KR101210618B1 - System based on diameter protocol - Google Patents

Abstract

The present invention relates to a diameter-based AAA authentication system.

AAA (Authentication, Authorization, Accounting) authentication system of the present invention provides a first subscriber authentication for a subscriber station, an EAP (Extensible Authentication Protocol) application module for generating and processing a specific first message, for a subscriber station MIP (Mobile Internet Protocol) application module that performs second subscriber authentication and authorization and generates and processes a specific second message, an accounting application module and an EAP application module for collecting and managing specific billing information for the subscriber terminal It is linked with MIP application module and accounting module and includes a base module for processing a specific message.

According to the present invention, it can be expected that the base module of the AAA authentication system can exclude the direct connection to the database and the work thereof, thereby improving the performance, stability, and scalability of the system.

AAA, Authentication System, EAP, MIP, Base, Diameter

Description

AAA based authentication system based on diameter (AAIA SYSTEM) {AAA SYSTEM BASED ON DIAMETER PROTOCOL}

1 is a block diagram illustrating a diameter-based AAA authentication system according to an embodiment of the present invention.

Figure 2 is a block diagram showing in detail the EAP application module of the AAA authentication system according to an embodiment of the present invention.

3 is a block diagram illustrating in detail the MIP application module of the AAA authentication system according to an embodiment of the present invention.

The present invention relates to an AAA (Authentication, Authorization, Accounting) authentication system based on a DIAMETER, and more particularly, to a DIMETER based authentication system for efficient message processing.

In general, AAA is a technology for providing subscriber authentication, authorization, and accounting services for accessing a network connected to a communication service provider of a mobile communication system and a wire communication system. The authentication is to verify the identity of the user before allowing network access. For the purpose of clear identification of the user, the authentication process requires a user name / password combination, a secret key, and a biological method (e.g. For example, unique data possessed by a user such as a fingerprint is used. The AAA authentication system compares the user-provided authentication data with user-related data in its database, and if the contents match, it grants access to the network. . Authorization (Authorization) is to determine what permissions and services to allow for users who are allowed to use the network, including the determination of IP addresses, applications and protocols to be provided. The authentication and authorization are generally performed together in the operating environment of the AAA system. Accounting collects information about the user's resource usage, which is used for billing, accounting and capacity expansion.

Such a conventional technology using the AAA authentication system is disclosed in the Republic of Korea Patent Publication No. 2004-0043735 "method based AAA authentication server and billing server separate processing method". This conventional technique is an authentication server that performs reliable connection between a separate authentication server and a charging server using a diameter protocol, synchronization of the authentication server and a charging server, and management of a charging server network composed of a plurality of charging servers. And a linkage processing technology of a billing server are disclosed.

Meanwhile, the conventional AAA authentication system includes a diameter base module, an application module, a database connection / work module, and a service function logic module. Such a conventional AAA authentication system performs a function of calling back message functions of transport layer connection, service layer negotiation, realm-based routing, and application service in a DIAMETER BASE. Message handling and accounting message functions such as authentication and forced termination are defined.

However, when processing the message about the definition of accounting function and accounting message functions such as subscriber termination, re-authentication and forced termination in the diameter base of the AAA authentication system, the diameter-based base module generates a specific database. Because it has to work with message processing in connection with, it brings about system performance deterioration and system is not stable.

Accordingly, the present invention is to solve the above problems, to provide a diameter-based authentication system for efficient message processing.

According to a first aspect of the present invention for solving the above technical problem, a diameter-based AAA authentication system for performing AAA (Authentication, Authorization, Accounting) for a subscriber station,

An EAP (Extensible Authentication Protocol) application module for providing a subscriber station with a first subscriber authentication and generating and processing a specified first message; A mobile internet protocol (MIP) application module for performing a second subscriber authentication and authorization verification for the subscriber station and generating and processing a specified second message; An accounting application module for collecting and managing specific billing information for the subscriber station; And a base module interworking with the EAP application module, the MIP application module, and the accounting module and processing a specific message.

Here, the EAP application module,

An EAP application initialization unit for initialization of the application module; And a first message generation / processing unit for generating and processing the specified first message.

Here, the MIP application module,

MIP application initialization unit for initialization of the application module; And a second message generation / processing unit for generating and processing the specified second message.

In this case, the specified first message includes a first subscriber termination message STR / A, a reauthentication message RAR / A, and a forced termination message ASR / A.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise.

In addition, the term module described herein refers to a unit for processing a specific function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

Now, a diameter-based AAA authentication system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

1 is a block diagram illustrating a diameter-based AAA authentication system according to an embodiment of the present invention.

As shown in FIG. 1, an AAA (Authentication, Authorization, Accounting) authentication system 100 according to an embodiment of the present invention includes a base module 170, an EAP application module 140, and a MIP application module 150. , An accounting application module 160, a database connection / task module 120, and a functional logic module 130.

The base module 170 calls back message functions of peer transport layer connection, service layer negotiation, realm-based routing, and application service, and the peer transport layer connection module 178 for each role. A service layer negotiation module 176, a realm-based routing module 174, and a call back module 172. In addition, interworking with the EAP application module 140, MIP application module 150, the accounting (Acct) application module 160.

The EAP (Extensible Authentication Protocol; hereinafter referred to as 'EAP') application module (EAP APP module) 140 provides various authentication methods, and generates a specific message and the EAP application initialization processing unit 148 for initialization of the application module. A first message generation / processing unit 142 capable of processing is included. Here, the specific message includes a message for subscriber termination, reauthentication, and forced termination.

Here, the EAP application module 140 supports authentication methods of the wireless LAN and the portable Internet of PAP, CHAP, MS-CHAP, MS-CHAPv2, and provides authentication methods of EAP-MD5, EAP-TTLS, and PEAP.

MIP (Mobile Internet Protocol; hereinafter referred to as 'MIP') application module (MIP APP. Module) 150 is connected to the base module 170 based on the DIAMETER authentication and authentication for the subscriber terminal It includes the MIP application initialization processing unit 156 and the second message generation / processing unit 152 capable of generating and processing a specific message to support the mobility of the subscriber station by performing the authorization verification. Here, the specific message includes a subscriber termination message.

The accounting application module 160 collects specific billing information, stores it securely and reliably, and ensures reliable delivery to a specific billing server.

The database connection / task module 120 is responsible for establishing and managing a connection with the database. The function logic module 130 provides specific functions including other function logic such as state management functions, fault management functions, operator matching functions, and the like. do.

The AAA authentication system according to the embodiment of the present invention enables the EAP application module and the MIP application module, which are application modules, to process the "subscriber termination, re-authentication, and forced termination" messages included in the conventional base module. The base module has the advantage of improving the performance, stability and scalability of the system by eliminating the direct connection with the database and its work.

Figure 2 is a block diagram showing in detail the EAP application module of the AAA authentication system according to an embodiment of the present invention.

As shown in FIG. 2, the EAP application module 140 according to an embodiment of the present invention provides various authentication schemes, and is capable of generating and processing a specific message and the EAP application initialization processing unit 148 for initialization of the application module. 1 includes a message generation / processing unit 142.

The first message generation / processing unit 142 generates and processes a specific message, and includes a DER / A 143, STR / A 144, RAR / A 145, and ASR / A 146 as specific messages. Create and process messages.

DER / A (Diameter EAP Request / Answer) message 143 is a message for Diameter authentication processing.

The STR / A (Session-Termination-Request / Session-Termination-Answer) message 144 is a message about termination of service of the subscriber station, and the EAP application module 140 terminates service termination of the subscriber station according to the state of the subscriber station. Process.

Here, the STR / A message 144 provides an L3 mobility but an abnormal service termination such as a case where the EAP subscriber authentication process succeeds at the initial access request of the subscriber station, but fails in the MIP registration request, but introduces Mobile IP. It is used when the service is terminated, such as when the service is terminated, such as when the mobility between heterogeneous IPs is provided by a method of tunneling between devices (for example, Simple IP).

In addition, the STR / STA message 144 in the MIP application module 150 according to the application service delivered from the DIAMETER client or the application service distinguished from the BASE module 170 shown in FIG. Called back with a message to terminate the session.

The RAR / A (Re-Auth-Request / Re-Auth-Answer) message 145 is a message for re-authenticating by checking a session state of a subscriber station of a network access device, and is an EAP application module according to the state of a subscriber station. In step 140, the network access device requests a re-authentication process of the subscriber station, and performs processing accordingly.

Here, the RAR / A message 145 is an AAA authentication system (Idle) in an environment in which modes such as idle, sleep, and active exist to save power of the subscriber station. When the incoming service request is delivered to the subscriber station recorded in the session information of 100), the idle state of the subscriber station is changed to Active and the returned resources are allocated and the incoming service state is available. It is used when the cloth is made possible. In particular, the network access device checks the state of the corresponding subscriber station after receiving the RAR message, and allocates network resources so that the subscriber station becomes a serviceable state when it exists in an area managed by the network access device and sends a RAA message for this information. It may be generated and delivered to the AAA authentication system 100.

ASR / A (Abort-Session-Request / Abort-Session-Answer) message 146 is a message capable of forcibly terminating a subscriber station which is determined to be abnormal, and duplicate login (SAP) through subscriber authentication in the EAP application module 140. log-in).

In addition, the ASR / A message 146 checks the session information when the subscriber station already connected to the network device requests EAP authentication of the subscriber station for initial access, forcibly terminates the already connected subscriber station, and requests a new access. Is used to allow.

By implementing such a message of STR / STA, RAR / RAA, ASR / ASA, which has been executed in the conventional base module, in the EAP application module and the MIP application module, the base module stores the specific data and By eliminating the direct connection and work accordingly, there is an advantage to improve the performance of the system and the stability and scalability of the system.

Next, a MIP application module according to an embodiment of the present invention will be described in detail.

3 is a block diagram illustrating in detail the MIP application module of the AAA authentication system according to an embodiment of the present invention.

As shown in FIG. 3, the MIP application module according to an exemplary embodiment of the present invention performs authentication and authority verification for a subscriber station by interworking with the DIAMETER-based base module 170 shown in FIG. 1. It supports mobility to the terminal, and includes a MIP application initialization processing unit 156 for initialization of the application module and a second message generation / processing unit 152 capable of generating and processing a specific message.

The second message generation / processing unit 152 generates and processes a specific message, and generates and processes a message including the AMR / A 153, the HAR / A 154, and the STR / A 155 as the specific message. .

The AMR / A (AA-Mobile-Node-Request / Answer) (153) and the HAR / A (Home-Agent-MIP-Request / Answer) (154) messages handle the AAA signals defined by the Mobile IPv4 Extension. This is a message.

The STR / A (Session-Termination-Request / Session-Termination-Answer) message 155 is a message for terminating a service of a subscriber station, and the MIP application module 150 terminates service termination of the subscriber station according to the state of the subscriber station. Process.

In addition, the STR / A message 155 is a MIP application module according to the application service delivered from the DIAMETER client or the application service distinguished from the base module 170 of the AAA authentication system 100 shown in FIG. Call back to the message to terminate the session.

The embodiments of the present invention described above are not only implemented through the apparatus and the method, but may also be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation can be easily implemented by those skilled in the art from the description of the above-described embodiments.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, It belongs to the scope of right.

According to the above-described configuration, a DIMETER-based authentication system that efficiently processes a message includes a message including a subscriber termination, re-authentication, forced termination message, etc., which is a message to be processed by accessing a database when providing a commercial service. By allowing the EAP application module and MIP application module to be processed, the base module of the AAA authentication system can eliminate the direct connection to the database and its work, thereby improving the performance, stability, and scalability of the system. You can expect the effect.

Claims (11)

In a diameter-based AAA authentication system for performing AAA (Authentication, Authorization, Accounting) for a subscriber station, An Extensible Authentication Protocol (EAP) application module for providing a first subscriber authentication to the subscriber station and generating and processing a specified first message; A mobile internet protocol (MIP) application module for performing a second subscriber authentication and authorization verification for the subscriber station and generating and processing a specified second message; An accounting application module for collecting and managing specific billing information for the subscriber station; And And a base module interworking with the EAP application module, the MIP application module, and the accounting application module, for processing a specific message. The specified first message includes a first subscriber termination message (STR / A), a reauthentication message (RAR / A), and a forced termination message (ASR / A). AAA authentication system, characterized in that. The method according to claim 1, The EAP application module, An EAP application initialization unit for initialization of the application module; And A first message generation / processing unit for generating and processing the specified first message AAA authentication system comprising a. delete The method according to claim 1, The first subscriber termination message (Session Termination Request / Answer; 'STR / A') is a message for processing the service termination of the subscriber station AAA authentication system. The method according to claim 1, The re-authentication message (Re Authentication Request / Answer) is an AAA authentication system, characterized in that the message for the re-authentication of the subscriber station. The method according to claim 1, The abort termination message (Abort Session Request / Answer) is a message for the session termination of the subscriber station AAA authentication system. 3. The method of claim 2, The EAP application module AAA authentication system, characterized in that for supporting authentication of the wireless LAN and the mobile Internet. The method according to claim 1, The MIP application module, MIP application initialization unit for initialization of the application module; And A second message generation / processing unit for generating and processing the specified second message; AAA authentication system comprising a. The method of claim 8, And the specified second message comprises a second subscriber exit message (STR / A). The method of claim 9, The second subscriber termination message is an AAA authentication system, characterized in that the message for the service termination of the subscriber station. The method according to claim 1, A function logic module for performing a specific function including a state management function, a fault management function, and an operator matching function; And Database connection / action module providing connection settings with specific databases AAA authentication system including more.

Images