Method for communication control in a communication network, communication control entity, key management entity, terminal and gateway entity

[0001] Field of the Invention

[0002] The present invention relates to a method for communication control in a communication network, a correspondingly adapted communication control entity, key management entity, terminal and gateway entity.

[0003] Recently, mobile communication networks have widely spread and increasingly found attention. In the near future, mobile communication networks will be more and more based on the Internet protocol (IP) so that users may access the Internet by means of the terminals and/or mobile stations MS, exchange data with the Internet or other subscriber terminals, e.g. via the Internet or via IP based networks.

[0004] However, even though the subsequent description focuses to a certain extent on IP based networks, the present invention as being subsequently outlined does not require an IP based network to be carried out but may work also with non-IP based networks.

[0005] Charging and billing for services offered and used by subscribers in an IP based network are challenging issues, because terminals are intelligent, and end-users are probably able to create their own applications and evade the charging and billing of the network operator (or service provider).

[0006] Charging is also problematic in IP based networks because the network is not reliable. This means that as data are transmitted in units of packets such as TCP/IP packets (TCPTransmission Control Protocol, IPInternet Protocol), those data packets are often transmitted as best effort traffic (even if different qualities of service QoS can be agreed on for such best effort traffic).

[0007] If a network operator plans to have charging based on an amount of transmitted data, the IP frame re-sendings, i.e. retransmission of TCP/IP data packets which could not be delivered successfully at the first attempt, in the network can cause more chargeable data than the end-user is able to see. Namely, the subscriber as an end user merely perceives the data necessary for running the application, while retransmissions are transparent to the subscriber.

[0008] In future networks, the billing of content (not only data amount but also of what is represented by the data) will increase in significance, and also the copyright of the content has to be ensured. To this end, a digital rights management (DRM) system has recently been introduced. DRM systems interact with clearing houses to be able to charge the end-user for the content he used/transmitted.

[0009] DRM systems have also been conceived to be used in connection with mobile communication, e.g. for distribution of ringing tones and/or so-called logos and/or games to be run as an application on the subscribers' terminals. One such approach is outlined in Digital Rights Management and Superdistribution of Mobile Content, White Paper, Nokia, 2001, retrieved on Aug. 22, 2002 from the Internet, i.e. http://www.nokia.com/networks/systems_and_solutions/solution_main/1,23797,423,00.html.

[0010] With current solutions, subscribers as well as operators are facing problems such that subscribers may evade the charging and billing of the network operator/service provider; this is not satisfactory for the operator/provider; subscribers may have to pay for retransmitted data packets which they never perceived to have been retransmitted; this is not satisfactory for the subscriber; different billing systems could have to be implemented, e.g. for voice calls or for data transmissions; this is inconvenient for the operator and increases his operational expenses for running the network, while the operator's operational expenses represent already a big portion of operator costs. (It is to be noted that data as used herein may also be referred to as content, i.e. a payload of data of a specific application for example.)

[0011] Consequently, it is an object of the present invention to provide an improved method for communication control in a communication network, a correspondingly adapted communication control functionality, key management entity, terminal and gateway entity, which remove the above outlined drawbacks.

[0012] According to the present invention, the above object is for example achieved by a method for communication control in a communication network between a terminal originating communication and a communication destination, the communication network comprising at least one communication control functionality, and a communication key management entity the method comprising the steps of: requesting communication by said terminal, determining at said at least one communication control functionality whether said communication request contains a valid communication key for communication in said network, and if no such valid key is contained, obtaining at least one valid key from said communication key management entity to be assigned to said requesting terminal for communication, performing communication of said requesting terminal to the communication destination using said communication key.

[0013] According to favorable further developments of the method said communication key comprises a pair of keys consisting of an encryption key for transmitting data as encrypted data and a decryption key for decrypting received encrypted data; said communication key has a predetermined expiry; said communication key expires after a predetermined amount of data has been transmitted or received; said communication key expires after a predetermined lifetime, the lifetime of the key being counted from the time of assigning it to the requesting terminal for use; said communication key expires either after a predetermined amount of data has been transmitted or received, or after a predetermined lifetime; the communication key expires only after a predetermined amount of data has been transmitted or received, and after a predetermined lifetime; the communication key obtained depends on a type of communication requested; types of communication are distinguished according to their quality of service QoS parameters; said decryption key for decrypting received encrypted data is forwarded to said destination; the method further comprising the steps of recording the communication keys assigned to the requesting terminal at said communication key management entity, and forwarding the record to a billing entity, and billing the requesting terminal based on a usage of the assigned keys; transmitted data are only partly encrypted; after said requesting and prior to said determining there is a further step of checking whether said request is a valid request, and if said request is a valid one, enabling communication.

[0014] According to the present invention, the above object is for example also achieved by a communication control functionality, comprising receiving means adapted to receive a communication request from a terminal, determination means adapted to determine whether said communication request contains a valid communication key for communication in said network, obtaining means responsive to said detection and adapted to obtain at least one valid key from a communication key management entity to be assigned to said requesting terminal for communication, if no such valid key is determined to be contained, and communication means adapted to perform communication of said requesting terminal with the communication destination using said communication key.

[0015] According to favorable further developments of said communication control entity, it further comprises key forwarding means adapted to forward said obtained encryption key and said decryption key to said terminal; said key forwarding means is adapted to forward at least the decryption key to the destination; it further comprises a checking means adapted to check whether said request is a valid request and to enable communication if said request is a valid one.

[0016] According to the present invention, the above object is for example also achieved by a key management entity for a communication network, comprising a first interface, interfacing to a communication control functionality connectable thereto, the first interface being adapted to receive, as an input from a communication control functionality, a key obtaining request for obtaining at least one valid key from the communication key management entity, and to transmit, as an output to a communication control functionality, said at least one valid key, and a second interface, interfacing to a billing entity connectable thereto, the second interface being adapted to transmit, as an output to a billing entity, a record comprising at least the requesting terminal's identification, assigned communication keys, and usage parameters of said keys.

[0017] According to the present invention, the above object is for example also achieved by a terminal, comprising receiving means adapted to receive a key assigned to said requesting terminal for communication, processing means adapted to include, into a request for communication, an indication of assigned communication keys, and transmission means adapted to transmit said request for communication to a communication control functionality of a communication network.

[0018] According to favorable further developments, said terminal further comprises a communication means adapted to perform bidirectional communication with a destination, wherein said communication means is adapted to use an encryption key for sending and a decryption key for receiving of communication data to and from said destination.

[0019] According to the present invention, the above object is for example also achieved by a gateway entity of a communication network constituting an interface to another network, said gateway entity comprising receiving means adapted to receive a key assigned to a requesting terminal for communication, a communication means adapted to perform bidirectional communication with a destination, wherein said communication means is adapted to use an encryption key for sending and a decryption key for receiving of communication data to and from said requesting terminal, and a relaying means for relaying said communication data in a non-encrypted format to and from a destination located in said another network.

[0020] By virtue of the present invention, Basically the following advantages can be achieved, subscribers may no longer evade the charging and billing of the network operator/service provider; this is satisfactory for the operator/provider; subscribers may no longer have to pay for retransmitted data packets which they never perceived to have been retransmitted; this is satisfactory for the subscriber; different billing systems do not have to be implemented, e.g. for voice calls or for data transmissions; this is convenient for the operator and decreases his operational expenses for running the network.

[0021] Thus, stated in other words, according to the present invention, a DRM system is used to enable e.g. the radio connection from the terminal to network or between terminals for a meaningful use (i.e. without a valid key or pair of keys, communicated data represent mere non-sense as no decryption is possible). Nevertheless, the same may be achieved for a non-radio connection (e.g. wired connection or infrared connection) as the functionality could also be included in an Ethernet card or the like of a personal computer as a terminal device. All the data in radio interface (or whatever transmission medium used) is encoded with a key which is derived from DRM system. DRM system keeps tracks about the keys delivered to a user and can so provide data for billing purposes. There can be different keys for different purposes (e.g. valid for a certain amount of time, valid for a certain amount of data, with different QoS-capabilities, etc.).

[0022] In contrast to calculating data amounts in many places as it is done e.g. in GPRS networks, where traditionally charging is fully based on an assumption that there is an intelligence (e.g. a somewhat centralized entity) in the network which is always needed in connection establishment, the present invention enables charging with intelligent terminals while reducing operator billing operational expenses, and the network induced retransmissions do not cause any extra costs to the end-user.

[0023] In the following, the present invention will be described in greater detail with reference to the accompanying drawing, in which

[0024] The Figure shows an example of an IP based network and entities/functionalities involved in the method according to the present invention.

[0025] Embodiment I:

[0026] A first embodiment of the present invention will now be described with reference to the Figure.

[0027] The Figure shows a sketch of an IP based communication network and entities/functionalities involved in the method according to the present invention. Arrows in the Figure represent signaling/data transmitted between the entities/functionalities. Arrows are denoted by numerals representing a stage and/or step of the method. It is to be noted that a stage of the method may be composed of plural individual steps which are not indicated individually in order to keep the illustration easy for perception. Also, only those entities/functionalities are shown which are involved in the method. Thus, the network may of course comprise more entities involved in properly running the network, while these are not shown in the Figure.

[0028] Subsequently, the entities/functionalities will be described.

[0029] As shown in the Figure, terminals MS-A and MS-B are present. For the subsequent explanation, MS-A is assumed to be a communication requesting (originating) terminal, while MS-B is assumed to represent a destination for communication. Nevertheless, the situation may also be vice versa. In addition, communication may be requested from e.g. MS-A to a destination (not shown) located in another network (such as a PSTN (Public Switched Telephone Network); in such a case, communication will be accomplished via a gateway DRM-GW (to be explained later). Furthermore, a call control switch CC-SW, a DRM key management entity DRM-KM, and a billing server denoted by $$$ is involved in carrying out the method according to the present invention. The terminals MS-A, MS-B may be any terminal such as a mobile station but also a personal computer connected to a network. Also, the call control switch, basically, represents an access control element such as a session control server, or, more generally, a communication control entity. Also, a router may represent a communication control entity, e.g. in a LAN or WLAN environment.

[0030] It is to be noted that the reference to a communication control entity rather has to be understood as a reference to a communication control functionality. The functionality need not be implemented as a separate entity as shown in the Figure in connection with the first embodiment. Rather, the communication control functionality also reside in the terminal itself, as briefly to be explained in connection with the second embodiment later on. Thus, the communication control functionality need not necessarily be a call control switch CC-SW, but may equally well be a communication control software installed at the terminal, e.g. MS-A.

[0031] Though not shown in their particular individual internal constitution, it is to be noted that each of the terminals MS-A, MS-B comprises receiving means which are adapted to receive a key assigned to said terminal upon requesting for communication, processing means which are adapted to include, into a request for communication, an indication of assigned communication keys, and transmission means which are adapted to transmit said request for communication (including the assigned key) to a communication control functionality. The functionality may, if included in a call control switch, be part of the communication network. If the communication control functionality is, however, installed at the terminal, then it cooperates only with the communication network, but does not represent a part of the network as such. The terminals further comprise communication means which are adapted to perform bidirectional communication with a destination, wherein said communication means is adapted to use an encryption key for sending and a decryption key for receiving of communication data to and from said destination. It is to be noted that the communication means may also be operated in a unidirectional communication mode only, i.e. for transmission only or reception only, if required.

[0032] Furthermore, as regards the communication control functionality represented in FIG. 1 as a call control switch CC-SW as an example, this functional entity comprises receiving means adapted to receive a communication request from a terminal (e.g. MS-A), determination means adapted to determine whether said communication request contains a valid communication key for communication in said network, obtaining means responsive to said detection and adapted to obtain at least one valid key from a communication key management entity to be assigned to said requesting terminal for communication, if no such valid key is determined to be contained, and communication control means adapted to enable communication of said requesting terminal MS-A with the communication destination, e.g. MS-B, using said assigned communication key. The communication control functionality further comprises key forwarding means adapted to forward said obtained encryption key and said decryption key to said (requesting) terminal. Also, the communication control entity, more precisely, its key forwarding means, is adapted to forward at least the decryption key to the destination. Nevertheless, the decryption key may, once obtained, also be forwarded from the requesting terminal to the destination. Note that the same internal functional behavior will apply for the communication control functionality if installed at the terminal, while any involved signaling/processing will remain internally in the terminal and not visible in the network as such.

[0033] The key management entity DRM-KM of the communication network comprises a first interface, interfacing the communication control entity connectable thereto, the first interface being adapted to receive, as an input from the communication control entity, a key obtaining request for obtaining at least one valid key from the communication key management functionality, and to transmit, as an output to the communication control functionality, said at least one valid key, and a second interface, interfacing to a billing entity connectable thereto, the second interface being adapted to transmit, as an output to a billing entity, a record comprising at least the requesting terminal's identification, assigned communication keys, and usage parameters of said keys.

[0034] Furthermore, the gateway entity of the communication network constituting an interface to another network (such as a PSTN) comprises receiving means adapted to receive a key assigned to a requesting terminal for communication, a communication means adapted to perform bidirectional communication with a destination, wherein said communication means is adapted to use an encryption key for sending and a decryption key for receiving of communication data to and from said requesting terminal, and a relaying means for relaying said communication data in a non-encrypted format to and from a destination (not shown) located in said another network (not shown).

[0035] With the entities having been described so far, the method will subsequently be described in greater detail with reference to FIG. 1 and the stages/steps 1 through 6.

[0036] Stage 1):

[0037] MS-A as a requesting terminal starts a call to MS-B as a destination. Before the call can be established, the call control entity CC-SW, or more generally the communication control functionality, requests an encryption-decryption key pair from key management. Key management entity DRM-KM stores information about the key and the use case for billing purposes. Keys can be valid for a certain time, or for a certain amount of data or for a certain amount of transactions, etc., as will be set out in greater detail herein below.

[0038] Stated in other words, MS-A requests communication, CC-SW determines whether said communication request contains a valid communication key for communication in said network, and if no such valid key is contained, CC-SW obtains at least one valid key from said communication key management entity DRM-KM to be assigned to said requesting terminal MS-A for communication, whereafter there is performed communication of said requesting terminal MS-A to the communication destination (e.g. MS-B) using said assigned or previously already present communication key. (Communication is insofar enabled as, when performed using the keys, the communication partners can perform a meaningful communication as both can encrypt/decrypt the messages for/from the respective other one. Without a key, communication would be nonsense.)

[0039] In this connection, it has to be noted that transmitted data may also be only partly encrypted, for example, only every second or third frame of data transmitted by the terminal is encrypted. This reduces the required processing while anyway the receiving side cannot read the data without the corresponding decryption key.

[0040] It is further to be noted that based on the request (valid request or not) it is checked whether communication can be enabled, i.e. whether a connection can be established at all or not. This could be accomplished using a signaling as it is currently known in various scenarios such as GSM networks. Furthermore, based on a valid communication key (contained in the (valid) request or retrieved from the key management entity) communication is performed.

[0041] Stage 2):

[0042] MS-A sends the decryption key to MS-B (or to the gateway DRM-GW if the destination is a terminal in another network such as e.g. a PSTN network). Alternatively, the decryption key can be sent to the destination already by the CC-SW entity/functionality. Also, the decryption key can be chargeable if needed; in such a case B contacts to Key Management entity DRM-KM, too (stage/step 2b).

[0043] Stage 3):

[0044] All the data (e.g. voice stream or multimedia message) between terminals is encrypted/decrypted with the keys-valid for a certain period of time or for a certain amount of data, etc.

[0045] More precisely, said communication key comprises a pair of keys consisting of an encryption key for transmitting data as encrypted data and a decryption key for decrypting received encrypted data, and a respective communication key has a predetermined expiry. The expiry can but need not be defined differently for an encryption key and a decryption key.

[0046] For example, said communication key expires after a predetermined amount of data has been transmitted or received, or said communication key expires after a predetermined lifetime, the lifetime of the key being counted from the time of assigning it to the requesting terminal for use.

[0047] Also, said communication key may be defined to expire either after a predetermined amount of data has been transmitted or received, or after a predetermined lifetime.

[0048] Also, said communication key may be defined to expire only after a predetermined amount of data has been transmitted or received, and after a predetermined lifetime.

[0049] Still further, said communication key obtained depends on a type of communication requested, with types of communication being distinguished according to their quality of service QoS parameters.

[0050] Stage 4):

[0051] When a key expires, MS-A (or MS-B) can request a new one. This implies of course that an entity using an encryption/decryption key knows and/or monitors the expiry of the respective key currently used.

[0052] If a new key is not requested while the old one nevertheless expires, then the connection established could become noise, i.e. due to encryption/decryption being no longer enabled, the data transmitted on the connection can no longer be listened to but the data appear as noise to a listening terminal (and makes no longer any sense, i.e. is nonsense as the recipient does not longer understand it due to its lack of decryption capability because of no valid (decryption) key).

[0053] In such a case, the connection could still be maintained, optionally, it could however also be released (e.g. immediately upon expiry of the old key if no new key is requested, or after a predetermined period of time, for which there occurred merely noise on the connection, or dependent on any other criteria).

[0054] Stage 5):

[0055] Key management entity DRM-KM sends usage data to billing entity. The same billing can be used as with any content paying. Stated in other words, a recording of the communication keys assigned to the requesting terminal at said communication key management entity DRM-KM is effected, and the corresponding record is forwarded to a billing entity, so that billing the requesting terminal MS-A is based on a usage of the assigned keys.

[0056] Stage 6):

[0057] In another scenario, MS-A calls a simple terminal (e.g. PSTN terminal). In this case the call and/or communication is routed via the DRM gateway DRM-GW, which decrypts the flow. The gateway acts a relaying entity between the requesting terminal MS-A and the destination (not shown) in the PSTN network. Communication between the DRM-GW and the terminal MS-A is encrypted/decrypted, while communication between DRM-GW and the PSTN terminal (not shown) happens as usual, i.e. non-encrypted.

[0058] Similarly, in case a PSTN terminal requests communication to e.g. MS-A, then the gateway is adapted to exhibit terminal properties in that way that the gateway DRM-GW requests communication, CC-SW determines whether said communication request contains a valid communication key for communication in said network, and if no such valid key is contained, CC-SW obtains at least one valid key from said communication key management entity DRM-KM to be assigned to said requesting terminal DRM-GW for communication, whereafter there is performed communication of said requesting terminal DRM-GW to the communication destination (e.g. MS-A) using said assigned communication key.

[0059] Embodiment II:

[0060] Embodiment I as described herein above was mainly described with a reference to a communication network having a centralized intelligence where the communication control functionality was implemented in a network entity such as the call control switch. Such a network architecture is commonly known for e.g. cellular communication networks.

[0061] For the second embodiment, a non-cellular communication network but rather a so-called ad-hoc network is now briefly considered. Such networks may rely on using a LAN or WLAN for interconnection between terminals and thus have no cellular structure.

[0062] More precisely, consider that there is free frequency and a WLAN connection (i.e. not a cellular connection). For example in following situation, then the communication control functionality is not a separate entity but installed at the terminal.

[0063] A certain company (e.g. Nokia/ . . . ) provides for example a terminal known as game station or more generally a Multimedia Terminal enabled with WLAN access to families. The same company also provides end user terminals (e.g. phones/PDA's/ . . . ) able to communicate with the game stations over WLAN. The game stations are connected to each others over WLAN/LAN. Because an increasing number of families has or will in future have such a game station, the WLAN covering will be present in large areas of the city.

[0064] Now, people can make calls/any connections with their terminals in a way, that they perhaps already know the IP address of the terminating party, and start to send IP data from terminal over WLAN to the nearest gamestation which acts as a router and routes the IP frames to the next gamestation over WLAN (or over perhaps even LAN) and finally to the gamestation nearby the terminating terminal. Then, there is no centralized access control in network. However, it might be in the company's interest to charge for this kind of ad-hoc network connections: all the traffic from a terminal over WLAN is encrypted, and can be utilized only if having the DRM enabled pair of en-/decryption keys. So, a communication control entity CC-SW as such is not necessarily needed, but the communication control functionality can be implemented to the terminal.

[0065] In such a scenario as assumed for the second embodiment, the network does not need an access control level intelligence for charging. Rather, charging can be accomplished with the present invention being implemented. A terminal may approach the DRM system at a predetermined IP address, for example by using a predetermined key.

[0066] Also, for example, a terminal A may send a message to the IP address of a DRM system by broadcasting it over WLAN. Terminals D and E then take the message and broadcast it further to terminals F and G, for example. Finally, the message reaches the DRM system which in response thereto broadcasts the key back to terminal A.

[0067] Thus, in a WLAN scenario, the present invention is equally well applicable and in such situation, the communication control functionality resides in the terminal.

[0068] Modification to the Embodiments:

[0069] Furthermore, even though herein above different keys have been mentioned for e.g. different QoS, in a further modification it need not be different keys to be assigned. Rather, differences between functionalities (such as different QoS implemented) can be implemented by the help of different kind of rights which are attached as an attribute to the key as such. In other aspects, the invention will not differ from what has been disclosed herein before.

[0070] Furthermore, even though the present invention will in most cases be implemented as a programmed implementation, it is of course to be understood that it may be implemented as hardware within a terminal, e.g. in a separate tamper resistant device.

[0071] Accordingly, as has been described herein before, the present invention concerns a method for communication control in a communication network between a terminal (MS-A) originating communication and a communication destination (MS-B, DRM-GW), the communication network comprising at least one communication control entity (CC-SW), and a communication key management entity (DRM-KM), the method comprising the steps of: requesting communication by said terminal (A), determining at said at least one communication control entity (CC-SW) whether said communication request contains a valid communication key for communication in said network, and if no such valid key is contained, obtaining at least one valid key from said communication key management entity (DRM-KM) to be assigned to said requesting terminal (MS-A) for communication, performing communication of said requesting terminal (MS-A) to the communication destination using said communication key. Also, correspondingly adapted entities are subject of the present invention.

[0072] While the invention has been described with reference to a preferred embodiment, the description is illustrative of the invention and is not to be construed as limiting the invention. Various modifications and applications may occur to those skilled in the art without departing from the true spirit and scope of the invention as defined by the appended claims.