User authentication in wireless access network

This document discloses a solution for enabling biometric authentication of a station. According to an aspect, the solution comprises transmitting, from the station, a trigger to include biometric data of a user of the station in authentication; a logic at a network node to handle the trigger and cause execution of an authentication procedure that employs the biometric data when performing said authentication procedure in a wireless access network; and indicating a result of the authentication to the station.

FIELD

The invention relates to user authentication in a wireless network.

BACKGROUND

Network access for a station is typically managed by a network access provider. The network access provider may provide a network infrastructure or utilize a network infrastructure of a network operator, such as an incumbent cellular communication system operator, a local cable television service, or a wireless services operator in modern communication solutions. The network infrastructure typically comprises one or more access nodes providing the station with wireless connectivity. The access node(s) may then connect to other parts of the network infrastructure such as a core network, and to other networks such as the Internet.

When negotiating the access to the network infrastructure for a particular end user or User Entity (UE) or subscriber, all referring to the same entity, authentication is the first process that provides a solution for identifying a user, typically by validating user credentials before granting the station with access to the access node(s). The process of authentication is based on each user having a unique piece of information, a username-password combination, a system identifier, or a secret key that serves as unambiguous identification credentials.

BRIEF DESCRIPTION OF THE INVENTION

The invention is defined by the subject-matter of the independent claims. Embodiments are defined in the dependent claims.

DESCRIPTION OF EMBODIMENTS

Embodiments described may be implemented in a radio system, such as in at least one of the following: Universal Mobile Telecommunication System (UMTS, 3G) based on basic wideband-code division multiple access (W-CDMA), high-speed packet access (HSPA), Long Term Evolution (LTE), LTE-Advanced, a system based on IEEE 802.11 specifications, a system based on IEEE 802.15 specifications, and/or a fifth generation (5G) mobile or cellular communication system

The embodiments are not, however, restricted to the system given as an example but a person skilled in the art may apply the solution to other communication systems provided with necessary properties. One example of a suitable communications system is the 5G system, as listed above. 5G has been envisaged to use multiple-input-multiple-output (MIMO) multi-antenna transmission techniques, more base stations or nodes than the current network deployments of LTE, by using a so-called small cell concept including macro sites operating in co-operation with smaller local area access nodes and perhaps also employing a variety of radio technologies for better coverage and enhanced data rates. 5G will likely be comprised of more than one radio access technology (RAT), each optimized for certain use cases and/or spectrum. 5G system may also incorporate both cellular (3GPP) and non-cellular (e.g. IEEE) technologies. 5G mobile communications will have a wider range of use cases and related applications including video streaming, augmented reality, different ways of data sharing and various forms of machine type applications, including vehicular safety, different sensors and real-time control. 5G is expected to have multiple radio interfaces, including apart from earlier deployed frequencies below 6 GHz, also higher, that is cmWave and mmWave frequencies, and also being capable of integrating with existing legacy radio access technologies, such as the LTE. Integration with the LTE may be implemented, at least in the early phase, as a system, where macro coverage is provided by the LTE and 5G radio interface access comes from small cells by aggregation to the LTE. In other words, 5G is planned to support both inter-RAT operability (such as LTE-5G) and inter-RI operability (inter-radio interface operability, such as inter-RI operability between cmWave and mmWave). One of the concepts considered to be used in 5G networks is network slicing in which multiple independent and dedicated virtual sub-networks (network instances) may be created within the same infrastructure to run services that have different requirements on latency, reliability, throughput and mobility.

FIG. 1illustrates an example of a communication system to which some embodiments of the invention may be applied. The system may comprise one or more access nodes110providing and managing respective cells100. The cell100may be, e.g., a macro cell, a micro cell, femto, or a pico cell, for example. From another point of view, the cell may define a coverage area or a service area of the access node. The access node110may be an evolved Node B (eNB) as in the LTE and LTE-A, an access point of an IEEE 802.11-based network (Wi-Fi or wireless local area network, WLAN), or any other apparatus capable of controlling radio communication and managing radio resources within a cell. For 5G solutions, the implementation may be similar to LTE-A, as described above. The access node may equally be called a base station or a network node. The system may be a wireless communication system composed of a radio access network of access nodes, each controlling a respective cell or cells. The access nodes may provide terminal devices (UEs)120,122with wireless access to other networks such as the Internet. The terminal device120,122may also be called a station, as in the description below. In some scenarios, one or more local area access nodes may be arranged within a control area of a macro cell access node. The local area access node may provide wireless access within a sub-cell that may be comprised within a macro cell. Examples of the sub-cell may include a micro, pico and/or femto cell. Typically, the sub-cell provides a hot spot within the macro cell. The operation of the local area access node may be controlled by an access node under whose control area the sub-cell is provided. In some scenarios, a plurality of local area access nodes may be controlled by a single macro cell access node.

The wireless access network ofFIG. 1may be employed by other networks such as an internet protocol multimedia subsystem (IMS) or services such as voice over LTE (VoLTE).

In the case of multiple access nodes in the communication network, the access nodes may be connected to each other with an interface. LTE specifications call such an interface as X2 interface. In IEEE 802.11 networks, a similar interface is provided between access points. An LTE access node and a WLAN access node may be connected, for example via Xw interface. Other wired or wireless communication methods between the access nodes may also be possible. The access nodes may be further connected via another interface to a core network130of the cellular communication system. The LTE specifications specify the core network as an evolved packet core (EPC), and the core network may comprise a mobility management entity (MME)132, and a gateway (GW) node134. The MME132may handle mobility of terminal devices in a tracking area encompassing a plurality of cells and also handle signalling connections between the terminal devices and the core network130. The MME132may further carry out authentication and integrity protection for terminal devices120,122. The gateway node134may handle data routing in the core network130and to/from the terminal devices. In an embodiment, the gateway node is replaced by a group of gateway nodes, such as in the LTE networks. In the LTE networks, a serving gateway (SGW) node is configured to assign a suitable packet data network gateway (PGW) for the station120,122to serve a data session. The gateway node134may connect to other communication networks such as the Internet144.

The radio system ofFIG. 1may support Machine Type Communication (MTC). MTC may enable providing service for a large amount of MTC capable devices, such as the at least one terminal device120,122. The at least one terminal device120,122may comprise a mobile phone, smart phone, tablet computer, laptop or other devices used for user communication with the radio communication network, such as an MTC network. These devices may provide further functionality compared to the MTC scheme, such as communication link for voice, video and/or data transfer. However, in MTC perspective the at least one terminal device120,122may be understood as a MTC device. It needs to be understood that the at least one terminal device120,122may also comprise another MTC capable device, such as a sensor device providing position, acceleration and/or temperature information to name a few examples. Some embodiments of the invention may thus be applicable to Internet of Things (IoT) systems, e.g. a radio access technology supporting a narrowband IoT (NB-IoT) communication scheme.

FIG. 1illustrates an infrastructure-based communication scenario with a fixed access node110providing a mobile terminal device120,122with radio access. Another perspective in wireless communications involves wireless links between mobile devices. In a context, the devices120,122may be peer devices in the sense that the devices120,122may be end points of a wireless connection and establish a local peer network. In another scheme, one of the devices120may provide the other device120with wireless access to the infrastructure. Accordingly, the device providing the access may be understood as a mobile access node. Such a scheme is sometimes called tethering.

The core network130and a network of access nodes110may form a wireless access network providing the terminal devices120,122with wireless access and data transfer capability with the other networks144. In order to provide the wireless access, the wireless access network may first establish a connection with the terminal device120. The connection establishment may include establishment of a radio connection such as a radio resource control (RRC) connection between the access node110and the terminal device and, furthermore, it may include establishment of a core network connection between the core network130and the terminal device. The connection establishment may include authentication of the terminal device. The authentication may be performed by the MME132, a dedicated authentication server140or, in general, any network node of the wireless access network capable of performing the authentication. In some embodiments, the authentication server is external to the wireless access network. Accordingly, resource consumption or overloading the core network regarding the authentication may be reduced. The authentication may utilize a reference database146storing user credentials that have been authorized to access the wireless access network.

The wireless access network may further comprise a home subscriber server (HSS)142storing information on subscribers. In the LTE system, the HSS combines a home location register (HLR) and an authentication center (AuC) which means that the elements140,142may be combined into a single network element. The HLR part of the HSS142stores and maintains user subscription information, including: user identification and addressing information such as International Mobile Subscriber Identity (IMSI) and Mobile Subscriber ISDN Number (MSISDN) or a mobile telephone number of the subscriber; and user profile information such as service subscription states and user-subscribed Quality of Service information (such as maximum allowed bit rate or allowed traffic class). The AuC part of the HSS142is in charge of generating security information from user identity keys. This security information is provided to the HLR and further communicated to other entities in the network. Security information is mainly used for authentication, ciphering and integrity protection to ensure data and signalling transmitted between the wireless access network and the terminal device is secured.

Conventional authentication mechanisms utilize identity information stored in the terminal device120,122, e.g. on a subscriber identity module (SIM) of the terminal device120,122. The identity information may include a globally unique subscriber identifier such as International Mobile Subscriber Identity (IMSI) of the LTE system. Other authentication mechanisms may involve a combination of a user name and a password as means for authentication a subscriber or a station. Other mechanisms may involve input of a secret password from the station.

Some embodiments of the invention enable authentication in connection with the wireless access based on utilizing biometric data of a user of the station in the authentication.FIGS. 2 and 3illustrate flow diagrams of processes for enabling the biometric-data-based authentication in the wireless access network.FIG. 2illustrates a procedure performed by the station120or122. Referring toFIG. 2, the process comprises as performed by the station: generating (block200) a connection establishment request comprising at least one information element indicating capability of the user device120or122using biometric data in an authentication procedure in a wireless access network; and transmitting (block202) the connection establishment request to a network node of the wireless access network.

FIG. 2illustrates a process where the station is configured to indicate the capability for using the biometric data in the authentication to the network node. In an embodiment, the network node is the access node110. In another embodiment, the network node is the MME132or a similar node establishing the core network connection for the station120,122.

FIG. 3illustrates a process performed by the network node. Referring toFIG. 3, the process comprises: receiving (block300) the connection establishment request for connection establishment for the station. As described in connection withFIG. 2, the connection establishment request comprises at least one information element indicating capability of using biometric data in an authentication procedure of the connection establishment. The method further comprises: determining a network element of the wireless access network storing the biometric data and retrieving (block302) the biometric data from the determined network element; transmitting (block304) an authentication request to authenticate the retrieved biometric data to an authentication node having access to a reference database storing reference biometric data; receiving (block304), from the authentication node as a response to the authentication request, an authentication result; and proceeding (block306) with the connection establishment for the station on the basis of the received authentication result.

The network element storing the biometric data of a user of the station may be the HSS142. As described above, the HSS may store various information on subscribers. Regarding the station described in connection with theFIGS. 2 and 3, the HSS142may store one or more identifiers of the station, contact details of the station, etc.FIG. 4illustrates an embodiment of a record of a user profile associated with the station at the HSS142. Referring toFIG. 4, the user profile may store an internet protocol (IP) multimedia private identity (IMPI) of a subscriber associated with the station and IP multimedia public identity (IMPU) of the subscriber. The IMPI may be defined as a permanently allocated global identity assigned by the home network operator. The IMPI may be a network access identifier in the form of an e-mail address, for example, and it may be used registration, authentication, authorization, administration, and accounting purposes.

The authentication has already been discussed above. Following the authentication, the authorization process defines rights and services the subscriber is allowed once the network access is granted. The authorization constitutes an ability to use certain types of services like IP address filtering, address assignments, route assignment, QoS/differential services, bandwidth control, traffic management, compulsory tunneling to a specific endpoint, encryption, and so on. Accounting is used to measure resources the subscriber consumes during access. Accounting may be carried out by logging session statistics of a service utilizing the wireless access and usage information.

In an embodiment, the HSS142stores biometric data of the subscriber as mapped to the IMPI. The biometric data may comprise definitions of a scanned finger print of the subscriber, definitions of a scanned retina of the subscriber, a recorded voice sample of the subscriber, or another biometric data measured, scanned or recorded from the subscriber and not restricted only to these types mentioned here. The biometric data may be recorded in the HSS when the user purchases the services, e.g. a mobile connection subscription. At the same instance, a memory of the SIM of the station may be updated with information that the biometric data of the user has been recorded and is available for use in the authentication. In another embodiment, the station120,122is configured with a capability of transporting this biometric data when during the connection establishment. For example, the wireless access network may open a data channel to the station120,122specifically for transmitting the biometric data. As a consequence, the station housing the SIM is capable of discerning in the process ofFIG. 2that the authentication based on the biometric data has been enabled. In connection with block200, the station may check the memory of the SIM whether or not the biometric data has been recorded and, if the memory stores information that the recording of the biometric data has been made, the station may proceed with block200and202.

The subscriber may be considered as the primary user of the station, e.g. a user with which the wireless access network associates a SIM of the station.

If there is no biometric trigger part of the connection request, then the wireless access network may carry out conventional authentication. The IMPU may be used by any user for requesting communications to other users. The user profile of the HSS142may store, as mapped to the IMPU, a telephone number of the subscriber or other contact details of the subscriber. Other contact details may include a session initiation protocol (SIP) contact details such as “SIP:user@domain” or “SIP:E.164@domain”. The user profile may further store, in connection with the IMPU, a list of communication services the subscriber has available.

The processes ofFIGS. 2 and 3are inter-related in the sense that they address the same concept of enabling the authentication by utilizing biometric data in connection with a connection establishment process for the station.FIG. 5illustrates a signalling diagram of a procedure for carrying out the connection establishment for the station120. The procedure involves signalling comprising features of the authentication by using the biometric data.

Referring toFIG. 5, the connection establishment comprises a procedure for establishing a radio resource control (RRC) connection between the access node110and the station120in block502. The details of the RRC connection establishment are described below in connection withFIG. 6. In an embodiment, the station120indicates the capability for the authentication based on the biometric data to the access node110in block502. When the RRC connection has been established, the access node110may transmit or forward an attach request to the MME132(step504). The attach request may be a non-access stratum (NAS) message. The attach request may comprise an indicator indicating the capability for the authentication based on the biometric data to the MME132.

In an embodiment, the information element indicating the capability for the authentication based on the biometric data is a flag or another short message only indicating said capability in block502and/or504. The information element may be a one-bit indicator. Upon receiving the attach request in step504, the MME132may detect that the authentication based on the biometric data has been triggered and, as a response, the MME may include in a subsequent identity request message a request for providing the biometric data. In step506, the MME transmits the identity request message to the station120through the access node110and over the established RRC connection. In response to the identity request, the station120may generate an identity response message and insert into the identity response message a resource locator element indicating a network resource storing the biometric data. As described above, the biometric data may have been stored beforehand in the HSS or another network element. The network location such as a network address of the network element may also be stored in the station120beforehand. Accordingly, the station120is capable of inserting the resource locator element indicating the network resource to the identity response message.

In an embodiment, the resource locator element is a uniform resource locator (URL).

Upon receiving the identity response message in step506and determining the network location of the biometric data from the identity response message, the MME may retrieve the biometric data from the network location, e.g. the HSS142, in a procedure of block508. In an embodiment, the retrieval in block508is performed according to Diameter protocol described in greater detail in connection withFIG. 7below.

Upon retrieving the biometric data of the subscriber of the station120in block508, the MME132may carry out the authentication in block510. In block510, the MME132may order the authentication server140to authenticate the retrieved biometric data. Details of this procedure are described in connection withFIG. 8below.

The authentication server140may be connected to a reference database serving as a repository for authorized reference biometric data. The reference database may be maintained by a regulatory authority that has access to biometric data collected from citizens. As known, many countries have an official digital database storing biometric identities of the citizens. The authentication server may access such a database and acquire the reference biometric data for the authentication. Upon receiving the biometric data of the subscriber from the MME and the reference biometric data from the reference database, the authentication server may compare the biometric data and output the result of the authentication to the MME132. Thereafter, the MME132may proceed with the establishment of the core network connection of the station in step512. For example, if the authentication was successful, the MME may proceed by transmitting a ciphered options request to the station120in step512and receiving a corresponding response. When the authentication is failed, corresponding actions may be carried out according to the standard procedures.

If fetching the subscriber's biometric data fails, the MME132may decide to perform the conventional, non-biometric-data-based authentication and complete the authentication process in the conventional manner.

In the embodiment ofFIG. 5, the station120sends the trigger or flag indicating the capability for using the biometric data in the authentication in step502and, subsequently in step506, the station120sends the resource location of the biometric data.

In another embodiment, the station120transmits also the resource location of the biometric data in step502. Accordingly, step506may be carried out in a conventional manner. The access node110may then forward the resource location of the biometric data to the MME132in step504. In both embodiments, there is no need to send the biometric data from the station120because the biometric data has been recorded and stored in the wireless access network beforehand.

Let us now describe how the indicator indicating the capability for the authentication based on the biometric data is applied to the RRC connection establishment procedure.FIG. 6illustrates a signalling diagram of the RRC connection establishment procedure between the station120and the access node110. Referring toFIG. 6, the RRC connection establishment procedure may start in a conventional manner in steps600and602where the station transmits a random access preamble to the access node110(step600) and receives a random access response (Step602) from the access node110. The random access response may include allocation of an uplink resource for a subsequent RRC connection request. In step604, the station transmits the RRC connection request, and the request may comprise the above-described information element that indicates the capability for the authentication by using the biometric data of the subscriber of the station120.

In an embodiment, a spare bit of a RRC connection request frame is used to indicate the capability. The RRC connection request may have the following form: UL-CCCH-Message

Above, the value of “spare” may indicate the capability, e.g. value “0” indicates no capability for using the biometric data and value “1” indicates the capability for using the biometric data but not restricted only to this logic. Some other possible available bit can also be used to implement this logic.

Upon receiving the RRC connection request in step604, the access node may proceed with the RRC connection establishment in a conventional manner in steps606and608where the RRC connection establishment is completed. As described above in connection with step504, the access node may use the information element received in step604to indicate the capability for the biometric-data-based authentication to the MME in the attach request.

When the MME has the knowledge the biometric data can be used in the authentication and, further, has the knowledge about the location of the biometric data, e.g. an address to the corresponding HSS142, the MME may initiate retrieval of the biometric data.FIG. 7illustrates a procedure for retrieving the biometric data. The embodiment ofFIG. 7describes implementation of the retrieval according to Diameter protocol. Diameter protocol is an application layer protocol for authentication, authorization and accounting in computer networks, and belongs to the set of protocols according to transport control protocol/internet protocol (TCP/IP). The communication inFIG. 7may be carried out over S6a or S6d interface between the MME132and the HSS142.

As described above, the biometric data of the user may be stored in the network element such as the HSS during registration of the subscriber to the wireless access network, e.g. when selling the SIM and associated services to the user. The network element may be accessible to all network nodes of the wireless access network such that the biometric data can be retrieved for the authentication purposes, for example. Referring toFIG. 7, let us now describe an embodiment of block508ofFIG. 5. In step700, the MME132or, in other embodiments, another network node of the wireless access network transmits an authentication-information-request (AIR) message (Attribute Value Pair (AVP) code318) to the HSS142. The AIR may carry an information element indicating that the MME132requests specifically for biometric data for the authentication. Upon receiving the AIR in step700, the HSS142generates an authentication-information-answer (AIA) message (message code318) that responds to the AIR. The AIA may comprise an acknowledgement of the request and a reference to a following message that will carry the biometric data. The HSS142transmits the AIA message in step702. Upon receiving the AIA message in step702, the MME extracts the information on the reference to the following message and starts to wait for the referred following message. In step704, the HSS can use insert subscriber data (ISD) message to transmit the biometric data of the user if needed

Upon receiving the biometric data in step704, the MME132may extract the biometric data and determine in block706whether or not further biometric data is needed. Upon determining that the received biometric data is sufficient for the authentication, the process may end. However, upon determining in block706that the received biometric data is incomplete or that further biometric data is needed, the MME132may trigger transmission of further biometric data by transmitting an insert subscriber response (ISR) message to the HSS142in step708. Upon receiving the ISR message in step708, the HSS may retrieve further biometric data from its memory or repository and return to step704again by transmitting the further biometric data to the MME132. In this manner, the procedure may stay in the loop of steps704to708until the MME132determines to have completed the retrieval of the biometric data needed for the authentication. This is one possible method of implementation in seeking biometric data for the authentication process and not restricted to it.

Upon receiving the biometric data of the subscriber for the authentication, the MME132may order the authentication server140to carry out the authentication of the biometric data. An embodiment of this procedure of block510is described now with reference toFIG. 8. In step800, the MME132transmits an authentication request to the authentication server140. The authentication request may carry the biometric data retrieved from steps740till708according to any one of the above-described embodiments. Upon receiving the authentication request and the biometric data in step800, the authentication server140may trigger an authentication process to verify authenticity of the received biometric data. In block802, the authentication server140retrieves the above-described reference biometric data from a repository storing the reference biometric data. The authentication request may further carry subscriber credentials that identify the subscriber and enable the authentication server to retrieve the reference biometric data of the correct subscriber from the repository. Upon receiving the reference biometric data in block802, the authentication server compares the biometric data received in step800with the reference biometric data retrieved in block802and determines an authentication result. If the authentication server determines in block804that the biometric data received in step800matches with the reference biometric data, the authentication is successfully complete, and the authentication server may transmit the authentication result indicating the verified authenticity of the biometric data to the MME132in step806. On the other hand, if the authentication server determines in block804that the biometric data received in step800does not match with the reference biometric data, the authentication is failed, and the authentication server may transmit in step806an authentication result indicating the invalid authenticity of the biometric data to the MME132.

If the authentication is successful and the biometric data authentic, the MME132may complete the attachment procedure and allow the station to access the wireless access network. The MME or another network element may also then proceed with the authorization and accounting procedures described above. If the authentication is failed and the biometric data invalid, the MME132may terminate the attachment procedure and indicate failed attachment to the station120.

A similar process of blocks800to806can be adopted by a visited network, if the station is roaming and not attached to its home network. The process may be used for checking if the user is a black listed or not, or for another purpose. An example of the other purpose is an embodiment where the visiting network uses the process in providing personalised services.

In an embodiment where the core network does not support the biometric authentication, the MME132may respond to the attach request received in step504with a response message that indicates that the biometric authentication is not supported. In such a case, the network node controlling the authentication may carry out a conventional authentication procedure.

In an embodiment, the biometric authentication, authorization, and/or accounting is utilized in connection with a session initiation protocol (SIP), e.g. as a part of SIP registration.FIG. 9illustrates an embodiment of the SIP registration procedure where biometric authentication is enabled. Referring toFIG. 9, a user agent such as the station120or an application executed in the station120or another electronic device transmits a SIP registration message to a server that may be a proxy server. The SIP registration message may comprise an information element indicating that the authentication/authorization/accounting based on the biometric data is available. The SIP registration message may further comprise a resource locator which is part of its message body called Session Descriptor Protocol (SDP) specifying a network location where the biometric data is store, e.g. in the form of an URL or even encrypted data in American Standard Code for Information Interchange (ASCII) or binary format. In an embodiment, the SIP registration message is REGISTER message of the SIP. Below, an embodiment of the REGISTER message with the information element and the resource locator.

The information element is “Authorization: Digest, Biometric”, and the resource locator is “biometric=“https://central database server url/xxxxx.jpg”” part of a session description protocol (SDP) body of the SIP.

Upon receiving the SIP registration message in step900, the proxy server may retrieve in block902the biometric data from the network resource indicated by the received resource locator. The proxy server may also retrieve the reference biometric data, as described above. In this case, the user credentials required for retrieving the correct reference biometric data may also be included in the SIP registration message. For example, in the above-described REGISTER message, the username parameter (“001010123456789@test.3gpp.com”) may be used when accessing the repository storing the reference biometric data. Thereafter, the proxy server may compare the biometric data with the reference biometric data in the above-described manner and determine the authentication result in block904. The authentication result may be transmitted to the user agent in step906.

In an embodiment where the biometric data stored in the HSS or in the142and/or in the reference database is accessible to all network operators, the authentication server or the network node may check a status of the subscriber associated with the biometric data and utilize the status in the one or more of the authentication, authorization, and accounting procedure. For example, if the status indicates that the subscriber has been blacklisted because of non-payment of bills or for some other reason, access of the subscriber to communication services may be prevented. For example, the connection establishment by the network node in theFIG. 5may be terminated in block508or510. From another perspective, the embodiment enables globally applied policies, rules, or features for each subscriber because the biometric data is globally unique to the subscriber and accessible to all networks in the reference database146.

The use of the biometric data in the authentication generally improves the security of the wireless access.

FIGS. 10 and 11illustrate block diagrams of apparatuses according to some embodiments of the invention.FIG. 10illustrates the station120whileFIG. 9illustrates the network node. The apparatus ofFIG. 10may be a terminal device or a peer device, or the apparatus may be comprised in any one of such apparatuses. The apparatus may be, for example, a circuitry or a chipset in such an apparatus. The apparatus ofFIG. 11may be the MME or another network node controlling authentication procedures, or the apparatus may be comprised in such an apparatus. The apparatus may be, for example, a circuitry or a chipset in such an apparatuses. The apparatuses ofFIGS. 10 and 11may be electronic devices comprising electronic circuitries.

Referring toFIG. 10, the apparatus may comprise a communication control circuitry10such as at least one processor, and at least one memory20including a computer program code (software)22wherein the at least one memory and the computer program code (software) are configured, with the at least one processor, to cause the apparatus to carry out any one of the embodiments of the station120described above.

The memory20may be implemented using any suitable data storage technology, such as semiconductor based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The memory may comprise a configuration database24for storing configuration data for use in the transmissions. For example, the configuration database24may store information on whether or not the biometric authentication is supported.

The apparatus may further comprise a communication interface (TX/RX)26comprising hardware and/or software for realizing communication connectivity according to one or more communication protocols. The communication interface26may provide the apparatus with communication capabilities to communicate in a cellular communication system and/or in another wireless network. Depending on whether the apparatus is configured to operate as a terminal device, a peer device, or another device, the communication interface26may provide different functions. The communication interface26may comprise standard well-known components such as an amplifier, filter, frequency-converter, (de)modulator, and encoder/decoder circuitries and one or more antennas. The communication interface26may comprise radio interface components providing the apparatus with radio communication capability in one or more wireless networks.

In an embodiment, the apparatus further comprises a scanner15for scanning or recording the biometric data from the user. The scanner may be a retinal scanner, a fingerprint scanner, or a voice recorder. The scanned biometric data may be stored in the memory20and transferred to the wireless access network in any one of the above-described embodiments.

Referring toFIG. 10, the communication control circuitry10may comprise a control plane circuitry12configured to carry out control plane signalling such as transmission and reception of control or management messages. Such messages may include connection establishment messages, connection management messages, connection termination messages, handover messages, measurement messages, etc. The control plane circuitry may, for example, carry out the signalling according to the embodiments of the RRC connection establishment described above. The communication control circuitry10may further comprise a data communication circuitry16configured to carry out user plane or data plane communication with a serving access node and/or with other devices.

The communication control circuitry10may further comprise a transmission controller18configured to control the operation of the circuitries12and16. In an embodiment, upon determining to initiate establishment of the RRC connection, e.g. upon receiving a connection establishment request from an application executed in the apparatus, the transmission controller18may check the configuration database for whether or not the biometric authentication is enabled. If the configuration database24indicates that the biometric authentication is enabled, the transmission controller18may configure the control plane circuitry to insert the information element indicating the capability for the biometric authentication in the RRC connection request message. On the other hand, if the configuration database24indicates that the biometric authentication is disabled, the transmission controller18may configure the control plane circuitry12to transmit a conventional RRC connection request message.

Referring toFIG. 11, the apparatus may comprise a communication control circuitry50such as at least one processor, and at least one memory60including a computer program code (software)62wherein the at least one memory and the computer program code (software) are configured, with the at least one processor, to cause the apparatus to carry out any one of the embodiments of the network node controlling the authentication, authorization, and/or accounting as described above.

The memory60may be implemented using any suitable data storage technology, such as semiconductor based memory devices, flash memory, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The memory may comprise a configuration database64for storing configuration data. For example, the configuration database64may store information on whether or not the network node supports the biometric authentication.

The apparatus may further comprise a communication interface (I/O)66comprising hardware and/or software for realizing communication connectivity according to one or more communication protocols. The communication interface66may provide the apparatus with communication capabilities to communicate in the cellular communication system and/or in another wireless access network. The communication interface may, for example, provide an interface to access nodes of the wireless access network and another interface towards the HSS or another entity storing the biometric data. The communication interface66may further provide an interface to the authentication server.FIG. 11illustrates some interfaces of the MME132towards other network nodes but these interfaces are merely exemplary.

Referring toFIG. 11, the communication control circuitry50may comprise an authentication controller58configured to control the authentication of the subscriber in connection with establishing the connection for the station120. The authentication controller may comprise, as a sub-circuitry, a conventional authentication controller54configured to perform the authentication in a conventional manner without using the biometric data. The authentication controller58may enable the conventional authentication controller54when the configuration database64indicates that the biometric authentication is not supported. The authentication controller may comprise, as a sub-circuitry, a biometric authentication controller55configured to perform the authentication by using the biometric data. The authentication controller58may enable the biometric authentication controller55when the configuration database64indicates that the biometric authentication is supported. The biometric authentication controller may perform blocks508and510according to any one of the above-described embodiments.