JP4793826B2 - Authentication method and system in handover of mobile terminal - Google Patents

Description

The present invention relates to an authentication method and system in handover of a mobile terminal.

  NGN (Next Generation Network) is being studied for end-to-end all-IP (Internet Protocol). This is realized by FMC (Fixed Mobile Convergence) that integrates fixed wired broadband and mobile wireless broadband. NGN is realized by a group of SIP (Session Initiation Protocol) servers based on IMS (IP Multimedia Subsystem) in order to reconstruct an existing telephone network into an IP-based next generation network. Accordingly, various multimedia services are provided by QoS and security corresponding to each service.

  A mobile terminal connected to such a network requires a handover technique for switching an access network with the movement. The handover technique requires shortening of the handover time from the viewpoint of operability and minimization of the data amount of the control message from the viewpoint of effective use of radio resources. Usually, most of the time and amount of data required for a handover is an authentication sequence for an access network to be connected after the handover.

  FIG. 1 is a system configuration diagram in the prior art.

  According to FIG. 1, a plurality of access networks 2 to 4 are interconnected to the integrated network 1. A high-speed wireless network (HSWA (High Speed Wireless Access) network) 2 is, for example, a wireless LAN (Local Area Network) or a wireless MAN (Metropolitan Area Network). Connected to the high-speed wireless network 2 is an access point 21 that communicates with the mobile terminal 5 via a wireless link. The mobile network 3 is, for example, a cellular communication network. A base station (Cellular BS) 31 that communicates with the mobile terminal 5 via a wireless link is connected to the mobile network 3. The fixed network 4 is configured by, for example, FTTH (Fiber To The Home) or ADSL (Asymmetric Digital Subscriber Line).

  Further, an AAA server (Authentication, Authorization and Accounting server) 11 and an HSS / HLR (Home Subscriber Server / Home Location Register) 12 are connected to the integrated network 1.

  The AAA server 11 has a subscriber authentication (Authentication) function, a service authorization (Authorization) function, and an event storage (Accounting) function. The subscriber authentication function confirms the legitimacy by a method of requesting a login / password to the mobile terminal, a method of using a certificate, a method of sharing a key, etc. in order to increase security for access to the integrated network 1. . The service permission function controls a service permitted to the mobile terminal after the authentication is completed. The event storage function stores various events that have occurred, for example, billing information.

  The HSS / HLR 12 stores, for example, a function (HSS) for accumulating and managing an identifier and subscriber information (IMSI (International Mobile Subscriber Identifier)) of a mobile terminal possessed by the subscriber, and a function for accumulating and managing current position information of the mobile terminal ( HLR).

  According to FIG. 1, a proxy AAA server 22 is also connected to the high-speed wireless network 2. The proxy AAA server 22 exists as a proxy server for the AAA server in the high-speed wireless network 2.

  The mobile terminal 5 is equipped with a SIM (Subscriber Identity Module). The SIM is an IC card that stores an identifier and subscriber information (IMSI) issued by a communication carrier. Thereby, the mobile terminal identifier and subscriber information in the mobile terminal 5 are specified. According to FIG. 1, the mobile terminal 5 is about to hand over from the mobile network 3 to the high-speed wireless network 2.

  FIG. 2 is a sequence diagram in the system of FIG.

(S201) It is assumed that the mobile terminal 5 detects a handover to the high-speed wireless network 2 when a wireless link is connected to the base station 31 of the mobile network 3. At this time, the mobile terminal 5 connects a wireless link with the access point 21 of the high-speed wireless network 2.

(S202) The mobile terminal 5 performs an authentication sequence via the high-speed wireless network 2 that is the movement destination. Here, a description will be given assuming that the authentication protocol is EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement, Extensible Authentication Protocol-Authentication / Encryption Key Distribution Method). According to FIG. 2, first, the mobile terminal 5 receives an EAP-Request from the access point 21 of the high-speed wireless network 2.
(S203) The mobile terminal 5 returns an EAP-Response including the IMSI stored in the SIM to the access point 21. The access point 21 transfers the EAP-Response to the proxy AAA server 22 in the high speed wireless network 2. The proxy AAA server 22 transfers the EAP-Response to the AAA server 11.

(S204) The AAA server 11 transmits a subscriber profile Request to the HSS / HLR 12 in order to confirm whether or not the mobile terminal 5 is permitted to connect to the high-speed wireless network 2. The subscriber profile Request includes a mobile terminal identifier and an IMSI. On the other hand, the HSS / HLR 12 searches whether or not connection to the high-speed wireless network 2 is permitted for the mobile terminal identifier. The HSS / HLR 12 returns a subscriber profile Response including the result to the AAA server 11.

(S205) If the mobile terminal 5 is permitted to connect to the high-speed wireless network 2, then the AAA server 11 transmits an authentication data Request including the mobile terminal identifier and the IMSI to the HSS / HLR 12. The HSS / HLR 12 generates a plurality of AVs (Authentication Vectors) based on the mobile terminal identifier included in the authentication data Request. The HSS / HLR 12 returns the authentication data Response including these AVs to the AAA server 11.

(S206) The AAA server 11 stores the AV included in the authentication data Response. Then, the AAA server 11 selects any one AV and transmits an EAP-Request / AKA-Challenge including the AV to the proxy AAA server 22. The proxy AAA server 22 transfers the received EAP-Request / AKA-Challenge to the access point 21 of the high-speed wireless network 2. The access point 21 transmits the received EAP-Request / AKA-Challenge to the mobile terminal 5. Thereby, the mobile terminal 5 confirms the network validity of the high-speed wireless network 2.

(S207) On the other hand, the mobile terminal 5 transmits EAP-Response / AKA-Challenge carrying the value calculated in the terminal to the access point 21 of the high-speed wireless network 2. The access point 21 transmits the received EAP-Response / AKA-Challenge to the proxy AAA server 22. The proxy AAA server 22 transmits the received EAP-Response / AKA-Challenge to the AAA server 11. Thereby, the AAA server 11 confirms the legitimacy of the subscriber by the value included in EAP-Response / AKA-Challenge.

(S208) Next, the AAA server 11 transmits EAP-Success Keying including the key to the proxy AAA server 22. The proxy AAA server 22 transmits the received EAP-Success Keying to the access point 21. The access point 21 transmits the received EAP-Success Keying to the mobile terminal 5.

  As described above, in order for a mobile terminal to perform handover to a different access network, it is necessary to perform an authentication sequence. The above-described sequence is for performing an authentication sequence via a destination access network. On the other hand, there is also a technique for performing an authentication sequence via an access network before handover (see, for example, Non-Patent Document 1).

  Further, in order to realize high-speed handover between wireless LANs, the AAA server that has received the authentication request message from the mobile terminal receives the access point of the access network before the handover and the predicted access point of the access network after the handover. And a technique for transmitting an authentication response message (see Non-Patent Document 2, for example). According to this technique, the access point of the access network after the handover has already received the authentication response message. Therefore, the mobile terminal can perform high-speed handover without signaling with the AAA server.

  Furthermore, there is a technique in which an authentication sequence to be performed by a mobile terminal is performed by an authentication device provided in a network (for example, see Patent Document 1). Since the authentication sequence between the mobile terminal and the AAA server can be performed in the network, the authentication time can be shortened, that is, the handover time can be shortened.

Hyun-HoChoi and Song. O and Dong-Ho Cho, “A seamless handoff scheme for UMTS-WLAN interworking”, Globecom'04, Nov. 2004. SangheonPack and Yanghee Choi, “Pre-Authenticated Fast Handoff in a Public Wireless LAN Based on IEEE 802.1x Model”, [online], IFIP TC6 Personal Wireless Communications 2002, [October 12, 2006 search], Internet <URL: http: //citeseer.ist.psu.edu/542647.html> JP 2004-266331 A

  However, when the mobile terminal performs an authentication sequence with the AAA server via the radio link, the handover time is long and radio resources are consumed. This is because, as described above, the mobile terminal needs to perform many exchanges in the authentication sequence at the time of handover.

  According to the technique described in Non-Patent Document 1, it is not necessary to perform an authentication sequence required at the time of handover by pre-authentication, but eventually, radio resources of the access network before the handover are used. As a judgment condition for starting handover, for example, it is possible to detect when the reception level is equal to or lower than a threshold value. However, if pre-authentication is performed when such a radio wave condition deteriorates, messages cannot be exchanged and the authentication sequence is often not completed. In this case, authentication is eventually performed via the moved access network.

Further, when the judgment condition for starting handover is the radio wave reception state, the radio wave reception state varies greatly depending on the surrounding buildings. As the reception level is equal to or less than the threshold value, when the reaction to the determined and pre-authenticate handover to this variation, would be wasteful use of radio resources.

  Furthermore, according to the technique described in Patent Document 1, it is necessary to store the identifier of the mobile terminal and the subscriber information in an authentication device arranged in the network. These pieces of information are originally concealed information and are securely managed by the HSS. Storing such information in an authentication device arranged in the access network is a problem from the viewpoint of security.

  Therefore, an object of the present invention is to provide an authentication method and the like that can realize an authentication sequence when a mobile terminal is handed over at high speed and safely, and further reduce the use of radio resources.

According to the present invention,
A plurality of interconnected access networks ;
An authentication server connected to the carrier network to authenticate the terminal ;
A subscriber management server connected to the operator network to determine whether or not network connection is possible;
A home gateway connected to any one of the access networks by wire and located in the subscriber premises ;
For systems with <br/> a mobile terminal connected to a first access network, An authentication method in a handover of the mobile terminal,
The mobile terminal is equipped with a SIM (Subscriber Identity Module) including a mobile terminal identifier and / or subscriber information,
The home gateway is equipped with a SIM containing a gateway identifier and / or subscriber information,
The subscriber management server stores connection permission network information in association with the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway,
Home gateway, upon detecting a trigger handover to the second access network in a mobile terminal, a mobile terminal identifier and / or subscriber information of the mobile terminal, the home gateway and a gateway identifier and / or subscriber information A first step of sending an authentication start message including to the authentication server;
The authentication server uses the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway to connect to the subscriber management server based on connection permission network information. A second step of inquiring
A third step in which the authentication server executes an authentication sequence based on an authentication protocol with the home gateway if connection is possible based on the connection-permitted network information ;
A fourth step in which the home gateway or the authentication server requests connection permission from the access base station of the second access network;
The mobile terminal has a fifth step of connecting to an access base station of the second access network without executing an authentication sequence.

According to another embodiment of the authentication method of the present invention,
The subscriber management server further accumulates and manages the location information of the mobile terminal ,
As a step before the first step, the mobile terminal periodically transmits a location registration request to the home gateway, and the home gateway stores the location information included in the location registration request together with the mobile terminal identifier, Transferring the registration request to the subscriber management server,
In the first step, the gateway detects a trigger for handover from the first access network to the second access network by the mobile terminal based on the service area information of the plurality of access networks and the location information of the mobile terminal. It is also preferred that this is performed.

According to another embodiment of the authentication method of the present invention,
The first step is also preferably performed when a trigger message for handover of the mobile terminal to the second access network is received from the mobile terminal or other communication device.

According to another embodiment of the authentication method of the present invention,
The access network is a high-speed wireless network, a mobile network or a fixed network,
Multiple access networks are interconnected by an integrated network,
Home gateway is connected by wire to the fixed network the R GW (Residential GateWay),
The access base station connected to the mobile terminal via a radio link is preferably an access point of a high-speed wireless network or a base station of a mobile network.

According to the present invention,
A plurality of interconnected access networks ;
An authentication server connected to the carrier network to authenticate the terminal ;
A subscriber management server connected to the operator network to determine whether or not network connection is possible;
A home gateway connected to any one of the access networks by wire and located in the subscriber premises ;
That having a <br/> a mobile terminal connected to a first access network, a mobile terminals handover system,
The mobile terminal is equipped with a SIM containing a mobile terminal identifier and / or subscriber information,
The home gateway is equipped with a SIM containing a gateway identifier and / or subscriber information,
The subscriber management server stores connection permission network information in association with the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway,
Home gateway
A handover detection unit that detects a trigger handover to the second access network in a mobile terminal,
An authentication start message for transmitting an authentication start message including the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway to the authentication server when a handover trigger is detected A transmission means;
An authentication sequence executing means for executing an authentication sequence based on an authentication protocol with an authentication server;
Have
The authentication server
A function of inquiring the subscriber management server whether or not to connect based on the connection-permitted network information using the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway; ,
A function for executing an authentication sequence based on an authentication protocol with a home gateway when connection is possible based on connection-permitted network information;
Have
Home gateway or an authentication server, connected to a second access network of the access base station, by Rukoto to request a connection permission, the mobile terminal, without performing the authentication sequence, the access base station of the second access network It is characterized by doing.

According to another embodiment of the system of the present invention,
The subscriber management server further accumulates and manages the location information of the mobile terminal ,
Home gateway, the mobile terminal, a location registration request receiving means for receiving a location registration request regular basis,
Location registration storage means for storing location information included in the location registration request together with the mobile terminal identifier ;
A location registration request transmitting means for transferring a location registration request to the subscriber management server ;
Have
Handover detection means preferably a service area information of a plurality of access networks, based on the position information of the mobile terminal, also Turkey issue detects the trigger for handover from the first access network by the mobile terminal to the second access network .

According to another embodiment of the system of the present invention,
It is also preferable that the handover detection means receives a trigger message for handing over the mobile terminal to the second access network from the mobile terminal or another communication device.

According to another embodiment of the system of the present invention,
The access network is a high-speed wireless network, a mobile network or a fixed network,
Multiple access networks are interconnected by an integrated network,
Home gateway is connected by wire to the fixed network R G W,
The access base station connected to the mobile terminal via a radio link is preferably an access point of a high-speed wireless network or a base station of a mobile network.

According to the authentication method and system of the present invention, the authentication sequence performed between the mobile terminal and the AAA server can be performed between the gateway installed by the subscriber of the mobile terminal and the AAA server. The gateway is normally connected by wire, and can realize the authentication sequence at high speed. Further, since the mobile terminal and the gateway are managed by the same subscriber, it is not necessary to store the subscriber information in a node on the network, and the safety is improved. Furthermore, since the authentication sequence is not performed via the radio link between the mobile terminal and the access base station, the use of radio resources can be reduced.

  Hereinafter, the best mode for carrying out the present invention will be described in detail with reference to the drawings.

  FIG. 3 is a system configuration diagram according to the present invention.

  According to FIG. 3, as in FIG. 1, a high-speed wireless network 2, a mobile network 3, and a fixed network 4 are interconnected to the integrated network 1. Connected to the integrated network 1 are an AAA server 11 that centrally manages and authenticates terminals, and an HSS / HLR 12 that determines whether or not a mobile terminal can be connected.

  According to the present invention, an RGW (Residential GateWay) 6 is connected to the fixed network 4 via FTTH or a metal line. The RGW 6 is installed in the subscriber's home of the mobile terminal 5 and functions as a home gateway. The RGW 6 mutually converts an input / output signal of a communication device (telephone, personal computer, etc.) connected thereto and an IP packet to the fixed network 4.

  The RGW 6 is equipped with an ISIM (Individual Subscriber Identity Module). The ISIM is an IC card that stores an identifier and subscriber information (IMSI (International Mobile Subscriber Identifier)) issued by a communication carrier. Thereby, it can be identified that the subscriber of the RGW 6 and the subscriber of the mobile terminal 5 match.

The RGW 6 is a mobile terminal identifier (UE-ID: User Equipment-IDentifier) of a mobile terminal further owned by a subscriber who owns the RGW, subscriber information IMSI of the mobile terminal, and a user unique key (K: Individual subscriber). authentication Key).

The mobile terminal 5 is equipped with a SIM and holds a table as shown in Table 2 below.

Further, the HSS / HLR 12 associates an identifier and IMSI based on SIM (M) attached to the mobile terminal 5, an identifier and IMSI based on ISIM attached to the RGW 6, and connectable network identification information. I remember. The HSS / HLR 12 holds a table as shown in Table 3 below.

  According to FIG. 3, the mobile terminal 5 periodically transmits a location registration request to the RGW 6 via the mobile network 3 that is an access network before the handover. This is different from the conventional technique in which the mobile terminal directly transmits a location registration request to the HSS / HLR 12. The RGW 6 accumulates the current location information of the mobile terminal 5 and transfers the received location registration request to the HSS / HLR 12.

  The RGW 6 holds service area information of a plurality of access networks. The service area information may be downloaded from another node such as the HSS / HLR 12.

  The RGW 6 detects a trigger for the mobile terminal 5 to perform a handover from the mobile network 3 to the high-speed wireless network 2 based on the service area information and the location information of the mobile terminal. When the mobile terminal 5 determines that the handover should be performed, the RGW 6 performs an authentication sequence of the mobile terminal 5 with the AAA server 11. The RGW 6 may perform an authentication sequence of the mobile terminal 5 with the proxy AAA server 22 connected to the destination high-speed wireless network 2.

  Thereafter, the RGW 6 or the proxy AAA server 22 requests connection permission from the access point 21 of the high-speed wireless network 2 at the movement destination. Thereby, the mobile terminal 5 can connect to the high-speed wireless network 2 without performing an authentication sequence via the high-speed wireless network 2 of the movement destination.

  FIG. 4 is a sequence diagram in FIG.

(S401) The mobile terminal 5 finishes the authentication process for the RGW 6 in advance. Therefore, a secure session is established between the mobile terminal 5 and the RGW 6 and data is concealed.

(S402) The mobile terminal 5 periodically transmits a location registration request to the RGW 6. Therefore, the mobile terminal 5 in the present invention does not directly transmit a location registration request to the HSS / HLR 12. The RGW 6 that has received the location registration request stores the location information included in the location registration request together with the mobile terminal identifier. Thereafter, the RGW 6 transfers the location registration request to the HSS / HLR 12.

(S403) The RGW 6 triggers the mobile terminal 5 to perform handover from the first access network to the second access network based on the service area information of the plurality of access networks 2 to 4 and the location information of the mobile terminal 5. Is detected. For example, it is detected that the mobile terminal 5 is approaching the boundary between two access networks. According to FIG. 3, the mobile terminal 5 detects a handover trigger from the mobile network 3 to the high-speed wireless network 2.

S404 to S409 correspond to the authentication sequence in FIG.
(S404) Upon detecting a handover, the RGW 6 transmits an EAP-response serving as an authentication start message to the AAA server, and starts authentication. According to FIG. 4, the EAP-response is transmitted to the proxy AAA server 22 connected to the destination high-speed wireless network 2. The EAP-response includes a mobile terminal identifier and IMSI, and an RGW identifier and IMSI. The proxy AAA server 22 transfers the EAP-response to the AAA server 11.

(S405) The AAA server 11 transmits a subscriber profile Request to the HSS / HLR 12 in order to confirm whether or not the mobile terminal 5 is permitted to connect to the high-speed wireless network 2. The subscriber profile Request includes the mobile terminal identifier and the IMSI. On the other hand, the HSS / HLR 12 searches for whether the mobile terminal identifier is permitted to connect to the high-speed wireless network 2 using the subscriber correspondence table. The HSS / HLR 12 returns a subscriber profile Response including the result to the AAA server 11.

(S406) If the mobile terminal 5 is permitted to connect to the high-speed wireless network 2, then the AAA server 11 transmits an authentication data Request including the mobile terminal identifier to the HSS / HLR 12. The authentication data Request includes the identifier of the mobile terminal and the IMSI. The HSS / HLR 12 generates a plurality of AVs based on the mobile terminal identifier included in the authentication data Request. The HSS / HLR 12 returns the authentication data Response including these AVs to the AAA server 11.

(S407) The AAA server 11 stores the AV included in the authentication data Response. Then, the AAA server 11 selects any one AV and transmits an EAP-Request / AKA-Challenge including the AV to the proxy AAA server 22. The proxy AAA server 22 transfers the received EAP-Request / AKA-Challenge to the RGW 6. Thereby, the RGW 6 confirms the network validity of the high-speed wireless network 2.

(S408) On the other hand, the RGW 6 transmits EAP-Response / AKA-Challenge carrying the value calculated in the RGW to the proxy AAA server 22. The proxy AAA server 22 transmits the received EAP-Response / AKA-Challenge to the AAA server 11. Thereby, the AAA server 11 confirms the legitimacy of the subscriber by the value included in EAP-Response / AKA-Challenge.

(S409) Next, the AAA server 11 transmits EAP-Success Keying including the key to the proxy AAA server 22. The proxy AAA server 22 transmits the received EAP-Success Keying to the RGW 6.

S410 to S413 correspond to the authentication sequence in FIG.
(S410) The RGW 6 transmits an EAP-Start requesting connection permission to the access point 21 of the high-speed wireless network 2 that is the movement destination. As another embodiment, the proxy AAA server 22 may transmit EAP-Start to the access point 21.
(S411) The access point 21 that has received EAP-Start knows that the mobile terminal 5 will be handed over. In response to this, the access point 21 transmits an EAP-Request to the RGW 6. In the case of the other embodiments described above, the access point 21 transmits an EAP-Request to the proxy AAA server 22.
(S412) Next, the RGW 6 transmits an EAP-Response to the access point 21. In the case of the other embodiments described above, the proxy AAA server 22 transmits an EAP-Response to the access point 21.
(S413) Further, the RGW 6 transmits an EAP-Success to the access point 21. In the case of the other embodiments described above, the proxy AAA server 22 transmits an EAP-Success to the access point 21.

(S414) Finally, the RGW 6 transmits the key to the mobile terminal 5. The mobile terminal may receive the handover trigger and transmit the notification to the RGW 6.
(S415) The mobile terminal 5 starts a handover process from the mobile network 3 to the high-speed wireless network 2.
(S416) Thereby, the mobile terminal 5 can be handed over from the mobile network 3 to the high-speed wireless network 2 without directly performing an authentication sequence with the AAA server 11. This is because the authentication sequence has already been executed between the RGW 6 and the AAA server 11.

  FIG. 5 is a functional configuration diagram of the RGW in the present invention.

  According to FIG. 5, the RGW includes a location registration request reception unit 601, a location registration storage unit 602, a location registration request transmission unit 603, a handover detection unit 604, an authentication start message transmission unit 605, and an authentication sequence execution unit. 606, a connection permission sequence execution unit 607, and an IP conversion unit 608. These functional units can also be realized by executing a program that causes a computer mounted on the RGW to function. The RGW is equipped with an ISIM.

  The location registration request receiving unit 601 periodically receives location registration requests from mobile terminals.

  The location registration storage unit 602 stores location information included in the location registration request together with the mobile terminal identifier. The location registration storage unit 602 stores the table of Table 1 described above.

  The location registration request transmission unit 603 transfers the location registration request to the subscriber management server. The operation of S402 in FIG. 4 described above is realized.

  Based on the service area information of the plurality of access networks and the location information of the mobile terminal stored in the location registration storage unit 602, the handover detection unit 604 is configured so that the mobile terminal can change from the first access network to the second access network. Detect a trigger to hand over to. The operation of S403 in FIG. 4 described above is realized.

  Moreover, it is preferable that the handover detection unit 604 is configured to receive a trigger message for handing over the mobile terminal to the second access network from the mobile terminal or another communication device. In this embodiment, the handover detection unit 604 does not require a location registration request from the mobile terminal.

  The authentication start message transmission unit 605 transmits an authentication start message based on the authentication protocol to the authentication server when the mobile terminal hands over to the second access network. The operation of S404 in FIG. 4 described above is realized.

  The authentication sequence execution unit 606 executes an authentication sequence with the authentication server. The operations of S407 to S409 in FIG. 4 described above are realized.

  The connection permission sequence execution unit 607 transmits a connection permission request to the access base station of the second access network that is the destination of the mobile terminal, and executes the connection permission sequence. Further, the connection permission sequence execution unit 607 transmits the key to the mobile terminal. The operation | movement of S410-S415 in FIG. 4 is implement | achieved.

  The IP conversion unit 608 converts an input / output signal of a communication device connected to the RGW and an IP packet to the fixed network 4 between each other.

  The ISIM 609 is an IC card and includes a gateway identifier and an IMSI.

As described above in detail, according to the authentication method and system of the present invention, the authentication sequence performed between the mobile terminal and the AAA server is performed between the gateway installed by the subscriber of the mobile terminal and the AAA server. Can be done. The gateway is normally connected by wire, and can realize the authentication sequence at high speed. Further, since the mobile terminal and the gateway are managed by the same subscriber, it is not necessary to store the subscriber information in a node on the network, and the safety is improved. Furthermore, since the authentication sequence is not performed via the radio link between the mobile terminal and the access base station, the use of radio resources can be reduced.

  According to the various embodiments of the present invention described above, those skilled in the art can easily make various changes, modifications and omissions within the scope of the technical idea and the viewpoint of the present invention. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

It is a system block diagram in a prior art. It is a sequence diagram in the system of FIG. It is a system configuration diagram in the present invention. FIG. 4 is a sequence diagram in the system of FIG. 3. It is a functional block diagram of RGW in this invention.

Explanation of symbols

1 Integrated network 11 AAA server 12 HSS / HLR
2 high-speed wireless network 21 access point 22 proxy AAA server 3 mobile network 31 base station 4 fixed network 5 mobile terminal 6 RGW, gateway 601 location registration request reception unit 602 location registration storage unit 603 location registration request transmission unit 604 handover detection unit 605 authentication Start message transmission unit 606 Authentication sequence execution unit 607 Connection permission sequence execution unit 608 IP conversion unit 609 ISIM
7 Personal computer

Claims (8)

A plurality of interconnected access networks ;
An authentication server connected to the carrier network to authenticate the terminal ;
A subscriber management server connected to the operator network to determine whether or not network connection is possible;
A home gateway connected to any one of the access networks by wire and located in the subscriber premises ;
For systems with <br/> a mobile terminal connected to a first access network, An authentication method in a handover of the mobile terminal,
The mobile terminal is equipped with a SIM (Subscriber Identity Module) including a mobile terminal identifier and / or subscriber information,
The home gateway is equipped with a SIM that includes a gateway identifier and / or subscriber information;
The subscriber management server stores connection permission network information in association with a mobile terminal identifier and / or subscriber information of the mobile terminal and a gateway identifier and / or subscriber information of the home gateway,
The home gateway, when detecting a trigger handover to the second access network in the mobile terminal, a mobile terminal identifier and / or subscriber information of the mobile terminal, a gateway identifier and / or subscriber of the home gateway A first step of transmitting an authentication start message including the person information to the authentication server;
The authentication server uses the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway to the subscriber management server, and the connection permission network. A second step for inquiring whether connection is possible based on the information;
A third step in which the authentication server executes an authentication sequence based on an authentication protocol with the home gateway if connection is possible based on the connection-permitted network information ;
A fourth step in which the home gateway or the authentication server requests connection permission from an access base station of a second access network;
An authentication method comprising: a fifth step in which the mobile terminal connects to the access base station of a second access network without executing an authentication sequence. The subscriber management server further stores and manages location information of the mobile terminal ,
As pre-stage of the first step, the mobile terminal, a location registration request, the steps of: periodically transmitting to the home gateway, the home gateway, the location information included in the location registration request with the mobile terminal identifier Storing, and transferring the location registration request to the subscriber management server,
In the first step, the gateway triggers a handover from the first access network to the second access network by the mobile terminal based on service area information of a plurality of access networks and location information of the mobile terminal. The authentication method according to claim 1, wherein the authentication method is executed upon detection.   The first step is performed when a trigger message for handing over the mobile terminal to a second access network is received from the mobile terminal or another communication device. Authentication method. The access network is a high-speed wireless network, a mobile network or a fixed network,
The plurality of access networks are interconnected by an integrated network;
The home gateway is the the fixed network connected by wire the R GW (Residential GateWay),
Said access the base stations connected by radio link to the mobile terminal, the access point of the high-speed wireless networks, or, according to any one of claims 1 to 3, characterized in that the base station of the mobile network Authentication method. A plurality of interconnected access networks ;
An authentication server connected to the carrier network to authenticate the terminal ;
A subscriber management server connected to the operator network to determine whether or not network connection is possible;
A home gateway connected to any one of the access networks by wire and located in the subscriber premises ;
That having a <br/> a mobile terminal connected to a first access network, a mobile terminals handover system,
The mobile terminal is equipped with a SIM including a mobile terminal identifier and / or subscriber information;
The home gateway is equipped with a SIM that includes a gateway identifier and / or subscriber information;
The subscriber management server stores connection permission network information in association with a mobile terminal identifier and / or subscriber information of the mobile terminal and a gateway identifier and / or subscriber information of the home gateway,
The home gateway is
A handover detection unit that detects a trigger handover to the second access network in the mobile terminal,
When the handover trigger is detected, an authentication start message including a mobile terminal identifier and / or subscriber information of the mobile terminal and a gateway identifier and / or subscriber information of the home gateway is transmitted to the authentication server. Authentication start message sending means
Authentication sequence execution means for executing an authentication sequence based on an authentication protocol with the authentication server;
Have
The authentication server is
Whether to connect to the subscriber management server based on the connection-permitted network information using the mobile terminal identifier and / or subscriber information of the mobile terminal and the gateway identifier and / or subscriber information of the home gateway With the ability to query
A function of executing an authentication sequence based on an authentication protocol with the home gateway when connection is possible based on the connection-permitted network information;
Have
The home gateway or the authentication server, to a second access network of the access base station, by Rukoto to request a connection permission, prior Symbol mobile terminal, without performing the authentication sequence, wherein the second access network A handover system characterized by connecting to an access base station. The subscriber management server further stores and manages location information of the mobile terminal ,
The home gateway, from said mobile terminal, a location registration request receiving means for receiving a location registration request regular basis,
Location registration storage means for storing location information included in the location registration request together with a mobile terminal identifier ;
Location registration request transmitting means for transferring the location registration request to the subscriber management server ;
Have
The handover detecting means, and the service area information of a plurality of access networks, based on the position information of the mobile terminal, that issues detected a trigger for handover from the first access network by the mobile terminal to the second access network handover system of claim 5, wherein the this. 6. The handover system according to claim 5 , wherein the handover detection unit receives a trigger message for the mobile terminal to perform handover to the second access network from the mobile terminal or another communication apparatus. The access network is a high-speed wireless network, a mobile network or a fixed network,
The plurality of access networks are interconnected by an integrated network;
The home gateway is R G W connected by wire to the fixed network,
Said access base station to be connected by radio link to the mobile terminal, the access point of the high-speed wireless networks, or, according to any one of claims 5 to 7, characterized in that the base station of the mobile network Handover system.

Images