KR100723678B1 - Method and System for Preventing Handset Replication in 1x EV-DO Packet Network - Google Patents

Abstract

The present invention relates to a method and system for preventing duplication of a terminal as a circuit network authentication interworking protocol in a 1x EV-DO packet network.

The present invention is a system for preventing duplication of a terminal using a circuit network authentication interworking protocol, a mobile communication terminal, an access network, AN_AAA (Access Network-Authorization Authentication) provided with a high-speed data service through the 1x EV-DO system Accounting: In a 1x EV-DO system including an access network authentication server), a public switched telephone network, a mobile switching center, the Internet, and a router, whether or not to subscribe to authentication in a circuit network is a customer oriented information system (COIS). A Combined EV-DO Data Base (CEDB), which is a database that receives and stores the authentication subscription from the AN_AAA and stores the subscriber information of the EV-DO service; And an AC (Authentication Center) for interworking with the AN_AAA and responding to the AN_AAA with a success or failure message of a CAVE authentication method for the subscriber requested by the AN_AAA, wherein the AC is a CAVE authentication method. AUTHR (Authentication Result) which is an output value of the AUTHR value and COUNT value received from the mobile communication terminal is compared to perform the CAVE authentication method for determining whether the authentication succeeds or fails, and the result of performing the CAVE authentication Provided is a system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network characterized by transmitting to AN_AAA.

According to the present invention, in order to prevent the use of the terminal duplicated ESN in the EV-DO network has a common promise value between the terminal and the AC and provides a circuit type authentication mechanism that allows access after comparing and confirming the existing terminal It can eliminate the effect on the network and make an efficient network configuration.

1x EV-DO, Copy Protection, CEDB, CAVE Certified, MIN, ESN, Circuit

Description

Method and System for Preventing Handset Replication in 1x EV-DO Packet Network

1 is a block diagram schematically illustrating a configuration of a system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network according to a preferred embodiment of the present invention;

2 is a flowchart illustrating a process of preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network according to an embodiment of the present invention;

FIG. 3 is a block diagram illustrating block characteristics of a system according to an exemplary embodiment of the present invention. FIG.

<Description of Symbols for Main Parts of Drawings>

100: hybrid terminal 110: access network

112: BTS 114: BSC

116: mobile switching center 118: public switched telephone network

120: ANTS 122: ANC

124: Packet Data Serving Node (PDSN) 126: Home Agent

128: Router 130: AAA (Authentication Server)

132: Internet 134: DLR

136: Access Network Authentication Server (AN_AAA) 138: AC

140: CEDB

The present invention relates to a method and system for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network. More specifically, in the process of using the 1x EV-DO service, the AUTHR (Authentication Result) value and the COUNT value promised between the hybrid terminal and the AC (Authentication Center) are compared and allowed to connect to the hybrid terminal having the same value. A method and system for preventing the use of a terminal.

The mobile communication system has been developed through a first generation analog AMPS (Advanced Mobile Phone System) method and a second generation cellular / personal communication service (PCS) method. International Mobile Telecommunication-2000 (IMT-2000) has been developed.

The IMT-2000 service may be classified into a code division multiple access (CDMA) 2000 1X service and a CDMA 2000 1x EV-DO service. The CDMA 2000 1X service uses the IS-95C network, which has evolved from the existing IS-95A and IS-95B networks. Internet-enabled service. Accordingly, the CDMA 2000 1X service enables the improvement of existing voice and WAP (Wireless Application Protocol) service quality as well as the provision of various multimedia services (AOD, VOD, etc.).

Meanwhile, the IMT-2000 system for the multimedia mobile communication service defined the standard of the synchronous IMT-2000 system in the 3rd Generation Partnership Projects (3GPP2), an international standardization organization. The method based on High Data Rate (HDR) was named "CDMA 2000 1x Evolution Data Optimized (EV-DO)" and was confirmed as an international standard. CDMA 2000 1x EV-DO (hereinafter, referred to as '1x EV-DO') is a communication standard of CDMA 2000 1X (hereinafter, referred to as '1X'). to be.

The 1X system provides a one-way high-speed data service with a transmission rate of up to 307.2 Kbps in the form of a mixed circuit circuit and packet network. On the other hand, the 1x EV-DO system provides a bidirectional high speed data service having a transmission rate of up to 2.4 Mbps for packet networks only.

However, these 1x EV-DO systems are currently used interchangeably with existing 1X systems. That is, the 1x EV-DO system and the 1x system are mixed in hardware in one wireless base station or base station controller, and operations are performed separately. In other words, the base station transmitter is provided with a channel card for the 1x EV-DO system and a channel card for the 1x system, respectively. In addition, the base station controller is also provided with a data processing board for processing packet data transmitted and received in the 1x EV-DO system and a data processing board for processing data transmitted and received in the 1x system.

On the other hand, the illegal call protection method used in the general mobile communication terminal detects a call attempt by two or more terminals having the same ESN, MIN information by using the ESN (Electrical Serial Number) and MIN (Mobile Identification Number) It was to block simultaneous calls by the counterfeit terminal in the same packet network. However, the EV-DO system prevents the use of illegal copy terminals through two processes, terminal authentication and user authentication. However, since terminal authentication uses HASH values based on Username=MIN@hrpd.nate.com and Password = ESN through AN_AAA, ESN terminal replication cannot be protected. In addition, since user authentication uses Username=sktelecom@wap95c.n-top.com and Password = NULL for AAA (Authorization Authentication Accounting), there is a problem that cannot be defended against ESN terminal replication. Therefore, there is a need for a method for effectively preventing ESN duplication of EV-DO Only terminals.

In order to solve the above problems, the present invention, the present invention compares the AUTHR (Authentication Result) value and COUNT value promised between the hybrid terminal and the authentication center (AC) in the process of using the 1x EV-DO service is the same value It is an object of the present invention to provide a method and system for preventing the use of a duplicated terminal by allowing access to the identified hybrid terminal.

In order to achieve the above object, the present invention provides a system for preventing duplication of a terminal using a circuit network authentication interworking protocol, and includes a mobile communication terminal, an access network, and a high-speed data service provided through the 1x EV-DO system. In the 1x EV-DO system including AN_AAA (Access Network-Authorization Authentication Accounting), public switched telephone network, mobile switching center, Internet, and router, whether or not authentication is registered in the circuit network is a customer information system. A combined EV-DO data base (CEDB), which is a database that receives and stores a received from a COIS (Customer Oriented Information System) and notifies the AN_AAA of whether to subscribe to the authentication, and stores subscriber information of an EV-DO service; And an AC (Authentication Center) for interworking with the AN_AAA and responding to the AN_AAA with a success or failure message of a CAVE authentication method for the subscriber requested by the AN_AAA, wherein the AC is a CAVE authentication method. AUTHR (Authentication Result) which is an output value of the AUTHR value and COUNT value received from the mobile communication terminal is compared to perform the CAVE authentication method for determining whether the authentication succeeds or fails, and the result of performing the CAVE authentication Provided is a system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network characterized by transmitting to AN_AAA.

In addition, according to another object of the present invention, a mobile communication terminal receiving a data service through the 1x EV-DO system; An access network for delivering voice and packet data to the mobile communication terminal; A communication access path for a communication call from the mobile communication terminal connected to the access network and an access network authentication server (AN_AAA) for authenticating the mobile communication terminal and authorizing the data service; A mobile telecommunication switching center providing a; Receives and stores whether or not an authentication subscription of a circuit network, and informs the AN_AAA (Access Network-Authorization Authentication Accounting) whether or not the authentication subscription, and determines whether the authentication success for the subscriber to respond to the AN_AAA In 1x EV-DO system including a combined EV-DO data base (CEDB), which is a database for storing subscriber information of AC (Authentication Center) and EV-DO service, a circuit network authentication interworking protocol is used in 1x EV-DO packet network A method for preventing copying of a terminal, comprising: (a) a value (16 Octet for MD5 ∥ AUTHR indicating an inherent value of the mobile communication terminal for copy protection as a parameter of CHAP Response from the mobile communication terminal in an ANC; COUNT), receiving a Name (MIN@hrpd.nate.com); (b) In the ANC, User-Name (MIN@hrpd.nate.com), CHAP-Password (16 Octet for MD5), CHAP-Challenge, and CAVE-Password (AUTHR ∥ COUNT), which are parameters of AccessRequest, are set as the Value. Transmitting to the AN_AAA; (c) receiving an MIN and an ESN together with a field value indicating whether the corresponding service subscriber performs circuit authentication by transmitting a subscriber information request signal from the AN_AAA to the CEDB; (d) determining whether the mobile communication terminal is subscribed to a circuit network authentication service using the CEDB in the AN_AAA; (e) receiving a CAVE (Cellular Authentication and Voice Encryption) authentication request signal received from the AN_AAA at the AC and performing a CAVE authentication method using a RAND value using upper 32 bits of a CHAP Challenge; And (f) comparing the AUTHR which is the output value of the CAVE authentication method, the AUTHR value and the COUNT value received from the mobile communication terminal, and determining whether the authentication succeeds or fails by determining the success or failure of the AC as a successful / failure. Generating an AUTH RES (Authentication Response) message including a value and transmitting the same to the AN_AAA; and a method for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network. To provide.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First of all, in adding reference numerals to the components of each drawing, it should be noted that the same reference numerals are used as much as possible even if displayed on different drawings. In addition, in describing the present invention, when it is determined that the detailed description of the related well-known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

1 is a block diagram schematically illustrating a configuration of a system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network according to a preferred embodiment of the present invention.

A system for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network according to a preferred embodiment of the present invention comprises a hybrid access terminal (HAT) 100 and an access network (AN). : Access Network (110), Mobile Switching Station (116), Public Switched Telephone Network (PSTN) 118, Packet Data Serving Node (PDSN) 124, Home Agent (HA) Home Agent (126), Router (128), Internet (132), Authentication Authorization Accounting (AAA) (130), Data Location Register (DLR) (134), Access Network Authentication Server (AN-AAA: Access Network-Authorization Authentication Accounting (136), Authentication Center (AC) 138, Combined EV-DO Data Base (CEDB) 140, and the like.

Currently, 1x EV-DO systems are used interchangeably with existing 1X systems. That is, the 1x EV-DO system and the 1X system are mixed in hardware in one access network 110, and operations are performed separately. In other words, the access network 110 is provided with a channel card and channel board for 1x EV-DO system and a channel card and channel board for 1x system, respectively.

Accordingly, the access network 110 includes a BTS 112 and a BSC 114 of a 1X system, and an 1x EV-DO transmitter (ANTS: ANTS) for the 1X EV-DO system. 120) and a 1x EV-DO controller (ANC: Access Network Controller, hereinafter referred to as 'ANC') (122). Accordingly, when packet data is transmitted to the hybrid terminal 100, the packet data is transmitted through the 1x EV-DO system. When voice data is transmitted, the packet data is transmitted through the 1x system.

The hybrid terminal 100 also receives voice service through the 1X system, and has a hardware-separated configuration so that high-speed data service can be provided through the 1x EV-DO system. The hybrid terminal 100 is set to switch to 1X mode to communicate through the 1X system in the standby state, and then switches to the 1x EV-DO mode at regular intervals to check whether the call is received by the 1x EV-DO system. Perform the operation to return to 1X mode.

When the hybrid terminal 100 receives data through the 1x EV-DO system in the 1x EV-DO mode, the hybrid terminal 100 typically receives a large amount of data from the access network 110. In case of a forward transmission for transmitting data in 100), channels divided by a code division multiple access (CDMA) scheme are transmitted through a time slot divided into time division multiplexing (TDM). In the case of reverse transmission transmitted from the hybrid terminal 100 to the ANTS 120 and the ANC 122, the existing CDMA scheme is used as it is to accommodate a large number of users.

In addition, while receiving the data in the traffic state of the 1x EV-DO mode, the hybrid terminal 100 switches to the 1X mode at regular intervals and checks again whether there is an incoming call such as a voice signal using the 1X system. The operation of returning to the 1x EV-DO mode is repeatedly performed.

The BTS 112 provides a mobile communication service including voice and data to the hybrid terminal 100 through an air interface. In addition, the BTS 112 performs location registration to determine the location of the hybrid terminal 100 existing in the cell area under its control. The BTS 112 may obtain information such as latitude and longitude of the BTS 112 from the Global Positioning System (GPS), and use the hybrid terminal to transmit the position information of the BTS 112 through a system parameter message of the forward link call channel. Forward to 100. The hybrid terminal 100 may register new location information by calculating a moving distance of the hybrid terminal 100 itself using the location information of the BTS 112 of the cell to which the hybrid terminal 100 belongs.

The BSC 114 performs various functions required for radio call processing such as handoff while controlling and managing the BTS 112. That is, the BSC 114 for controlling voice or data transmission transmits the voice signal transmitted from the BTS 112 to the mobile communication switching center 116, and the data signal transmitted from the BTS 112 transmits the packet data serving node 124. To send).

The mobile switching center 116 physically connects the multiple BSCs 114 to another mobile switching center or public switched telephone network 118 to provide an access path for voice calls to the communication call from the hybrid terminal 100. .

In addition, the mobile communication switching center 116 is a home location register (HLR), which is a database that stores information of the hybrid terminal 100 registered with the hybrid terminal 100 within its own area. The user's call is processed by obtaining profile information of the hybrid terminal 100 from a visitor location register (VLR), which is a database that stores the information. The profile information stores information on a mobile identification number (hereinafter referred to as 'MIN'), an electrical serial number (ESN), and subscribed additional services of the hybrid terminal 100. .

The public switched telephone network 118 is a wired public telephone network provided by a general wired communication service provider, and connects a telephone line to a telephone exchange facility, thereby connecting a hybrid terminal 100 and a landline telephone, between a hybrid terminal 100 and an AT, and a general landline telephone. It is a network configured to talk between them.

The ANTS 120 serves to transmit packet data to the hybrid terminal 100, and the ANC 122 serves to transmit data between the ANTS 120 and the packet data serving node 124. In addition, the ANC 122 is connected to the DLR 134 and the AN_AAA 136.

Since the PDSN (packet data serving node) 124 and the home agent 126 exchange and manage the location of the hybrid terminal 100 by exchanging a fixed IP address and a temporary IP address of the hybrid terminal 100, the hybrid terminal ( 100) can always receive data service regardless of location even when moving. Router 128 is used for connection with the Internet 132.

AAA 130 is a function of verifying the status of the bandwidth, service, etc. of the hybrid terminal 100 to authenticate, the function of encrypting data using an encryption key (transmission) to transmit and receive data through the Internet 132, encryption A level management function and a data collection function for charging and settlement of the hybrid terminal 100 are performed.

The AN_AAA 136 has a function of authenticating and authorizing the hybrid terminal 100 to use the data service through the access network 110 and whether the hybrid terminal 100 is subscribed to the circuit network authentication service from the CEDB 140. Receives information on whether or not, and receives an AUTH RES (Authentication Response) message including a Successful / Failure parameter indicating whether authentication succeeded from the AC (138). Therefore, AN_AAA 136 stores the service status information such as MIN, ESN and service request, termination, outgoing / suspended of the hybrid terminal 100.

Here, the AN_AAA 136 authenticates the hybrid terminal 100 accessing the access network 110 using a standardized Challenge Handshake Authentication Protocol (CHAP). Here, the CHAP authentication method is one of the authentication protocols for the Point-to-Point Protocol (PPP) used for dial-up Internet Protocol (IP) connection, and is a password among user ID and password. It refers to a technology for authenticating the hybrid terminal 100 by transmitting the encrypted.

The DLR 134 allocates a unicast access terminal identifier (UATI) to the hybrid terminal 100 and manages location information of the hybrid terminal 100. Here, UATI is an access terminal identifier for identifying the hybrid terminal 100 on the air standardized by 3GPP2 and is newly generated in the DLR 134 whenever the hybrid terminal 100 moves within a radius of the base station. That is, over the air, UATI is used as an access terminal identifier, and MIN or IMSI (International Mobile Station Identity) is used as an access terminal identifier in a wired network. IMSI is a number that includes a country code (MCC), a mobile network code (MNC) and a MIN.

When the hybrid terminal 100 is authenticated by the AN_AAA 136 and the UATI is allocated by the DLR 134, the Internet 132 through the packet data serving node 124 and the packet data serving node 124 in the same manner as the data communication in the 1X system. Data service is performed.

The AC 138 interworks with the AN_AAA 136 and determines the success of the CAVE authentication scheme for the subscriber requested by the AN_AAA 136 and responds to the AN_AAA 136. The CAVE authentication method compares AUTHR (Authentication Result) which is an output value of the CAVE authentication method in the AC 138 with the AUTHR value and the COUNT value received from the hybrid terminal, and determines whether the authentication succeeds or fails.

In addition, when the CAVE authentication method succeeds, the AC 138 transmits an AUTH RES (Authentication Response) message having a Successful value as a parameter to the AN_AAA 136, and the AN_AAA 136 receives the AN_AAA 136 to the ANC 122. Transmit Access Accept signal. If the CAVE authentication method is not successful, the AC 138 transmits an AUTH RES (Authentication Response) message having a Failure value as a parameter to the AN_AAA 136, and the AN_AAA 136 receives the access to the ANC 122. Send Fail signal.

In addition, the AC 138 receives a CAVE authentication request signal transmitted from the AN_AAA 136, an AUTHR which is an output value of the CAVE authentication method from the AC 138, and an AUTHR value and COUNT received from the hybrid terminal. Comparator for CAVE authentication method that compares the values to determine whether the authentication succeeds or fails. It is a kind of central processing unit that controls the overall operation of AC 138 and generates the result information of CAVE authentication method. It has a structure including a transmission unit for transmitting to the AN_AAA (136).

Here, the hybrid terminal 100 is equipped with communication software and / or communication hardware interlocked with the AC (138), in the case of the communication software can be implemented in a form that can be downloaded from the AC (138).

The CEDB 140 receives and stores whether or not the authentication is registered in the circuit network from a customer oriented information system (COIS), and notifies AN_AAA (Access Network-Authorization Authentication Accounting) of the authentication. Database that stores subscriber information of DO service. The main components of the CEDB 140 include a data receiver for receiving a subscriber information request signal from the AN_AAA 136, user information included in the subscriber information request signal for the EV-DO service, and subscriber information for the EV-DO service. A data comparison unit to compare, a subscriber information database unit that stores subscriber information for the EV-DO service, and a transmission unit for transmitting subscriber information of the EV-DO service including circuit authentication subscription to the AN_AAA 136.

2 is a flowchart illustrating a process of preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network according to a preferred embodiment of the present invention.

Through the LCP Negotiation procedure of the PPP (Point to Point Protocol), the ANC 122 transmits a signal requesting the hybrid terminal 100 to perform the MD5 type CHAP authentication method (S200). Here, the ANC 122 transmits a signal for requesting to perform the MD5 CHAP authentication method except the CAVE authentication method to the hybrid terminal 110 so that the conventional mobile communication terminal performs only the MD5 CHAP authentication method. It is designed to prevent this, because a malfunction may occur when a CAVE authentication method is requested.

The hybrid terminal 100 receives a signal for requesting the execution of the MD5 type CHAP authentication method and then sends a CAVE & MD5 signal to the LCP Configure-Ack that can support not only the MD5 type CHAP authentication method but also the circuit type CAVE authentication method. It generates and transmits to the ANC (122) (S202). Here, the CAVE & MD5 signal is a signal indicating that the hybrid terminal 100 can perform not only the CHAP authentication method, which is the 1X EV-DO authentication method of the existing MD5 method, but also the CAVE authentication method of the circuit method. The hybrid terminal 100 generates Value (16 Octet for MD5 ∥ AUTHR COUNT) and User-Name (MIN@hrpd.nate.com) as a parameter of CHAP Response and transmits it to the ANC 122.
The ANC 122 receives the CAVE & MD5 signal from the hybrid terminal 100 and recognizes that the hybrid terminal 110 can perform both the MD5 type CHAP authentication method and the circuit type CAVE authentication method, and the hybrid terminal 100. In step S204, a signal for requesting to perform the CHAP authentication method of the MD5 method and the CAVE authentication method of the MD5 method is transmitted.

The hybrid terminal 110 receives a signal (LCP Configure-Request) for requesting the execution of the MD5 type CHAP authentication method and the circuit type CAVE authentication method from the ANC 122, and in response thereto, the MDAP type CHAP authentication method. A response signal (LCP Configure-Ack) to perform the operation is transmitted to the ANC 122 (S206). The ANC 122 transmits the value of the CHAP Challenge to the hybrid terminal 100 (S208).

Recognizing the upper 32 bits of the CHAP Challenge as the RAND value, performing the CAVE authentication method using the Shared Secret Data-Authentication (SSD_A) value, the value stored in the hybrid terminal 100 and used for circuit authentication, and MIN and ESN. Create an AUTHR. The ANC 122 receives Value (16 Octet for MD5 ∥ AUTHR COUNT) and User-Name (MIN@hrpd.nate.com) as a parameter of CHAP Response from the hybrid terminal 100 (210).

ANC 122 is a value received from the hybrid terminal, User-Name (MIN@hrpd.nate.com), CHAP-Password (16 Octet for MD5), CHAP-Challenge, CAVE-Password (AUTHR ∥ COUNT) ) Is set and transmitted to AN_AAA (136) (S212). In order to obtain subscriber information, AN_AAA 136 transmits a subscriber information request signal to CEDB 140 (S214).

The CEDB 140 determines whether the user of the hybrid terminal 100 is subscribed to the circuit network authentication service. The CEDB 140 stores an AuthServiceProfile, which is a field value indicating whether the service subscriber performs circuit authentication, and transmits the AuthServiceProfile to the AN_AAA 136 together with the MIN and the ESN (S216).

When the hybrid terminal 100 is subscribed to the circuit network authentication service, the CEDB 140 notifies this to the AN_AAA 136, and the AN_AAA 136 requests an AUTH REQ (Authentication Request) requesting to perform the CAVE authentication method. The message is transmitted to the AC 138 (S218). Here, the AUTH Authentication Request (REQ) message includes MIN, RAND, AUTHR, COUNT, etc., and the RAND value uses the upper 32 bits of the CHAP Challenge. If the hybrid terminal 100 is not subscribed to the circuit authentication service, the CEDB 140 notifies the AN_AAA 136, and the AN_AAA 136 performs the existing MD5 CHAP authentication method.

Upon receiving the AUTH REQ (Authentication Request) message, the AC 138 performs the CAVE authentication method, and compares AUTHR, the output value of the CAVE authentication method, and AUTHR and COUNT values received from the hybrid terminal to determine whether the authentication succeeds or fails. By determining, the CAVE authentication method is performed. The AC 138 transmits an AUTH RES (Authentication Response) message having a parameter of Successful / Failure value to the AN_AAA 136 as a result of performing the CAVE authentication method (S220).

If the CAVE authentication method succeeds, the AC 138 transmits an AUTH RES message having a Successful value to the AN_AAA 136, and the AN_AAA 136 transmits an Access Accept to the ANC 122 (S222). If the CAVE authentication method fails, the AC 138 transmits an AUTH RES message having a Failure value to the AN_AAA 136, and the AN_AAA 136 transmits an Access Reject to the ANC 122.

The ANC 122 transmits a CHAP Success or CHAP Failure signal indicating whether the final authentication succeeds to the hybrid terminal 100 (S224).

FIG. 3 is a block diagram illustrating block characteristics of a system according to an exemplary embodiment of the present invention. FIG.

AC 138 works in conjunction with AN_AAA 136. That is, the AN_AAA 136 determines whether the authentication succeeds for the requested subscriber and responds with the AN_AAA 136.

AN_AAA 136 determines whether to perform AC 138 authentication. That is, by analyzing the subscriber information received from the CEDB 140, the authentication request to the AC (138) when the circuit authentication subscription. In addition, there is an AC 138 interworking function to generate an authentication message for circuit authentication to interwork with the AC (138).

The CEDB 140 receives and stores the circuit certification subscription from the COIS in conjunction with the COIS. In addition, the AN_AAA 136 notifies the AN_AAA 136 of the circuit authentication subscription.

The ANC 122 performs LCP Negotiation of the CAVE authentication method with the hybrid terminal. That is, when the algorithm request of the hybrid terminal 100 and the CHAP authentication method of the CAVE authentication method performs the LCPNegotiation of the terminal and the CAVE authentication method. In addition, when the hybrid terminal 100 receives an output value (AUTHER, COUNT) of the CAVE authentication method for the authentication request, the hybrid terminal 100 transmits an Access Request including the CAVE-Password to the AN_AAA (136).

The hybrid terminal 100 performs CAVE LCP Negotiation. That is, Negotiation is performed when the algorithm of CHAP authentication method using CAVE authentication method from the network is required. In addition, to perform the CHAP authentication algorithm through the CAVE authentication algorithm, AUTHR using SSD_A (Shared Secret Data- Authentication), MIN, ESN and RAND (CHAP Challenge) received from the network stored in the hybrid terminal 100. Create

In the above description, a method and a system for preventing duplication of the hybrid terminal 100 in the 1X EV-DO system as a preferred embodiment of the present invention have been described. However, the present invention is not limited thereto, and the hybrid terminal 100 as well as the EV- It can be used to prevent duplication of all mobile communication terminals capable of performing the DO service.

The above description is merely illustrative of the technical idea of the present invention, and those skilled in the art to which the present invention pertains may make various modifications and changes without departing from the essential characteristics of the present invention. Therefore, the embodiments disclosed in the present invention are not intended to limit the technical idea of the present invention but to describe the present invention, and the scope of the technical idea of the present invention is not limited by these embodiments. The protection scope of the present invention should be interpreted by the following claims, and all technical ideas within the equivalent scope should be interpreted as being included in the scope of the present invention.

As described above, according to the present invention, since the AUTHR (Authentication Result) value and the COUNT value promised between the hybrid terminal and the AC (Authentication Center) are compared, the access is allowed to the hybrid terminal whose value matches. You can prevent it. That is, only hybrid terminals that have received the CAVE authentication scheme of the circuit type can be used to block the use of the terminal that duplicates the ESN (Electrical Serial Number) in the EV-DO network.

Claims (11)

A system for preventing duplication of a terminal using a circuit network authentication interworking protocol, comprising: a mobile communication terminal, an access network, and an Access Network-Authorization Authentication Accounting (AN_AAA), which receives a high-speed data service through the 1x EV-DO system. 1x EV-DO system comprising a network authentication server), a public switched telephone network, a mobile switching center, the Internet, and a router, CEDB, which is a database for receiving and storing authentication subscription in circuit network from COIS (Customer Oriented Information System) which is a customer information system, and notifying AN_AAA of the authentication subscription, and storing subscriber information of EV-DO service. (Combined EV-DO Data Base); And An AC (Authentication Center) that interworks with the AN_AAA and responds to the AN_AAA with a message indicating whether the CAVE (Cellular Authentication and Voice Encryption) authentication method succeeds for the subscriber requested by the AN_AAA. It includes, but the AC performs the CAVE authentication method to determine whether the authentication success or failure by comparing the AUTHR (Authentication Result), the output value of the CAVE authentication method and the AUTHR value and COUNT value received from the mobile communication terminal and And a circuit for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network, wherein the result of performing the CAVE authentication is transmitted to the AN_AAA. The method of claim 1, The mobile communication terminal uses a circuit network authentication interworking protocol in a 1x EV-DO packet network, which generates Value (16 Octet for MD5 ∥ AUTHR COUNT) and User-Name as a parameter of CHAP Response and transmits it to the ANC. System to prevent duplication of the terminal. The method of claim 2, The ANC sets the User-Name, CHAP-Password (16 Octet for MD5), CHAP-Challenge, and CAVE-Password (AUTHR ∥ COUNT) as parameters of an AccessRequest and transmits the Value received from the mobile communication terminal to the AN_AAA. A system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network. The method of claim 1, wherein the CEDB, A circuit network authentication is performed in a 1x EV-DO packet network, comprising an AuthServiceProfile which is a field value indicating whether circuit authentication is performed for a subscriber of the EV-DO service, and transmitting the AuthServiceProfile to the AN_AAA together with a MIN and an ESN. System for preventing duplication of a terminal by using an interworking protocol. The method of claim 4, wherein the AN_AAA is, When the mobile communication terminal is subscribed to the circuit network authentication service, MIN, RAND, AUTHR and COUNT are transmitted to the AC, and when the mobile communication terminal is not subscribed to the circuit network authentication service, the existing MD5 type CHAP A system for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network, characterized by performing an authentication method. delete The method of claim 1, wherein the AC, If the CAVE authentication method succeeds, an AUTH RES (Authentication Response) message having a Successful value as a parameter is transmitted to the AN_AAA as an authentication success message; if the CAVE authentication method fails, AUTH having a Failure value as a parameter to the AN_AAA A system for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network, characterized by transmitting an RES (Authentication Response) message as an authentication failure message. The method of claim 1, wherein the AC, A data receiver configured to receive a CAVE authentication request signal transmitted from the AN_AAA; A comparison unit for determining whether the CAVE authentication method succeeds or fails by comparing AUTHR which is an output value of the CAVE authentication method in the AC, the AUTHR value and the COUNT value received from the mobile communication terminal; A control unit for controlling overall operation of the AC and generating result information of the CAVE authentication method; And Transmitter for transmitting the result information to the AN_AAA A system for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network comprising a. The method of claim 1, wherein the CEDB, A data receiver configured to receive a subscriber information request signal for the EV-DO service from the AN_AAA; A subscriber information database unit storing subscriber information on the EV-DO service; A data comparison unit comparing user information included in the subscriber information request signal for the EV-DO service with subscriber information for the EV-DO service; And Transmitter for transmitting user information on the EV-DO service, including whether the network network authentication service subscription to the AN_AAA A system for preventing duplication of a terminal by using a circuit network authentication interworking protocol in a 1x EV-DO packet network comprising a. A mobile communication terminal receiving a data service through the 1x EV-DO system; An access network for delivering voice and packet data to the mobile communication terminal; A communication access path for a communication call from the mobile communication terminal connected to the access network and an access network authentication server (AN_AAA) for authenticating the mobile communication terminal and authorizing the data service; A mobile telecommunication switching center providing a; Receives and stores whether or not an authentication subscription of a circuit network, and informs the AN_AAA (Access Network-Authorization Authentication Accounting) whether or not the authentication subscription, and determines whether the authentication success for the subscriber to respond to the AN_AAA In 1x EV-DO system including a combined EV-DO data base (CEDB), which is a database for storing subscriber information of AC (Authentication Center) and EV-DO service, a circuit network authentication interworking protocol is used in 1x EV-DO packet network As a copy protection method of a terminal, (a) Value (16 Octet for MD5 ∥ AUTHR COUNT), Name (MIN @) indicating an inherent value of the mobile communication terminal in order to prevent copying as a parameter of CHAP Response from the mobile communication terminal in an ANC (Access Network Controller). hrpd.nate.com); (b) In the ANC, User-Name (MIN@hrpd.nate.com), CHAP-Password (16 Octet for MD5), CHAP-Challenge, and CAVE-Password (AUTHR ∥ COUNT), which are parameters of AccessRequest, are set as the Value. Transmitting to the AN_AAA; (c) receiving an MIN and an ESN together with a field value indicating whether the corresponding service subscriber performs circuit authentication by transmitting a subscriber information request signal from the AN_AAA to the CEDB; (d) determining whether the mobile communication terminal is subscribed to a circuit network authentication service using the CEDB in the AN_AAA; (e) receiving a CAVE (Cellular Authentication and Voice Encryption) authentication request signal received from the AN_AAA at the AC and performing a CAVE authentication method using a RAND value using upper 32 bits of a CHAP Challenge; And (f) Successful / Failure value as a parameter indicating whether the authentication succeeds by determining whether the authentication succeeds or fails by comparing the AUTHR which is the output value of the CAVE authentication method, the AUTHR value received from the mobile communication terminal, and the COUNT value in the AC. Generating an AUTH RES (Authentication Response) message including the step of transmitting to the AN_AAA A method for preventing duplication of a terminal using a circuit network authentication interworking protocol in a 1x EV-DO packet network comprising a. The method of claim 10, wherein the method is After step (d) above, (d1) if the AN_AAA is not subscribed to the circuit authentication service, performing an existing MD5 type CHAP authentication method in the AN_AAA Method for preventing the duplication of the terminal using the circuit network authentication interworking protocol in the 1x EV-DO packet network, characterized in that it further comprises.

Images