The present invention relates to a method for using services of a mobile packet core network in a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network, whereby the mobile device accesses the mobile packet core network via the wireless radio access network.

The present invention further relates to an entity of a mobile packet core network of a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network, to which the mobile device can establish a secure tunnel connection. The entity is designed to be employed in a method according to the invention.

Another object of the present invention is a mobile device in a communication system comprising the mobile device, a core network, a mobile packet core network and a wireless radio access network. The mobile device comprising means for accessing the wireless radio access network and is designed to be employed in a method according to the invention.

Another object of the present invention is an entity of a communication system comprising a mobile device, a core network, a mobile packet core network and a wireless radio access network. The entity is designed to be employed in a method according to the invention.

Another object of the present invention is a provisioning system of a mobile packet core network of a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network. The provisioning system is designed to be employed in a method according to the invention. In view of the growth of mobile network traffic, it has been considered to provide the possibility to use mobile data over a wireless radio access network, for example a Wi-Fi technology, as an additional radio access network. In this approach, the existing infrastructure of a mobile packet core network is used to a large extent. However, also security within the communication system comprising a mobile device, a core network, a mobile packet core network and a wireless radio access network should not be decreased, when Wi-Fi access networks are used. Especially there is a need for a solution allowing a secure access to core services of a mobile packet core network and also respectively a secure access to the internet.

In this respect, it has already been proposed to provide authentication methods, such as EAP-SIM / AKA, WPA2 and so called IPsec tunnels for Wi-Fi access to a mobile packet core network, which is also referred to as Mobile Operator Network (MON). Whereas the identification of the person of the user of the communication network may be considered in such approaches, for example by means of using the MSISDN (MSISDN: Mobile Subscriber Integrated Services Digital Network) and/or the IMSI (IMSI: International Mobile Subscriber Identity) representing the subscriber identification, the overall security remains flawed. In particular, the authorization of a mobile device to be used in a communication system cannot be monitored or denied in such approaches.

To classify available scenarios how a mobile device could connect via a wireless radio access network, for example a Wi-Fi, to the mobile packet core network it is to distinguish between a trusted Wi-Fi access and an untrusted Wi-Fi access. For both scenarios (trusted Wi-Fi access and untrusted Wi-Fi access) solutions are available in the standards.

The standard based solution to connect a trusted Wi-Fi access whereby the Wi-Fi air interface and Wi-Fi transport are secure, to the mobile packet core network could be supported via available nodes of the communication system, for example via TWGs (TWG: Trusted Wireless Gateway) connected to the PDN (PDN: Packet Data Network) via PGW in 4G networks or via a similar node/function in 3G networks connected to the GGSN (GGSN: Gateway GPRS (GPRS: general packet radio service) Support Node). In this case all functions in the mobile packet core network could be reused including the availability to offer core services of the mobile packet core network to customers respectively subscribers of the MNO as users. In this case the user plane traffic will be routed via the traffic management function based on the MSISDN of the customer to the core service function in the Gi LAN. The architecture is for example disclosed with 3GPP TR 23.852 for trusted networks only or 3GPP TS 23.402 for non-3GPP accesses.

Similar functions have been standardized in 3GPP for an untrusted Wi-Fi access, for example public Wi-Fi in a coffee shop or the like. In this case an IPsec tunnel from the mobile device towards the mobile packet core network will be established. With this solution all services of an MNO including core services could be offered to a customer as the authentication will be done by MSISDN or IMSI. Architecture for this approach is for example disclosed with 3GPP TS 23.402 or for 3G networks with 3GPP TS 23.234.

Core services of a mobile packet core network of an MNO (Mobile Network Operator) for example offer customers respectively subscribers secure internet access, especially a virus scanner or anti-malware, particularly when such services are booked or subscribed by the customers. In such cases the traffic management function of the mobile packet core network routes the traffic from customers which have booked the service in that case towards the respective function (for example virus scanner or anti-malware) in the mobile packet core network of the MNO. The identification of the customer is based in the MSISDN or the IMSI (IMSI : International Mobile Subscriber Identity). Both, the MSISDN and the IMSI, are available during the registration process of a mobile device which is usable in a mobile packet core network in the mobile packet core network, but this might be different in some cases if the mobile device will be connected to the mobile packet core network via a wireless radio access network, for example via Wi-Fi, especially since the impact on the mobile device is limited.

In view of this state of the art, it is the object of the present invention to provide a solution which allows customers respectively subscribers with a mobile device, especially customers with legacy 2G, 3G or 4G devices having also Wi-Fi capabilities and customers with Wi-Fi only devices, to use a wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network, especially core services of the mobile packet core network such as a virus scanner or anti-malware. As technical solution the invention proposes a method for using services of a mobile packet core network in a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network, whereby the mobile device accesses the mobile packet core network via the wireless radio access network, characterized in that the mobile device during setup of a connection of the mobile device to the wireless radio access network determines whether the wireless radio access network is a trustworthy wireless radio access network, and at least if the wireless radio access network is not trustworthy establishes a secure tunnel connection to an entity of the mobile packet core network for triggering a usage of a service of the mobile packet core network by an authentication entity of the mobile packet core network by using a certificate or credentials like a MSISDN and/or a IMSI stored within the mobile device as credential towards the entity.

The communication system according to the present invention comprises a mobile device, a core network, a mobile packet core network and a wireless radio access network.

The mobile device can be a mobile phone, smart phone, tablet or any other mobile communication terminal capable of connecting to a wireless radio access network. The mobile device may also be referred to as user equipment (UE), mobile terminal or mobile station (MS). In particular the mobile device could support a no classic mobile radio access capability, for example Wi-Fi only, or is a mobile communication terminal of the mobile packet core network. The later the mobile device is capable of connecting to the mobile packet core network also via radio access networks which are different from the wireless radio access networks, which are for example GRAN, GERAN, UTRAN or E-UTRAN. Thus present invention supports mobile devices with a SIM (SIM: Subscriber Identity Module) or an USIM (USIM: Universal SIM) and also mobile devices without a SIM or an USIM, for example an iPad or the like with Wi-Fi only.

The core network is preferably a packet switched PS domain network. Via the core network, the mobile device can access for example the Internet.

The mobile packet core network is also referred to as the MNO network. The mobile packet core network can in particular be 2G, 3G, and/or LTE networks according to the 3GPP standards. The mobile packet core network comprises entities such as data bases, for example Home Location Register (HLR), Home Subscriber Server (HSS), Visitor Location Register (VLR), Equipment Identity Register (EIR) as well as service entities such the Mobile Switching Centre (MSC), Short Message Service Centre (SMSC) and an Authentication, Authorization and Accounting Server (AAA server). The AAA server will hereinafter also simply be referred to as AAA.

The wireless radio access network is a radio access network for access to the mobile packet core network. It should be noted that this radio access network hereinafter will be referred to as wireless radio access network in order to distinguish it from other radio access networks which may be used by the mobile device to access the mobile packet core network. The wireless radio access network can in particular be a wireless local area network (WLAN) and most preferably a Wi-Fi (Wireless Fidelity) network. The Wi-Fi network is in particular a network governed by the protocol IEEE 802.1 1 which defines the communication in this network. A further embodiment of the present invention suggests to use Bluetooth, a wireless technology standard for exchanging data over short distances, as the wireless radio access network for access to the mobile packet core network.

In the communication system according to the invention, wireless radio access technology is thus combined with the communication via mobile packet core network for accessing the core network, for example for retrieving content from the internet.

According to the present invention the determination of the trustworthiness of the wireless radio access network on side of the mobile device comprises a comparison of an identifier respectively identification used to signal the wireless radio access network to the mobile device with an identifier respectively identification of a wireless radio access network stored in a list within the mobile device. A preferred embodiment of the present invention is characterized in that the identifier respectively identification signaled to the mobile device is the SSID (SSID: Service Set Identifier) of the wireless radio access network and the identifier respectively identification stored in the list within the mobile device is a SSID of a wireless radio access network. Another advantageous embodiment of the present invention suggests, that the trustworthiness of the wireless radio access network is determined by an application, preferably by an ANDSF (ANDSF: Access Network Discovery and Selection Function) application, running on side of the mobile device.

In a further embodiment of the present invention the secure tunnel connection to an entity of the mobile packet core network, preferably a VPN Server (VPN: Virtual Private Network) is established by an application, preferably a VPN application, running on side of the mobile device. According to a further embodiment of the present invention the application establishing the secure tunnel connection to an entity of the mobile packet core network is started by the application determining the trustworthiness of the wireless radio access network, if the wireless radio access network is not trustworthy.

In a preferred embodiment of the present invention the application (ANDSF application) is an ANDSF Client which is be able to retrieve a certificate or credentials from an ANDSF server, able to manage the certificate or credentials on the mobile device and/or be capable to start the VPN application, especially a VPN client, on the mobile device when the identifier respectively identification used to signal the wireless radio access network to the mobile device, preferably the SSID, is considered to be an untrusted one. The VPN application, especially a VPN client is preferably previously installed or downloaded to the mobile device.

A further embodiment of the present invention suggests that the application determining the trustworthiness of the wireless radio access network and the application establishing the secure tunnel connection to an entity of the mobile packet core network are combined in a single application running on side of the mobile device. The combination of both applications (the application determining the trustworthiness of the wireless radio access network and the application establishing the secure tunnel connection to an entity of the mobile packet core network) in a single application is not necessary for the present invention but a possible embodiment.

A further advantageous embodiment of the present invention is characterized in that the entity of the mobile packet core network, preferably a VPN Server or a TTG (TTG: Tunnel Terminating Gateway) or an ePDG (ePDG: evolved Packed Data Gateway), to which the mobile device established a secure tunnel connection uses the certificate stored within the mobile device to establish a secure connection to the mobile packet core network. The certificate retrieve a MSISDN (MSISDN: Mobile Subscriber Integrated Services Digital Network) respectively a virtual MSISDN (vMSISDN) and/or an IMSI (IMSI : International Mobile Subscriber Identity) respectively a virtual IMSI (vIMSI) allocated to the user of the mobile device (UE) out of a database (DB) of the communication system. The certificate or credentials were individually created based on a MSISDN respectively a virtual MSISDN (vMSISDN) and/or an IMSI respectively a virtual IMSI (vIMSI). The relation between the certificate and a MSISDN respectively a virtual MSISDN (vMSISDN) and/or an IMSI respectively a virtual IMSI (vIMSI) is located in the database (DB) of the communication system.

A vMSISDN and/or a vIMSI is advantageously usable when the mobile device does not have a SIM (SIM: Subscriber Identity Module) respectively USIM (USIM: Universal SIM) and/or if the mobile device can access the communication system only via a wireless radio access network, preferably is a wireless-radio-access- network-only (Wi-Fi-only) device. Thus providing a vMSISDN and/or a vIMSI allows a mobile device access to the mobile packet core network via the wireless radio access network, even when the mobile device is a wireless-radio-access- network-only device. Advantageously there is no limitation for e. g. Gi-LAN services using the vMSISDN and/or the vIMSI in comparison to MSISDN and/or IMSI. Thus it is possible to use the vMSISDN and/or the vIMSI in case of untrusted networks. For this a client on the mobile device might need to be modified.

A virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) according to the present invention is a piece of information or an identifier with a data format or structure similar to a MSISDN for a vMSISDN or an IMSI for a vIMSI. The virtual MSISDN (vMSISDN) and/or the virtual IMSI (vIMSI) provided are designed to use services of the mobile packet core network without having to use a SIM or USIM with a mobile device. Advantageously the virtual MSISDN (vMSISDN) and/or the virtual IMSI (vIMSI) works inside the mobile network environment or if the mobile device is changed to support this. For this the virtual MSISDN (vMSISDN) and/or the virtual IMSI (vIMSI) is advantageously stored and provided within the mobile packet core network and/or the mobile device. Thus with a virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) according to the present invention advantageously services could be offered as with a standard MSISDN and/or IMSI. The services offered are preferably based on a profile stored in the mobile packet core network, for example in the HLR or the HSS. The services advantageously comprise charging services and/or authentication services of the mobile packet core network. With that, the proposed solution using a virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) advantageously allows the usage of other wireless or wired technologies, for example Bluetooth or Ethernet, for accessing the mobile packet core network with a mobile device. A further preferred embodiment of the present invention suggest the usage of a Wi-Fi- or IP- webcam as a mobile device without a SIM/USIM (also called SIM-less device or USIM-less device). The Wi-Fi- or IP-webcam gets a vMSISDN and/or a vIMSI and can then use services of the mobile packet core network. For example in case of a movement in the area of the Wi-Fi- or IP-webcam for signaling the movement or the like.

The database (DB) is advantageously designed to store the relation between MSISDN respectively vMSISDN, IMSI respectively vIMSI and the created respectively generated certificate. In a further embodiment of the present invention the database (DB) gets requests from the entity of the mobile packet core network, preferably the VPN Server or a TTG (TTG: Tunnel Terminating Gateway) or an ePDG (ePDG: evolved Packed Data Gateway), to identify the MSISDN respectively vMSISDN and/or IMSI respectively vIMSI for a specific user identified by the specific user certificate or credentials. For the usage of TTG or ePDG it is advantageously supposed to use a TTG client or ePDG client on a Wi-Fi only device. With that the solution according to the present invention could be independent from the VPN client.

The present invention further suggests that the entity (VPN Server, TTG node ePDG node) of the mobile packet core network passes the retrieved certificate or credentials to the database to retrieve the MSISDN respectively vMSISDN and/or IMSI respectively vIMSI for authentication of the user towards the authentication entity (AAA) of the mobile packet core network, which uses the MSISDN respectively vMSISDN and/or IMSI respectively vIMSI for triggering a usage of a service of the mobile packet core network.

In another embodiment of the present invention an entity, preferably an ANDSF Server, of the communication system creates respectively generates the certificate or credentials preferably as a user specific certificate out of the MSISDN respectively the vMSISDN and/or the IMSI respectively vIMSI allocated to the user of the mobile device and stores at least the created certificate or credentials in a database of the communication system, preferably together with the MSISDN respectively the vMSISDN and/or the IMSI respectively vIMSI allocated to the user of the mobile device. A further embodiment is characterized in that the entity (e.g. ANDSF Server) of the communication system sends the certificate or credentials to the mobile device, preferably to the application (ANDSF application) running on side of the mobile device for determining the trustworthiness of the wireless radio access network, and stores the certificate by the mobile device, preferably within the application (e.g. VPN application) running on side of the mobile device for establishing the secure tunnel connection. In case of an application supporting e.g. TTG or ePDG it is supposed that on a no classic mobile radio access capability device (e.g. Wi-Fi only device) the ANDSF Server could send the required credentials to establish a secure connection towards the mobile packet core network to the application.

Advantageously the certificate or credentials (required credentials) are stored securely within the mobile device without any access by the user or other applications without approved once from the operator.

A further preferred embodiment of the present invention is characterized in that a provisioning system of the mobile packet core network generates a virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) if the mobile device does not have a SIM (SIM: Subscriber Identity module) respectively USIM (Universal SIM) and/or if the mobile device can access the communication system only via a wireless radio access network (Wi-Fi), preferably is a wireless-radio-access- network-only (Wi-Fi-only) device, and reports the generated virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) to the entity (preferably an ANDSF Server) of the communication system creating the certificate.

As technical solution of the initially mentioned problems the present invention furthermore proposes an entity, preferably a VPN Server, of a mobile packet core network of a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network (Wi-Fi), to which the mobile device can establish a secure tunnel connection, characterized in that the entity (e.g. VPN Server) comprising means for receiving a certificate or credentials from the mobile device, which certificate is stored within the mobile device as credential, means for retrieving a MSISDN respectively a virtual MSISDN (vMSISDN) and/or an IMSI respectively a virtual IMSI (vIMSI) allocated to a user of the mobile device out of a database of the communication system by use of the received certificate, and means for passing the retrieved MSISDN respectively virtual MSISDN (vMSISDN) and/or IMSI virtual IMSI (vIMSI) to an authentication entity (AAA) of the mobile packet core network for triggering a usage of a service of the mobile packet core network with the mobile device.

The activities of the entity (VPN server) finish after authentication of the certificate or credentials. Then the user of the mobile device has access to the IP network behind the entity (VPN server). Preferably the entity (VPN server) has to request the MSISDN respectively vMSISDN and/or IMSI respectively vIMSI from the database of the communication system based on the certificate or credentials send from the mobile device. After that the entity (VPN server) preferably sends an authentication request to the authentication entity, preferably an AAA server with the MSISDN respectively vMSISDN and/or the IMSI respectively vIMSI. If the HLR/HSS via the AAA confirms that this is a customer of the MNO it gives access to the WLAN Proxy, e.g. the TWG or the equivalent function in UMTS networks, which then starts the standard process, especially for connecting to the internet.

The entity (e.g. VPN Server) is advantageously designed to be employed in a method according to the present invention.

As technical solution of the initially mentioned problems the present invention furthermore proposes a mobile device in a communication system comprising the mobile device, a core network, a mobile packet core network and a wireless radio access network (Wi-Fi), the mobile device comprising means for accessing the wireless radio access network (Wi-Fi), characterized in that the mobile device further comprising means for determining whether the wireless radio access network (Wi-Fi) is a trustworthy wireless radio access network (Wi-Fi), and means for establishing a secure tunnel connection to an entity (e.g. VPN Server) of the mobile packet core network for triggering a usage of a service of the mobile packet core network by an authentication entity (AAA) of the mobile packet core network by using a certificate or credentials stored within the mobile device as credential towards the entity (e.g. VPN Server) at least if the wireless radio access network (Wi-Fi) is not trustworthy.

The mobile device is advantageously designed to be employed in a method according to the present invention. As technical solution of the initially mentioned problems the present invention furthermore proposes an entity, preferably an ANDSF Server, of a communication system comprising a mobile device, a core network, a mobile packet core network and a wireless radio access network (Wi-Fi), characterized in that the entity (ANDSF Server) comprising means for creating a certificate or credentials, preferably as a user specific certificate, out of a MSISDN respectively a virtual MSISDN (vMSISDN) and/or an IMSI respectively a virtual IMSI (vIMSI) allocated to the user of the mobile device and means for storing at least the created certificate or credentials in a database of the communication system, preferably together with the MSISDN respectively the virtual MSISDN (vMSISDN) and/or the IMSI respectively the virtual IMSI (vIMSI) allocated to the user of the mobile device.

In a further embodiment of the present invention the entity (preferably an ANDSF Server) further comprising means for sending the certificate or credentials to the mobile device, preferably to an application (ANDSF application) running on side of the mobile device for determining the trustworthiness of the wireless radio access network (Wi-Fi), and means for storing the certificate or credentials by the mobile device, preferably within an application (VPN application) running on side of the mobile device for establishing a secure tunnel connection.

The entity (ANDSF Server) is preferably designed as a node respectively function in the core network. The entity (ANDSF server) preferably creates respectively generates a user specific certificate or credentials when getting MSISDN respectively vMSISDN and/or IMSI respectively vIMSI for example from a provisioning system respectively provisioning tool. Further the entity (ANDSF server) preferably is extended with a specific database (DB) to store the certificate or credentials and MSISDN respectively vMSISDN, IMSI respectively vIMSI relation. Furthermore the entity (ANDSF server) is advantageously able to send the user specific certificate to the mobile device.

The entity (ANDSF Server) is advantageously designed to be employed in a method according to the present invention.

As technical solution of the initially mentioned problems the present invention furthermore proposes a provisioning system respectively provisioning tool of a mobile packet core network of a communication system comprising a mobile device, a core network, the mobile packet core network and a wireless radio access network (Wi-Fi), characterized in that the provisioning system of the mobile packet core network comprising means for generating a virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) if the mobile device does not have a SIM respectively USIM and/or if the mobile device can access the communication system only via a wireless radio access network (Wi-Fi), preferably is a wireless- radio-access-network-only (Wi-Fi-only) device, and reports the generated virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) to an entity (ANDSF Server) of the communication system creating a user specific certificate or credentials related to the MSISDN respectively vMSISDN and/or IMSI respectively vIMSI.

Advantageously the provisioning system respectively provisioning tool provides an interface to send user information, preferably MSISDN respectively vMSISDN and/or IMSI respectively vIMSI, to the e.g. ANDSF server. In a preferred embodiment the provisioning system respectively provisioning tool creates respectively generates a virtual MSISDN (vMSISDN) and/or a virtual IMSI (vIMSI) for devices without SIM respectively USIM, for example a WLAN-only tablet or the like.

The provisioning system respectively provisioning tool is advantageously designed to be employed in a method according to the present invention.

Other details, characteristics and advantages of the invention will be explained in detail in the following by means of the exemplary embodiments represented in the figures of the drawings. Herein:

Fig. 1 is a schematic diagram of entities of a communications system used in a first embodiment according to the present invention for using a wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network;

Fig. 2 is an information flow of an example for using a wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network according to the present invention with the communications system according to Fig. 1 ; Fig. 3 is a schematic diagram of entities of a communications system used in a second embodiment according to the present invention for using a wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network; and

Fig. 4 is an information flow of an example for using a wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network according to the present invention with the communications system according to Fig. 3.

In the Fig. 1 to Fig. 4 only those entities of the communication system which are being used for the method according to the present invention and which play a major role in carrying out the method according to the present invention are depicted. Further entities will be present and may be used. As the communication in such a communication system is known these additional entities are not specifically shown or mentioned. In addition, for sake of clarity, only one mobile device UE is shown in the figures, it is, however, obvious that several mobile devices UE may be part of the communication network.

A user of a mobile device UE is customer respectively subscriber of services, especially core services, offered by a MNO in a mobile packet core network, in particular a 2G, 3G and/or LTE network. The mobile device UE can access a wireless radio access network, in particular a Wi-Fi network with its Wi-Fi access points. For using such core services of a mobile packet core network of an MNO, in particular for an e.g. secure internet access, especially via an e.g. virus scanner or anti-malware, the customer has to book such services. In particular the user of the mobile device UE books such core service and wishes to use these core services also via the wireless radio access network, in particular the Wi-Fi network, irrespective of whether or not the wireless radio access network is a trusted or untrusted wireless radio access network. Such booking of services of the MNO is done in advance the method according to the present invention via a e.g. provisioning system respectively provisioning tool or a GUI (GUI : Graphical User Interface) provided by the mobile packet core network of the MNO. The provisioning system respectively provisioning tool reports the MSISDN and/or IMSI of the customer respectively subscriber to an entity of the communication system, presently to an ANDSF server. If the customer respectively subscriber does not have or use a SIM or a USIM, the provisioning system respectively tool will generate a virtual MSISDN and/or a virtual IMSI, especially, when the customer respectively subscriber uses a Wi-Fi-only device or a SIM-less/USIM-less device.

In case no TTG or ePDG support to the mobile device and in the mobile packet core network the entity (ANDSF Server) creates respectively generates a user specific certificate and associates it with the given MSISDN/IMSI respectively vMSISDN/vlMSI and stores all tine information in a database DB for further use.

For using an untrusted wireless radio access network, especially Wi-Fi, as access towards the mobile packet core network for using services of the mobile packet core network the user downloads an ANDSF application and a VPN application to his mobile device, for example from a corresponding app store or the like, and registers the applications towards the MNO network.

The ANDSF Server sends the user specific certificate to the downloaded ANDSF application on the mobile device. The ANDSF application then stores the user specific certificate preferably securely in the VPN client.

With that the provisioning for using a wireless radio access network, especially Wi- Fi, as access towards the mobile packet core network for using services of the mobile packet core network according to the present invention is finished respectively completed.

The user then, especially later, starts a session in a wireless radio access network, especially a Wi-Fi session, in an untrusted environment for example in a coffee shop or the like. The user respectively the mobile device of the user registers to the untrusted wireless radio access network (untrusted Wi-Fi) for example via a portal, for example with an user name and a password he got from the owner or operator of the wireless radio access network Wi-Fi. With that the mobile device UE receives an identifier respectively identification used to signal the wireless radio access network Wi-Fi to the mobile device (UE) with an identifier respectively identification of a wireless radio access network Wi-Fi stored in a list within the mobile device (UE), especially the ANDSF application. Presently the SSID of the Wi-Fi is used as identifier respectively identification. When the SSID of the wireless radio access network (untrusted Wi-Fi) is not part of the trusted SSID lists stored in the ANDSF application the ANDSF application on the mobile device UE starts the VPN application on the mobile device UE. The VPN application running on side of the mobile device UE then establishes a secure tunnel using the user specific certificate as credential towards a VPN server of the mobile packet core network.

The VPN Server of the mobile packet core network will use the user specific certificate to retrieve the user's MSISDN/IMSI respectively vMSISDN/vlMSI from the database DB of the communication system. The VPN server then passes the user's MSISDN/IMSI respectively vMSISDN/vlMSI to an authentication entity, for example an AAA server (AAA: authentication, authorization and accounting) of the mobile packet core network, which will trigger the authentication request to the HLR/HSS. If the HLR/HSS confirms then the AAA server will trigger the 3GPP connection. The remain of the flow then is standard.

The information flow of the method according to the present invention comprises according to Fig. 2 the following steps: a) User/subscriber subscribes to service via provisioning system; b) provisioning system will pass MSISDN/IMSI information to ANDSF. If user/subscriber does not have a SIM/USIM, provisioning system will generate a virtual vMSISDN/vlMSI ; c) ANDSF generates certificate and stores the pair of certificate and MSISDN/IMSI or vMSISDN/vlMSI in a database DB of the communication system; d) user/subscriber install ANDSF client and retrieves it's certificate and ANDSF policies; e) when user/subscriber is in a Wi-Fi network not considered trusted, the mobile device UE of the user/subscriber will establish a secure VPN connection to the VPN concentrator using the certificate as credential; f) the VPN concentrator will use the certificate to retrieve the user's MSISDN/IMSI respectively vMSISDN/vlMSI ; g) the VPN concentrator passes this information to AAA; h) AAA will confirm user/subscriber via a standard request to the HLR/HSS; i) the AAA server will trigger the 3GPP connection; j) remain of the flow is standard.

In case TTG or ePDG will be support on the mobile device (which is not supporting classic mobile radio access capability but only e.g. Wi-Fi) and in the mobile packet core. In this case the entity (e.g. ANDSF Server) creates respectively generates user specific credentials and associates it with the given vMSISDN/vlMSI and stores all tine information in a database DB for further use. Note that the device does not have SIM/USIM capabilities in this case.

The server sends the user specific credentials to the downloaded application e.g. ANDSF on the mobile device. The ANDSF application then stores the user specific credentials preferably securely in the TTG or ePDG client.

With that the provisioning for using a wireless radio access network, especially Wi- Fi, as access towards the mobile packet core network for using services of the mobile packet core network according to the present invention is finished respectively completed.

The user then, especially later, starts a session in a wireless radio access network, especially a Wi-Fi session, in an untrusted environment for example in a coffee shop or the like. The user respectively the mobile device (e.g. Wi-Fi only) of the user registers to the untrusted wireless radio access network (untrusted Wi-Fi) for example via a portal, for example with an user name and a password he got from the owner or operator of the wireless radio access network Wi-Fi. With that the mobile device UE receives an identifier respectively identification used to signal the wireless radio access network Wi-Fi to the mobile device (UE) with an identifier respectively identification of a wireless radio access network Wi-Fi stored in a list within the mobile device (UE), especially the ANDSF application.

Presently the SSID of the Wi-Fi could be used as identifier respectively identification. When the SSID of the wireless radio access network (untrusted Wi- Fi) is not part of the trusted SSID lists stored in the ANDSF application the ANDSF application on the mobile device UE starts the TTG or ePDG application on the mobile device (e.g. Wi-Fi only). The TTG or ePDG application running on side of the mobile device then establishes a secure tunnel using the user specific credentials towards a TTG or ePDG server of the mobile packet core network.

The TTG or ePDG Server of the mobile packet core network will use the user specific credentials to retrieve the user's vMSISDN/vlMSI from the database DB of the communication system. The TTG or ePDG server then passes the user's vMSISDN/vlMSI to an authentication entity AAA (AAA: authentication, authorization and accounting), for example an AAA Server of the mobile packet core network, which will trigger the authentication request to the HLR/HSS. If HLR/HSS confirms then AAA server passes the confirmation to the TTG or ePDG server which initiates the 3GPP connection. The remain of the flow then is standard.

The information flow of the method according to the present invention comprises according to Fig. 4 the following steps: a) User/subscriber subscribes to service via provisioning system; b) provisioning system will pass MSISDN/IMSI information to ANDSF. If subscriber does not have a SIM/USIM card, provisioning system will generate a virtual vMSISDN/vlMSI ; c) ANDSF or related systems generates credentials and stores the pair credentials and MSISDN/IMSI respectively vMSISDN/vlMSI in a database DB; d) user/subscriber install ANDSF client and retrieves it's credentials and ANDSF policies; e) when user is in a Wi-Fi network not considered trusted, the device will establish a secure tunnel connection to the TTG/ePDG function using the credentials; f) TTG/ePDG function will use the credentials to retrieve user's MSISDN/IMSI respectively vMSISDN/vlMSI; g) TTG/ePDG function passes this information to AAA; h) AAA will confirm user/subscriber via a standard request to the HLR/HSS; i) TTG/ePDG function will trigger the 3GPP connection; j) remain of the flow is standard

The exemplary embodiments of the invention represented in the figures of the drawings and described in connection with these one only serve for explaining the invention and are not limiting for this one.

List of reference numerals:

UE/MS mobile device (mobile phone, smart phone, tablet or any other mobile communication terminal capable of connecting to a wireless radio access network)

Wi-Fi wireless radio access network VPN Virtual Private Network

AAA Authentication, Authorization and Accounting