Patent Description:
Descriptions of mobile networks and systems can be found in the literature, such as in particular in Technical Specifications published by standardization bodies such as for example 3GPP (<NUM>rd Generation Partnership Project).

An example of 3GPP mobile system is EPS (Evolved Packet System). An EPS network comprises a Core Network called EPC (Evolved Packet Core) that can be accessed not only by 3GPP access, but also by non-3GPP access, such as in particular WLAN access will be considered more particularly in the following. WLAN access to EPC is specified in particular in 3GPP TS <NUM>, and includes Trusted WLAN access and Untrusted WLAN access. An example of non-roaming architecture for 3GPP and Non 3GPP (Trusted or Untrusted) access to EPC is recalled in <FIG> taken from 3GPP TS <NUM>. An example of roaming architecture for 3GPP and Non 3GPP (Trusted or Untrusted) access to EPC is recalled in <FIG> taken from 3GPP TS <NUM>.

In a system such as EPS for example, a UE may connect to various external networks (referred to as Packet Data Network PDN, an example being an operator's IMS network), via EPC providing connectivity (referred to as PDN connectivity) services. User authentication and authorization procedures are generally performed before granting access and providing connectivity services at establishment of a PDN connection or EPC session.

Untrusted WLAN access to EPC involves entities such as ePDG (evolved Packet Data Gateway) and 3GPP AAA Server (and 3GPP AAA Proxy in case of rooming), and interfaces such as SWa interface between WLAN AN (WLAN Access Network) and 3GPP AAA Server(or between WLAN AN and 3GPP AAA Proxy in case of roaming), and SWm interface between ePDG and 3GPP AAA Server (or between ePDG and 3GPP AAA Proxy in case of roaming), as specified in particular by 3GPP TS <NUM>. Authentication and authorization procedures and protocols for these procedures are specified in particular in 3GPP TS <NUM> and 3GPP TS <NUM>.

Trusted WLAN access to EPC involves entities such as TWAN (Trusted WLAN Access Network) and 3GPP AAA Server (and 3GPP AAA Proxy in case of rooming), and interfaces such as STa interface between TWAN and 3GPP AAA Server (or between TWAN and 3GPP AAA Proxy in case of roaming), as specified in particular by 3GPP TS <NUM> and 3GPP TS <NUM>. Authentication and authorization procedures and protocols for these procedures are specified in particular in 3GPP TS <NUM> and 3GPP TS <NUM>.

In such systems, an IMEI (International Mobile Equipment Identity) has been defined for mobile equipment identification purpose. As specified in particular by 3GPP TS <NUM>, an equipment may be classified as white-listed, grey-listed or black-listed or may be unclassified. Such lists are specified in particular in 3GPP TS <NUM>. The white list is composed of all number series of equipment identities that are permitted for use. The black list contains all equipment identities that belong to equipment that need to be barred. Besides the black and white list, administrations have the possibility to use a grey list. Equipments on the grey list are not barred (unless on the black list or not on the white list), but are tracked by the network (for evaluation or other purposes).

IMEI checking procedures may be performed, whereby a mobile equipment (or UE) may provide its IMEI upon request, and the network may check the status of this IMEI with the EIR (Equipment Identity register).

As recognized by the inventors, and as will be explained with more details later, there is a need to enhance IMEI checking in such systems, in particular for WLAN access (Trusted or Untrusted) to EPC.

Embodiments of the present invention in particular address such needs.

<CIT> describes a technique for permitting a UE to conditionally access an EPC network, when the UE is requesting the access to the EPC network using a non-3GPP access network.

Some embodiments of apparatus and/or methods in accordance with embodiments of the present invention are now described, by way of example only, and with reference to the accompanying drawings, in which:.

Description of various aspects and/or embodiments of the invention.

IMEI(SV) checking is specified for 3GPP accesses for CS and PS domains in TS <NUM>, TS <NUM>, TS <NUM> and TS <NUM>, as well as in appropriate stage <NUM> specifications. In order to check the IMEI(SV), the network needs to trigger the retrieval of the IMEI(SV) from the UE. NAS messages are specified for that. IMEI(SV) retrieval for non-3GPP accesses such as trusted and untrusted WLAN is specified but for such non-3GPP accesses IMEI(SV) checking in the EIR is not specified yet and a study is currently under progress in SA2 to define whether EIR should be interfaced to the TWAN (for trusted WLAN access) and to ePDG (for untrusted WLAN) or to the AAA server. All contributions up to now push for interfacing the EIR with the AAA server for various reasons, one reason being that the architecture would be common to both trusted and untrusted WLAN, another reason being that it reduces the number of interfaces to the EIR.

CT1 has recently agreed in CT1 two CRs that allow the network to retrieve the ME's IMEI(SV): <NUM> CR0460 for trusted WLAN and <NUM> CR0461 for untrusted WLAN. For the trusted WLAN case, the IMEI(SV) is retrieved from the UE by the AAA server (via EAP-AKA' new attribute AT_DEVICE_IDENTITY), while for the untrusted WLAN case the IMEI(SV) is retrieved from the UE by the ePDG (via a new IKEv2 attribute DEVICE_IDENTITY).

However, which entity should trigger the IMEI(SV) checking, and which entity should decide whether to continue the authorization process in case of black-listed, grey-listed or white-listed ME is not specified.

For non roaming PS sessions, the AAA server (in HPLMN) could be this entity. But for roaming sessions like emergency sessions, this might be in the VPLMN. The main reason is local regulatory policies which force the emergency sessions/calls to be handled by the VPLMN (or by the TWAN operator in the trusted WLAN access case) and thus to take decision on whether to accept emergency sessions issued by e.g. potentially stolen devices.

This would be in line with the mechanisms specified for the 3GPP accesses where the IMEI checking is fully performed in the VPLMN (by the MSC, SGSN, MME). See e.g. TS <NUM> clause <NUM>. <NUM>, which specifies in step 5b:
"In order to minimise signalling delays, the retrieval of the ME Identity may be combined with NAS security setup in step 5a. The MME may send the ME Identity Check Request (ME Identity, IMSI) to the EIR. The EIR shall respond with ME Identity Check Ack (Result). Dependent upon the Result, the MME decides whether to continue with this Attach procedure or to reject the UE.

For an Emergency Attach, the IMEI check to the EIR may be performed. If the IMEI is blocked, operator policies determine whether the Emergency Attach procedure continues or is stopped.

In case of WLAN access to EPC, no solution is specified for triggering the IMEI(SV) checking and deciding whether to continue the Access authorization in case of in case of black-listed or grey-listed ME (Mobile Equipment) especially in case of roaming.

Only a partial solution for the HPLMN is disclosed:.

Figure <NUM>. <NUM>-<NUM> in clause <NUM>. <NUM> of TS <NUM> (Tunnel full authentication and authorization - untrusted access) has been updated (<FIG>) for enabling IMEI checking by the AAA server.

The signaling flows of <FIG>, <FIG> and <FIG> allow in roaming scenarios the ePDG orTWAN operator to request IMEI checking using an EIR (Equipment Identity Register) via the AAA server in the Home PLMN.

Unfortunately, the signaling flows of <FIG>, <FIG> and <FIG> are not applicable to all operators because, although some operators use a centralized EIR (e.g. the GSMA EIR), some other operators are willing to check the IMEI using an EIR that is local to their PLMN or to the country.

The signaling flows of <FIG>, in addition to allowing in roaming scenarios the ePDG orTWAN operator to request IMEI checking using an EIR (Equipment Identity Register) via the AAA server in the Home PLMN, allow the ePDG or the TWAN operator to request IMEI checking using an EIR located in the VPLMN country and connected to the 3GPP AAA proxy.

The signaling flows of <FIG>, <FIG> and <FIG> enhance the above mechanism for IMEI(SV) checking, which only allows the ePDG to decide whether to retrieve the IMEI(SV) from the UE, to allow the 3GPP AAA server to instruct the ePDG to retrieve the IMEI(SV) from the UE.

The signaling flows also include enhancing the above mechanism for IMEI(SV) checking, which only allows full IMEI checking procedure by the HPLMN, to allow the VPLMN or the TWAN operator to.

although the IMEI checking is performed via the 3GPP AAA server in the HPLMN.

If it is required that the operator granting the access (VPLMN or TWAN operator) must decide whether to continue the Access authorization process in case of black-listed, grey-listed or white-listed ME (at least for emergency session with Local Break Out). The signaling flows, allowing in particular to minimize the number of AAA server exchanges and the number of interfaces to the EIR include one or more of:.

An example of call flow in case of Untrusted WLAN is depicted in <FIG>. The IMEI retrieval has been recently agreed at 3GPP (i.e. IMEI Request parameter in step <NUM>, IMEI parameter and the steps 8b and 8c in the figure). <FIG> includes the addition of IMEI Request in step <NUM>, IMEI Check Request and Action on IMEI Check Result.

(black-listed, grey-listed or white-listed ME).

An example of signaling flow related to a possible solution in case of Trusted WLAN is depicted in <FIG>.

The IMEI retrieval has been recently agreed at 3GPP (i.e. IMEI Request parameter, IMEI parameter and the steps 22c and 22d in the figure).

<FIG> includes the addition of IMEI Request in steps <NUM> and <NUM>, IMEI Check Request and Action on IMEI Check Result (black-listed, grey-listed or white-listed ME).

An alternative solution includes requesting IMEI Check as soon as possible i.e. in the EAP-RSP/Identity in step <NUM>. An example of a corresponding call flow is depicted in <FIG>.

<FIG> includes the addition of IMEI Check Request and Action on IMEI Check Result (black-listed, grey-listed or white-listed ME).

The signaling flows of <FIG> allow the handling of IMEI checking assuming two cases i.e. where the EIR is in the visited country and where the EIR is in the home country. It is also assumed that the AAA server/proxy is interfaced with the EIR.

It is assumed that the EIR (specified in particular in TS <NUM>) is interfaced with the AAA server (or proxy) and not directly to the ePDG/TWAN to minimize the number of interfaces and to avoid the duplication of the procedures in ePDG and TWAN.

As already indicated, the non-roaming case mechanism is straight forward, but the roaming case requires more analysis.

For 3GPP access, TS <NUM> clause <NUM>. <NUM> specifies in step 5b: "In order to minimise signalling delays, the retrieval of the ME Identity may be combined with NAS security setup in step 5a. The MME may send the ME Identity Check Request (ME Identity, IMSI) to the EIR. The EIR shall respond with ME Identity Check Ack (Result). Dependent upon the Result, the MME decides whether to continue with this Attach procedure or to reject the UE. " Therefore, for 3GPP access, the decision for triggering the IMEI check procedure, as well as the decision for continuing the procedure is performed in the VPLMN.

Moreover, depending on local regulations, the EIR may be located in the visited country (local EIR, not always synchronized with an EIR outside the country) or centralized (e.g. GSMA EIR). The solution should work with both alternatives.

In embodiments of the invention, the operator who is granting the access (i.e. the VPLMN or the TWAN operator) takes the responsibility of the action plan i.e..

In the untrusted WLAN case, the ePDG can retrieve the IMEI from the UE on its own. It is not the case for trusted WLAN case, in which only the 3GPP AAA server can do that. Hence, the solutions for untrusted WLAN and for trusted WLAN will necessarily be different.

Examples of signaling flows allowing in particular to minimize the number of AAA exchanges are illustrated in <FIG>.

Examples of signaling flows illustrated in <FIG> (untrusted WLAN) and <NUM> (trusted WLAN) are first described.

For untrusted WLAN, an example of signaling allowing to keep the same number of 3GPP AAA exchanges is illustrated in <FIG>:.

For trusted WLAN, an example of signaling flow which may require one more 3GPP AAA exchange is illustrated in <FIG>. When the EIR is in the visited country, the TWAN cannot immediately provide the IMEI to the 3GPP AAA proxy. Hence, it may be necessary to have a preliminary step where the TWAN asks the 3GPP AAA server to retrieve the IMEI and to return it to the TWAN, before the 3GPP AAA proxy can check the IMEI via the local country EIR:.

The AAA server applies the IMEI check instructions received in the "Action upon IMEI check" i.e., based on the "Action upon IMEI check" and on the "IMEI check result" from the visited or home EIR, determines whether the authentication and authorization procedure shall continue or shall be stopped (step <NUM> in <FIG>).

Examples of signaling flows illustrated in <FIG> (untrusted WLAN access) and <NUM> (trusted WLAN access) are now described.

For untrusted WLAN, an example of signaling flow allowing to keep the same number of 3GPP AAA exchanges is illustrated in <FIG>:.

Claim 1:
An Authentication Authorization Accounting server in a Home Public Land Mobile Network of a Third Generation Partnership Project packet core for a user equipment, wherein the Authentication Authorisation Accounting server is configured to:
receive from a Trusted WLAN access network a request for checking of an International Mobile Equipment Identity of the user equipment by an Equipment Identity Register in a Visited Public Land Mobile Network for the user equipment;
send an Authentication Authorization Accounting message to the Trusted WLAN access network, wherein the Authentication Authorization Accounting message comprises an International Mobile Equipment Identity retrieved from the user equipment via the Trusted WLAN access network, and an indication that the International Mobile Equipment Identity is to be checked by the Equipment Identity Register in said Visited Public Land Mobile Network.