KR101385846B1 - Communications method and communications systems - Google Patents

Abstract

Disclosed herein are embodiments of a communication method and communication system. According to an embodiment, the packet switch (SGSN) activates encryption of the mobile terminal to the authentication center in response to receiving an attach request, a routing area update request, or a packet data service request from the mobile terminal. Request and receive authentication information, including whether or not. The packet exchanger may encrypt the data packet transmitted to the mobile terminal or the authentication process of the mobile terminal based on the received authentication information. Therefore, it is possible to provide a differentiated security service for each mobile terminal in the packet data service.

Packet, encryption, SGSN, authentication, 3GPP

Description

COMMUNICATIONS METHOD AND COMMUNICATIONS SYSTEMS

The present invention relates to a communication system, and more particularly, to provide a packet service with enhanced security to a subscriber in a mobile communication system.

Widely used in recent years, Wideband Code Division Multiple Access (W-CDMA) is one of the 3rd generation mobile communication technology standards and is currently being adopted by most countries. It is expanding new markets by providing various services such as -mail and multimedia messages. In the wireless communication technologies such as W-CDMA, many organizations in Europe, Japan, the United States, and China have formed 3GPP (3rd Generation Project Group) to develop international standard technologies.

Under W-CDMA, packet services are provided along with circuit services according to the 3GPP standard. Packet service is a type of service that receives radio resources every time data is transmitted between transmitting and receiving terminals, transmits data in packet units, and is charged in packet units. This packet service is distinguished from a circuit service in which the wireless service continues to occupy radio resources until the data transmission between the transmitting and receiving terminals is completed and is charged in proportion to the access time.

On the other hand, with the development of mobile communication technology, illegal activities through illegal use, eavesdropping or tracking, and various communication crimes are also increasing. Such illegal acts result in a decrease in the service quality for the subscribers of the mobile communication service as well as a decrease in the profits of the service provider, an invasion of personal privacy, and an increase in communication crimes. In order to prevent communication crime, ciphering techniques are used for communication services. Encrypting a packet prevents the malicious subscriber from decrypting the message even if the malicious subscriber intercepts the packet message of the mobile terminal. Therefore, hacking such as the packet message leaking can be prevented, and the security of the packet service can be enhanced.

Currently, the W-CDMA packet service provides encryption based on the 3GPP specification. According to the encryption function based on the 3GPP standard, when a mobile terminal sends an attach request, a routing area update request, a service request, etc., a SGSN (Serving GPRS Support Node) that manages the mobile terminal and performs packet exchange is managed by SGSN. Encryption is determined according to whether encryption is set in advance for each system and encryption is performed.

As such, according to the 3GPP standard, packet encryption is first performed in SGSN and subscriber information is received from a home location register (HLR). That is, since the subscriber information is received after the encryption step, it is not possible to know whether to encrypt each subscriber. Therefore, according to the current 3GPP standard, it is not possible to encrypt packets for each subscriber, and as a result, it is not possible to provide differentiated packet security services for each subscriber.

To provide security services in accordance with current 3GPP specifications, encryption must be enabled throughout the system. In this case, various problems may occur. In particular, the following two problems exist. First, if encryption is enabled for the entire system, the system load is excessively increased because all packets of all subscribers in the system must be encrypted. Second, additional signaling for encryption acts as an unnecessary load for subscribers who do not want encryption. Therefore, there is a need to selectively provide encryption only for a desired user.

SUMMARY OF THE INVENTION An object of the present invention is to provide a communication method and a communication system capable of selectively providing a security service to a packet service subscriber.

According to one embodiment of the invention, a communication method comprises the steps of: receiving a connection request message from a mobile terminal; And requesting authentication information of the mobile terminal and receiving the authentication information from an authentication center. At this time, the authentication information may include whether encryption of the mobile terminal is activated.

In this embodiment, the communication method may further comprise storing the authentication information.

In this embodiment, the communication method includes receiving a packet service request message from the mobile terminal; And determining whether to encrypt the packet based on the authentication information, and if it is determined to encrypt the packet, encrypting the packet.

According to another embodiment of the present invention, a communication method includes receiving a packet service request message from a mobile terminal; And requesting authentication information of the mobile terminal from an authentication center and receiving the authentication information from the authentication center. At this time, the authentication information may include whether encryption of the mobile terminal is activated.

In this embodiment, the communication method may further include determining whether authentication information including whether encryption of the mobile terminal is activated or not is stored. The requesting and receiving of the authentication information may include requesting authentication information of the mobile terminal from the authentication center and receiving the authentication information from the authentication center in response to determining that the authentication information is not stored. It may include the step.

In embodiments, the authentication information may be received through a message according to the 3rd Generation Project Group (3GPP) standard.

According to another embodiment of the present invention, a communication method includes receiving a location update request message from a mobile terminal; And requesting information on the mobile terminal from a first packet exchange managing the mobile terminal, and receiving information on the mobile terminal from the first packet exchange. In this case, the information on the mobile terminal may include whether encryption of the mobile terminal is activated.

In this embodiment, the information on the mobile terminal may be received through a message according to the 3rd Generation Project Group (3GPP) standard.

In this embodiment, the communication method includes determining whether the information on the mobile terminal includes authentication information including whether encryption of the mobile terminal is activated; And in response to determining that the information about the mobile terminal does not include authentication information including whether to activate encryption of the mobile terminal, request the authentication information to an authentication center, and receive the authentication information from the authentication center. It may further comprise the step.

According to another embodiment of the present invention, a communication system may include a mobile terminal, a packet switch for managing the mobile terminal, and an authentication center for storing authentication information of the mobile terminal. The packet exchange may be operable to request authentication information of the mobile terminal to the authentication center in response to receiving a connection request from the mobile terminal. The authentication center may be operable to transmit the authentication information of the mobile terminal to the packet exchange in response to receiving the request for authentication information of the mobile terminal from the packet exchange. At this time, the authentication information may include whether encryption of the mobile terminal is activated.

According to another embodiment of the present invention, a communication system may include a mobile terminal, a packet switch for managing the mobile terminal, and an authentication center for storing authentication information of the mobile terminal. The packet exchange may be operable to request authentication information of the mobile terminal to the authentication center in response to receiving a packet service request from the mobile terminal. The authentication center may be operable to transmit the authentication information of the mobile terminal to the packet exchange in response to receiving the request for authentication information of the mobile terminal from the packet exchange. The authentication information may include whether encryption of the mobile terminal is activated.

According to another embodiment of the present invention, a communication system may include a mobile terminal, a first packet switch that managed the mobile terminal, and a second packet switch currently managing the mobile terminal. The second packet switch may be operable to request the first packet exchange for information about the mobile terminal in response to receiving the location update request from the mobile terminal. The first packet exchange stores information about the mobile terminal and operates to transmit information about the mobile terminal to the second packet exchange in response to receiving a request for information about the mobile terminal from the second packet exchange. Can be. In this case, the information on the mobile terminal may include authentication information including whether encryption of the mobile terminal is activated.

According to embodiments of the present invention, the packet switch (SGSN) may receive authentication information including whether to activate encryption of the mobile terminal from the authentication center. Therefore, encryption can be performed for each subscriber using a packet service.

According to embodiments of the present invention, in response to receiving at least one of an attach request, a packet service request, and a routing area update request, the packet exchange determines whether to activate encryption of the mobile terminal from the authentication center. Authentication information that includes can be received.

According to embodiments of the present invention, in response to receiving at least one of a connection request, a packet service request, and a location update request from a mobile terminal, the packet switcher moves on the basis of authentication information including whether to activate encryption of the mobile terminal. Encryption of data transmitted to the terminal can be performed.

According to embodiments of the present invention, in response to receiving a location update request from a mobile terminal, the packet switch may receive information including whether encryption of the mobile terminal is activated from a previous packet switch that managed the mobile terminal. .

According to embodiments of the present invention, the packet exchanger may provide a differentiated security service for each subscriber by performing encryption on a subscriber basis using a packet service.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the present invention, when the same numbers indicate the components described in the drawings and the description, generally refer to the same components.

1 is a block diagram of an exemplary communications system environment in which the present invention may be practiced. The communication system environment 100 may include any mobile communication system, such as, for example, a W-CDMA system and a fourth generation mobile communication system currently under development. Operation in communication system environment 100 has been described to the minimum extent necessary to enable those skilled in the art to make and use the invention in order not to obscure the subject matter of the invention. Communication system environment 100 may be designed as a hierarchical network having multiple levels for management of calls and transmission of voice and packet data.

In one embodiment, the communication system environment 100 may include a mobile terminal 110, a base station system 120, and a network subsystem 130. It is noted that the components shown in FIG. 1 are helpful for explanation and the number and arrangement of actual components may be different from this.

In one embodiment, the mobile terminal 110 includes a smartphone, personal digital assistants (PDAs), and a portable computer such as a palmtop operating with or without a laptop or cellular telephone. The mobile terminal 110 may include a subscriber identity module (SIM), which is a kind of smart card capable of storing a unique IMEI.

In one embodiment, the base station system 120 serves to wirelessly connect the mobile terminal 110 to the network subsystem 130, and provides a base station Node B and a plurality of base stations directly connected to the mobile terminal 110. It may include a base station controller (RNC) that manages and handles setup, frequency hopping, and handover for a radio channel.

In one embodiment, the network subsystem 130 manages user information or terminal information subscribed to each mobile carrier, user movement processing between base stations, and a public switched telephone network (PSTN) according to the call type. It can be in charge of connection to).

In one embodiment, network subsystem 130 may include a Serving GPRS Support Node (SGSN) 140 and an Authentication Center (AuC) 150. In addition, network subsystem 130 may be responsible for mobile service switching centers (MSCs), which may be responsible for setup, control and transmission of calls and management of text messages, mobility management, location registration / management, authentication, handover, roaming, and the like. Visitor Location Register (VLR) that can store the current location of the terminal, location and status information of the mobile terminal 110, and HLR (Home Location) that can provide the system requesting this information. And a Gateway GPRS Support Node (GGSN), which serves as a gate device for sending a subscriber information store (Register) and packet data to the Internet (not shown). The above-described components may be connected to communicate with each other. Those skilled in the art will readily appreciate that there may be other components of the network subsystem 130 of the present invention, and a detailed description thereof will be omitted.

2 is a block diagram of a mobile terminal, an SGSN, and an authentication center according to an embodiment of the present invention. The components shown in FIG. 2 are exemplary, and each component may be integrated, separated, or omitted according to a design specification, and the connection relationship of each component may also be changed. In addition, each component illustrated in FIG. 2 has been described only for the components for implementing the present invention. In general, the mobile terminal 110, the SGSN 140, and the authentication center 150 include more components. In this specification, description thereof will be omitted.

In one embodiment, the mobile terminal 110 may include a storage 111. The storage unit 111 may be a non-volatile memory such as a ROM, a flash memory, a magnetic computer storage device (eg, a hard disk, a diskette drive, a magnetic tape), an optical disk drive, or a volatile memory such as a RAM. ), But is not limited thereto. In one embodiment, the storage 111 may include a Subscriber Identity Module Card (SIM Card). In an embodiment, the storage 111 may store personal information of the user of the mobile terminal 110 and information used for authentication.

In one embodiment, the mobile terminal 110 may further include a transmitter / receiver 112. The transmitter / receiver 112 may receive or transmit data from the base station system 120 and / or the network subsystem 130. The mobile terminal 110 updates the location requesting the SGSN 140 to the SGSN 140 through the transmitting / receiving unit 112 due to a connection (eg, an Attach) request due to a terminal booting or turning on, a change in location, or the like. (Eg, Routing Area Update) request, or a packet service request message requesting a change of service from the circuit service to the packet service, and may transmit various messages from the SGSN 140.

The SGSN 140 of FIG. 2 is a system that performs packet processing in an asynchronous network, and may play a role corresponding to an exchange in a voice service field. The SGSN 140 may generally perform packet routing and transmission, mobility management (attach / detach and region management), logical link management, and authentication for the mobile terminal 110 in its service area.

In one embodiment, SGSN 140 may include a storage unit 141 that is operative to store various information in association with other components. The storage unit 141 may include a nonvolatile memory such as a ROM, a flash memory, a magnetic computer storage device (eg, a hard disk, a diskette drive, a magnetic tape), an optical disk drive, and a volatile memory such as a RAM, but is not limited thereto. It is not.

As shown in FIG. 2, SGSN 140 may further include a transmit / receive unit 142 that is operable to transmit and receive data from mobile terminal 110 and / or network subsystem 130. In one embodiment, the transmitter / receiver 142 may receive a message from the mobile terminal 110 such as a connection (eg, Attach) request, a location update (eg, Routing Area Update) request, and a packet service request.

In one embodiment, the transmitting / receiving unit 142 in response to receiving the access request message from the mobile terminal 110 requests authentication information including whether to activate encryption of the mobile terminal 110 to the authentication center 150 The message may be transmitted, and authentication information may be received from the authentication center 150. In an embodiment, the transmitter / receiver 142 may store authentication information received in association with the storage 141.

Table 1 shows exemplary authentication information received from the authentication center.

In one embodiment, the authentication information may be defined according to the 3GPP standard, for example, according to the 3GPP 29.002 standard, as shown in Table 1. As shown in Table 1, the authentication information includes information related to authentication of the mobile terminal 110, such as the number of requested vectors, the node type, and the authentication set list. It may include. In one embodiment, the private extension field of the authentication information may include whether encryption of the mobile terminal 110 is activated. For example, in the private extension field of the authentication information (see the last row italic field of Table 1), 1 bit of a predetermined position may indicate encryption activation if 0, and encryption deactivation if 1.

In one embodiment, the transmitting / receiving unit 142, in response to receiving the location update request message from the mobile terminal 110, information about the mobile terminal 110 to the previous SGSN 140 that had jurisdiction over the mobile terminal 110. Send a message requesting, for example, an SGSN context message, and receive an SGSN context response message from a previous SGSN. In an embodiment, the transmitter / receiver 142 may store at least a portion of the SGSN context response message received in association with the storage 141.

Table 2 shows an exemplary SGSN context response message.

In one embodiment, the SGSN context response message may be defined according to the 3GPP specification, for example according to the 3GPP 29.060 standard, as shown in Table 2. As shown in Table 2, the SGSN context response message includes a Tunnel Endopoint Identifier Control Plane indicating information related to the location of the mobile terminal 110, Radio Priority indicating radio priority, Packet Flow ID and QoS information indicating packet order, It may include a PDP context including a GGSN Address and the like, an MM context including information related to authentication of the mobile terminal 110, and the like. In one embodiment, the MM context may include an information field indicating whether encryption of the mobile terminal 110 (encryption function is adopted).

Table 3 shows example parameters of the MM context of the SGSN response message.

As shown in Table 3, the MM context may include information related to authentication of the mobile terminal 110, such as a security mode and the number of authentication vectors transmitted. In an embodiment, the private extension field of the MM context, eg, the Container field, may include information indicating whether encryption of the mobile terminal 110 is activated. For example, if 1 bit of a predetermined position in the Container field is 0, encryption may be activated, and if 1, encryption may be deactivated. The above description is only an example for indicating whether encryption of the mobile terminal 110 is activated in the MM context, but is not limited thereto. For example, a field other than the Container field may be used, and a method of representing the number of bits and encryption activation / deactivation may be variously changed.

As shown in FIG. 2, SGSN 140 may further include an authenticator 143 that is operative to authenticate mobile terminal 110. In one embodiment, the authenticator 143 may perform authentication of the mobile terminal 110 based on authentication information including whether to activate encryption of the mobile terminal 110 stored in the storage 141. In an embodiment, the authenticator 143 may perform encryption of the data packet transmitted to the mobile terminal 110 based on authentication information including whether encryption of the mobile terminal 110 is activated.

In one embodiment, when the authentication unit 143 performs one event, such as authenticating the mobile terminal 110 or encrypting a data packet of the mobile terminal 110, one authentication vector stored in the storage unit 141 is used. Can be used. For example, when the authentication information of the mobile terminal 110 stored in the storage unit 141 includes five authentication vectors, the authentication unit 143 authenticates or authenticates the mobile terminal 110 using one authentication vector. When the packet data of 110 is encrypted, four authentication vectors remain in the storage unit 141.

In one embodiment, if the authentication information of the mobile terminal 110 is not stored in the storage unit 141, the authentication unit 143 to the mobile terminal 110 through the transmission / reception unit 142 to the authentication center 150. ) Can request authentication information. For example, when the transmitter / receiver 142 authenticates the mobile terminal 110 in response to receiving the connection request from the mobile terminal 110, the authentication information of the mobile terminal 110 is stored in the storage unit 141. Since not, the authentication unit 143 may request the authentication information of the mobile terminal 110 to the authentication center 150 through the transmitter / receiver 142.

In an embodiment, the authentication unit 143 moves to the authentication center 150 through the transmission / reception unit 142 when all the authentication vectors are exhausted from the authentication information of the mobile terminal 110 stored in the storage unit 141. The authentication information of the terminal 110 may be requested. For example, when the transmitting / receiving unit 142 encrypts a data packet of the mobile terminal 110 in response to receiving a location update request or packet service request message from the mobile terminal 110, first, the data packet of the mobile terminal 110 is stored in the storage unit 141. Reference may be made to the authentication information of the mobile terminal 110. At this time, if the number of authentication vectors remaining in the authentication information is 0, the authentication unit 143 may request the authentication information of the mobile terminal 110 to the authentication center 150 through the transmitter / receiver 142.

The authentication center 150 of FIG. 2 stores and manages authentication information including whether encryption of the mobile terminal 110 is activated and performs authentication of the mobile terminal 110 in association with the SGSN 140. In one embodiment, the authentication center 150 may include a storage unit 151 operable to store authentication information of the mobile terminal 110. The storage unit 151 may include a nonvolatile memory such as a ROM, a flash memory, a magnetic computer storage device (eg, a hard disk, a diskette drive, a magnetic tape), an optical disk drive, and a volatile memory such as a RAM, but is not limited thereto. It is not.

In one embodiment, the authentication center 150 may further include a transmitter / receiver 152. The transmitter / receiver 152 may receive or transmit data between the network subsystem 130 components. In an embodiment, the transmitter / receiver 152 may transmit authentication information including information on whether to enable ciphering to the SGSN 140 for each mobile terminal 110.

According to an embodiment of the present invention, the SGSN may receive information on whether to activate encryption of the mobile terminal in association with an authentication center. Therefore, unlike the conventional 3GPP packet service standard, it was not possible to perform encryption or data packet encryption in the authentication process for each subscriber, but in one embodiment of the present invention, encryption can be performed for each subscriber. Therefore, it is possible to provide a differentiated packet security service for each subscriber.

3 is a flowchart illustrating a case where a mobile terminal makes a connection request to a system according to an embodiment of the present invention. In one embodiment, it is assumed that SGSN 140-1 is currently in control of mobile terminal 110, and SGSN 140-2 is in charge of mobile terminal 110 before mobile terminal 110 is powered off. do. When the mobile terminal 110 requests a connection (eg, an attach) to the system due to booting or the like, more components (eg, HLR, MSC / VLR, etc.) are used to perform a more complicated procedure. The description is omitted so as not to obscure the core of the invention.

First, the mobile terminal 110 may transmit a connection request message to the SGSN 140-1 (step 301). The SGSN 140-1 may transmit an identification request message for the mobile terminal 110 to the SGSN 140-2 in response to receiving the access request message from the mobile terminal 110 ( Step 302). SGSN 140-2 may transmit an identification information response message to SGSN 140-1 in response to receiving the identification information request message from SGSN 140-1 (step 303). The SGSN 140-1 determines whether the received identification information response message includes the identification information for the mobile terminal 110, and if it is determined not to include the identification information response message, the SGSN 140-1 may transmit the identification information request message to the mobile terminal 110. (Step 304). The mobile terminal 110 may transmit an identification information response message to the SGSN 140-1 in response to receiving the identification information request message from the SGSN 140-1 (step 305).

Next, the SGSN 140-1 may transmit a message requesting authentication information including whether to activate encryption of the mobile terminal 110 to the authentication center 150 (step 306). In response to receiving the message requesting the authentication information of the mobile terminal 110 from the SGSN 140-1, the authentication center 150 sends the authentication information including whether the encryption of the mobile terminal 110 is activated or not. 1) (step 307). Information on whether encryption is activated may be configured as one parameter of authentication information defined in, for example, the 3GPP 29.002 standard, as shown in Table 1 above. The SGSN 140-1 may perform an encryption function during the authentication process for the mobile terminal 110 according to whether encryption included in the received authentication information of the mobile terminal 110 is activated (step 308). In an embodiment, the SGSN 140-1 may store information on whether or not encryption of the received mobile terminal is activated in a form defined in, for example, the 3GPP standard, as shown in Table 3 below. In one embodiment, the subsequent access procedure of the mobile terminal 110 is, for example, according to the standard procedure defined in the 3GPP standard, for example, a GPRS Support Node (GGSN) and a Home Location Register (HLR), and the like. It may proceed in conjunction.

According to an embodiment of the present invention, before receiving the subscriber information from the HLR, the SGSN may receive authentication information including whether encryption of the mobile terminal is activated in cooperation with the authentication center. Therefore, when authenticating the mobile terminal in response to the access request of the mobile terminal, it is possible to perform encryption for each mobile terminal by referring to the authentication information received from the authentication center. As such, according to an embodiment of the present invention, it is possible to provide a differentiated packet security service for each subscriber.

4 is a flowchart illustrating a case where a mobile terminal makes a location update request according to an embodiment of the present invention. In one embodiment, it is assumed that SGSN 140-1 governs mobile terminal 110 after location movement, and SGSN 140-2 governs mobile terminal 110 before location movement. For example, when the mobile terminal 110 requests a routing area update request to the system due to a location change or the like, more components (eg, HLR, GGSN, etc.) are used to perform a more complicated procedure. Omit the description so as not to obscure the core.

First, the mobile terminal 110 may transmit a location update request message to the SGSN 140-1 (step 401). SGSN 140-1 may transmit an SGSN context request message to SGSN 140-2 in response to receiving the location update request message (step 402). SGSN 140-2 may transmit an SGSN context response message to SGSN 140-1 in response to receiving the SGSN context request message (step 403). For example, the SGSN context response message may be defined according to the 3GPP standard as shown in Table 2. In one embodiment, the SGSN context response message may include an MM context associated with authentication of the mobile terminal 110, as shown in Table 3, and the MM context may include whether encryption of the mobile terminal 110 is activated or not. Can be.

In an embodiment, the SGSN 140-1 determines whether the MM context of the SGSN context response message received from the SGSN 140-2 includes or does not include encryption of the mobile terminal 110, and determines that the SGSN 140-1 does not include encryption. In operation 404, a message for requesting authentication information including whether to activate encryption of the mobile terminal 110 may be transmitted to the authentication center 150. In response to receiving the message requesting authentication information of the mobile terminal 110, the authentication center 150 may transmit authentication information including whether to activate encryption of the mobile terminal 110 to the SGSN 140-1 ( Step 405). Information on whether encryption of the mobile terminal 110 is activated may be configured as one parameter of authentication information defined in, for example, the 3GPP 29.002 standard, as shown in Table 1 above. According to the information on whether encryption is activated through step 403 or 405, the SGSN 140-1 may perform encryption on the data packet transmitted to the mobile terminal 110 (step 406). In one embodiment, the subsequent location update procedure of the mobile terminal 110 is, for example, a GPRS Support Node (GGSN) and a Home Location Register (HLR) according to the standard procedure defined in the 3GPP specification. It may proceed in conjunction with the back.

According to an embodiment of the present invention, the SGSN may receive information on whether to activate encryption of the mobile terminal in association with a previous SGSN or an authentication center that had jurisdiction over the mobile terminal. Therefore, in response to receiving the location update request from the mobile terminal, it is possible to encrypt the data packet transmitted for each mobile terminal. As such, according to an embodiment of the present invention, it is possible to provide a differentiated packet security service for each subscriber.

 5 is a flowchart illustrating a case where a mobile terminal requests a packet data service according to an embodiment of the present invention. When the mobile terminal 110 requests a packet data service, more components (eg, HLR, GGSN, etc.) are used to perform a complicated procedure, but the description is omitted in order not to obscure the core of the present invention.

The mobile terminal 110 may send a packet service request message to the SGSN 140 (step 501). In response to receiving the packet service request message, the SGSN 140 may transmit a message to the authentication center 150 requesting authentication information including whether to activate encryption of the mobile terminal 110 (step 502). In one embodiment, step 502 determines whether the SGSN 140 stores authentication information including whether to activate encryption of the mobile terminal 110, and determines that all or none of the stored authentication vectors are exhausted. In response, the method may include transmitting a message requesting authentication information of the mobile terminal 110 to the authentication center 150. In response to receiving the authentication information of the mobile terminal 110, the authentication center 150 may transmit authentication information to the SGSN 140 including whether to activate encryption of the mobile terminal 110 (step 502). Information on whether encryption of the mobile terminal 110 is activated may be configured as one parameter of authentication information defined in, for example, the 3GPP 29.002 standard, as shown in Table 1 above. According to the information on whether encryption is activated, the SGSN 140 may perform encryption on the data packet transmitted to the mobile terminal 110 (step 503). In one embodiment, the subsequent packet data service request procedure of the mobile terminal 110 is, for example, according to the standard procedure defined in the 3GPP specification, for example, a packet gateway exchange (GGSN) and a subscriber information store (HLR). It can proceed in conjunction with a register.

According to an embodiment of the present invention, the SGSN may receive information on whether to activate encryption of the mobile terminal in association with an authentication center. Therefore, in response to receiving the packet data service request from the mobile terminal, it is possible to encrypt the data packet transmitted for each mobile terminal. As such, according to an embodiment of the present invention, it is possible to provide a differentiated packet security service for each subscriber.

Although the foregoing methods have been described through specific embodiments, the foregoing methods may also be embodied as computer readable codes on a computer readable recording medium. A computer-readable recording medium includes all kinds of recording apparatuses in which data that can be read by a computer system is stored. Examples of the computer-readable recording medium include a ROM, a RAM, a CD-ROM, a magnetic tape, a floppy disk, an optical data storage device, and the like, and may be implemented in the form of a carrier wave (for example, transmission over the Internet) . In addition, the computer-readable recording medium may be distributed over network-connected computer systems so that computer readable codes can be stored and executed in a distributed manner. And, functional programs, codes, and code segments for implementing the above-described embodiments can be easily inferred by programmers of the art to which the present invention belongs.

While the present invention has been described in connection with certain embodiments thereof, it will be apparent to those skilled in the art that various modifications and variations can be made therein without departing from the spirit and scope of the invention . It is also contemplated that such variations and modifications are within the scope of the claims appended hereto.

1 is a block diagram of an exemplary communications system environment in which the present invention may be practiced.

2 is a block diagram of a mobile terminal, SGSN and authentication center according to an embodiment of the present invention.

3 is a flowchart illustrating a case where a mobile terminal makes a connection request to a system according to an embodiment of the present invention.

4 is a flowchart illustrating a case where a mobile terminal makes a location update request to a system according to an embodiment of the present invention.

5 is a flowchart illustrating a case where a mobile terminal requests a packet data service according to an embodiment of the present invention.

Claims (16)

A communication method in a packet switch (SGSN) that manages a mobile terminal, Receiving a connection request message from the mobile terminal; Requesting authentication information of the mobile terminal and receiving the authentication information from an authentication center; And Determining whether to perform encryption of the mobile terminal with reference to the authentication information; The authentication information includes whether the encryption activation of the mobile terminal. The method according to claim 1, Storing the authentication information. 3. The method of claim 2, Receiving a packet service request message from the mobile terminal; And Determining whether to encrypt the packet based on the authentication information, and if it is determined to encrypt the packet, encrypting the packet Communication method further comprising. The method according to claim 1, Requesting and receiving the authentication information is performed before receiving subscriber information of the mobile terminal from a subscriber information store for location registration of the mobile terminal. A communication method in a packet switch (SGSN) that manages a mobile terminal, Receiving a packet service request message from the mobile terminal; Requesting authentication information of the mobile terminal from an authentication center and receiving the authentication information from the authentication center; And Determining whether to perform encryption of the mobile terminal with reference to the authentication information; The authentication information includes whether the encryption activation of the mobile terminal. 6. The method of claim 5, Determining whether authentication information including whether encryption of the mobile terminal is activated or not is stored; Further comprising: The requesting and receiving of the authentication information may include requesting authentication information of the mobile terminal from the authentication center and receiving the authentication information from the authentication center in response to determining that the authentication information is not stored. Communication method comprising. The communication method according to claim 1 or 5, wherein the authentication information is received through a message according to a 3rd generation project group (3GPP) standard. The communication method according to claim 7, wherein the authentication information is received through a message according to 3GPP 29.002 standard, and whether to activate encryption of the mobile terminal is defined as a private extension. A communication method in a second packet switch (SGSN) currently managing a mobile terminal, Receiving a location update request message from the mobile terminal; Requesting information on the mobile terminal from a first packet switch that managed the mobile terminal, and receiving information on the mobile terminal from the first packet switch; And Determining whether to perform encryption on the mobile terminal by referring to the information on the mobile terminal, The information about the mobile terminal includes authentication information including whether encryption of the mobile terminal is activated. 10. The method of claim 9, The information about the mobile terminal is received through a message according to the 3rd Generation Project Group (3GPP) standard. The communication method of claim 10, wherein the information about the mobile terminal is received through a message according to 3GPP 29.060 standard, and the authentication information is included in an MM Context field. 10. The method of claim 9, Determining whether the information on the mobile terminal includes authentication information including whether to activate encryption of the mobile terminal; And In response to determining that the information on the mobile terminal does not include authentication information including whether to activate encryption of the mobile terminal, requesting the authentication information to an authentication center, and receiving the authentication information from the authentication center. step Communication method further comprising. A communication system comprising a mobile terminal, a packet switch for managing the mobile terminal, and an authentication center for storing authentication information of the mobile terminal. The packet exchange is operable to request authentication information of the mobile terminal to the authentication center in response to receiving a connection request from the mobile terminal, and encrypt the mobile terminal with reference to the authentication information delivered from the authentication center. To determine whether or not to perform The authentication center is operative to transmit authentication information of the mobile terminal to the packet exchange in response to receiving the request for authentication information of the mobile terminal from the packet exchange, The authentication information is registered in the authentication center for each mobile terminal, the communication system including whether or not the encryption activation of the mobile terminal. A communication system comprising a mobile terminal, a packet switch for managing the mobile terminal, and an authentication center for storing authentication information of the mobile terminal. The packet exchange is operable to request authentication information of the mobile terminal to the authentication center in response to receiving a packet service request from the mobile terminal, and for the mobile terminal with reference to the authentication information delivered from the authentication center. Works to determine whether to perform encryption, The authentication center is operative to transmit authentication information of the mobile terminal to the packet exchange in response to receiving the request for authentication information of the mobile terminal from the packet exchange, The authentication information includes a communication system whether the encryption activation of the mobile terminal. A communication system comprising a mobile terminal, a first packet switch that managed the mobile terminal, and a second packet switch that currently manages the mobile terminal. The second packet switch is operable to request the first packet switch for information about the mobile terminal in response to receiving a location update request from the mobile terminal, for the mobile terminal delivered from the first packet switch. It is operated to determine whether to perform encryption for the mobile terminal with reference to the information, The first packet exchange stores information about the mobile terminal and operates to transmit information about the mobile terminal to the second packet exchange in response to receiving a request for information about the mobile terminal from the second packet exchange. Become, The information about the mobile terminal includes authentication information including whether encryption of the mobile terminal is activated. As a packet switch (SGSN) in a mobile communication system, When the mobile terminal requests the packet data transmission, the transmission and reception unit for requesting the authentication information, including whether or not to activate the encryption of the mobile terminal to the authentication center, and receiving the authentication information from the authentication center; And And an authenticator configured to determine whether to encrypt the mobile terminal by referring to the authentication information.

Images