one FAP and unauthorized on another FAP. From the perspective of a FAP, a device is either an authorized device or an unauthorized device. From the perspective of a device, a FAP is either an authorized FAP (e.g., a “home” FAP that the device is authorized on), or an unauthorized FAP (e.g., a “foreign” FAP that the device is not authorized on). A “home” FAP need not be located in a user's home and may, e.g., be located in an office building, or a public place. Likewise, a “foreign” FAP may be located, e.g., in close physical proximity to a user's “home” FAP but still be “foreign” from the perspective of the device. Just as a FAP may identify more than one authorized device in its access control list, a device may be authorized on more than one FAP (and thus may have more than one authorized FAP or “home” FAP). Hereafter, for ease of description, a home FAP for an access terminal will be referred to as though it is the only home FAP for the access terminal. Access control lists may be updated periodically by, e.g., an administrator or operator of the core network, e.g., the core network122. Access control lists may also be built dynamically and loaded to the FAP by, e.g., an administrator or operator of the core network, e.g., the core network122.

In, e.g., a wireless network such as a UMTS network, each access point is assigned an access point identifier such as a Location Area Identifier. Location Area Identifiers are explained in more detail in, e.g., 3GPP Technical Specification 23.003, section 4.4.4.6. The Location Area Identifier (LAI) of the access point is broadcast to devices. When camping on an access point, the device issues a Location Area Update Request message that contains the LAI assigned to that access point. That Location Area Update Request message is forwarded by the access point to the core network and the core network returns a message to the device that, e.g., allows that device to camp on the access point to use normal service (e.g., non-emergency service) or that rejects the device's Location Area Update Request to disable normal service (e.g., unless the device is trying to make an emergency call from the FAP). Once camped on an access point with a particular LAI, the device can move into the coverage area of another access point with the same LAI without issuing a new Location Area Update Request. The device issues a new Location Area Update Request message when the device moves into the coverage area of an access point with a different LAI. The device may also issue the Location Area Update Request periodically to inform an access point that the device is still in the vicinity of the access point.

A LAI is an example of an access point identifier. In wireless networks that use other air interface standards, an access point identifier other than a LAI may be used in, e.g., access control.

When a device moves into the coverage area of a FAP, the device will generally issue a Location Area Update Request message containing the LAI assigned to that FAP. Thus, even a device that is unauthorized on a particular FAP but that is in range of or in the coverage area of the FAP will generally attempt to camp on the FAP and perform Location Area registration with the core network (e.g., core network122) using the Location Area Update Request message. In order to support a form of closed access control, Location Area Update Request messages from unauthorized devices should be rejected to prevent the unauthorized devices from camping on the FAP to use normal service. If Location Area Update requests from unauthorized devices are not rejected by the FAP in some fashion, then unauthorized devices that remain in range of the FAP will generally keep retrying the Location Area Update Requests, which drains the battery and shortens the battery life of the devices. Other issues may arise when Location Area Update requests from unauthorized devices are not properly rejected. In a situation in which a FAP is surrounded by unauthorized devices, for example in a crowded area, the FAP may become overloaded in handling Location Area Update requests. If the FAP passes messages from devices to the core network without first confirming that the devices originating the messages are authorized on the FAP, then, due to the potential volume of requests from unauthorized devices, excessive messaging traffic between the FAP and the core network may become an issue. On the other hand, it is possible for a FAP to reject an unauthorized device completely, or effectively completely. However, since some core network operators consider it desirable for any device, even an unauthorized device, to make emergency calls using a FAP, such rejection methods that block unauthorized devices from making even emergency calls may be undesirable.

Referring toFIG. 3, a FAP242is configured to detect the presence of devices320aand320b, for example, handsets, that enter femtozone240. Based on a device identifier associated with a device, say320a, FAP242, upon detection of and verification that the device320amay camp on the FAP242, may make available a set of applications to run on the device320a. The set of applications are particular to that device through personal proxy client340a. FAP242may also detect and verify permission to camp for device320band make available a set of applications for device320bthrough personal proxy client320b.

A device320(which may represent device320aor device320binFIG. 3) has associated with it a unique device identifier with which the FAP242is able to identify the device. Examples of device identifiers that may be used in an access control list on a particular FAP may include the International Mobile Subscriber Identity (IMSI) of the device. While the device may also use a temporary identifier such as a Temporary Mobile Subscriber Identity (TMSI) in initial communications with a FAP, access control lists may generally include the unique IMSI of the device rather than the TMSI.

Detection of the device begins when the device enters the femtozone associated with FAP242and broadcasts its device identifier via a signal. The FAP242then receives the signal containing the device identifier with a built-in receiver. Once the device identifier is retrieved from the signal using a processor in the FAP242, the device is considered detected by the FAP242.

The detected device has its device identifier located on the access control list as described above. Assuming the device is authorized to camp on the FAP242, the device identifier is then matched with an identifier in the personal proxy client (“PPC identifier”) in order to identify applications that are to be run on the device320or on the FAP242, a device attached to the home network360, or a server attached to the Internet370and associated with the device identifier. A database of PPC identifiers and pointers to applications corresponding to each PPC identifier may be kept in a location accessible to the FAP242. Such a database may be separate from the access control list, but it may be incorporated into the access control list and therefore stored in memory in the FAP as well.

Matching the device identifier with a PPC identifier may be accomplished, for example, through looking up the PPC identifier in a database. Such a looking up may be done using a standard pattern-matching algoritlun.

As stated above, a PPC identifier is associated with pointers to applications that may be run on the device320, FAP242. a device attached to home network360, or on a server attached to the Internet370. Once the device identifier is matched with a PPC identifier, the device identifier is associated with the pointers to the applications. The pointers may comprise, e.g., IP addresses denoting locations where the corresponding applications are stored. The locations may be directly accessible by the FAP242.

The FAP242may access the applications now associated with the device identifier via the associated pointers. Typical applications may include a single sign-on application, a personal automated teller application, and an automatic network backup application. The applications may be run on FAP242, device320, other devices connected to the FAP242, e.g., a device attached to the home network360, or a server attached to the Internet370. For example, if a pointer contains the IP address of a storage location of an application, then a message may be sent from the FAP242to the storage location to download the application to the device320via the FAP242. An application may also be stored on, for example, the FAP242, or a femto server244. At least some of the applications may already be present on device320; in that case, such applications need not be loaded onto the device. An application may also be loaded to a device attached to the home network360or a server attached to the Internet370.

Once the applications are loaded onto device320, FAP242, a device attached to home network360, or to a server attached to the Internet370, they are activated by the FAP242. Each application may have a usage flag associated with device320. A usage flag has two states: “on” and “off”. An application may be activated on the device if its usage flag associated with the device is in the “on” state. By default, a usage flag is in the “off” state. If the device320has been detected and authorized, and an associated application has been loaded by the FAP242, then the usage flag for that application is switched to the “on” state. Typically, the usage flag stays in the “on” state while the device320is camped on the FAP242.

If the device320departs from the femtozone associated with FAP242or is no longer detected by the FAP242, then the applications loaded onto the device320, FAP242, a device attached to home network360, or to a server attached to the Internet370, may be deactivated. The deactivation may occur by a switching of the usage flags of the applications loaded onto device320, FAP242, the device attached to the home network360, or the server attached to the Internet370, from “on” to “off”.

The concept of a personal application proxy client that is activated while device320camps on FAP242and is deactivated when device320departs from the femtozone as described above can be generalized into a personal policy server that may apply to the device320, FAP242, a device attached to the home network360, or to a server attached to the Internet370through a FAP242while the device320camps on the FAP242. Such a personal policy server is illustrated inFIG. 4. Femto personal policy server540comprises a set of Femto personal policy profiles542for devices that may appear on the access control list for a FAP242. There may be a unique personal policy profile542for each device320that is allowed to camp on the FAP242. When the device320attaches to the FAP242and is detected by the FAP242as described above, the detected device320has its device identifier located on the access control list as described above. Assuming the device is authorized to camp on the FAP242, the device identifier is then matched with an identifier in the personal policy server (“PPS identifier”) in order to identify the personal policy profile542that corresponds to the device320.

Each Femto personal policy profiles542may take the form of a set of rules, and will be described below as such. The rules contained in a personal policy profile may be applied to the device320, or to the FAP242or to a device attached to the home network360, or to a server attached to the Internet370, while the device320camps on the FAP242.

If device320departs from the femtozone associated with FAP242or is no longer detected by FAP242, then a first personal policy profile associated with device320is deactivated and the rules contained in the personal policy profile are no longer applied to the device320, FAP242, a device attached to home network360, or to a server attached to the Internet370.

In certain cases, when the personal policy profile is deactivated, a different, second personal policy profile corresponding to the device320is retrieved using the PPS identifier, and the rules contained in the second personal policy profile may be applied to the device320, FAP242, a device attached to home network360, or to a server attached to the Internet370, while the device320is not detected by the FAP242. In this case, if the device320is detected again by the FAP242, the second personal policy profile is deactivated, and the first personal policy profile to be used while the device320is camping on the FAP242is activated.

Femto personal policy server540containing the set of rules as described above may reside on FAP242or on a device closely integrated with the FAP, a device external to the FAP, e.g., femto server244, a device connected to home network360, or on a server connected to the Internet370. Femto personal policy server540may apply its rules in the set of rules to any device associated with FAP242, including FAP242itself.

The rules contained in a personal policy profile may include a wide variety of different rules. A typical example is a set of rules for changing the functionality of the device320, FAP242, a device attached to the home network360, or to a server attached to the Internet370given ambient conditions. Ambient conditions may be a time of day, a time of year, a location (i.e. work or home), or another condition. Such conditions may be described with a set of parameters. A set of rules may also be thought of as a table of parameters and values associated with the parameters. For example, changing the functionality of the device320, FAP242, a device attached to the home network360, or a server attached to the Internet370may involve activating applications associated with the device320, FAP242, a device attached to the home network360, or a server attached to the Internet370. Further, if there are other parameters associated with the device identifier, then further matching is done on those parameters. For example, the time of day according to FAP242may be matched with a value of the time parameter in the rules table. If no such parameter value exists, then a default set of applications may be activated. As described above, activating an application comprises setting a usage flag associated with the application and the associated device to an “on” state from an “off” state.

Examples of rules that may be included in a set of rules in a personal policy profile include rules that control a look and feel of the user interface on the device320or on a device attached to a home network360associated with FAP242; for example, a rule may specify any set of applications, services, or features accessible by a user from device320or a device attached to home network360, such as e.g., address books; a user preference changing application that change user preferences for applications on device320or on devices attached to home network360; an application that controls accessibility settings for address books, web sites, etc. (e.g., for parental control); applications that change “personal routes” accessible in a local routing table in the FAP242or on a home gateway, or call routing settings in the FAP242or on a call routing server attached to the FAP242; an application that manages QoS treatment in the FAP242or on a home gateway of different types of traffic generated by a user and/or a priority of user traffic with respect to that of other users, for different traffic types; an application that manages Digital Right Management and content sharing privileges and/or billing and charging profiles for the user using device320or devices attached to home network360.

Although the techniques described above employ the UMTS air interface standard, the techniques are also applicable to other CDMA and non-CDMA air interface technologies in which, e.g., messages can be passed between access terminals and other network components.

The processes described herein are not limited to use with any particular hardware, software, or programming language; they may find applicability in any computing or processing environment and with any type of machine that is capable of running machine-readable instructions. All or part of the processes can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations thereof.

The processes described herein and their various modifications (hereinafter “the processes”), are not limited to the hardware and software described above. All or part of the processes can be implemented, at least in part, via a computer program product, e.g., a computer program tangibly embodied in an information carrier, such as one or more machine-readable storage media or in a propagated signal, for execution by, or to control the operation of, one or more data processing apparatus, e.g., a programmable processor, a computer, multiple computers, and/or programmable logic components.

Actions associated with implementing all or part of the processes can be performed by one or more programmable processing devices executing one or more computer programs to perform the functions of the processes. All or part of the processes can be implemented as, special purpose logic circuitry, e.g., an FPGA (field programmable gate array) and/or an ASIC (application-specific integrated circuit).

Processing devices suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processing device will receive instructions and data from a read-only memory or a random access memory or both. The components of a computer include one or more processing devices for executing instructions and one or more memory devices for storing instructions and data.

Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto-optical disks, or optical disks. Information carriers suitable for embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in special purpose logic circuitry.

The techniques described herein can be implemented in a distributed computing system that includes a back-end component, e.g., as a data server, and/or a middleware component, e.g., an application server, and/or a front-end component, e.g., a client computer having a graphical user interface and/or a Web browser through which a user can interact with an implementation of the invention, or any combination of such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication, e.g., a communication network. Examples of communication networks include a local area network (“LAN”) and a wide area network (“WAN”), e.g., the Internet, and include both wired and wireless networks.

Actions associated with the processes can be rearranged and/or one or more such actions can be omitted to achieve the same, or similar, results to those described herein.

Components of different implementations may be combined to form implementations not specifically set forth above. Other implementations not specifically described are also within the scope of the following claims.