KR101171311B1 - Method of authenticating relay station in broadband wireless access system - Google Patents

Abstract

The present invention relates to a method for providing a terminal with authentication for a relay station for extending a service range in a broadband wireless access system. The relay station authentication method in the broadband wireless access system according to the present invention is a method for authenticating a relay station for relaying communication between a base station and a terminal in a broadband wireless access system. A first step of providing authentication confirmation information of the relay station, a second step of performing an authentication procedure for the terminal, and a specific message capable of authenticating the authentication confirmation information by a message authentication function obtained through the authentication procedure Included in the characterized in that it comprises a third step provided to the terminal.

Broadband, wireless access, relay station, authentication

Description

Method of authenticating relay station in broadband wireless access system

1 shows an example of a security sublayer provided by IEEE 802.16.

2 illustrates an example of networking using a relay station.

3 is a diagram for explaining the operation of networking using a relay station in accordance with IEEE 802.16.

4 is a flowchart illustrating a network entry procedure when the terminal is initialized in a broadband wireless access system.

FIG. 5 is a flowchart illustrating a detailed description of an authentication procedure of a terminal among the network entry procedures of the terminal shown in FIG. 4.

6 is a process flow diagram of one preferred embodiment of the present invention.

7 is a process flow diagram of another preferred embodiment of the present invention.

The present invention relates to a broadband wireless access system. More specifically, the present invention relates to a method for providing a terminal with authentication for a relay station for extending a service range in a broadband wireless access system.

IEEE 802.16, the International Technical Specification for Broadband Wireless Access Systems, uses the Privacy and Key Management (PKM) protocol to provide authentication, data confidentiality, and data security. Provide integrity

1 shows an example of a security sublayer provided by IEEE 802.16. Authentication in IEEE 802.16 may be performed using an RSA or EAP authentication protocol when the network enters the terminal, updates the validity of the authentication key, and performs handover of the terminal.

The terminal and the base station establish a security association (SA) to ensure data confidentiality and data integrity. The SA is a data encryption key and initialization vector used to ensure data encryption and integrity when transmitting user data between the base station and the terminal. It consists of a cryptographic suite of the same. In addition, the PKM protocol defines the authentication key renewal procedure and encryption key renewal procedure through re-authentication, so that it can be protected from threats such as replay attacks from unlawful users.

Hereinafter, a networking method using a relay station in a broadband wireless access system will be described. 2 shows an example of networking using a relay station.

In IEEE 802.16, multi-hop relay networking (multi-hop relay) is a method for improving overall throughput by extending service coverage of a base station and providing higher signal quality to a terminal in a shadow area in a broadband wireless access system. (hop relay networking) is in progress.

In IEEE 802.16, work is being carried out to improve the frame structure of the physical layer and to add a new protocol of the MAC layer for relay networking. Its main features include a tree structure with the base station as the base point of the relayed data path, compatible with existing point-to-multi-point (PMP) schemes, and relay and point-to-multipoint schemes have the same frequency. Use bands or other adjacent frequencies. As the type of relay station, fixed, temporary, nomadic, and mobile relay stations are considered.

3 is a view for explaining the operation of the networking using a relay station according to IEEE 802.16. The purpose of the relay station can be summarized in two broad ways: service coverage expansion and throughput improvement of the base station. The operation of the relay station may be differently defined as shown in FIG. 3 according to each purpose.

When the relay station is used to expand the service coverage of the base station as shown in relay station type 1 of FIG. 3, the relay station 34 transmits and receives data between the terminal 35 and the base station 31 as well as the base station 31. Or all control messages transmitted from the terminal 35. When the relay station is used for throughput improvement as shown in the relay station type 2 of FIG. 3, the relay station 32 relays only user data exchanged between the terminal 33 and the base station 31, and broadcasts the base station 31. The terminal 33 and the base station 31 may exchange the control message of the type or the uplink control message of the terminal 33 directly. As such, the data relayed using the relay station may have a delay compared to when the terminal and the base station directly transmit and receive data, and the relay station provides a good signal quality to the terminal to which the data is relayed, and accordingly, an appropriate channel coding rate By relaying to the terminal using a rate and a modulation (modulation) method, the overall throughput can be increased.

4 is a flowchart illustrating a network entry procedure when the terminal is initialized in a broadband wireless access system.

(1) When the UE first powers on, it searches for a downlink channel and acquires up / down synchronization with the base station. In this case, the terminal receives a downlink map (DL-MAP) message, an uplink map (UL-MAP) message, a downlink channel descriptor (DCD) message, and an uplink channel descriptor (UCD) message from the base station, Acquire it.

(2) The terminal performs ranging with the base station to adjust uplink transmission parameters, and receives a basic management CID and a primary management CID from the base station.

(3) The terminal negotiates basic performance with the base station.

(4) Authenticate the terminal.

(5) The terminal registers with the base station, and the terminal managed by IP receives a second management connection identifier (Secondary management CID) from the base station.

(6) Set up the IP connection.

(7) Set the current date and time.

(8) Download the configuration file of the terminal from the TFTP server.

(9) Establish a connection to a prepared service.

FIG. 5 is a flowchart illustrating a detailed description of an authentication procedure of a terminal among the network entry procedures of the terminal shown in FIG. 4.

Referring to FIG. 5, the terminal searches for a downlink channel to register with the network and acquires up / down synchronization with the base station (S501). In this case, the terminal adjusts an uplink transmission parameter by performing ranging and negotiates security-related basic performances such as an authentication method, a data encryption algorithm, a data integrity algorithm, and a message authentication method with a base station.

The terminal performs an authentication procedure through an authentication protocol such as a base station, an AAA server, and an Extensible Authentication Protocol (hereinafter referred to as 'EAP') (S502). If terminal authentication is successfully performed, the terminal and the authentication server set a shared master key (S503).

On the other hand, the base station receives a master key (Master Key) for the terminal from the authentication server (S504), the terminal and the base station generates an Authentication Key (Authentication Key) from the received master key (S505). The terminal and the base station generate a message authentication code key for media access control management message integrity using the generated authentication key, and include a traffic encryption key; Hereinafter, a key encryption key (hereinafter referred to as 'KEK') for encrypting 'TEK' is generated. In addition, the terminal and the base station test the validity of the authentication key by performing a 3-way handshake, and perform mutual authentication (S506).

By establishing a security association with the base station, the terminal determines a data encryption and integrity algorithm, a traffic key encryption algorithm, and the like for user data transfer, and receives a TEK for actually encrypting user data from the base station (S507).

As described in the configuration of the prior art, the service scenario using the relay station can be largely classified into 1) service coverage expansion of the base station or 2) increased throughput of the entire base station. Among them, when the relay station is used to expand the service coverage of the base station (type 1), the terminal and the base station must transmit and receive not only user data but also control signaling through the relay station. That is, in order for the terminal to enter the initial network, control messages transmitted and received between the terminal and the base station should be transmitted through the relay station, and the terminal and the base station should be able to assure each other the reliability of the relayed control message. In order to prevent a malicious user from imitating the function of the relay station and disrupting the network connection of a specific terminal through the modification of the control message exchanged between the terminal and the base station, the base station must authenticate the relay station. It should be possible to determine whether the relay station relaying the control signaling of is an authorized relay station, but there is a problem in the prior art that a procedure related to authentication of the relay station is not defined.

The present invention has been made to solve the problems of the prior art as described above, an object of the present invention is to provide a relay station authentication method for a reliable relay operation by the relay station in a broadband wireless access system will be.

According to an aspect of the present invention, the base station provides authentication confirmation information for the relay station through a control message transmitted to the terminal in the initial network entry procedure of the terminal through the relay station. According to another feature of the invention, it is preferable that the base station provides authentication confirmation information for the relay station to the terminal at least twice. In this case, initially, the terminal provides authentication confirmation information for the relay station through a first message transmitted by the base station to the terminal when the terminal first enters the network, and then the authentication confirmation information for the relay station is modified in the middle. After the authentication procedure is completed for the terminal to prevent the authentication, the authentication confirmation of the relay station through a second message that can be authenticated by the terminal by the message authentication function promised between the terminal and the base station according to the authentication procedure It is desirable to transmit the information. When the terminal successfully authenticates the second message by the message authentication function, the terminal may perform reliable authentication of the relay station according to the authentication confirmation information.

As described above, the terminal accesses the network through the relay station through authentication confirmation of the relay station in two steps, and secures reliability of the control message exchange and the user data exchange with the base station through the relay station. Make sure

In one aspect of the present invention having the above characteristics, the method for authenticating a relay station in a broadband wireless access system according to the present invention is to authenticate a relay station for relaying communication between a base station and a terminal in a broadband wireless access system. A method, comprising: a first step of providing authentication confirmation information of the relay station to a terminal in a network entry process; a second step of performing an authentication procedure for the terminal; and the authentication confirmation information through the authentication procedure And a third step of providing the terminal to the specific message that can be authenticated by the acquired message authentication function.

In another aspect of the present invention, a method for authenticating a relay station in a broadband wireless access system according to the present invention includes a method for authenticating a relay station for relaying communication between the terminal and a base station in a terminal in a network entry process. A first step of receiving authentication confirmation information of the relay station from a base station, a second step of performing an authentication procedure for the terminal, and a specific message that can be authenticated by a message authentication function obtained through the authentication procedure. And a fourth step of receiving the transmitted authentication confirmation information, and a fourth step of determining whether to authenticate the relay station through the authentication confirmation information.

The construction, operation, and other features of the present invention will be readily understood by the preferred embodiments of the present invention described below with reference to the accompanying drawings. 6 and 7 are flowcharts of procedures of preferred embodiments of the present invention.

6 illustrates an embodiment in which the terminal performs authentication for the relay station during network entry without requesting authentication confirmation for the relay station from the terminal when the relay station is used to expand service coverage of the base station. It is about.

Referring to FIG. 6, when the terminal powers up for the first time (S601), the terminal transmits a reference signal such as a preamble or pilot signal transmitted from the base station and a control message in the form of a broadcast (uplink / downlink map). ), The synchronization of the downlink frame should be obtained. When the terminal is located outside the service coverage range of the base station to directly receive the reference signal and the map message of the base station (S602), the terminal performs an operation for receiving the reference signal transmitted from the relay station.

When the terminal receives the reference signal of the relay station and the map message transmitted by the base station and relayed by the relay station (S603), the terminal uses the received reference signal to downlink synchronization with the relay station. Acquire and obtain the uplink / downlink channel parameters (UCD / DCD) relayed through the relay station (S604). The terminal acquires an uplink transmission synchronization and transmits a ranging request message (RNG-REQ) as a procedure for registering with the base station, and the relay station transmits the ranging request message to the base station (S605). .

The base station that has received the ranging request message through the relay station checks the ranging station in a ranging response message (RNG-RSP) to confirm that the relay station relaying the ranging request message is authenticated. It includes the authentication confirmation information for the transmission to the relay station, the relay station transmits the received ranging response message to the terminal (S606). In this case, the ranging response message includes a ranging parameter adjustment value for uplink transmission of the terminal, a basic connection identifier and a primary connection identifier assigned to the terminal.

The terminal receiving the ranging response message transmits a terminal basic capability request message (SBC-REQ) for basic performance negotiation to the base station (S607), and the base station responds to the terminal basic capability response message (SBC). -RSP) is transmitted to the terminal (S608). If the base station does not transmit the authentication confirmation information for the relay station to the terminal through the ranging response message, the authentication confirmation information may be provided to the terminal through the basic capability response message.

The terminal and the authentication server (AAA server) performs an authentication procedure for the terminal using an authentication protocol such as RSA or EAP (S609). When the authentication procedure is successfully performed for the terminal, the terminal and the authentication server share the same master key, and the authentication server transfers the master key to the base station (S610). Based on the master key, the terminal and the base station derive the same authentication key from each other through a predetermined key derivation function. The base station includes an authentication key identifier, an arbitrary number of base stations, and a message authentication code for message authentication in a SA-TEK-Challenge message as a first step for checking an authentication key shared with the terminal and establishing a security association. Transfer to (S611). Upon receiving the SA-TEK-Challenge message, the terminal confirms the authentication of the message and delivers the SA-TEK-REQ message including the random number of terminals, an authentication key identifier, a security capability parameter, and a message authentication code to the base station. (S612). The base station transmits the SA-TEK-RSP message with the security association parameter, the relay station authentication confirmation information, the message authentication code, and the like to the terminal in response thereto (S613). When the terminal successfully authenticates the message of the SA-TEK-RSP through the received message authentication code, and the authentication of the relay station is confirmed, the terminal performs the remaining network entry procedure such as a registration procedure with the base station.

Table 1 shows an example of the data format of the authentication confirmation information for the relay station in the embodiment of FIG.

Name Type Length Value Scope RS authentication confirmation parameters TBD 6 bytes RS ID or RS preamble index RNG-RSP (SBC-RSP)
SA-TEK-RSP

7 is a flowchart illustrating another exemplary embodiment of the present invention, and relates to an embodiment in which the base station provides the terminal with authentication confirmation for the relay station at the request of the terminal.

The operation description of the embodiment shown in FIG. 7 is similar to the process described in the embodiment shown in FIG. 6, but the process of requesting the authentication confirmation of the relay station is added when the terminal transmits the ranging request message to the base station (S705). . In addition, the authentication confirmation request of the relay station may be included in the basic capability negotiation request message (S707) and SA-TEK-REQ message (S712).

Table 2 and Table 3 respectively show an example of the relay station authentication confirmation request parameter transmitted from the terminal to the base station and the relay station authentication confirmation response parameter transmitted by the base station to the terminal in response to the embodiment shown in FIG.

Name Type Length Value Scope RS authentication request
parameter TBD 6 bytes RS ID or RS preamble index RNG-REQ
(SA-TEK-REQ)

Name Type Length Value Scope Check RS Certification
parameter TBD 6 bytes RS ID or RS preamble index RNG-REQ
(SA-TEK-REQ)

As described above, the base station provides the terminal with twice the authentication confirmation information for the relay station as the initial ranging response message and the SA-TEK-RSP message. The ranging response message is not initially provided with the message authentication function. Because it does not. That is, the ranging response message may be modified by a third party. In order to prevent this, the ranging response message may be modified by using a message authentication code shared by the terminal and the base station after performing the terminal authentication procedure. This is to allow the terminal to check whether the relay station authentication confirmation information received in the ranging response message is valid by transmitting the authentication confirmation information of the relay station. In addition, the transmission of the authentication confirmation information of the relay station through the ranging response message is to allow the terminal to perform the authentication confirmation of the relay station at the beginning of the network entry procedure.

It will be apparent to those skilled in the art that the present invention may be embodied in other specific forms without departing from the spirit or essential characteristics thereof. Accordingly, the above detailed description should not be construed as limiting in all aspects and should be considered as illustrative. The scope of the invention should be determined by reasonable interpretation of the appended claims, and all changes within the equivalent scope of the invention are included in the scope of the invention.

According to the present invention, there is an effect that a reliable relay networking operation can be performed through a relay station between a terminal and a base station.

Claims (12)

A method for authenticating a relay station for relaying communication between a base station and a terminal in a broadband wireless access system, A first step of providing authentication confirmation information of the relay station to a terminal in a network entry process; A second step of performing an authentication procedure for the terminal; And And a third step of including the authentication confirmation information in a specific message that can be authenticated by the message authentication function obtained through the authentication procedure and providing the authentication confirmation information to the terminal. The method of claim 1, And receiving a request for authentication confirmation for the relay station from the terminal. The method of claim 1, In the first step, the authentication confirmation information is transmitted in a ranging response message (ranging response message) characterized in that the relay station authentication method. The method of claim 1, And the message authentication function is performed by a message authentication code obtained through the authentication procedure. 5. The method of claim 4, And the message authentication code is included in the specific message and transmitted. The method of claim 5, The specific message is a relay station authentication method, characterized in that the SA-TEK-RSP (Security Association Traffic Encryption Key Response message). A method for authenticating a relay station relaying communication between a terminal and a base station in a terminal in a network entry process, A first step of receiving a ranging response message including authentication confirmation information of the relay station from the base station; A second step of the terminal performing an authentication procedure with respect to the authentication server and the terminal; A third step of receiving, from the base station, a SA-TEK-RSP message (Security Association Traffic Encryption Key Response message) including the authentication confirmation information and capable of authenticating by a message authentication function obtained through the authentication procedure; And And a fourth step of determining whether to authenticate the relay station through the authentication confirmation information. The method of claim 7, wherein Requesting the base station for authentication confirmation of the relay station. delete The method of claim 7, wherein And the message authentication function is performed by a message authentication code obtained through the authentication procedure. The method of claim 10, And the message authentication code is included in the SA-TEK-RSP message and received. delete

Images