Patent Description:
<CIT> describes a system within which an access network detects Quality of Service (QoS) links for both Internet Protocol (IP) Multimedia Subsystem (IMS) sessions and non-IMS sessions where the non-IMS sessions is recognized as being associated with a particular application type. <CIT> discloses a method of implementing a control plane of an evolved packet core (EPC) in a cloud computing system using the OpenFLow protocol. Existing mobile networks provide for the transmission of data between a mobile device and the ground via a plurality of connections which deliver predefined quality of service, including a relative priority amongst others. As all connections use the same wireless media for transfer, in times of heavy traffic load or the like the amount of available capacity can become quickly exhausted. In such cases, connections having a particular service attribute, such as a lower priority, may be dropped in order to maintain the continued correct operation of connections having a different service attribute, for example those with a higher priority.

Security services such as the police and fire departments typically share at least some of their communications resources, for example via private cell phone networks or the like, with the public or others. During crisis situations the usage of all these parties increases which quickly leads to the resources becoming exhausted. However, during such crisis situations security services have an increased reliance on such communications in order to correctly understand and deal quickly and effectively with the crises. One method of reducing congestion under such circumstances would be to refuse transmission of one or other type of data. For example streaming video requires a large amount of data and limiting or prohibiting its transmission during crisis situations could significantly reduce the probability of congestion. Security services, however, typically encrypt data during transmission, for example via a secure virtual private network (VPN) connection or the like. As such, it is impossible to tell the type of data being transmitted. Additionally, cell phone networks are typically not under control of the security services.

What is needed therefore, and one object of the present is a system and method which allows for at least some of the connections supporting secured communications to be dropped while maintaining others while providing control over which type of data is being transmitted via the remaining secured connections to those using the secured communications.

Dependent claims describe preferred embodiments. In order to address the above and other drawbacks, there is provided a tunnel filtering system comprising a wireless network comprising at least one base station and a packet data network gateway interconnecting the wireless network to a public network, at least one user equipment comprising a Virtual Private Network (VPN) client and at least one mobile application, a wireless radio connection interconnecting the at least user equipment and the base station, an EPS session interconnecting each of the at least one user equipment and the packet data network gateway via the wireless radio connection, each of the of EPS session identified by an IP address of the interconnected user equipment wherein each of the EPS session comprises a default EPS bearer and a plurality of dedicated EPS bearers identified by an EPS bearer ID, a VPN gateway connected to the public network and comprising a gateway IP address, and at least one application server comprising at least one server application, wherein a plurality of VPN tunnels interconnect each of the VPN client with the VPN gateway, each of the VPN tunnels comprising a user equipment IP address, a VPN gateway IP address and a known port, wherein data transmission via one of the VPN tunnels is supported by an associated one of the EPS bearers, and a set of filters shared between a first routing function in each of the at least one user device and a second routing function in the VPN gateway, each of the filters used by the first and second routing functions to direct a particular one of a plurality of data types to a first specified one of the plurality of VPN tunnels. A communicating one of the at least one mobile application communicates data of the particular data type with a communicating one of the at least one server application via the first specified VPN tunnel and a first associated EPS bearer and further wherein when the first associated EPS bearer and the first specified VPN tunnel are no longer available, at least one of the set of filters is modified such that the particular data type is associated with a second specified one of the VPN tunnels wherein the communicating mobile application communicates the data of said particular data type subsequently with the communicating server application via the second specified VPN tunnel and a second associated EPS bearer.

There is also provided a method for securely interconnecting at least one mobile application executing on a mobile device comprising a Virtual Private Network (VPN) client with an application server via a wireless radio connection established between the mobile device and a base station of a wireless network comprising a packet data network gateway interconnecting the wireless network to a public network comprising a VPN gateway comprising a gateway IP address. The method comprises opening an EPS session interconnecting the mobile device and the packet data network gateway via the wireless radio connection, each of the of EPS session identified by an IP address of the interconnected user equipment wherein each of the EPS session comprises a default EPS bearer and a plurality of dedicated EPS bearers identified by an EPS bearer ID, establishing a plurality of Virtual Private Network (VPN) tunnels between the VPN client and the VPN gateway, each of the VPN tunnels comprising a user equipment IP address, the gateway IP address and a known port wherein data transmission via one of the VPN tunnels is provided between the mobile device and the packet data network gateway by a respective one of the EPS bearers, sharing a set of filters between a first routing function in the mobile device and a second routing function in the VPN gateway, each of the filters used by the first and second routing functions to direct a particular data type to a first specified one of the plurality of VPN tunnels, transmitting data of the particular data type between the mobile application and the application server using the first specified VPN tunnel, modifying at least one of the shared filters such that the particular data type is directed to a second specified one of the VPN tunnels, and transmitting data of the particular data type between the mobile application and the application server using the second specified VPN tunnel.

Additionally, there is provided a non-transitory computer readable medium storing a program causing a microprocessor to execute a process on a mobile device comprising a storage device, a Virtual Private Network (VPN) client with an application server via a wireless radio connection established between the mobile device and a base station of a wireless network comprising a packet data network gateway interconnecting the wireless network to a public network comprising a VPN gateway comprising a gateway IP address. The process comprises opening an EPS session interconnecting the mobile device and the packet data network gateway via the wireless radio connection, each of the of EPS session identified by an IP address of the interconnected user equipment wherein each of the EPS session comprises a default EPS bearer and a plurality of dedicated EPS bearers identified by an EPS bearer ID, establishing a plurality of Virtual Private Network (VPN) tunnels between the VPN client and the VPN gateway, each of the VPN tunnels comprising a user equipment IP address, the gateway IP address and a known port wherein data transmission via one of the VPN tunnels is provided between the mobile device and the packet data network gateway by a respective one of the EPS bearers, storing a set of filters in the storage device, each of the filters directing a particular data type to a first specified one of the plurality of VPN tunnels, routing data of the particular data type for transmission between the mobile application and the application server according to the filters to the first specified VPN tunnel, modifying at least one of the shared filters such that the particular data type is directed to a second specified one of the VPN tunnels, and routing data of the particular data type for transmission between the mobile application and the application server according to the filters to the second specified VPN tunnel.

Referring now to <FIG>, a tunnel filtering system in accordance with an illustrative embodiment of the present invention, and generally referred to using the reference numeral <NUM>, will now be described. The System comprises a plurality of mobile devices/user equipment (UE) <NUM> which communicate via a wireless communication network <NUM>, such as GSM, 3GPP, <NUM> LTE or the like. In one embodiment the wireless network <NUM> provides data communications via a plurality of base stations <NUM>/wireless network <NUM>, such as an LTE network or the like, connected to a Wide Area Network (WAN) such as the Internet <NUM> for one or more mobile applications <NUM> running on the UE <NUM> and such that the mobile application <NUM> can communicate with one of a plurality of application servers <NUM> which is situated remote from the UE <NUM> and on which is running a server application <NUM>. Typically, this is done using TCP/IP and the like which support inter alia the establishment of a TCP/IP connection <NUM> for transmission of data between the mobile application <NUM> and the application server <NUM>. The mobile device/UE <NUM> illustratively comprises a microprocessor or the like (not shown) and the one or mobile applications <NUM> are stored in a computer readable storage medium (also not shown) on the UE <NUM> for execution as a process by the microprocessor. In a particular embodiment the application server <NUM> may comprise a storage repository <NUM> comprising data which may be accessed by the mobile application <NUM>.

Referring now to <FIG> in addition to <FIG>, the wireless network <NUM> comprises inter alia three (<NUM>) components which work in concert to establish and maintain connections for UEs <NUM> and such that they can communicate with application servers <NUM> and the like via the Internet <NUM>: A Mobility Management Entity (MME) <NUM>; a Serving Gateway (SGW) <NUM>; and a Packet Data Network Gateway (PGW) <NUM>. The MME is a control node which manages the wireless network <NUM> by providing for UE authentication, orchestrating handovers between different LTE networks, and bearer management. The SGW <NUM> provides an interface towards the UEs <NUM> via the base stations <NUM>. The SGW <NUM> is responsible for handovers between neighbouring base stations <NUM> as well as for data transfer. Each SGW <NUM> also monitors and maintains context information related to a UE <NUM> during a UE's idle state and generates paging requests when downlinked data is received from the UE <NUM>. The PGW <NUM> provides the interconnection with external data networks such as the Internet <NUM>. The PGW <NUM> manages policy enforcement, packet filtering, provides billing support and the like. The PGW <NUM> also allocates IP addresses to the UEs <NUM>.

Referring now to <FIG> in addition to <FIG>, in order to exchange data between a mobile application <NUM> running on the UE <NUM> and a server application <NUM> running on the Application Server <NUM>, an end-to-end type connection <NUM> is established between the UE <NUM> and the Application Server <NUM>. In a particular embodiment at least a portion of this connection <NUM> comprises a Virtual Private Network (VPN) type connection which allows data to be transmitted between the UE <NUM> and the Application Server24 in a secure fashion. As will be understood by a person of ordinary skill in the art, in a particular embodiment the point of termination of the VPN at the Application Server <NUM> side may be at a corporate gateway or the like (not shown) which provides for example an interface between the Application Server <NUM> and the Internet <NUM>.

Still referring to <FIG> in addition to <FIG>, other layers in the UE protocol stack are used to support the transmission of data via the end-to-end connection. Indeed, data packets which are transmitted via the end-to-end connection are transmitted between the UE <NUM> and the PGW <NUM> via one or more Evolved Packet System (EPS) bearers <NUM> and in turn transmitted between the UE <NUM> and the SGW <NUM> via an Enhanced Radio Access Bearer (E-RAB) <NUM>. Similarly, data transmitted via the E-RAB <NUM> are transmitted between the UE <NUM> and the base station <NUM> via a radio bearer <NUM>. Additional system internal signalling bearers <NUM> and <NUM> are provided as well as external bearers <NUM> for communicating via the Internet <NUM>.

Still referring to <FIG> in addition to <FIG>, in order to establish a communication path (or attach to the wireless network <NUM>), for example on power up of the UE <NUM>, using system information received from the base station <NUM> a UE <NUM> establishes a Radio Resource Control (RRC) connection to the base station <NUM> via the radio bearer <NUM>. The base station <NUM> also communicates with the MME <NUM> in order to authenticate the UE <NUM>. Once the UE <NUM> is authenticated by the MME <NUM> a default EPS bearer <NUM> is established between the UE <NUM> and the PGW <NUM>. The default EPS bearer <NUM> is assigned an IP address by the PGW <NUM>. A default EPS bearer is assigned when the UE <NUM> attaches to the wireless network <NUM> for the first time, and is maintained as long as UE <NUM> is attached to the wireless network <NUM>. The default EPS bearer provides a best effort service in that bit rate is not guaranteed. Of note is that a UE <NUM> may have additional default EPS bearers <NUM> which are identified using their own IP addresses. Additional default EPS bearers can be useful in situations where different type of communications require a different delivery network to be accessed by the PGW <NUM>, such as Internet Messaging Service (IMS) traffic on a first default EPS bearer and other Internet traffic on a second default EPS bearer.

Still referring to <FIG>, once attached each EPS bearer <NUM> provides a virtual connection between the UE <NUM> and the PGW <NUM> and provides a data transmission service to which may be associated one or more quality of service (QoS) parameters, such as QoS Class Identifier (QCI), Allocation and Retention Priority (ARP), Guaranteed Bit Rate (GBR) and Aggregate Maximum Bit Rate (AMBR).

Still referring to <FIG>, In addition to the default EPS bearer <NUM>, other dedicated EPS bearers <NUM> can be established between the UE <NUM> and the PGW <NUM> and to each of which may be assigned a different set of QoS parameters. Each of the dedicated EPS bearers <NUM> has the same IP address as the default EPS bearer <NUM> (although in a particular embodiment additional default EPS bearers <NUM> may be established having a different IP address). The Dedicated EPS bearers <NUM> are typically used to provide a dedicated communication tunnel between UE <NUM> and PGW <NUM> to which is dedicated a particular type of traffic, such as Voice Over IP (VOIP), streaming video or the like. A typical set of EPS bearers <NUM> might include one (<NUM>) default EPS bearer and eight (<NUM>) dedicated EPS bearers each assigned a unique QCI as follows:.

Referring now to <FIG>, as discussed above, the EPS bearers <NUM> can be used to support one or more VPN tunnels <NUM> established between a VPN client <NUM> executing on the UE <NUM> and a VPN gateway <NUM>, for example located within a corporate network <NUM> or the like. As known in the art a VPN inter alia allows data to be encrypted between VPN Client <NUM> and VPN gateway <NUM> such that users can securely share data via unsecured public networks such as the Internet <NUM> and WiFi or the like. In a particular embodiment, and as will be described in more detail below, when a mobile application <NUM> wishes to communicate securely with an application server <NUM> via a VPN tunnel <NUM>, the VPN client <NUM> establishes a plurality of VPN tunnels <NUM>, one for each EPS bearer <NUM> interconnecting the UE <NUM> to the PGW <NUM>. The VPN tunnels are established using the IP address assigned to the UE <NUM> by the PGW <NUM>, the IP address of the VPN Gateway <NUM> and a known port <NUM> for each VPN tunnel. Illustratively port <NUM> is assigned to the VPN tunnel <NUM> which is assigned to the default EPS bearer <NUM>, port <NUM> is assigned to the EPS bearer <NUM> associated with QCI <NUM>, port <NUM> is assigned to the EPS bearer <NUM> associated with QCI <NUM>, and so on. This port is the same at both the VPN client <NUM> and the VPN gateway <NUM>. As known in the art, and for example when using the Internet Protocol Security (IPSec) network protocol suite, a VPN tunnel <NUM> is established between the VPN client <NUM> and the VPN gateway <NUM> through mutual authentication and the negotiation of cryptographic keys (not shown), for example using Internet Key Exchange (IKE and IKEv2) which are used subsequently during any communication session to encrypt and decrypt transmitted data.

Still referring to <FIG>, in order to control the type of data communications/application <NUM> which may use a given one of the VPN tunnels <NUM>, a configuration file <NUM> is shared between the VPN client <NUM> and the VPN gateway <NUM>. The configuration file <NUM> comprises filters which are shared by a first routing function <NUM> in the UE <NUM> and a second routing function <NUM> in the gateway to associate a given data type for transmission via a given VPN tunnel <NUM>. The configuration file <NUM> may be updated from time to time in order to redefine which data type may use which VPN tunnel <NUM>. As such, a first application <NUM> communicating data of a first type with a first server application <NUM> via a first VPN tunnel <NUM> using dedicated EPS bearer <NUM> having QCI <NUM> may be redirected using an updated configuration file <NUM> to a second VPN tunnel <NUM> using a different dedicated EPS bearer <NUM> having QCI <NUM>, thereby allowing the EPS bearer <NUM> having QCI <NUM> and the first VPN tunnel to be dropped without affecting secure transmission of data from the first application <NUM> to the first server application <NUM>.

Claim 1:
A tunnel filtering system (<NUM>) comprising:
a wireless network comprising at least one base station (<NUM>) and a packet data network gateway (<NUM>) interconnecting said wireless network to a public network (<NUM>);
at least one user equipment (<NUM>) comprising a Virtual Private Network, VPN, client (<NUM>) and at least one mobile application (<NUM>);
a wireless radio connection (<NUM>) interconnecting said at least user equipment and said base station;
an EPS session interconnecting each of said at least one user equipment and said packet data network gateway via said wireless radio connection, each of said of EPS sessions being identified by an IP address of said interconnected user equipment wherein each of said EPS sessions comprises a default EPS bearer (<NUM>) and a plurality of dedicated EPS bearers (<NUM>) identified by an EPS bearer ID;
a VPN gateway (<NUM>) connected to said public network and comprising a gateway IP address; and
at least one application server (<NUM>) comprising at least one server application (<NUM>);
wherein
a plurality of VPN tunnels (<NUM>) interconnect each of said VPN client with said VPN gateway, each of said VPN tunnels comprising a user equipment IP address, a VPN gateway IP address and a known port (<NUM>), wherein data transmission via one of said VPN tunnels is supported by an associated one of said EPS bearers; and
a set of filters (<NUM>) are shared between a first routing function in each of said at least one user device and a second routing function in said VPN gateway, each of said filters being used by said first and second routing functions to direct a particular one of a plurality of data types to a first specified one of said plurality of VPN tunnels;
wherein a communicating one of said at least one mobile application communicates data of said particular data type with a communicating one of said at least one server application via said first specified VPN tunnel and a first associated EPS bearer and further wherein when said first associated EPS bearer and said first specified VPN tunnel are no longer available, at least one of said filters is modified such that said particular data type is associated with a second specified one of said VPN tunnels wherein said communicating mobile application communicates said data of said particular data type subsequently with said communicating server application via said second specified VPN tunnel and a second associated EPS bearer.