JP2006245831A - Communication method, communication system, authentication server and mobile - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a security higher than a conventional communication system regarding an authentication between a mobile 3 moved between communication networks using different authentication systems and authentication servers in the communication networks. <P>SOLUTION: In the authentication of the mobile 3, a correctness is decided according to whether or not random numbers transmitted from each of the authentication server 11 for a home network 1 and the mobile 3 to the authentication server 21 for a network 2 are identical with an information obtained by ciphering the result of the authentication computed by a common cipher key. Accordingly, even when a malicious person wire-taps the transmitted and received information in the case of the authentication; a successful impersonation is made unable by succeeding communications, an additional function is not required for the authentication server 21 for the network 2, and a clearing function is not also required. In the authentication in the case of a hand-over, since the result of the authentication used for the authentication in the case of the start of a communication is used as a procedure employed as the random numbers, the procedure of the information from the authentication server 11 for the home network 1 to the mobile 3 is shortened, and a transaction processing can be reduced. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention encrypts authentication results calculated by a mobile device and a home network in communication between a mobile device moving between communication networks each having an authentication server using different authentication methods, and an authentication server of each of a roaming network and a home network. Communication system that can easily authenticate a mobile device by reducing the number of communication transactions without adding an additional function to the authentication server of the roaming network using the authentication server of the roaming network. About.

  A mobile device that performs roaming needs to be registered in the home network via the roaming network, and at that time, authentication of the mobile device is performed. In the current cellular communication, it is common that authentication specifications are unified between communication networks by agreement between telecommunications carriers that perform roaming (Non-Patent Document 1 and Non-Patent Document 2).

  FIG. 5 is a block diagram of a system for performing authentication during roaming between communication networks each having an authentication server using different authentication methods. As shown in FIG. 5, a communication system for authenticating a mobile device at the time of roaming includes a home network 1 as a communication network to which a user has a service belonging relationship, and a roaming network 2 as another communication network. The mobile device 3 is configured. The home network 1 and the roaming network 2 are connected via a communication network 41. When the mobile device 3 moving between the home network 1 and the roaming network 2 is located in the home network 1, the mobile device 3 is connected to the home network 1 via the communication line 42. When the mobile device 3 is in the roaming network 2, the mobile device 3 is connected to the roaming network 2 via the communication line 43.

  When the mobile device 3 performs roaming by moving from the home network 1 to the roaming network 2, the mobile device 3 moves to the position of the home network 1 via the communication line 43, the communication line 24, the communication network 41, and the communication line 14. A location registration request is made to the registration server 12. The location registration server 12 that has received the location registration request requests the authentication server 11 connected via the communication line 14 to confirm the validity of the mobile device 3.

  The authentication server 11 of the home network 1 transmits authentication information (eg, mobile device address, shared encryption key, etc.) of the mobile device 3 to the authentication server 21 of the roaming network 2. The authentication server 21 of the roaming network 2 that has received the authentication information executes the authentication of the mobile device 3. When the authentication is successful, the authentication server 21 of the home network 1 notifies the authentication server 11 of the home network 1 that the authentication has been successful. Store authentication information. Further, the location registration server 12 of the home network 1 stores that the mobile device 3 is in the roaming network 2.

  At the start of communication when the mobile device 3 is in the roaming network 2, authentication is performed in the same procedure as in the location registration. When the authentication is successful, the authentication information of the mobile device 3 is the authentication server of the roaming network 2. 21 is stored.

  At the time of handover of the mobile device 3, the authentication server 21 of the roaming network 2 executes authentication of the mobile device 3 using the authentication information of the mobile device stored in the authentication server 21 of the roaming network 2.

The methods of Non-Patent Documents 1 and 2 are based on the premise that authentication specifications are unified among communication carriers. However, in Internet communication involving various communication carriers, the authentication specifications are used by all communication carriers. It becomes difficult to unify. Therefore, as shown in FIG. 5, in the current Internet communication, a clearing device 23 is installed in the roaming network 2 or a clearing function that absorbs a difference in authentication specifications in the authentication server 21 of the roaming network 2 ( The mobile device 3 can be authenticated even when the roaming network 2 and the home network 1 have different authentication methods.
3rd Generation Partnership Project Technical Specification 23.012 “Location Management Procedures (Release1999)”, June 2000. (P.9-P.36), [online], [Search February 3, 2005], Internet <URL: http : //www.3gpp.org/ftp/Specs/2004-12/R1999/23_series/> 3rd Generation Partnership Project Technical Specification 33.102 "3G Security; Security architecture (Release1999)", December 2002. (P.17-P.26), [online], [Search February 3, 2005], Internet <URL : Http://www.3gpp.org/ftp/Specs/2004-12/R1999/33_series/> Japanese Patent Laid-Open No. 2002-261761

  In Patent Document 1, when roaming, it is necessary to notify authentication information that can be recognized only between the mobile device and the authentication server of the home network to an authentication server in the roaming network corresponding to the clearing device to be relayed. It is also possible to impersonate a clearing device by intercepting packets sent and received by Service-to-Self. In that case, there is a possibility that the clearing device that has been impersonated may communicate with another clearing device, and there remains a problem that the security level of communication is lowered.

  In addition, when a mobile station performs a handover within a roaming network, it is necessary to always perform authentication via a clearing device, and thus there remains a problem that transaction processing of the handover increases.

  The present invention has been made in view of such problems. In a communication network having an authentication server that uses different authentication methods, in the authentication of the authentication server of each of the home network and the roaming network, the security level is reduced. It is an object of the present invention to provide a communication method between mobile devices capable of preventing an increase in transaction processing.

  In order to solve the above-described problems, the present invention uses the following communication method.

The invention according to claim 1 is a communication method by a plurality of communication networks each having an authentication server that uses different authentication methods and a mobile device that communicates using the plurality of communication networks, the communication network being a mobile device And a home network having a service belonging relationship with the service and a roaming network in which the mobile device communicates by roaming. This communication method moves at the time of location registration or communication start when the mobile device moves to the roaming network. The authentication procedure that the authentication server of the roaming network uses the authentication result created and owned by the authentication server of the mobile device and the home network, and the authentication server of the mobile device and the home network The authentication procedure is characterized in that authentication is performed using a previously calculated authentication result as a random number.
By using this procedure, authentication of a mobile device in a plurality of communication networks each having an authentication server using a different authentication method is simplified, and authentication that does not particularly require an existing clearing device is possible. This solves the problem of a decrease in security level due to interception of transmitted and received packets and the problem of increase in transaction processing.

The invention according to claim 2 is the invention according to claim 1, wherein the information used in the authentication procedure executed at the time of location registration or at the start of communication includes a mobile device address that can uniquely identify a mobile device, The shared encryption key that is stored together between the mobile device and the home network authentication server, the random number generated by the home network authentication server, and the mobile station and the home network authentication server are calculated by the authentication procedure. Information obtained by encrypting the authentication result with the shared encryption key.
According to this, the lowering of the security level can be prevented more reliably.

According to a third aspect of the present invention, in the first aspect of the invention, the authentication of the mobile device at the time of location registration is performed by the location registration request signal transmitted from the location registration server of the roaming network by the mobile device. The home network is recognized from the home network address (example: domain name) that can uniquely identify the home network in the mobile device address (example: user name @ domain name) that can be uniquely identified, and a location registration request signal is transmitted. It is characterized by doing.
According to this, it becomes possible for the roaming network location registration server to identify the home network of the mobile device and transmit a location request signal to the authentication server of the home network. Sent to network authentication server.

The invention according to claim 4 is the invention according to claim 1, wherein the authentication server of the home network is generated by the shared encryption key stored in advance in the mobile device and the authentication server of the home network and the authentication server of the home network. The authentication result is calculated using a random number. The authentication result is encrypted with the shared encryption key, and the mobile station address, the generated random number, and the encrypted authentication result are transmitted to the authentication server of the roaming network.
The roaming network authentication server stores the received mobile device address and the encrypted authentication result as a pair of data, and transmits a random number generated by the home network authentication server to the mobile device.
The mobile device calculates the authentication result using the shared encryption key stored in advance together with the authentication server of the home network and the received random number. After that, as with the home network authentication server, the authentication result is encrypted with the shared encryption key, and the mobile station address and the encrypted authentication result are transmitted to the roaming network authentication server.
The authentication server of the roaming network that has received the mobile device address and the encrypted authentication result searches the stored authentication result of the mobile device using the mobile device address as a search key and receives it from the mobile device. Compare with the encrypted authentication result. If the compared authentication results are the same, authentication is successful, an authentication response signal is transmitted to the home network authentication server, and the location information of the mobile device in the home network location registration server is updated via the home network authentication server. It is characterized by that.
According to this, authentication of the mobile device in the communication network is simplified, and the problem of a decrease in security level due to interception of transmitted and received packets is solved.

  In the invention according to claim 5 or 6, in the invention according to claim 1, the authentication procedure similar to the location registration is executed even when communication of the mobile device is started.

According to an eighth aspect of the present invention, in the first aspect of the invention, the information used in the authentication procedure executed at the time of handover includes a mobile unit address that can uniquely identify the mobile unit, and authentication of the mobile unit and the home network. The shared encryption key stored together between the servers, the authentication result used for authentication at the start of communication stored between the mobile station and the home network authentication server, and the mobile station and home network And an authentication result obtained by encrypting the authentication result respectively calculated by the authentication server with the shared encryption key.
According to this, the lowering of the security level can be prevented more reliably.

In the invention according to claim 7, 9 or 10, in the invention according to claim 1, in the authentication of the mobile device at the time of handover, when the mobile device executes authentication with the authentication server of the home network at the start of communication The authentication result is used as a random number.
The calculation of the authentication result is the same as the calculation procedure at the start of communication, and the mobile device uses the shared encryption key stored in advance between the authentication result and the mobile server and the home network authentication server. The result is calculated, the authentication result is encrypted with the shared encryption key, and the mobile device address that uniquely identifies the mobile device and the encrypted authentication result are transmitted to the authentication server of the roaming network.
The authentication server of the roaming network that has received the mobile device address and the encrypted authentication result stores the information, and is included in the mobile device address (eg, user name @ domain name) as in the case of location registration. By identifying the home network from a home network address (eg, domain name) that can identify the home network, the mobile station address and the encrypted authentication result are transmitted to the authentication server of the home network.
The authentication server of the home network that has received such information uses the authentication result when the authentication is executed with the mobile device at the start of communication, as a random number, similar to the mobile device. An authentication result is calculated from a shared encryption key stored in advance between the authentication servers, encrypted with the shared encryption key, and the mobile device address and encryption that can uniquely identify the mobile device to the authentication server of the roaming network Send the authentication result.
Similar to the authentication procedure at the start of communication, the roaming network authentication server that has received the mobile device address and the encrypted authentication result stores the encrypted authentication of the mobile device stored using the mobile device address as a search key. The result is retrieved and compared with the encrypted authentication result received from the mobile device. If the comparison results are the same, authentication is successful and handover is executed.
According to this, authentication at the time of handover of a mobile device in a plurality of communication networks is simplified, thereby solving a problem of a decrease in security level due to interception of transmitted and received packets and an increase in transaction processing. Is done.
Other solutions will be clarified in the “Best Mode for Carrying Out the Invention” section below.

  ADVANTAGE OF THE INVENTION According to this invention, the communication method which can suppress the fall of the security level by a interception of the transmission / reception packet of a Service-to-Self and transaction processing can be provided in roaming service.

  Next, embodiments of the present invention will be described in detail with reference to the drawings. Further, FIG. 1 will be referred to if necessary. FIG. 1 is a configuration diagram of a communication network that realizes authentication at the time of roaming according to an embodiment of the present invention.

(Home network, roaming network, communication line)
The home network 1 includes an authentication server 11, a location registration server 12, and a communication line 14 that connects the authentication server 11 and the location registration server 12. The roaming network 2 includes an authentication server 21, a location registration server 22, and an authentication. The communication line 24 connects the server 21 and the location registration server 22. The home network 1 and the roaming network 2 are connected via a communication network 41.
When the mobile device 3 is in the home network 1, the mobile device 3 is connected to the home network 1 via the communication line 42, and when the mobile device 3 is in the roaming network 2, the mobile device 3 The machine 3 is connected to the roaming network 2 via the communication line 43.

(Authentication server 11 of home network 1)
The authentication server 11 of the home network 1 includes a transmission / reception unit 111 that transmits and receives data, a storage unit 112 that stores each data, and a calculation unit 113 that performs processing such as calculation and encryption of the authentication result of each data. Is done.

(Location registration server 12 of home network 1)
The location registration server 12 of the home network 1 includes a transmission / reception unit 121 that transmits / receives data and the like, and a storage unit 122 that stores data such as location information of the mobile device 3.

(Authentication server 21 of roaming network 2)
The authentication server 21 of the roaming network 2 includes a transmission / reception unit 211 that performs transmission / reception of data, a storage unit 212 that stores each data, a calculation unit 213 that performs processing such as calculation and encryption of each data authentication result, and each authentication result The comparison unit 214 is configured to compare the above.

(Roaming network 2 location registration server 22)
The location registration server 22 of the roaming network 2 includes a transmission / reception unit 221 that transmits and receives data and a calculation unit 223 that performs processing for recognizing an address that can identify a home network.

(Mobile machine)
The mobile device 3 includes a transmission / reception unit 31 that transmits / receives data, a storage unit 32 that stores each data, and a calculation unit 33 that performs processing such as calculation of an authentication result and encryption.

  Note that the authentication server 11, the location registration server 12, the authentication server 21 of the roaming network 2, and the location registration server 22 shown in FIG. 1 are a CPU (Central Processing Unit), a RAM (Random Access Memory), and a ROM. (Read Only Memory), a hard disk drive, an input / output interface and the like are implemented using a computer. Each unit of these servers expands a program stored in the hard disk drive of the computer into a RAM, and executes a CPU. Is implemented by executing.

  FIG. 2 is a process flow in authentication of the mobile device 3 at the time of location registration, which is executed when the mobile device 3 according to the embodiment of the present invention moves to the roaming network 2. With reference to FIG. 1, the flow of the authentication procedure at the time of location registration will be described with reference to FIG. In this embodiment, communication between the home network 1 and the roaming network 2 is performed via the communication network 41, and communication between the mobile device 3 and the home network 1 is performed via the communication line 42 between the mobile device 3 and the roaming network 2. Communication in is via the communication line 43, and will not be described below. In addition, communication between the servers of the home network 1 is performed via the communication line 14, and communication between the servers of the roaming network 2 is performed via the communication line 24.

The transmission / reception unit 31 of the mobile device 3 that has roamed in the roaming network 2 sends a location registration request signal to the calculation unit 223 of the location registration server 22 of the roaming network 2 via the transmission / reception unit 221 of the location registration server 22 of the roaming network 2. Is transmitted (S401).
The information included in the location registration request signal includes a mobile device address (eg, user name @ domain name) that can uniquely identify the mobile device 3, and the mobile device address identifies the home network 1. Contains possible home network addresses (eg domain names). The computing unit 223 of the location registration server 22 of the roaming network 2 performs a home network address recognition process of the mobile device 3 (S402), and the mobile device 3 recognizes the home network address of the home network 1 to which the service belongs. . As a result, the calculation unit 223 of the location registration server 22 of the roaming network 2 transmits / receives the location registration server 12 of the home network 1 having the recognized home network address via the transmission / reception unit 221 of the location registration server 22 of the roaming network 2. A location registration request signal including the mobile device address is transmitted to unit 121 (S403).

The transmission / reception unit 121 of the location registration server 12 of the home network 1 that has received the location registration request signal includes an authentication request including a mobile device address in the transmission / reception unit 111 of the authentication server 11 of the home network 1 in order to authenticate the mobile device 3. A signal is transmitted (S404), and the mobile device 3 is requested to be authenticated.
The transmission / reception unit 111 of the authentication server 11 of the home network 1 requests the calculation unit 113 of the authentication server 11 of the home network 1 to perform a first authentication result calculation process. The computing unit 113 of the authentication server 11 of the home network 1 and the shared encryption key stored in advance between the storage unit 32 of the mobile device 3 and the storage unit 112 of the authentication server 11 of the home network 1 and the authentication of the home network 1 A first authentication result calculation process is performed using the first random number generated by the calculation unit 113 of the server 11 (S405), and the authentication result (first authentication result) is calculated. The authentication result calculation process may be, for example, a calculation process using a hash function. Thereafter, the calculation unit 113 of the authentication server 11 of the home network 1 performs an encryption process on the calculated first authentication result using the shared encryption key (S406).
The computing unit 113 of the authentication server 11 of the home network 1 sends the authentication request signal including the encrypted first authentication result, the mobile device address of the mobile device 3 and the first random number to the authentication server 11 of the home network 1. Are transmitted to the storage unit 212 of the authentication server 21 of the roaming network 2 via the transmission / reception unit 111 of the roaming network 2 and the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 (S407).

The storage unit 212 of the authentication server 21 of the roaming network 2 performs processing for storing the received mobile device address and the encrypted first authentication result as a pair of data (S408).
Subsequently, the storage unit 212 of the authentication server 21 of the roaming network 2 sends the first mobile station 3 in the roaming network 2 to the mobile device 3 that has been received from the computing unit 113 of the authentication server 11 of the home network 1. An authentication request signal including a random number is transmitted to the computing unit 33 of the mobile device 3 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 and the transmission / reception unit 31 of the mobile device 3 (S409).
The computing unit 33 of the mobile device 3 receives the shared encryption key stored in advance between the storage unit 32 of the mobile device 3 and the storage unit 113 of the authentication server 11 of the home network 1 and the received first random number. And performing a second authentication result calculation process (S410), calculating an authentication result (second authentication result), and subsequently encrypting the second authentication result using the shared encryption key. Processing is performed (S411).
Then, the computing unit 33 of the mobile device 3 uses the encrypted second authentication result and the mobile device address of the mobile device 3 as an authentication response signal, and the authentication server 21 of the roaming network 2 and the transmission / reception unit 31 of the mobile device 3. To the comparison unit 214 of the authentication server 21 of the roaming network 2 (S412).

  The comparison unit 214 of the authentication server 21 of the roaming network 2 retrieves the encrypted first authentication result from the storage unit 212 of the authentication server 21 of the roaming network 2 using the mobile device address as a search key. Then, a comparison process is performed between the first authentication result and the encrypted second authentication result (S413). As a result of comparison, if the encrypted authentication results are not the same, a communication rejection signal (not shown) is sent to the transmission / reception unit 31 of the mobile device 3 and the transmission / reception unit 111 of the authentication server 11 of the home network 1. ) To block communication. On the other hand, if the encrypted authentication results are the same, an authentication response signal is transmitted to the transmission / reception unit 111 of the authentication server 11 of the home network 1 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2. (S414).

The transmission / reception unit 111 of the authentication server 11 of the home network 1 transmits an authentication response signal to the transmission / reception unit 121 of the location registration server 12 of the home network 1 (S415). The transmission / reception unit 121 of the location registration server 12 of the home network 1 that has received the authentication response signal instructs the storage unit 122 of the location registration server 12 of the home network 1 to update the location information. The storage unit 122 of the location registration server 12 of the instructed home network 1 performs processing for updating the location information of the mobile device 3 stored in the storage unit 122 of the location registration server 12 of the home network 1 (S416).
The storage unit 122 of the location registration server 12 of the home network 1 transmits a location registration response signal to the transmission / reception unit 221 of the location registration server 22 of the roaming network 2 via the transmission / reception unit 121 of the location registration server 12 of the home network 1 ( S417). The transmission / reception unit 221 of the location registration server 22 of the roaming network 2 that has received the location registration response signal further transmits a location registration response signal to the transmission / reception unit 31 of the mobile device 3 (S418).

(Authentication procedure at the start of communication)
FIG. 3 is a flowchart showing the flow of the authentication procedure at the start of communication.
With reference to FIG. 1, the flow of the authentication procedure at the start of communication will be described with reference to FIG.

The transmission / reception unit 31 of the mobile device 3 that has roamed in the roaming network 2 transmits an authentication request signal to the calculation unit 213 of the authentication server 21 of the roaming network 2 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2. (S501). The timing for making the authentication request is, for example, when the mobile device 3 starts a call or exchanges data.
The information used when making an authentication request includes a mobile device address (for example, user name @ domain name) that can uniquely identify the mobile device 3, and the mobile network address identifies the home network 1. Contains possible home network addresses (eg domain names). The computing unit 213 of the authentication server 21 of the roaming network 2 performs a home network address recognition process of the mobile device 3 (S502), and the mobile device 3 recognizes the home network address of the home network 1 to which the service belongs. Accordingly, the computing unit 213 of the authentication server 21 of the roaming network 2 passes through the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 and the transmission / reception unit 111 of the authentication server 11 of the home network 1. An authentication request signal is transmitted to the calculation unit 113 (S503).

The computing unit 113 of the authentication server 11 of the home network 1 includes a shared encryption key stored in advance between the storage unit 32 of the mobile device 3 and the storage unit 112 of the authentication server 11 of the home network 1, and the home network 1. A third authentication result calculation process is performed using the second random number generated by the computing unit 113 of the authentication server 11 (S504), and an authentication result (third authentication result) is calculated. Thereafter, the calculation unit 113 of the authentication server 11 of the home network 1 performs an encryption process on the calculated third authentication result using the shared encryption key (S505).
The computing unit 113 of the authentication server 11 of the home network 1 sends the authentication response signal including the encrypted third authentication result, the mobile device address of the mobile device and the second random number to the authentication server 11 of the home network 1. The data is transmitted to the storage unit 212 of the authentication server 21 of the roaming network 2 via the transmission / reception unit 111 and the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 (S506).

The storage unit 212 of the authentication server 21 of the roaming network 2 performs a process of storing the mobile device address and the encrypted third authentication result as a pair of data (S507).
Subsequently, the storage unit 212 of the authentication server 21 of the roaming network 2 sends the authentication request signal including the second random number received to the mobile device 3 located in the roaming network 2 to the authentication of the roaming network 2. The data is transmitted to the calculation unit 33 of the mobile device 3 via the transmission / reception unit 211 of the server 21 and the transmission / reception unit 31 of the mobile device 3 (S508).
The computing unit 33 of the mobile device 3 receives the shared encryption key stored in advance between the storage unit 32 of the mobile device 3 and the storage unit 112 of the authentication server 11 of the home network 1 and the received second random number. Then, a fourth authentication result calculation process is performed (S509), and an authentication result (fourth authentication result) is calculated. Subsequently, the fourth authentication result is encrypted using the shared encryption key (S510).
Then, the calculation unit 33 of the mobile device 3 sends the encrypted fourth authentication result and the mobile device address of the mobile device 3 to the transmission / reception unit 31 of the mobile device 3 and the transmission / reception unit 211 of the authentication server 21 of the roaming network 2. Then, the data is transmitted to the comparison unit 214 of the authentication server 21 of the roaming network 2 (S511).

  The comparison unit 214 of the authentication server 21 of the roaming network 2 retrieves the encrypted third authentication result from the storage unit 212 of the authentication server 21 of the roaming network 2 using the mobile device address as a search key, and is encrypted. The third authentication result is compared with the encrypted fourth authentication result (S512). If the encrypted authentication results are not the same, a communication rejection signal (not shown) is transmitted to the transmission / reception unit 31 of the mobile device 3 and the transmission / reception unit 111 of the authentication server 11 of the home network 1. , Block communication. On the other hand, if the mutually encrypted authentication results are the same, the authentication server of the home network 1 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 and the transmission / reception unit 111 of the authentication server 11 of the home network 1. The authentication response signal is transmitted to the storage unit 112 of 11 (S513).

The storage unit 112 of the authentication server 11 of the home network 1 performs processing for storing the third authentication result (S514).
Next, when storage of the authentication result is completed, the storage unit 112 of the authentication server 11 of the home network 1 sends an authentication response signal to the authentication server 21 of the roaming network 2 via the transmission / reception unit 211 of the authentication server 11 of the home network 1. Is transmitted to the transmission / reception unit 211 (S515).
The transmission / reception unit 211 of the authentication server 21 of the roaming network 2 transmits an authentication response signal to the transmission / reception unit 31 of the mobile device 3 (S516).
The transmitter / receiver 31 of the mobile device 3 instructs the storage unit 32 of the mobile device 3 to store the fourth authentication result, and the storage unit 32 of the mobile device 3 performs the process of storing the fourth authentication result ( S517).
Thereby, the authentication of the mobile device 3 is completed, and the communication can be started.

(Authentication procedure during handover)
FIG. 4 is a flowchart showing a flow of authentication procedure processing at the time of handover in a state where the mobile device 3 is located in the roaming network 2. The authentication procedure at the time of handover will be described in detail with reference to FIG. 4 with reference to FIG.

  As for authentication of the mobile device 3 at the time of handover, the mobile device 3 voluntarily makes an authentication request before receiving the authentication request from the home network 1.

The computing unit 33 of the mobile device 3 stores the authentication data stored in the storage unit 32 of the mobile device 3 when authentication is performed with the authentication server 11 of the home network 1 at the start of communication (S517 in FIG. 3). The authentication result is a third random number, and the third random number and the shared encryption key are similarly stored using the shared encryption key stored in advance with the authentication server 11 of the home network 1 in the storage unit 32. A fifth authentication result calculation process is performed from the key (S601). Thereafter, the calculated fifth authentication result is encrypted using the shared encryption key (S602).
The calculation unit 33 of the mobile device 3 transmits an authentication request signal to the storage unit 212 of the authentication server 21 of the roaming network 2 via the transmission / reception unit 31 of the mobile device 3 and the transmission / reception unit 211 of the roaming network 2 (S603). . This authentication request signal includes an encrypted fifth authentication result and a mobile device address (for example, user name @ domain name) that can uniquely identify the mobile device 3. , A home network address (for example, a domain name) that can identify the home network 1 is included. The storage unit 212 of the authentication server 21 of the roaming network 2 performs a process of storing the mobile device address and the encrypted fifth authentication result as a pair of data (S604).
Further, the computing unit 213 of the roaming network 2 performs processing for recognizing the home network address of the home network 1 to which the mobile device 3 has a service belonging relationship from the received mobile device address (S605). Thereby, the computing unit 213 of the authentication server 21 of the roaming network 2 acquires the home network address obtained via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 and the transmission / reception unit 111 of the authentication server 11 of the home network 1. The mobile station address and the encrypted authentication request signal are transmitted to the calculation unit 113 of the authentication server 11 of the home network 1 having (S606).

The computing unit 113 of the authentication server 11 of the home network 1 stores the third unit stored in the storage unit 112 of the home network 1 when authentication is performed with the mobile device 3 at the start of communication (S514 in FIG. 3). The authentication result is a fourth random number, and similarly, the shared random key stored in advance with the mobile unit 3 in the storage unit 112 is used to calculate the sixth random number and the shared cryptographic key from the fourth random number. The authentication result calculation process is performed (S607). Thereafter, the calculated sixth authentication result is encrypted using the shared encryption key (S608).
The calculation unit 113 of the authentication server 11 of the home network 1 sends an authentication response signal including the encrypted sixth authentication result and the mobile device address of the mobile device 3 to the transmission / reception unit 111 of the authentication server 11 of the home network 1; The data is transmitted to the comparison unit 214 of the authentication server 21 of the roaming network 2 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 (S609).

  The comparison unit 214 of the authentication server 21 of the roaming network 2 retrieves the encrypted fifth authentication result from the storage unit 212 of the authentication server 21 of the roaming network 2 using the mobile device address as a search key. The fifth authentication result is compared with the encrypted sixth authentication result (S610). If the encrypted authentication results are not the same, a communication rejection signal (not shown) is transmitted to the transmission / reception unit 31 of the mobile device 3 and the transmission / reception unit 111 of the authentication server 11 of the home network 1, Block communication. On the other hand, if the encrypted authentication results are the same, an authentication response signal is transmitted to the transmission unit 31 of the mobile device 3 via the transmission / reception unit 211 of the authentication server 21 of the roaming network 2 (S611). Is executed.

As described above, when the location of the mobile device 3 is registered, the communication is started, and the handover is performed between the mobile device 3 moving between a plurality of communication networks each having an authentication server of a different authentication method and the authentication servers (11, 21). Each authentication method was explained separately.
According to such a configuration, the authentication server 21 of the roaming network 2 is encrypted with respect to each other with respect to the encrypted authentication result from the authentication server 11 of the home network 1 and the encrypted authentication result from the mobile device 3. Since the legitimacy of the mobile device is determined by comparing whether or not the authentication results are the same, the mobile device can be simply authenticated. Further, in order to realize these functions, no additional function is required in the authentication server of the roaming network, and the existing clearing device is not necessary.
In addition, the data related to the mobile device that is sent and received in the authentication procedure is a random number used temporarily, except for the mobile device address that can uniquely identify the mobile device, and an encrypted authentication result that is merely a data string. Therefore, even if a Service-to-Self intercepts information on packets sent and received, it becomes impossible to impersonate the mobile device in subsequent communications, providing higher communication security than conventional communication methods. It can be said that it is possible.

  In the authentication procedure at the time of handover, the authentication result used at the start of communication is used as a random number used at the time of authentication. Therefore, the procedure for notifying the random number from the authentication server of the home network to the mobile device is not necessary, and the number of data transmission / reception is reduced. The transaction processing at the time of handover can be deleted.

It is a block diagram of the communication system which the communication network which uses the different authentication system concerning embodiment of this invention provides. It is a sequence chart of the authentication procedure at the time of the location registration concerning embodiment of this invention. It is a sequence chart of the authentication procedure at the time of the communication start concerning embodiment of this invention. It is a sequence chart of the authentication procedure at the time of the handover concerning the embodiment of the present invention. It is a block diagram of the conventional communication system.

Explanation of symbols

1 Home network 2 Roaming network 3 Mobile device 11 Authentication server (authentication server for home network)
12 Location registration server (Home network location registration server)
21 Authentication server (roaming network authentication server)
22 Location Registration Server (Roaming Network Location Registration Server)
41 communication network 42, 43 communication line

Claims (15)

In a communication method using a plurality of communication networks each having an authentication server that uses different authentication methods and a mobile device that communicates using the plurality of communication networks,
The communication network includes a home network that is a home having a service relationship with the mobile device, and a roaming network in which communication of the mobile device is performed by roaming,
When the mobile device moves to the roaming network, at the time of location registration or at the start of communication, authentication of the roaming network is performed using an authentication result created and owned by each of the mobile device and the home network authentication server. An authentication procedure in which the server authenticates;
A communication method, wherein at the time of handover of the mobile device, the mobile device and an authentication server of the home network execute an authentication procedure for performing authentication using a previously calculated authentication result as a random number. Information used in the authentication procedure executed at the time of the location registration or the start of communication is:
A mobile address that can uniquely identify the mobile;
A shared encryption key stored together between the mobile device and the home network authentication server;
A random number generated by an authentication server of the home network;
The communication method according to claim 1, further comprising: an authentication result obtained by encrypting an authentication result calculated by the mobile device and the authentication server of the home network by the shared encryption key in the authentication procedure. The authentication procedure at the time of location registration is as follows:
The location registration server of the roaming network recognizes an address that can identify the home network of the mobile device from the mobile device address included in the location registration request signal transmitted by the mobile device, and sends it to the location registration server of the home network. The communication method according to claim 1, wherein a location registration signal is transmitted. The authentication procedure at the time of location registration is as follows:
The mobile device and the home network authentication server obtain an authentication result from a random number generated by the home network authentication server and a shared encryption key stored in both the mobile device and the home network authentication server. Calculating, encrypting the authentication result with the shared encryption key, and comparing the encrypted authentication results with the authentication server of the roaming network, thereby confirming the validity of the mobile device. The communication method according to claim 1. The authentication procedure at the start of communication is as follows:
The authentication server of the roaming network recognizes an address that can identify the home network of the mobile device from the mobile device address included in the authentication request signal transmitted by the mobile device, and sends an authentication request signal to the authentication server of the home network. 2. The communication method according to claim 1, wherein: The authentication procedure at the start of communication is as follows:
The mobile device and the home network authentication server obtain an authentication result from a random number generated by the home network authentication server and a shared encryption key stored in both the mobile device and the home network authentication server. Calculating, encrypting the authentication result with the shared encryption key, and comparing the encrypted authentication results with the authentication server of the roaming network, thereby confirming the validity of the mobile device. The communication method according to claim 1. The authentication procedure at the start of communication is as follows:
After the mobile device and the home network authentication server confirm the validity of the mobile device, the authentication result calculated at the time of authentication is stored together between the mobile device and the home network authentication server. The communication method according to claim 1, wherein: Information used in the authentication procedure at the time of handover is:
A mobile address that can uniquely identify the mobile;
A shared encryption key stored together between the mobile device and the home network authentication server;
Authentication results calculated by authentication at the start of communication stored together between the mobile device and the home network authentication server, and authentications calculated by the mobile device and the home network authentication server in the authentication procedure, respectively. The communication method according to claim 1, further comprising: an authentication result obtained by encrypting a result with the shared encryption key. The authentication procedure at the time of the handover is as follows:
The authentication server of the roaming network recognizes an address that can identify the home network of the mobile device from the mobile device address included in the authentication request signal transmitted by the mobile device, and sends an authentication request signal to the authentication server of the home network. The communication method according to claim 1, wherein: The authentication procedure at the time of the handover is as follows:
The mobile device and the home network authentication server each store an authentication result calculated by authentication at the start of communication, and the authentication result is a random number. The random number and the mobile device and the home network authentication server By calculating an authentication result from the shared encryption key stored together, encrypting the authentication result with the shared encryption key, and comparing each encrypted authentication result with the authentication server of the roaming network, the movement 2. The communication method according to claim 1, wherein the authenticity of the machine is confirmed. In a communication system with a plurality of communication networks each having an authentication server using different authentication methods and a mobile device that communicates using the plurality of communication networks,
The communication network includes a home network having a service relationship with the mobile device, and a roaming network in which the mobile device communicates by roaming,
The mobile device that moves between the home network and the roaming network is stored together with a random number generated by the home network authentication server and the home network authentication server at the time of location registration and communication start of the mobile device. An authentication result is calculated using the shared encryption key, and the authentication result is encrypted with the shared encryption key.
The home network generates a random number in response to a request from the mobile device that moves between the home network and the roaming network at the time of location registration of the mobile device and at the start of communication, and the generated random number is transferred to the mobile network. An authentication server having a function of calculating an authentication result using a shared encryption key stored together with the machine and encrypting the calculated authentication result with the shared encryption key,
The roaming network compares the encrypted authentication results transmitted from the home network authentication server and the mobile device at the time of registration of the location of the mobile device and at the start of communication to verify the validity of the mobile device. A communication system comprising an authentication server having a function of checking. In a communication system with a plurality of communication networks each having an authentication server using different authentication methods and a mobile device that communicates using the plurality of communication networks,
The communication network includes a home network having a service relationship with the mobile device, and a roaming network in which the mobile device communicates by roaming,
A mobile device that moves between the home network and the roaming network uses a shared encryption stored together with the random number and the authentication server of the home network as an authentication result calculated by authentication at the start of communication at the time of handover. A function of calculating an authentication result using a key and encrypting the calculated authentication result with the shared encryption key;
At the time of the handover, the home network calculates an authentication result by using the authentication result used in the last communication with the mobile device and the shared encryption key stored together with the mobile device at the request of the mobile device. And an authentication server having a function of encrypting the calculated authentication result with the shared encryption key,
The roaming network compares the encrypted authentication results transmitted from the mobile network authentication server and the mobile device at the time of the handover, and has an authentication function for confirming the validity of the mobile device. A communication system comprising a server. Used in a communication system by a plurality of communication networks each having an authentication server that uses different authentication methods and a mobile device that communicates using the plurality of communication networks, and the communication network belongs to the mobile device and a service An authentication server for the home network, including a home network having a roaming network in which communication of the mobile device is performed by roaming,
Storage means for storing a shared encryption key stored together with the mobile device moving between the home network and the roaming network, and an authentication result calculated at the start of communication with the mobile device;
Computation means for generating a random number, calculating an authentication result using the random number and the shared encryption key, and encrypting the authentication result using the shared encryption key Authentication server. Used in a communication system by a plurality of communication networks each having an authentication server that uses different authentication methods and a mobile device that communicates using the plurality of communication networks, and the communication network belongs to the mobile device and a service An authentication server of the roaming network, including a home network having a roaming network in which communication of the mobile device is performed by roaming,
An encrypted first authentication result transmitted from an authentication server of the home network, and an encrypted second authentication result transmitted from a mobile device moving between the home network and the roaming network; Storage means for storing
A comparing means for comparing the first authentication result with the second authentication result and comparing whether or not they are the same;
An authentication server comprising recognition means for recognizing an address capable of identifying the home network of the mobile device from a mobile device address included in a location registration request or authentication request transmitted from the mobile device. Used in a communication system by a plurality of communication networks each having an authentication server that uses different authentication methods and a mobile device that communicates using the plurality of communication networks, and the communication network belongs to the mobile device and a service A mobile network comprising a home network having a roaming network in which communication of the mobile device is performed by roaming,
Storage means for storing a shared encryption key stored together with the authentication server of the home network, and an authentication result calculated when the mobile device starts communication;
Computing means for calculating an authentication result using a random number generated by an authentication server of the home network or the authentication result and a shared encryption key, and encrypting the calculated authentication result with the shared encryption key; A mobile machine characterized by.

Images