JP2009026215A - Verification processor, verification processing method, and verification processing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To mitigate a process load of a terminal, while shortening connecting time to IMS, and fully securing the reliability of verification by IMS. <P>SOLUTION: It has a terminal 2, a IP-CAN 3 and a IMS 4 which has P-CSCF5a and S-CSCF5b, and HSS6. The P-CSCF5a is provided with a verification processor 7 which performs the verification for making connection between a terminal 2 and the IMS 4. The verification processor 7 has an authentication acquisition section and a verification processing part. If the authentication acquisition section acquires RAND, AUTN and RES, the verification processing part performs the verification process of IP-CAN 3 based on RAND and AUTN, and performs the verification process of the terminal 2 based on RAND and RES. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to an authentication processing apparatus, an authentication processing method, and an authentication processing system for performing authentication by a core network in order to connect a terminal and a core network using an access network as a communication path.

  IMS (IP Multimedia core network Subsystem) defined by 3GPP (3rd Generation Partnership Project), which is a standardization project for third generation (3G) mobile communication systems, establishes IP (Internet Protocol) connection to IMS, which is a core network. It is connected to a terminal such as a fixed telephone or a mobile phone via an IP-CAN (IP Connectivity Access Network) which is an access network to be provided. At this time, in order to ensure security in communication between the terminal and the IMS, an authentication process is performed between the terminal and the IMS.

  In this authentication processing, after authentication is performed between the terminal and the IP-CAN, when the terminal transmits a registration processing request to the IMS, an authentication request including a challenge value is sent from the IMS to the terminal. Sent. When the terminal generates an appropriate response to the challenge value and returns it to the IMS, the IMS performs authentication processing by performing verification of the response content using the authentication vector.

  However, if the authentication process is separately performed between the IP-CAN and the IMS, the number of times of transmission / reception of information between the terminal and the IMS increases, which causes a delay in connection to the IMS and the processing of the terminal. There was a problem that the burden increased.

Therefore, conventionally, in order to simplify the authentication process between the terminal and the IMS, when the IP-CAN and the IMS are provided by the same operator, the IMS is connected to the terminal from both the IP-CAN and the terminal. An authentication processing method has been considered in which an IP address of a machine is acquired and the terminal is authenticated if these IP addresses match (see Patent Document 1).
Japanese Patent Laid-Open No. 2007-020001

  However, since the conventional authentication process is a simple authentication of comparing IP addresses, there is a fear of forgery or fraud. Further, since the authentication process is performed based on the IP address transmitted from the IP-CAN, the trust relationship between the IP-CAN and the IMS is indispensable, and the IP-CAN and the IMS are provided by other operators. In this case, there is a problem that the reliability of authentication is lowered.

  Therefore, the present invention provides an authentication processing apparatus, an authentication processing method, and an authentication processing apparatus capable of reducing the connection time to the core network and reducing the processing burden on the terminal while sufficiently ensuring the reliability of authentication by the core network. An object is to provide an authentication processing system.

  An authentication processing apparatus according to the present invention is an authentication processing apparatus that performs authentication for connecting a core network that uses an access network as a communication path and a terminal that is mutually authenticated with the access network, from the terminal Authentication information acquisition means for acquiring authentication information used in the mutual authentication processing for mutual authentication, and authentication processing means for performing authentication processing based on the authentication information acquired by the authentication information acquisition means. Features.

  An authentication processing method according to the present invention is an authentication processing method for performing authentication in order to connect a core network having an access network as a communication path and a terminal that is mutually authenticated with the access network. An authentication information acquisition step for acquiring authentication information used in the mutual authentication processing for mutual authentication from an apparatus, and an authentication processing step for performing authentication processing based on the authentication information acquired in the authentication information acquisition step. It is characterized by that.

  The authentication processing system according to the present invention includes a core network that uses an access network as a communication path, and a terminal that is mutually authenticated with the access network, and authenticates to connect the core network and the terminal. An authentication processing device that performs authentication, wherein the terminal includes an authentication information transmitting unit that transmits authentication information used in the mutual authentication processing for the mutual authentication to the core network, and the core network includes: An authentication information acquisition unit that acquires the authentication information from the terminal, and an authentication processing unit that performs an authentication process based on the authentication information acquired by the authentication information acquisition unit.

  According to the authentication processing device, the authentication processing method, and the authentication processing system, when the authentication information used in the mutual authentication processing between the terminal and the access network is acquired from the terminal, the terminal and the core are based on the authentication information. Since authentication for connecting to the network is performed, the number of times of transmission and reception of information between the terminal and the core network can be reduced. Therefore, it is possible to reduce the processing load on the terminal while shortening the connection time to the core network while sufficiently ensuring the reliability of the authentication process.

  In this case, the authentication information is information including authentication request information transmitted from the access network to the terminal in the mutual authentication process, and the authentication processing means is a process performed by the terminal in the mutual authentication process. It is preferable to perform authentication processing for the access network by performing the same processing as in FIG. According to this authentication processing device, mutual authentication is performed based on the authentication request information by obtaining authentication request information transmitted from the access network to the terminal in the mutual authentication processing between the terminal and the access network. Since the access network is authenticated by a process similar to the process performed by the terminal in the process, the number of times information is transmitted and received between the terminal and the core network can be reduced. Further, since the terminal and the access network have already been mutually authenticated, it is possible to ensure the reliability of the authentication process by performing authentication on the access network.

  The authentication information includes authentication request information transmitted from the access network to the terminal in the mutual authentication process, and authentication response information transmitted from the terminal to the access network in the mutual authentication process. Preferably, the authentication processing means performs an authentication process on the terminal by performing a process similar to the process performed by the terminal and the access network in the mutual authentication process. According to this authentication processing apparatus, the authentication request information transmitted from the terminal to the terminal in the mutual authentication processing between the terminal and the access network, and the terminal in the mutual authentication processing between the terminal and the access network. The authentication response information transmitted from the access network to the access network is acquired, and based on the authentication request information and the authentication response information, the authentication for the terminal is performed by the same processing as that performed by the terminal and the access network in the mutual authentication processing. Therefore, the number of times information is transmitted and received between the terminal and the core network can be reduced. Further, since the terminal and the access network have already been mutually authenticated, it is possible to ensure the reliability of the authentication process by performing authentication on the terminal.

  ADVANTAGE OF THE INVENTION According to this invention, while ensuring the reliability of the authentication by a core network fully, while shortening the connection time to a core network, the processing burden of a terminal can be reduced.

  Hereinafter, an authentication processing device, an authentication processing method, and an authentication processing system according to embodiments of the present invention will be described with reference to the drawings. In addition, in each figure, the same code | symbol is attached | subjected to the same element and the overlapping description is abbreviate | omitted.

  First, the configuration of the authentication processing system according to the present embodiment will be described. FIG. 1 is a diagram showing a configuration of an authentication processing system according to an embodiment of the present invention.

  As shown in the figure, an authentication processing system 1 according to the present embodiment includes a terminal 2, an IP-CAN (access network) 3 composed of a 3G network, and an IMS (core network) 4. The IMS 4 includes a P-CSCF (Proxy Cell Session Control Function) 5a, an S-CSCF (Serving Cell Session Control Function) 5b, and an HSS 6 (Home Subscriber Server). The P-CSCF 5 a is provided with an authentication processing device 7 that performs authentication processing in the IMS 4. In the following description, unless otherwise indicated, the P-CSCF 5a and the S-CSCF 5b are collectively referred to as CSCF 5.

  The terminal 2 is a mobile communication terminal such as a mobile phone that is connected to the IMS 4 using the IP-CAN 3 as a communication path and performs IP-based multimedia communication. The terminal 2 holds the user unique key K allocated at the time of a connection contract between the terminal 2 and the IP-CAN 3 and IMS 4.

  As shown in FIG. 2, the terminal 2 functionally includes an IP-CAN authentication processing unit 21 and an IMS authentication processing unit (authentication information transmission unit) 22. As shown in FIG. 3, the terminal 2 physically includes a CPU 101, a ROM 102, a RAM 103, an auxiliary storage device 104, a communication module 105 that controls wireless communication based on IP, and an input device. The operation unit 106 and the display 107 are provided. Each function described in FIG. 2 operates the communication module 105 under the control of the CPU 101 by reading predetermined computer software onto the CPU 101 or the RAM 103 shown in FIG. This is realized by reading and writing data.

  The IP-CAN authentication processing unit 21 performs mutual authentication processing between the terminal 2 and the IP-CAN 3. The IP-CAN authentication processing unit 21 transmits a connection request to the IP-CAN 3 in order to perform mutual authentication processing with the IP-CAN 3, and then RAND (random number: Random) transmitted from the IP-CAN 3. number) and AUTN (Authentication Token).

  RAND is information including calculation information for performing mutual authentication processing between the terminal 2 and the IP-CAN 3. The AUTN is an authentication token for performing mutual authentication processing between the terminal 2 and the IP-CAN 3, and the MAC (network identifier: Message Authentication Code) and AMF (authentication management field: Authentication and key Management) of the IP-CAN 3. Field), SQN (sequence number: Sequence Number) and AK (secret key: Anonymity Key), etc. are included in the exclusive logical ring (SQN XOR AK).

  Then, the IP-CAN authentication processing unit 21 calculates the network identifier XMAC by calculation using the user unique key K held in the IP-CAN 21 and RAND and AUTN. Then, the IP-CAN authentication processing unit 21 compares the network identifier XMAC of the calculation result with the network identifier MAC included in the AUTN, and if they match, determines that the IP-CAN 3 is a correct network, and determines the IP-CAN 3 Certify.

  On the other hand, the IP-CAN authentication processing unit 21 calculates RAND using the user unique key K held in the IP-CAN 21 and transmits the calculation result to the IP-CAN 21 as RES (authentication response: Response).

  The IP-CAN authentication processing unit 21 stores the RAND and AUTN received from the IP-CAN 3 and the RES transmitted to the IP-CAN 3.

  The IMS authentication processing unit 22 performs an authentication process between the terminal 2 and the IMS 4. The IMS authentication processing unit 22 reads the RAND, AUTN, and RES stored by the IP-CAN authentication processing unit 21 and adds them to a registration processing request (Register) that requests authentication for connecting the terminal 2 and the IMS 4. Then, the IMS authentication processing unit 22 transmits this registration processing request to the IMS 4.

  The IP-CAN 3 is an access network serving as a communication path for IP access between the terminal 2 and the IMS 4. The IP-CAN 3 holds the user unique key K allocated at the time of the connection contract between the terminal 2 and the IP-CAN 3 and the IMS 4, similarly to the terminal 2. FIG. 4 is a diagram illustrating an authentication process in the IP-CAN 3. As shown in the figure, the IP-CAN 3 has a VLR (Visitor Location Register) / SGSN (Serving SGRS Service Node) 7 that performs authentication processing of the terminal 2 and an HLR that issues an authentication vector used for authentication processing of the terminal 2. (Home Location Register) 8.

  When the IP-CAN 3 receives the connection request from the terminal 2, the HLR 8 issues an authentication vector to the VLR / SGSN 8.

  This authentication vector is information including RAND, RRES, XRES, CK (Cipher Key), IK (Integrity Key), AUTN, and the like.

  When the VLR / SGSN 8 receives the authentication vector from the HLR 8, the VLR / SGSN 8 transmits RAND and AUTN among the information included in the authentication vector to the terminal 2. When the VLR / SGSN 8 receives the RES from the terminal 2, the VLR / SGSN 8 compares the XRES included in the authentication vector with the RES received from the terminal 2, and determines that the terminal 2 is the correct user if they match. Then, the terminal 2 is authenticated. Then, when mutual authentication is performed between the terminal 2 and the IP-CAN 3, the VLR / SGSN 8 performs an IP access establishment process between the terminal 2 and the IP-CAN 3.

  The CSCF 5 is a logical node that performs call session control and the like in IMS. Similarly to the terminal 2, the CSCF 5 holds a user unique key K allocated at the time of a connection contract between the terminal 2 and the IP-CAN 3 and IMS 4. The P-CSCF 5a is a logical node that is connected to the terminal 2 and performs call session control in the IMS. The S-CSCF 5b serves as a SIP (Session Initiation Protocol) server to register the terminal 2 and call session. It is a logical node that performs control.

  As shown in FIG. 5, the authentication processing device 7 provided in the CSCF 5 functionally includes an authentication information acquisition unit (authentication information acquisition unit) 71 and an authentication processing unit (authentication processing unit) 72. Further, as shown in FIG. 3, the authentication processing device 7 physically includes a CPU 101, a ROM 102, a RAM 103, an auxiliary storage device 104, a communication module 105 that controls wireless communication based on IP, and an input. An operation unit 106 as a device and a display 107 are provided. Each function described in FIG. 5 causes the communication module 105 to operate under the control of the CPU 101 by reading predetermined computer software onto the CPU 101 or the RAM 103 shown in FIG. This is realized by reading and writing data.

  When the CSCF 5 receives the registration processing request transmitted from the terminal 2, the authentication information acquisition unit 71 extracts RAND, AUTN, and RES from the registration processing request, and acquires RAND, AUTN, and RES.

  The authentication processing unit 72 performs a process similar to the process performed by the terminal 2 in the mutual authentication process between the terminal 2 and the IP-CAN 3 in order to connect the terminal 2 and the IMS 4. Authentication processing for IP-CAN3 is performed. The authentication processing unit 72 is similar to the process performed by the terminal 2 and the IP-CAN 3 in the mutual authentication process between the terminal 2 and the IP-CAN 3 in order to connect the terminal 2 and the IMS 4. By performing the process, the authentication process for the terminal 2 is performed.

  More specifically, the authentication processing unit 72 uses the user unique key K held in the CSCF 5 and the RAND and AUTN acquired by the authentication information acquisition unit 71 to obtain the network identifier XMAC by calculation. And the authentication process part 72 compares the network identifier XMAC of a calculation result with the network identifier XMAC contained in AUTN, and if it corresponds, it will judge that IP-CAN3 is a correct network and will authenticate IP-CAN3.

  On the other hand, the authentication processing unit 72 calculates the RAND acquired by the authentication information acquiring unit 71 using the user unique key K held in the CSCF 5. Then, the authentication processing unit 72 compares the calculation result with the RES acquired by the authentication information acquisition unit 71, and if they match, determines that the terminal 2 is the correct user and authenticates the terminal 2. Then, when the IP-CAN 3 and the terminal 2 are authenticated, the authentication processing unit 72 transmits a registration processing request (Server Assignment Request) to the HSS 6. Upon receiving a registration processing response (Server Assignment Answer) from the HSS 6, the authentication processing unit 72 transmits a registration processing request response (200 OK) indicating that the registration processing has been completed to the terminal 2, and the terminal Connect the machine 2 and the IMS 4.

  The HSS 6 is a logical node that authenticates the terminal 2 connected in the IMS 4. When the HSS 6 receives a registration process request for the terminal 2 from the CSCF 5, the HSS 6 performs a Registration registration process for the terminal 2, transmits a registration process response to the CSCF 5, and manages various information of the terminal 2.

  Subsequently, operations of the authentication processing apparatus, the authentication processing method, and the authentication processing system according to the present embodiment will be described. FIG. 6 is a sequence diagram showing the processing operation of the authentication processing system.

  First, the IP-CAN authentication processing unit 21 of the terminal 2 transmits a connection request to the IP-CAN 3 (Step S1). Next, the terminal 2 and the IP-CAN 3 perform mutual authentication processing (step S2), and perform IP access establishment processing for connecting the terminal 2 and the IP-CAN 3 (step S3). In step S2, RAND and AUTN are transmitted as authentication request information from the IP-CAN 3 to the terminal 2, and RES is returned as authentication response information from the terminal 2 to the IP-CAN 3. Mutual authentication processing between the terminal 2 and the IP-CAN 3 is performed. In step S2, the terminal 2 stores RAND, AUTN, and RES.

  After mutual authentication is performed between the terminal 2 and the IP-CAN 3, the IMS authentication processing unit 22 of the terminal 2 adds RAND, AUTN, and RES to the registration processing request (Register), and requests this registration processing. Is transmitted to the CSCF 5 (step S4).

  When the registration processing request transmitted from the terminal 2 is received in the CSCF 5, the authentication processing device 7 of the CSCF 5 extracts and acquires RAND, AUTN, and CSCF 5 from the registration processing request in the authentication information acquisition unit 71.

  Next, the authentication processing device 7 of the CSCF 5 uses the authentication processing unit 72 to perform the IP-CAN 3 authentication processing using the user unique key K held by the CSCF 5 and the RAND and AUTN acquired by the authentication information acquisition unit 71. (Step S5).

  Next, the authentication processing device 7 of the CSCF 5 uses the user unique key K held in the CSCF 5 and the RAND and RES acquired by the authentication information acquisition unit 71 in the authentication processing unit 72 to perform the authentication processing of the terminal 2. (Step S6).

  After the authentication processing of the IP-CAN 3 and the terminal 2 is performed, the authentication processing unit 72 of the CSCF 5 transmits a registration processing request (Server Assignment Request) to the HSS 6 (Step S7). Then, the HSS 6 performs registration registration processing of the terminal 2 (step S8), and transmits a registration processing response (Server Assignment Answer) to the CSCF 5 (step S9).

  Next, the CSCF 5 transmits a registration processing request response (200 OK) to the terminal 2 (step S10). In this way, the communication path between the terminal 2 and the IMS 4 is connected, and the terminal 2 can communicate through the IMS 4.

  Next, operations and effects of the authentication processing device, the authentication processing method, and the authentication processing system according to the present embodiment will be described.

  According to the authentication processing device, the authentication processing method, and the authentication processing system according to the present embodiment, the authentication information (RAND, AUTN, and RES) used in the mutual authentication processing between the terminal 2 and the IP-CAN 3 is received from the terminal 2. Once acquired, authentication for connecting the terminal 2 and the IMS 4 is performed based on the authentication information (RAND, AUTN, and RES), so that the number of times of transmission / reception of information between the terminal 2 and the IMS 4 is reduced. Can do. For this reason, it is possible to reduce the connection time to the IMS 4 and reduce the processing load on the terminal 2 while sufficiently ensuring the reliability of the authentication process.

  In addition, according to the authentication processing device, the authentication processing method, and the authentication processing system according to the present embodiment, the terminal 2 transmits to the terminal 2 from the IP-CAN 3 in the mutual authentication process between the terminal 2 and the IP-CAN 3. By acquiring the authentication request information (RAND and AUTN), the IP-CAN 3 is authenticated based on the authentication request information (RAND and AUTN) by the same process as that performed by the terminal 2 in the mutual authentication process. Therefore, the number of times of transmission / reception of information between the terminal 2 and the IMS can be reduced. Furthermore, since the terminal 2 and the IP-CAN 3 are already mutually authenticated, the reliability of the authentication process is ensured by performing the authentication for the IP-CAN 3 without performing the authentication process of the terminal 2. Is possible.

  In addition, according to the authentication processing device, the authentication processing method, and the authentication processing system according to the present embodiment, the terminal 2 transmits to the terminal 2 from the IP-CAN 3 in the mutual authentication process between the terminal 2 and the IP-CAN 3. Authentication request information (RAND) and the authentication response information (RES) transmitted from the terminal 2 to the IP-CAN 3 in the mutual authentication process between the terminal 2 and the IP-CAN 3, thereby obtaining the authentication request information. Based on (RAND) and authentication response information (RES), the terminal 2 is authenticated by the same process as the process performed by the terminal 2 and the IP-CAN 3 in the mutual authentication process. It is possible to reduce the number of times of sending and receiving information. Further, even if the IP-CAN 3 authentication process is not performed, since the terminal 2 and the IP-CAN 3 are already mutually authenticated, the reliability of the authentication process is ensured by performing the authentication for the terminal 2. It becomes possible.

  The present invention has been specifically described above based on the embodiment. However, the present invention is not limited to the above embodiment. For example, in the above embodiment, the CSCF 5 includes both the terminal 2 and the IP-CAN 3. However, the authentication process may be terminated when one of the authentications is performed, and the connection process between the terminal 2 and the IMS 4 may be performed.

  Moreover, although what was comprised by 3G network as IP-CAN was demonstrated as an example, IP-CAN may be what kind of network as long as it is an IP base network, and as shown in FIG. W-LAN (Wireless Local Area Network) 3a, 3G network 3b, Internet network 3c, etc. may be used. In addition, when AKA (Authentication and Key Agreement) authentication is used as a mutual authentication method at that time, it can be performed in the same manner as the above processing. When other mutual authentication methods are used, the above processing and information transmitted / received are different, but the processing content can be performed by the same processing as described above.

It is a figure which shows the structure of the authentication processing system which concerns on embodiment of this invention. It is a figure which illustrates the function structure of a terminal. It is a figure which illustrates the hardware constitutions of a terminal and an authentication processing apparatus. It is a figure which shows the authentication process in IP-CAN. It is a figure which illustrates the function structure of an authentication processing apparatus. It is a sequence diagram which shows the processing operation of an authentication processing system. It is a figure which shows the structure of the authentication processing system for demonstrating the structural example of IP-CAN.

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Authentication processing system, 2 ... Terminal, 3 ... IP-CAN (access network), 4 ... IMS (core network), 7 ... Authentication processing apparatus.

Claims (5)

An authentication processing device that performs authentication to connect a core network that uses an access network as a communication path and a terminal that is mutually authenticated with the access network,
Authentication information acquisition means for acquiring authentication information used in the mutual authentication processing for the mutual authentication from the terminal;
Authentication processing means for performing authentication processing based on the authentication information acquired by the authentication information acquiring means;
An authentication processing device comprising: The authentication information is information including authentication request information transmitted from the access network to the terminal in the mutual authentication process,
The authentication processing apparatus according to claim 1, wherein the authentication processing unit performs authentication processing for the access network by performing processing similar to processing performed by the terminal in the mutual authentication processing. The authentication information is information including authentication request information transmitted from the access network to the terminal in the mutual authentication process and authentication response information transmitted from the terminal to the access network in the mutual authentication process. Yes,
3. The authentication process according to claim 1, wherein the authentication processing unit performs an authentication process for the terminal by performing a process similar to the process performed by the terminal and the access network in the mutual authentication process. The authentication processing device described. An authentication processing method for performing authentication in order to connect a core network that uses an access network as a communication path and a terminal that is mutually authenticated with the access network,
An authentication information acquisition step for acquiring authentication information used in the mutual authentication process for the mutual authentication from the terminal,
An authentication process step of performing an authentication process based on the authentication information acquired in the authentication information acquisition step;
An authentication processing method comprising: An authentication processing device comprising a core network that uses an access network as a communication path, and a terminal that is mutually authenticated with the access network, and performing authentication to connect the core network and the terminal,
The terminal includes an authentication information transmission unit that transmits authentication information used in the mutual authentication processing for the mutual authentication to the core network,
The core network comprises authentication information acquisition means for acquiring the authentication information from the terminal, and authentication processing means for performing authentication processing based on the authentication information acquired by the authentication information acquisition means. Authentication processing system.

Images