JP2006230011A - Authentication method and system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a authentication method and system with which a VAS platform can identify an MS accessing the service of the VAS platform. <P>SOLUTION: In the authentication method and system for identifying subscribers of a first network in a second network, the address of the second network is assigned to the subscribers. Information on mapping between the address and subscriber recognition of the second network is generated and transmitted to the second network. Thus, authentication server connection is formed between the first and second networks and the subscriber recognition is handed over to the second network. The VAS platform of the second network receives the address and the subscriber recognition of the second network and consequently, subscriber access service of the VAS platform is identified for the purpose of charging and/or addressing. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an authentication method and system for identifying a subscriber of a first network in a second network.

  In GPRS (General Packet Radio Service) systems, packet mode technology is used to efficiently transfer high and low speed data and signaling. GPRS optimizes the use of network and radio resources. Applications based on standard data protocols are supported and interworking with IP networks is defined. GPRS is configured to support from intermittent and burst data transfers to occasional transmission of large amounts of data. Billing is usually based on the amount of data transferred.

  GPRS introduces two new network nodes in the GSM mobile network. The serving GPRS support node (SGSN) is at the same hierarchical level as the mobile switching center (MSC), tracks the individual location of the mobile station (MS) and performs security functions and access control. The SGSN is connected to the base station system by a frame relay. A gateway GSN (GGSN) provides interworking with external packet switched networks and is connected to the SGSN via an IP-based GPRS backbone network. The GLR system's HLR (Home Location Register) can be improved with GPRS subscriber information, and the VLR (Visitor Location Register) can be improved for more efficient alignment of GPRS and non-GPRS services and functions, For example, improvements can be made to paging of circuit-switched calls that can be performed more efficiently via SGSN, and to combined GPRS and non-GPRS location updates.

  In order to access the GPRS service, the MS first informs the network of its presence by performing a GPRS attach. This operation establishes a logical link between the MS and the SGSN and allows the MS to use paging via the SGSN and notification of incoming GPRS data. In order to send and receive GPRS data, the MS must activate the packet data address that it wants to use. This operation can inform the MS to the corresponding GGSN and initiate interworking with the external data network. User data is transferred transparently between the MS and the external data network in a manner known as encapsulation and tunneling, in which case the data packet is provided with GPRS-specific protocol information and Transferred to / from GGSN. This transparent forwarding method reduces the need for GPRS mobile networks to interpret external data protocols and allows additional interworking protocols to be easily introduced in the future.

  If the mobile subscriber wants to access the value added service (VAS) provided by the IP network, service specific billing is an essential feature of the corresponding VAS platform for the mobile operator. This means that the operator needs a service platform that can perform billing based on the accessed WML content or URL (Uniform Resource Locator) and the supplied message, for example. However, MS identification in a VAS platform connected to a GPRS network or other mobile packet switched network is unusual. The reason is that the VAS platform only receives IP packets from a certain source address, but this is usually just the dynamic IP address of the MS and is therefore not quite enough to identify that MS. . In addition, a MSISDN (Mobile Station ISDN Number) that is particularly important for messaging services (eg, multimedia messaging) to prevent additional HLR queries is also required.

  Known MS identification is performed, for example, by using a username, password or encryption key. However, these types of solutions are complex to operate and manage for mobile operators. In addition, these solutions typically require their own management system and database, which is the existing mobile operator's existing key where IMSI (International Mobile Subscriber Identification) or MSISDN is a key to CDR (Call Detail Record). It is not necessarily compatible with any billing system or billing system.

  Alternatively, an authentication service can be performed in the HLR. However, this solution leads to a significant load increase on the HLR, which is already a very demanding node.

  Therefore, it is an object of the present invention to provide an authentication method and system that allows a VAS platform to identify an MS accessing a service of that VAS platform.

  The purpose is an authentication method for identifying a subscriber of a first network in a second network, assigning the address of the second network to the subscriber, and the subscriber's address and subscriber in the second network. Is generated by an authentication method comprising the steps of generating information about the mapping between the recognition and sending the mapping to the second network.

  Furthermore, the object is an authentication system for identifying a subscriber of a first network in a second network, comprising a gateway device, which assigns an address of the second network to the subscriber. And an authentication client means for generating information about mapping between the address of the second network and subscriber identity and transmitting the mapping information to the second network, and Achieved by an authentication system comprising an authentication server provided in the second network and configured to log and maintain the mapping information.

  Further, the object is to provide an assigning means for assigning an address of the second network to a subscriber of the first network in a gateway device for connecting the first network to the second network, and the second network. This is accomplished by a gateway device comprising authentication client means for generating information about the mapping between address and subscriber identity and sending the mapping information to the IP network.

  Accordingly, mapping information between the address of the second network and the subscriber identity is generated and supplied to the second network. This achieves a client-server connection, which allows the actual subscriber identity of the dynamic address of the second network to be handed over to the second network. The second network identifies the subscriber using a mapping between the address of the second network and the subscriber identity.

  Since the first network, eg GGSN, contains information about the mapping between the second network address and the subscriber identity, new mapping data can be sent to the second network when the mapping changes.

  The subscriber identity is preferably the subscriber's IMSI and / or MSISDN. Thus, the multimedia messaging service uses MSISDN to identify the recipient, and the recipient can identify the sender of the message based on the MSISDN provided by the multimedia messaging service center, and the HLR query is Is no longer needed. In addition, MSISDN or IMSI is used by the charging function to identify subscribers and perform service specific charging.

  The mapping information can be sent in an access request message, eg, a RADIUS access request message.

  An authentication server function is preferably provided for the VAS platform, an access request message is sent to the authentication server function of the VAS platform, and the mobile terminal is identified on the VAS platform based on the mapping information. In this case, the authentication server function may be included in the VAS platform, or the authentication server function may be provided by a dedicated authentication server.

  When the gateway device is a GGSN, the mapping information is generated by the authentication client function of the GGSN.

  The mapping information can also be used for service specific billing.

  The authentication server may be a RADIUS server for the VAS platform provided in the second network, where the VAS platform is configured to identify the subscriber based on the mapping information.

  Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

  A preferred embodiment of an authentication method and system according to the present invention will be described below based on a GPRS network which is an example of a first network and an IP network which is an example of a second network.

  As shown in FIG. 1, a mobile terminal or mobile station (MS) 1 is wirelessly connected to a GSM network 2, which is then connected to a SGRS 3 of a GPRS backbone network. The GPRS backbone network comprises a billing server 4 and a GGSN 5, which is connected to an IP network 9, for example a specific operator's intranet or the Internet.

  The GGSN 5 comprises an access point unit (AP) 51 that provides access to the IP network 9, which is configured to assign an IP address to the MS to be connected to the IP network 9. In addition, the GGSN 5 comprises an authentication client unit 52 configured to provide the necessary parameters for access requests generated to the IP network 9. Furthermore, this authentication client unit 52 is configured to clarify and specify the handling of username and password parameters supplied to the desired VAS of the IP network 9.

  According to the preferred embodiment shown in FIG. 1, the IP network 9 is the operator's intranet backbone, which is an address assignment server 6, for example a RADIUS (Remote Authentication Dial-in User Service) server, a DHCP (Dynamic Host Configuration). Protocol) server or DNS (domain name server). The address assignment server 6 is configured to respond to an access request from the GGSN 5 with an access accept or access reject message. Furthermore, the address assignment server 6 performs host configuration and address assignment in the IP network 9.

  Furthermore, the IP network 9, for example the operator's intranet, comprises a value added service (VAS) platform 7. An example of such a VAS platform is a Multimedia Message Center (MMSC) for supplying multimedia messages to requesting subscribers such as MS1. Yet another example of a VAS platform is the Wireless Application Protocol (WAP) that provides access to the World Wide Web (WWW) based on a corresponding uniform resource locator (URL).

  According to a preferred embodiment of the present invention, a dedicated authentication server 8 for the VAS platform 7 is provided in the IP network 9. The authentication server 8 is a RADIUS server that accepts or rejects an access request to the VAS platform 7. Further, the authentication server 8 is configured to log or store an access request received from an authentication client 52 of the GGSN 5, eg, a RADIUS client, or a corresponding mobile subscriber identity. Accordingly, the authentication client 52 of the GGSN 5 communicates with an address assignment server or a specific authentication server 8 so that an authentication client-server connection is established.

  In particular, the authentication client 52 incorporates the mapping information or adds it to the access request and, based on it, derives the actual MSISDN and / or IMSI of the MS requesting service from the IP network 9 at the authentication server 8. Can do. The mapping information includes the current IP address, MSISDN and / or IMSI, or a combination or shortened version thereof, based on which the MSISDN and / or IMSI can be derived from the current IP address. MSISDN can be obtained from GSM network 2 via SGSN 3 by GGSN 5.

  Thus, the authentication client unit 52 of the GGSN 5 provides information regarding the mapping between the IP address and the MSISDN and / or IMSI. When this mapping is changed, the authentication client unit 52 transmits new mapping information to the authentication server 8 of the IP network 9. Thereby, MSISDN and / or IMSI are always obtained in the VAS platform 7.

  MSISDN can be provided as an additional GTP parameter supplied from SGSN 3 to GGSN 5. The IMSI can also be derived from the TID supplied from SGSN 3 to GGSN 5.

  The GGSN 5 functions as an access point of the GSM GPRS data network for interworking with the IP network 9. In this case, the GPRS network looks like any other IP network or subnetwork. Access to the IP network 9 involves specific functions such as user authentication, user authorization, end-to-end encryption between the MS and the IP network 9, and assignment of dynamic IP addresses belonging to the IP network 9 address space. More specifically, the MS 1 that requests access to the IP network 9 is given an address that belongs to the operator addressing space. This address is given at contract time (in this case it is a static address) or in a PDP (Packet Data Protocol) context activation (in this case it is a dynamic address). This address is used for packet transfer between the IP network 9 and the GGSN 5 and within the GGSN 5.

  An example of an access operation performed on the IP network 9 through the GPRS backbone network will be described below with reference to FIG.

  FIG. 2 is an information flow and processing diagram illustrating signaling and processing operations performed during an exemplary access operation. According to FIG. 2, MS1 sends a “PDP context activation request” message to SGSN3, which includes protocol configuration options and parameters such as NSAPI (Network Layer Service Access Point Identifier). SGSN 3 then forms the TID for the requested PDP context by combining the IMSI stored in the MM (Mobility Management) context with the MSAPI received from the MS, where the SGSN obtains the MSISDN from the HLR. Fetch. SGSN 3 then sends a “Create PDP Context Request” message to GGSN 5, which includes parameters such as APN (Access Point Name), TID and MSISDN. The AP unit 51 of the GGSN 5 assigns an IP address for the MS 1 and the authentication client unit 52 incorporates the parameters required for the access request into the authentication server 8. More specifically, the authentication client unit 52 generates mapping data indicating the mapping between the assigned IP address and the MSISDN / IMSI.

  The GGSN 5 transmits an access request including the IP address and mapping data to the authentication server 8 provided for the VAS platform 7. The authentication server 8 then accepts or rejects the received request. Further, the authentication server 8 logs a request including the IP address and mapping data. Accordingly, the VAS platform 7 can identify the MS 1 based on the mapping data included in the access request stored in the authentication server 8.

  The GGSN 5 sends a “PDP Context Formation Response” message back to the SGSN 3 where the cause value is set based on the result of the authentication, ie access denied or accepted. Based on the cause value received in the “PDP Context Create Response” message, SGSN 3 sends a “PDP Context Activate Accept” message or a “PDP Context Activate Reject” message to MS1.

  Thus, with the above access procedure, VAS platform 7 can receive the IP address and the IMSI and MSISDN of the accessing MS, the addressing of the multimedia messaging service can be based on MSISDN, and Service-specific billing can be performed.

  In summary, the present invention relates to an authentication method and system for identifying a subscriber of a first network in a second network, wherein the address of the second network is assigned to the subscriber. Information about the mapping between the address of the second network and the subscriber identity is generated and transmitted to the second network. Thereby, an authentication server connection is formed between the first network and the second network, and the subscriber recognition can be handed over to the second network. Thus, the VAS platform of the second network can receive the second network's address and subscriber identity, and thus can identify the VAS platform's subscriber access services for billing and / or addressing purposes.

  Note that the authentication method and system described above can be applied to gateway devices between two networks, such as mobile networks and IP networks, or telephone networks (eg, ISDN, PSTN) and closed or open data networks. Further, the authentication server 8 and the authentication client unit 52 are not limited to the RADIUS server and the client. Note also that multiple VAS platforms, similar or different from each other, can be attached to the second network simultaneously.

  The above description of the preferred embodiments and the accompanying drawings are only intended to illustrate the present invention. Accordingly, the preferred embodiments of the invention can be modified within the scope of the claims.

1 is a block diagram of a GPRS network connected to an IP network according to a preferred embodiment of the present invention. FIG. 3 is an information flow and processing diagram illustrating an operation of accessing an IP network according to a preferred embodiment of the present invention.

Explanation of symbols

1 Mobile terminal or mobile station 2 GSM network 3 SGSN
4 Billing server 5 GGSN
6 Address allocation server 7 VAS platform 8 Authentication server 9 IP network 51 Access point unit 52 Authentication client unit

Claims (17)

An authentication method for identifying a subscriber of a first network (2) in a second network provided with an authentication server function for a VAS platform,
a) assigning the address of the second network (9) to the subscriber;
b) generating information about the mapping between the subscriber's address and the subscriber's identity in the second network (9); and c) sending the mapping to the second network;
The authentication method is characterized in that the subscriber is identified on the VAS platform based on the mapping information.   The authentication method according to claim 1, wherein the mapping information is transmitted to the second network when the mapping between the address and subscriber recognition in the second network changes.   The authentication method according to claim 1 or 2, wherein the subscriber's recognition is the subscriber's IMSI and / or MSISDN.   4. The authentication method according to claim 1, wherein the mapping information is transmitted in an access request message.   The authentication method according to claim 4, wherein the access request message is a RADIUS access request message.   The authentication method according to claim 1, wherein the authentication server function is included in a VAS platform.   The authentication method according to claim 1, wherein the authentication server function is provided by a dedicated authentication server.   The authentication method according to claim 1, wherein the mapping information is generated by an authentication client function in the GGSN.   9. The authentication method according to claim 1, wherein the mapping information is used for service-specific charging and / or addressing of a mobile terminal. An authentication system for identifying a subscriber (1) of a first network (2) in a second network (9),
a) a gateway device (5), which includes an assigning means (51) for assigning an address of the second network (9) to the subscriber (1), and a second network (9) Authentication client means (52) for generating information about the mapping between the address and subscriber identity and transmitting the mapping information to the second network (9), and b) the second network An authentication server (8) provided in (9) and configured to log and maintain the mapping information;
c) The authentication server (8) is a server of the VAS platform (7) provided in the second network (9), and the VAS platform (7) is connected to the subscriber (1) based on the mapping information. An authentication system configured to identify a).   The authentication system according to claim 10, wherein the gateway device is GGSN (5).   The authentication system according to claim 10 or 11, wherein the authentication client means (52) is a RADIUS client.   The authentication system according to any one of claims 10 to 12, wherein the authentication server (8) is a RADIUS server.   14. The authentication system according to claim 10, wherein the subscriber recognition is IMSI or MSISDN.   The authentication system according to any one of claims 10 to 14, wherein the authentication client means (52) is configured to transmit the mapping information to the authentication server (8) in an access request message. In the gateway device for connecting the first network (2) to the second network (9),
a) assigning means (51) for assigning the address of the second network (9) to the subscriber (1) of the first network (2);
b) authentication client means (52) for generating information relating to the mapping between the address of the second network (9) and the subscriber identity, and for transmitting the mapping information to the IP network (9); ,
And the authentication client means (52) is a RADIUS client.   The gateway apparatus according to claim 16, wherein the authentication client means (52) is configured to transmit the mapping information in an access request message.

Images