WO2008028437A1 - Method for providing service quality for a packet data connection and system, network node and communication terminal - Google Patents

Abstract

The invention relates to a simple and yet reliable method for providing quality of service for a packet data connection between a communication system and a communication terminal (KEG) connected to said communication system. According to said method, trustworthiness of the communication terminal (KEG) in relation to the communication system is proven using the functionality "Trusted Computings " (11), the communication terminal (KEG) requests the communication system for provision of the appropriate quality of service (12) required for the respective packet data connection and the quality of service requested by the communication terminal (KEG) for the packet data connection is provided by the communication system (13). The invention also relates to a system, a network node (NK) and a communication terminal (KEG).

Description

description

Method for providing a quality of service for a packet data connection and arrangement, network node and communication terminal

The invention relates to a method for providing a quality of service for a packet data connection between a communication system and a communication terminal connected to the communication system.

Quality of service (QoS) generally describes a measure of the totality of the quality characteristics of a packet data connection as viewed by a user of the packet data connection, i. for example, a communication terminal, understood. For example, parameters such as throughput, i. the average amount of data transmitted per unit time, the loss rate, i. the relative number of data packets lost during a transmission, the latency, i. the mean time delay in transmission or the so-called "jitter", which is a measure of the deviation of the latency from its mean, are taken into account The respective definition of the quality of service generally depends on the respective type of communication system used Provide one

Quality of service in principle for a communication system according to any fixed or mobile standard.

Different services or applications usually have different quality of service requirements. For example, while in a real-time communication in the form of a voice connection such as VoIP (Voice over IP (Internet Protocol)) in particular loss rate, latency and jitter affect the quality of the service is for a service in the form of a pure data transfer usually essentially the throughput of importance.

In the event that the communication system is a 3rd Generation Mobile Network according to the 3GPP (3rd Generation Partnership Project) standard, the document "3GPP TS 23.207 V6.6.0 (2005-09); 3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; End-to-end Quality of Service (QoS) Concept and Architecture (Release 6) "a method of the type mentioned. In particular, Figure 4 of this document shows the process in the provision of a quality of service for a packet data connection between a communication terminal in the form a so-called user equipment (UE) and the mobile network or a network node of the mobile network in the form of a so-called Gateway GPRS (General Packet Radio Service) Support Node (GGSN) In general, it should be noted that the specific form of a packet data connection of the respective type Thus, in the case of using a communication system in the form of a mobile network according to the 3GPP standard, the packet data connection may be given by a so-called PDP (packet data protocol) context - ketdatenprotokoll, such as the Intern et protocol (IP).

The communication terminal is connected to the communication system, ie there is basically a connectivity between the communication terminal and the communication system. In the case of a communication system in the form of a mobile radio network in accordance with the 3GPP standard, the connection can be effected, for example, by the fact that the communication terminal device is connected by means of a so-called "GPRS attach". Log in message in the mobile network and then builds a packet data connection. The connection of the communication terminal in the example mentioned comprises both the structure of the packet data connection from the communication terminal to a GGSN, ie a network node of the so-called core network of the mobile network, as well as the initialization of the mobility relationship to a network node, such as a so-called Serving GPRS Support Node (SGSN), which then interacts with the so-called radio or wireless network of the mobile network, for example using a base station in the form of a so-called Node-B or a so-called Radio Network Controller (RNC).

The present invention has for its object to provide a simple yet reliable method for providing a quality of service for a packet data connection between a communication system and a communication terminal connected to the communication system.

This object is achieved according to the invention by a method for providing a quality of service for a packet data connection between a communication system and a communication terminal connected to the communication system, in which the communication terminal detects its trustworthiness with respect to the communication system using functionality of the "trusted computing", The quality of service which is appropriate for the respective packet data connection is requested by the communication system from the communication terminal and the quality of service requested by the communication terminal for the packet data connection is then provided by the communication system is also possible that the communication terminal first a requests appropriate quality of service from the communication system for the particular packet data connection and then the communication terminal proves its trustworthiness with respect to the communication system using functionality of the "trusted computing".

The proof of the trustworthiness by the communication terminal with respect to the communication system takes place in such a way that the communication terminal makes credible to the communication system that it is compliant with requirements and rules prescribed by the communication system. This means that it can be ruled out after successful verification of the trustworthiness by the communication system that an unwanted manipulation of the communication terminal exists.

According to the invention, the verification of the trustworthiness is carried out using functionality of "trusted computing." The term "trusted computing" is a technology for providing secure platforms known, which is supported and specified in particular by the so-called "Trusted Computing Group" (TCG) The aim of "Trusted Computing" in particular is to provide information technology with a trustworthy basis through a security solution that is deeply rooted in hardware and software. The publications of the Trusted Computing Group can be found on the Internet from the website https://www.trustedcomputinggroup.org, with particular reference to the documents "TCG Specification; Architecture Overview; Specification; Revision 1.2; 28 April 2004", " TCG Infrastructure Working Group; Reference Architecture for Interoperability (Part I); Specification Version 1.0; Revision 1; 16 June 2005 "and" TCG Trusted Network Connect; TNC Architecture for Interoperability; Specification Version 1.1; Revision 2; 1 May 2006 ".

According to the inventive method, the provision of the quality of service for the packet data connection between the communication system and the connected communication terminal takes place in accordance with the previous explanations such that the communication terminal proves its trustworthiness with respect to the communication system using the functionality of "trusted computing" the communication terminal for the packet data connection to a quality of service from the communication system, the communication system on a review of the requested quality of service and possibly a restriction of the requested quality of service is waived .This is basically possible, since on the one hand the communication terminal is known, for which purpose uses the packet data connection For this reason, the communication terminal can meet both minimum quality of service requirements and adequate declarations LIMITATION set on the maximum quality of service. For example, a telephony program using the Session Initiation Protocol (SIP) protocol may be programmed to request only a quality of service appropriate to telephony from the communication system and upon receipt of a "SIP BYE" message indicating the end of the call, terminate the transmission and reception of data on the voice channel and release the requested quality of service, ie the corresponding transmission resources of the communication system Such correct behavior can be checked, for example, by a test and certification process for the software.

On the other hand, however, it must still be remembered that modern communication terminals would or even allow the installation of their own software programs. As a result, it can not be fundamentally assumed that the communication terminal actually requests an appropriate quality of service for the respective intended application. Thus, by changing or exchanging the software used on the communication terminal, the user of the communication terminal device could request an inadequately high quality of service for the desired application. This may be interesting for users, for example, if the packet data connection and its quality of service are not separately charged, but are included in the charge for the application used via the packet data connection. In such a scenario, which is expressly provided by many operators of communication systems, two manipulated communication terminals could for example simulate the establishment of a voice connection, but in fact build a video connection. This would mean that for the video connection only the price of a voice connection would be charged. In addition, two communication terminals could, for example, also signal the end of a connection if there is no corresponding network-side monitoring, whereby the charge collection is ended, but nevertheless continue to use the data channel or the packet data connection, ie continue a video transmission or a telephone conversation, for example.

According to the previous explanations, the proof of its trustworthiness by the communication terminal with respect to the communication system using the functionality of "trusted computing" is thus a decisive prerequisite for ensuring that only one of the communication packets is available for the respective packet data connection or respectively intended use of the packet data connection also requires appropriate quality of service becomes. This is also important for the communication system because it is usually desirable for the communication system to limit the quality of service in order to retain transmission resources for other communication terminals and thus to ensure optimum throughput with respect to the entire communication system and all connected communication terminals. At the same time, however, in the context of the provision of a packet data connection, application-specific minimum requirements must be adhered to since, as described above, depending on the application or service used via the packet data connection by the communication terminal, a certain minimum quality of service is generally required for reasonable use ,

On the basis of the previous proof of its trustworthiness by the communication terminal with respect to the communication system using "trusted computing" functionality, the quality of service requested by the communication terminal for the packet data connection is provided by the communication system, assuming a corresponding availability of transmission resources Instead, it is trusted that the communication terminal does not request a higher quality of service than is appropriate for the respective packet data connection or the respective application used over this packet data connection the requirement of an unjustifiably high quality of service would be erfindungsg excluded by "trusted computing" measures, which is justified in a correct behavior of the communication terminal.

The method according to the invention is advantageous, since the process of providing a quality of service for a packet data connection is considerably simplified. In particular, this eliminates the need for a network-side, i. communication system side, checking and possibly limiting the quality of service requested by the communication terminal. This also means that the negotiation of the quality of service for a packet data connection can advantageously be limited to the communication terminal as well as the components of the communication system which have limited transmission resources. This means, for example, in the event that the communication system is a mobile radio network, that the negotiation of the quality of service on the communication terminal and the access network, i. the radio or radio network of the mobile network can be limited. In this case, components of the core network of the mobile radio network are only to be included in the negotiation of the quality of service to be provided for the packet data connection if they themselves have limited resources. In addition, it is advantageously possible for the method steps of the method according to the invention to be embedded in already existing communication sequences. This will reduce the required communication overhead, i. advantageously further reduces the number of messages exchanged between components of the communication system with each other and / or between the components of the communication system and the communication terminal.

In a preferred embodiment, the method according to the invention runs in such a way that the communication terminal has its trustworthiness with regard to hardware used by it and / or software proves. This is advantageous since, depending on the respective requirements, the communication terminal can thus prove its trustworthiness to the extent required in each case. In this context, the "Trusted Computing" advantageously provides functionality for both the verification of the trustworthiness of the hardware used by the communication terminal and in particular of the software used by the communication terminal.

Preferably, the method according to the invention can also run such that the communication terminal verifies its trustworthiness in relation to software used for at least one service supported by the communication terminal. This development of the method according to the invention offers the advantage that the communication terminal can prove its trustworthiness with respect to the communication system, in particular with respect to a software used for at least one service or application supported by the communication terminals. This can preferably take place either in each case in connection with requesting the provision of a packet data connection for the relevant service or the relevant application, or else, if appropriate independently of the actual provision of the packet data connection, jointly for all services supported by the communication terminal. Thus, it is conceivable, for example, that the communication terminal proves its trustworthiness with respect to one, several or all of the services or services it supports, simultaneously with its authentication.

Preferably, the inventive method can also run such that the communication terminal its trustworthiness using the function "Trusted Network Con- nect "of" Trusted Computings ". The verification of the trustworthiness of the communication terminal using the function "Trusted Network Connect" of the "Trusted Computing" is advantageous, since this is a specific for the detection of the trustworthiness or integrity of a communication terminal against a communication system specified functionality. In general, the communication terminal, for example, using the functionality "Integrity Measurement, Storage and Reporting" of the "Trusted Computing" against the communication system in a non-manipulatable way assure that runs on it a very specific software. For this purpose, the communication terminal measures, for example, before starting an application-specific software characteristic properties of the program code of the software. This can be done, for example, by determining a cryptographic "hash value." The measured values determined in this way can now be transmitted in a trustworthy manner to the communication system by the communication terminal using the functionality of the "Trusted Network Connect". There, the measured values, which can also be referred to as integrity labels, are compared with stored values, so that it is possible to determine whether the software is known, tested and certified by the service-requested communication system. In this case, for example, the integrity flags can either be stored directly on a network node of the communication system, or the communication system can access an external database for checking the values, for example. If this happens, for example for a communication system in the form of a mobile radio network according to the 3GPP standard, by a network node in the form of a GGSN, the access to such an external database can take place, for example, via the so-called radius interface at the GGSN. Preferably, they are Integrity indicator for all services and communication terminals or users of the communication terminals available in the communication system. Requests to provide a packet data connection for a service that does not originate from certified software are advantageously rejected by the communication system.

In a further preferred embodiment of the inventive method, the trustworthiness of the communication terminal is detected in connection with an authentication and / or authorization check of the communication terminal. A corresponding authentication, i. the proof of his identity by the communication terminal, as well as authorization check, i. the check that the communication terminal is authorized to use a specific functionality, usually takes place when signing a communication terminal to a communication system, for example. As already explained above, the verification of the trustworthiness of the communication terminal in connection with an authentication and / or authorization check of the communication terminal is particularly advantageous because this reduces the communication effort, i. the number of messages exchanged between the communication terminal and the communication system and between components of the communication system is reduced.

The verification of the trustworthiness as well as the requesting of an adequate quality of service by the communication terminal device can take place with respect to the same network node of the communication system. In a particularly preferred embodiment, however, the method according to the invention is designed such that the verification of the trustworthiness of the communication terminal with respect to a network node of the communication cation system is carried out by the fact that its trustworthiness against another network node is detected by the communication terminal and the trustworthiness of the communication terminal is communicated to the network node by the further network node. Thus, another network node representative of the network node, in which the communication terminal before or after the quality of service request, make the verification of the trustworthiness of the communication terminal. The result of this check is then communicated to the network node by the other network node. As a result, the functionality of providing a quality of service for a packet data connection is advantageously decoupled from the functionality of checking the trustworthiness of the communication terminal by the communication system.

In a particularly preferred embodiment of the inventive method, the quality of service is provided on the basis of a request message sent by the communication terminal via the communication system to an application server for starting a service. This embodiment is preferred because in this case the packet data connection is provided specifically for a service requested by the communication terminal via the network node from an application server. In particular, in this case, it is advantageous that a control or restriction of the requested by communication terminal quality of service communication system side can be dispensed with. In this case, the application server is regarded as not belonging to the actual communication system. Since the communication system itself therefore generally has no knowledge of the requested service or the requested application, it is usually not possible for it to dissuade the service-specific minimum requirements for the quality of service. estimate. As a result, a check of the quality of service requested by the communication terminal would require communication between the communication system or one of its network nodes and the application server. In order for such communication to occur at all, a special configuration of the application server is required and both the application server and the relevant network node of the communication system must implement the relevant protocols. It should be noted that the communication system or the relevant network node should in principle be independent of the services provided by means of the packet data connection. Exactly this is now made possible by the preferred development of the method according to the invention, since the need for communication between the communication system and the application server in the context of providing the quality of service is eliminated. Moreover, it is not necessary for the network node connected to the application server by the communication system, which is, for example, a so-called IP (Internet

Protocol) gateway, which knows and can evaluate high-level protocols embedded in passing data packets. The reason for this is that it is not necessary for the network node to be able to conclude the service requested by the communication terminal or the quality of service that is appropriate for this service. Thus, the provision of a quality of service based on a request message sent by the communication terminal via the communication system to the application server for starting a service is significantly simplified, ie both the communication system-side configuration and implementation effort and the communication effort is considerably reduced. In a further preferred embodiment, the method according to the invention runs in such a way that the billing of the service takes place exclusively by the application server. This embodiment is advantageous in that it disclaims communication between a network node connected to the application server and the application server not only in connection with the provision of a quality of service for a packet data connection, but also subsequently for the charging of a service using this packet data connection Service allows.

Thus, advantageously, no related communication between the network nodes and the application server is required. In addition, there is advantageously no need for the communication system or the respective network node to monitor the packet data connection or the respective service used. In general, it should be noted at this point that, depending on the type of communication system used and the nature of the respective packet data connection, several services can also jointly use a packet data connection. Are there any other, besides the services to be billed on the application server, i. those in whose billing the communication system is involved, these two different types of service can preferably be treated differently by the communication system.

This means that the two different types of service preferably separate packet data connections, i. For example, use PDP contexts. In this case, the resource control and billing, for example, in the access and core network of a mobile network, for the one

Service mode, ie for those services that are not charged on the application server, while they are active for the packet data connection or the packet data connections for such services application server, it does not need to be used, ie it is not active.

The method according to the invention can also preferably run as an application server in an application server in a communication network according to the IMS (IP Multimedia Subsystem) architecture. This is advantageous because the IP Multimedia Subsystem is a widely used type of communication network for providing application servers.

In a further preferred development, the method according to the invention is designed such that a mobile radio network according to the GPRS (General Packet Radio Service), the EDGE (Enhanced Data Rates for GSM Evolution) or the UMTS (Universal Mobile Telecommunications System) is used as the communication system. Standard is used. In general, the use of a mobile radio network as a communication system is particularly preferred, since in particular the usually scarce and therefore cost-intensive transmission resources of the air interface of a mobile network result in that preferably only a quality of service actually appropriate for the respective situation is provided for a packet data connection. At the same time, in mobile networks, there is a particular need to minimize the number of messages exchanged over the air interface as well as within the core network. The use of a mobile radio network according to one of the said standards is preferred since these are widespread and frequently used types of mobile radio networks for the provision of packet data connections and for the transmission of packet data-oriented data.

The invention further relates to an arrangement. With regard to the arrangement, the object of the present invention is to specify an arrangement which enables a simple yet reliable method for providing a quality of service for a packet data connection between a communication system and a communication terminal connected to the communication system.

This object is achieved by an arrangement with means for carrying out the method described above according to one of the method claims treated above. The advantages of the arrangement according to the invention correspond to the advantages mentioned in connection with the method according to the invention or the corresponding developments of the method according to the invention.

The invention further relates to a network node of a communication system.

With regard to the network node, the object of the present invention is to specify a network node which makes it possible to provide a quality of service for a packet data connection in a simple yet reliable manner.

This object is achieved according to the invention by a network node of a communication system for use in the method described above according to one of the above-described method claims and / or for use in the arrangement described above. The advantages of the network node according to the invention result from the statements in connection with the method according to the invention and its preferred developments.

Furthermore, the invention relates to a communication terminal. With regard to the communication terminal, the present invention has the object to provide a communication terminal, which can be used in a simple yet reliable method for providing a quality of service for a packet data connection between a communication system and a connected to the communication system communication terminal.

This object is achieved by a communication kationsendgerät for use in the previously described

Method according to one of the above-described method claims and / or for use in the arrangement described above. The advantages of the communication terminal according to the invention in turn result from the corresponding advantages of the method according to the invention and its preferred developments.

To further illustrate the invention shows

Figure 1 is a simplified schematic representation of the flow of a method for providing a quality of service for a packet data connection from which the invention proceeds, and

Figure 2 compared to this in a schematic

Representation in an embodiment of the method according to the invention between an embodiment of the communication terminal according to the invention, an embodiment of the inventive network node and an application server exchanged messages. FIG. 1 shows in a simplified schematic representation the provision of a quality of service for a packet data connection between a network node NK of a communication system and a communication terminal KEG connected to the network node NK. The representation of FIG. 1 is generally to be understood such that the vertical bars represent the communication terminal KEG, the network node NK or the application server AS according to the corresponding reference symbols, and the vertical arrows represent the messages exchanged between these components. The method illustrated in FIG. 1 is a simplified schematic representation of the 3GPP TS 23.207 specification previously mentioned, which for 3GPP standard mobile radio networks, the concept and the architecture for providing a quality of service (Quality of Service ) for a packet data connection, discussed procedure. The aim of this figure 1 is to facilitate the understanding of the embodiment of the inventive method shown in Figure 2.

According to FIG. 1, the communication terminal KEG may, for example, be a mobile radio telephone which is connected via a non-illustrated access network to a network node NK of the communication system, for example in the form of a GGSN (Gateway GPRS Support Node). According to the previous explanations, the term "connected" means that at least one connectivity basically exists between the communication terminal KEG and the network node NK In the case of a network node NK in the form of a GGSN, this may have been established, for example, by the communication terminal KEG using a so-called "GPRS attach" message has logged into the communication system in the form of the mobile network according to the 3GPP standard. The network node NK in the form of the GGSN thereby fulfills the Function of a so-called IP (Internet Protocol) gateway, which provides access to a service core network in which the applications or services to be used are provided.

Due to the characteristics, in particular of wireless access networks, the quality of service must be ensured and managed by special measures in such configurations between the communication terminal KEG and the network node NK. This may be the case, for example, for applications provided in the so-called IP Multimedia Subsystem (IMS) of third-generation mobile networks, for example in accordance with the UMTS (Universal Mobile Telecommunication System) standard. In this case, a so-called UMTS User Equipment (UE) is used as the communication terminal KEG, and the packet data connection is produced by a so-called PDP (packet data protocol) context. In this case, for example, a so-called UTRAN (UMTS Terrestrial Radio Access Network) can be used in conjunction with a GPRS core network as the wireless access network, wherein the network node NK in the form of the GGSN serves as the IP gateway and accesses the IMS as a service gateway. Core network manufactures. The services or applications to be used are implemented as servers in the IMS. These include, for example, the so-called "Proxy Call Session Control Function (P-CSCF)" for multimedia sessions or the "presence server" for instant messaging and presence services.

As already explained above, in the context of the provision of a packet data connection, it is of great importance to negotiate a suitable, ie appropriate quality of service between the communication terminal KEG and the communication system. In this case, both the network node NK in the form of the GGSN and the actual access be involved in the negotiation. It is usually desirable from the point of view of the communication terminal KEG or its user to have the highest possible quality of service made available. On the other hand, from the point of view of the access network or its

Limit the quality of service to retain resources for other users, ensuring optimal throughput for the entire communication system. However, depending on the service that is to be used via the packet data connection, this is service-specific

To comply with minimum requirements. In addition, the actual availability of transmission resources in the access network must be taken into account, this availability being known to the access network itself. However, the access network and the network node NK usually have no knowledge of the type of service for which the quality of service is to be provided. Therefore, they are also unable to estimate the service-specific minimum quality of service requirements. Although the communication terminal KEG, in turn, knows the desired service and the resulting minimum quality of service requirements, it is not trustworthy, i. there is a risk that the communication terminal KEG is manipulated in such a way that it demands a higher than the appropriate quality of service.

As shown in FIG. 1, the provision of a quality of service for a packet data connection can take place such that the communication terminal KEG requests a service from the application server AS in a request message 1. For example, if a service of the IMS is requested, the application server AS may be a P-CSCF. The request message 1 may be, for example, the message "SIP Invite". In a quality of service request message 2a, the terminal then requests a quality of service which from its point of view is suitable for the use of the service. This can be done, for example, by creating a PDP context with the corresponding properties.

In the next method step 2b, the application server AS informs the network node NK which quality of service at the most, i. maximum, to be provided. For the case described, the application server AS is a server of the IMS, i. For example, a P-CSCF, this application server first provides the information about the maximum quality of service to a component known as the Policy Decision Function (PDF) .The PDF then shares the maximum quality of service on request to the network node NK in the form of the GGSN With.

In method step 2c, the quality of service between the network node NK, the communication terminal KEG and the access network (not shown in FIG. 1 for reasons of clarity) is negotiated taking into account the maximum quality of service communicated by the application server AS.

Subsequently, in method step 3, a packet data connection with the negotiated quality of service is provided by the network node NK and the access network. This makes it possible for the communication terminal KEG to use the provided packet data connection with the provided, guaranteed quality of service in method step 4.

It should be noted that in the case of IMS applications, the policy decision function uses preconfigured policies, that is to say so-called policies, and uses the parameters provided to specify the maximum or to be allocated. deduced quality of service. The network node NK in the form of the GGSN queries when receiving the quality of service request, as previously described, the maximum quality of service to be provided by the policy decision function. It can be seen that the procedure described thus requires communication between the application server AS and the network node NK, for example via the intermediary policy decision function. This has the consequence that provision is necessary by means of which the application server AS can even determine the policy decision function which is responsible for the network node NK used. This is problematic because the application server AS must be specially configured for this and the network node NK in the form of the IP gateway is normally independent of the applications that can be used via it. In addition, the described method according to FIG. 1 results in the application server AS and the network node NK having to implement the protocols relevant for the services.

FIG. 2 shows a schematic representation of the messages exchanged in an embodiment of the method according to the invention between an embodiment of the communication terminal according to the invention, an embodiment of the network node according to the invention and an application server.

The basic type of representation corresponds to that of Figure 1. Furthermore, in the embodiment of Figure 2, a communication system in the form of a mobile network according to the 3GPP standard and the use of an application server AS in a communication network according to the IMS architecture adopted. This clarifies the differences between the illustrated embodiment. play the method according to the invention and the method shown in Figure 1 easier.

In the exemplary embodiment of the method according to the invention shown in FIG. 2, the communication terminal KEG starts a desired application or a service desired by it by sending a signaling message 10 to the application server AS. Analogously to the request message 1 in FIG. 1, this may be, for example, a message of the "SIP Invite" type.

In the fundamental difference from the procedure described in FIG. 1, however, an integrity check of the communication terminal KEG, that is to say in step 11, now takes place. the communication terminal KEG has its integrity with respect to the network node NK by means of "Trusted Network Connect" of the "Trusted Computing", i. his trustworthiness, after. This particularly concerns the originality of the software, which communicates with the application server AS and requests the provision of the quality of service. The proof of the trustworthiness of the communication terminal KEG can in principle be done individually for each service, or at the same time in a common process step for all supported by the communication terminal KEG services. In addition, it is also possible for the method steps 10 and 11 to be reversed in their order or for the method to be started independently of a request message 10 for starting a service sent by the communication terminal KEG via the network node NK to the application server AS.

After successful verification of the trustworthiness, ie after a successful integrity check, the communication terminal KEG in method step 12 requests a message for the requested appropriate, ie adequate quality of service. On the basis of the proof of the trustworthiness of the communication terminal KEG, the network node NK can trust that the communication terminal KEG does not request an unnecessarily high quality of service and therefore only checks the availability of corresponding transmission resources, but not the suitability of the requested quality of service for the requested service. Thus, the network node NK advantageously has no particular knowledge of the nature of the requested service.

In step 13, the network node NK and the access network of the communication system, i. For example, the UTRAN, the communication terminal KEG the requested quality of service available. As already explained above, the quality of service for the packet data connection is provided without further checking or restriction by the communication system.

After the provision of the requested quality of service in method step 13, the communication terminal KEG is now in method step 14 analogous to method step 4 in FIG. 1 possible to communicate with the application server AS via a packet data connection with the requested quality of service.

As can be seen from a comparison of the exemplary and schematic process sequences of FIGS. 1 and 2, the exemplary embodiment of the method according to the invention shown in FIG. 2 offers the particular advantage that the

Node NK has no knowledge of the requested by the communication terminal KEG or its user service or the quality of service for this service must have. This means that for the network node NK, for example in the form of an IP gateway, is not required to receive such information from the application server AS. In addition, the network node NK neither has to evaluate nor even know the higher-value protocols embedded in the throughput data packets. On the other hand, at least one of these abilities is required in the method illustrated by way of example and in simplified form in FIG. 1, since the network node NK has to in some way conclude the requested service or the quality of service that is appropriate for this service.

In addition, the method according to the invention offers the advantage that, at least in the case where the communication system is a mobile radio network and all

Services / applications of the communication terminal KEG have already been checked for their trustworthiness, the negotiation of the quality of service on the communication terminal KEG and the access network can be limited. In this case, the network node NK may also be, for example, a network node NK of the access network, i. for example, the radio network of the mobile network, act. In this case, the sides of an IP gateway, which allows the connection to the application server AS, compared to the access network, a release for the communication terminal KEG done.

This offers the advantage that the IP gateway itself only has to be involved in the negotiation of the actual quality of service, even if it itself has critical transmission resources that are critically limited in terms of the transmission resources of the communication system.

As already explained above, moreover, at least part of the communication shown in FIG. 2, ie, in particular, the proof of the trustworthiness of the community, can be provided. nikationsendgerätes KEG in step 11 against the network node NK, advantageously in the usual authentication and authorization process be embedded. This is not shown in FIG. 2 for reasons of clarity. Such an embedding of the proof of trustworthiness in messages which are required anyway for other reasons is advantageous, as this further reduces the communication effort, ie the number of messages exchanged between the network components.

Claims

claims A method for providing a quality of service for a packet data connection between a communication system and a communication terminal (KEG) connected to the communication system, in which - its reliability is demonstrated by means of the communication terminal (KEG) in relation to the communication system, using functionality of "trusted computing" (11), - Is requested by the communication terminal (KEG) appropriate for the particular packet data connection quality of service of the communication system (12) and then - The quality of service requested by the communication terminal (KEG) for the packet data connection is provided by the communication system (13). 2. The method according to claim 1, wherein a communication terminal (KEG) proves its trustworthiness with respect to hardware and / or software used by it. 3. Method according to claim 2, wherein a communication terminal (KEG) proves its trustworthiness with respect to software used for at least one service supported by the communication terminal (KEG). 4. The method according to any one of the preceding claims, characterized in that the communication terminal (KEG) proves its trustworthiness using the function "Trusted Network Connect" of the "Trusted Computing". 5. Method according to one of the preceding claims, characterized in that the verification of the trustworthiness of the communication terminal (KEG) takes place in connection with an authentication and / or authorization check of the communication terminal (KEG). 6. Method according to one of the preceding claims, characterized in that the verification of the trustworthiness of the communication terminal (KEG) with respect to a network node (NK) of the communication system takes place in that - Is proved by the communication terminal (KEG) its trustworthiness to another network node and - The trustworthiness of the communication terminal (KEG) the network node (NK) is communicated from the other network node. 7. Method according to one of the preceding claims, characterized in that the quality of service is provided for starting a service on the basis of a request message (10) sent by the communication terminal (KEG) via the communication system to an application server (AS). 8. The method according to claim 7, wherein a billing of the service takes place exclusively by the application server. 9. The method according to any one of claims 7 or 8, characterized in that An application server (AS) is an application server in a communication network according to the IMS (IP Multimedia Subsystem) architecture. 10. The method according to any one of the preceding claims, characterized in that as a communication system, a mobile network according to the GPRS (General Packet Radio Service) -, the EDGE (Enhanced Data Rates for GSM Evolution) or the UMTS (Universal Mobile Telecommunications System) standard is used. 11. Arrangement with means for carrying out the method according to one of claims 1 to 10. 12. network node (NK) of a communication system for use düng in the method according to one of claims 1 to 10 and / or for use in the arrangement according to claim 11. 13. Communication terminal (KEG) for use in the method according to one of claims 1 to 10 and / or for use in the arrangement according to claim 11.