1. Jun Wang (jwang@qualcomm.com)jwang@qualcomm.com Anand Palanigounder (apg@qualcomm.com)apg@qualcomm.com Peerapol Tinnakornsrisuphap (peerapol@qualcomm.com)peerapol@qualcomm.com George Cherian (gcherian@qualcomm.com)gcherian@qualcomm.com Chandru Sundarraman (chandru@qualcomm.com)chandru@qualcomm.com June 09, 2009 QUALCOMM Inc. Page 1 Femto Access Control Notice © 2009. All rights reserved. The contributors grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner ’ s name any Organizational Partner ’ s standards publication even though it may include all or portions of this contribution; and at the Organizational Partner ’ s sole discretion to permit others to reproduce in whole or in part such contribution or the resulting Organizational Partner ’ s standards publication. The contributors are also willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions for purpose of practicing an Organizational Partner ’ s standard which incorporates this contribution. This document has been prepared by the contributors to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on the contributors. The contributors specifically reserves the right to amend or modify the material contained herein and nothing herein shall be construed as conferring or offering licenses or rights with respect to any intellectual property of the contributors other than provided in the copyright statement above.

2. FAP Access Control 2 What is FAP Access Control? Allow only mobiles that are part of the Access Control List (ACL) for a FAP to access services through that FAP (aka Closed Subscriber Group or CSG in 3GPP) Types of Associations in 3GPP2 – Open Association: Any mobile can register with the FAP and access services – Restricted Association: Only mobiles in the access control list for a given FAP allowed to register and access service. Any other mobile NOT allowed any type of association. – Signaling Association: Any mobile can register with FAP, but during service access mobile may be redirected to macro, if it’s not in the FAP ACL (i.e., mobile is not authorized to access service through the restricted FAP) Problem(s): Which network entity decides whether a mobile is allowed to access through FAP? Which network entity enforce sthe ACL policy and how to enforce the policy? How does the FAP know its types ? This presentation focuses on the network aspects of ACL Page 2

3. HRPD/1x Packet Femto Architecture Update Page 3

4. HRPD/1x Packet Femto Control Access Design Page 4 Femto-AAA or FMS stores FAP type and access control list FAP is served as the first level of enforcement point (EP) PDSN is the second level of Enforcement Point After successful FAP authentication and authorization, the FAP can access femto-AAA/FMS through SeGW to request FAP type and access control list Access control list for 1xPS services should use user’s MSID Each FAP is associated with a list of allowed MSIDs (as part of the FAP profile in Femto- AAA) Access control list for HRPD PS services can use Option 1: User’s NAI (Recommended Option) Option 2: User’s MSID Each FAP associated with a list of allowed MSIDs or User’s NAIs (as part of the FAP profile in Femto-AAA/FMS)

5. SIP Based 1x CS Femto Architecture Update Page 5

6. SIP Based 1x CS Femto Control Access Design Page 6 Femto-AAA or FMS stores FAP type and associated Access Control List FAP is the first level of Enforcement Point Upon the FAP authentication and authorization successful, the FAP can access femto- AAA or FMS through SeGW to request FAP type and optional ACL For enterprise FAP, the ACL may not be returned if ACL is too long FCS is the second level of Enforcement Point The FCS obtains FAP types and Access Control List from femto AAA/FMS FCS requests the access control list from femto-AAA/FMS using format of FEID@realm after SIP registration is successful Access control list for 1x CS services should use mobile’s CS service identity (MSID) Each FAP associated with a list of allowed MSIDs (as part of the 1x FAP profile in femto-AAA) MSID can be either IMSI or MIN

7. Procedure for FAP as an Enforcement Point Page 7 If the type is the open association: No special procedure for FAP There is no ACL If the type is the restricted association : FAP only allows the MS in ACL to access the system 1x FAP rejects the RGM/ORM/PRM (or any air interface signaling) if the MS is not in the ACL HRPD FAP rejects the HRPD session negotiation if the MS is not in the ACL If the type is the signaling association: FAP allows all the MS to send signaling to the system 1x FAP accepts the RGM/ORM/PRM (or any air interface signaling): If the MS is not in the ACL, the FAP may redirect the MS to the Macro BS when the MS is establishing the call HRPD FAP accepts the HRPD session negotiation with the MS If the MS is not in the ACL, the FAP may redirect the MS to the Macro BS when the MS is establishing the data call

8. Procedures for FCS as an Enforcement Point Page 8 FCS is aware of the associated FAP’s types and ACL If the associated FAP type is the open association : No special procedure in FCS If the associated type is the restricted association : FCS only allows the MS in ACL to access the system FCS rejects the MS registration (and other SIP signaling such as SIP Invite etc) if the MS is not listed in the ACL If the associated type is the signaling association: FCS allows all the MS to send SIP signaling to the system FCS accepts the MS registration/MS Origination: If the MS is not in the ACL, the FCS may redirect the MS to the Macro BS when the MS is establishing the call

9. Procedures for PDSN as an EP and for AAA as Storage Point (1) If the associated FAP type is the open association: No special procedure in PDSN and the HAAA If the associated type is the restricted association: Option 1: Allows PPP to be established (since the MS still can be authenticated). The HAAA indicates to the PDSN that the MS is not in ACL for the FEID. The PDSN moves A10 to the macro BS and release the A10 to the FAP by indicating the FAP that the MS is not in ACL The PDSN can indicate to the MS through PPP VSP, and/or The FAP can redirect the MS to the macro by indicating the reason. For HRPD, the FAP will tear down the HRPD session Option 2: Does not allow the PPP to be established. The HAAA indicates to the PDSN that the MS is not in ACL for the FEID. The PDSN release the A10 to the FAP by indicating the FAP that the MS is not in ACL The PDSN sends LCP termination request to the MS and indicate to the MS through either PPP VSP or LCP termination option, and/or The FAP can redirect the MS to the macro by indicating the reason. For HRPD, the FAP will tear down the HRPD session Option 3: Option 2 + return ACL to the PDSN so that the PDSN does not need to go to HAAA for PPP authentication for other MSs which is not in ACL Page 9

10. Procedures for PDSN as an EP and for AAA as Storage Point (2) If the associated type is the signaling association: Option 1: Allows PPP to be established (since the MS still can be authenticated). The HAAA indicates to the PDSN that the MS is not in ACL for the FEID. When the data is received, the PDSN may send limited data to the FAP and indicate the FAP that the MS is not in ACL through A11 signaling. The PDSN buffers the rest of the data until the Macro AN setup A10 with the PDSN. The PDSN then release the A10 to the FAP. The PDSN can notify to the MS through PPP VSP, and/or The FAP can redirect the MS to the macro by indicating the reason. Option 2: Allows PPP to be established (since the MS still can be authenticated). The HAAA indicates to the PDSN that the MS is not in ACL for the FEID. The PDSN immediately moves A10 to the macro BS and release the A10 to the FAP by indicating the FAP that the MS is not in ACL The PDSN can indicate to the MS through PPP VSP, and/or The FAP can redirect the MS to the macro by indicating the reason. Page 10

11. Recommendations Page 11 Add the Femto Access Control feature in the initial release: Make necessary updates to architecture specified in X.P0059-000 Specify the HRPD/1x PS Femto Access Control feature in X.P0059-100 Specify the 1x CS Femto Access Control feature in X.P0059-200 Specify the FAP procedures in A.S0024 Adopt the following proposals as suggested in this contribution: Study the storage entity for FAP types and ACL based on operator's configuration FAP receives FAP types and optional ACL form the storage entity FAP is the first level of Enforcement Point for both 1x and HRPD FCS or PDSN is the second level of Enforcement Point for 1x CS femto (may be deferred to next release) Stage 2 and Stage 3 contributions will flow up