Henry Haverinen

Interworking architecture between 3GPP and WLAN systems

The Third Generation Partnership Project has recently taken the initiative to develop a cellular-WLAN interworking architecture as an add-on to the 3GPP cellular system specifications. The article presents an overall view on an interworking architecture, which enables provisioning by mobile operators of a public WLAN access service for 3GPP system subscribers. The enabling functionalities include the reuse of 3GPP subscription, network selection, 3GPP system-based authentication, authorization and security key agreement using SIM/USIM card, user data routing and service access, as well as end user charging. The interworking functionalities are achieved without setting any 3GPP specific requirements for the actual WLAN access systems, but relying on the existing functionality available in a typical WLAN access network based on IEEE 802.11 standards.

Cellular access control and charging for mobile operator wireless local area networks

This article presents a system architecture, design considerations, and rationale for a mobile operator wireless LAN. The article also discusses the system implementation and performance issues. The system presented reuses GSM and GPRS mechanisms for user authentication, access control, subscriber management, operator roaming, and billing, while still being compatible with wireless Internet service provider networks and IETF and IEEE protocols such as RADIUS, EAP, and IEEE 802.1x. The architecture is a result of research carried out by Nokia between 1999 and 2002. The designed architecture has also been verified in a complete system implementation.

Authentication and key generation for mobile IP using GSM authentication and roaming

A new authentication, authorization and accounting (AAA) infrastructure for use on the Internet is being developed at the IETF. AAA support is also being specified for mobile IP. The paper describes an implemented prototype system that demonstrates how the existing GSM authentication and operator roaming infrastructure can be used for mobile IP authentication and key distribution. We present a mechanism for authenticating the user and generating mobile IP authentication keys using the GSM subscriber identity module (SIM). The Internet AAA network has an interface to the GSM network for obtaining authentication information from the GSM Authentication Centre (AuC). After the authentication keys have been generated, the default mobile IP authentication with these keys is used for several subsequent registrations.

Towards Service Continuity in Emerging Heterogeneous Mobile Networks

There are indications that the next generation mobile communication systems shifts away from the traditional vertically integrated approach in system design and instead allow access to a set of services through a variety of heterogeneous access technologies. With the emergence of multimode mobile devices, the next step in the integration of heterogeneous mobile networks, i.e. inter-access service continuity, gains relevance. This paper reviews emerging heterogeneous access networks and their integration, and studies service continuity, including the relevance of mobile IPv4 and mobile IPv6 and other mobility solutions at, above, and below IP layer, in this context. We propose a new system architecture, which combines mobile IP and IPsec in a 3GPP operator environment. As part of the proposed framework we present new techniques for mobility security association bootstrapping and for enhancing the mobile devices NAPT traversal implementation. The selected architecture is evaluated using an experimental laboratory setup. The results are used to build up an analysis of the solution and draw up some conclusions

A portable mobile IP implementation

This paper describes the software architecture of a portable mobile IP implementation. In addition, the paper discusses general design issues with protocol implementations and the relationship between a protocol implementation and the operating system. The mobile IP implementation has been adapted for several operating systems, including Windows 2000, Windows CE and Linux. As mobile IP is an enhancement of the Internet protocol (IP), the implementation is an add-on component to an existing TCP/IP stack. One of the challenges in such an implementation is the fact that the existing protocol implementation is often available only as an executable binary, which cannot be modified. Another challenge is how to make the implementation generic and porting-friendly, as solutions required in different operating systems vary substantially.

NAAP: A User-To-Network Authentication Protocol

This paper presents the design of an IP-level user-to-network authentication protocol called the Network Access Authentication Protocol (NAAP). The protocol is an extensible UDP-based protocol that is used by a mobile terminal and an edge router for IP network access authorization for example on public Wireless Local Area Networks (WLANs). NAAP can use any Extensible Authentication Protocol (EAP) method that is capable of distributing a session key. It includes authentication service discovery, message integrity protection, protection against message replays, deregistration and a mechanism to detect if a terminal has silently left the access network. The protocol has been implemented and it is used in the Nokia Operator Wireless LAN solution [1] with GSM SIM authentication.

Improving user privacy with firewall techniques on the wireless LAN access point

Wireless local area networks (WLANs) for public access need to provide privacy between users and also ensure correct charging where access is based on payment. However, by design, conventional LANs and WLANs provide directs unmediated communications between networked devices at the link layer. The paper presents a method to allow networked client devices to communicate with a network comprising routers and other servers while preventing unmediated communication between the clients on the wireless network. An advantage of the method is that it can be implemented entirely within the WLAN access point as a configurable forwarding policy database. No changes are needed to the WLAN client software or the routers and servers and the communication remains completely within the scope of existing industry standards.

Test Bed for Plain C/C++ Protocol Implementations

This paper presents a protocol software test bed, which was developed for the testing of a Network Access Authentication Protocol (NAAP) implementation. We demonstrate how modular software design can help in protocol testing and we present a simple software interface that enables flexible protocol testing of protocol implementations. Besides normal use scenarios, the test bed allows automatic testing of various error cases, such as dropped, delayed, duplicated and modified packets.