JP2022134280A - Authentication system - Google Patents

Abstract

To provide an authentication system capable of improving security in line authentication.SOLUTION: A UPF 30 comprises: an assignment unit 311 that assigns to each user terminal 10 accessing an authentication server 2 on the Internet, an IP address including a value obtained by generating a session number unique to each session, calculating the session number with an IMSI of the user terminal 10 and encrypting the calculated value using a key shared in advance with the authentication server 2, as well as, including the session number; and a transfer unit 313 that transfers to the authentication server 2, a data packet of the user terminal 10, designating the assigned IP address to be a transmission source thereof, so as to allow the authentication server 2 to derive the IMSI of the user terminal 10 from the IP address.SELECTED DRAWING: Figure 2

Description

The present invention relates to a system where a server on the Internet authenticates a mobile user based on IP address.

Conventionally, there has been provided a system (line authentication system) that authenticates a user using a service on the Internet by using user identification information (a subscriber identification number of a telecommunications carrier) associated with an assigned IP address.
For example, Non-Patent Document 1 proposes a technique for realizing MAC address authentication using an IP management database that registers MAC addresses and the like for IP addresses.

Kazuyuki Miyakita et al., Operation and function expansion of network access authentication-linked IP management database, Information Processing Society of Japan Research Report, Vol. 2016-CSEC-73, No. 2, pp. 1-6 (2016).

However, conventional line authentication systems authenticate users using a database that links IP addresses assigned to users and subscriber identification numbers (IMSI), for example. Therefore, if the IP address is the same, the server on the Internet can presume that the access source is the same user, so it has become possible to track the usage history of services by the same user.

With IPv4, for example, such security problems can be alleviated by using NAT (Network Address Translation). rice field.

SUMMARY OF THE INVENTION An object of the present invention is to provide an authentication system capable of improving security in line authentication.

A communication control apparatus according to the present invention generates a session number that differs for each session for a user terminal that accesses an authentication server on the Internet, calculates it with the identification number of the user terminal, and shares it with the authentication server in advance. an allocation unit that allocates an IP address containing a value encrypted with a key and the session number; The authentication server includes a forwarding unit that derives an identification number of the user terminal from the IP address.

The user terminal identification number may be a subscriber identification number recorded in the SIM.

The authentication system according to the present invention comprises a plurality of said communication control devices corresponding respectively to a plurality of authentication servers, and a base station communicating with said user terminal, said base station receiving from said user terminal The data packet is transferred to the communication control device pre-associated with the user terminal, and the communication control device shares the unique key with one of the plurality of authentication servers in advance.

The communication control device may be provided for each network slice assigned to the user terminal.

A communication control program according to the present invention is for causing a computer to function as the communication control device.

According to the present invention, security in line authentication can be improved.

It is a figure which shows the structure of the authentication system in embodiment. It is a figure which shows the functional structure of UPF in embodiment. It is a figure which shows the calculation method of the IP address assigned to the user terminal in embodiment. It is a sequence diagram showing the flow of the authentication method in the embodiment.

An example of an embodiment of the present invention will be described below.
FIG. 1 is a diagram showing the configuration of an authentication system 1 according to this embodiment.
The authentication system 1 includes a user terminal 10 that performs mobile communication, a base station 20 that communicates with the user terminal 10, and a UPF (User Plane Function) 30 that is a communication control device that performs data transfer (routing) from the mobile network to the Internet. and provides a line authentication mechanism for an authentication server 2 on the Internet.

The UPF 30 is provided in each of a plurality of network slices introduced in the fifth generation mobile communication system (5G), and is recorded in the SIM (Subscriber Identity Module) of the user terminal Subscriber identification number (International Mobile Subscriber Identity; IMSI) , the network slice number is registered in advance as contract information.

A network slice number is set for each service provided to the user or for each service provider, and a unique key is shared between the corresponding UPF 30 and the authentication server 2 of the service used by the user.
The base station 20 transfers the data packet received from the user terminal 10 to the UPF 30 linked in advance to the service used by this user terminal 10 .

The UPF 30 assigns to the user terminal 10 an IP address from which IMSI can be derived as authentication information when the user terminal 10 communicates with the Internet.
The authentication server 2 performs authentication by deriving the IMSI from the IP address assigned to the user terminal 10 using a key shared with the UPF 30 in advance.

FIG. 2 is a diagram showing the functional configuration of the UPF 30 in this embodiment.
The UPF 30 is an information processing apparatus (computer) including a communication device and the like in addition to the control unit 31 and the storage unit 32. The control unit 31 appropriately reads and executes various programs stored in the storage unit 32, It functions as the following units in this embodiment.
The control unit 31 of the UPF 30 includes an allocation unit 311 , a holding unit 312 and a transfer unit 313 .

The allocation unit 311 generates a different session number for each session for the user terminal 10 accessing the authentication server 2 on the Internet, calculates it with the identification number (IMSI) of the user terminal 10, and shares it with the authentication server 2 in advance. assigns an IP address containing a value encrypted with the key and the session number.

FIG. 3 is a diagram showing a method of calculating the IP address assigned to the user terminal 10 in this embodiment.
When the entire IP address is divided into three parts B, N, and U, B is the part indicating the range of IP addresses assigned to the service provider, and N is an arbitrary value that differs for each session.

U is obtained by encrypting the operation result of N and Z with X, where Z is the IMSI and X is the key. The operation of N and Z may be appropriately set, for example, combination of bit strings (N∥Z or Z∥N), addition, exclusive OR, or the like.
As a result, the UPF 30 and the authentication server 2 possessing the key X can derive Z by decrypting the portion U of the IP address with the key X and performing an inverse operation using N.

The holding unit 312 associates the IP address assigned to the user terminal 10 with the IMSI, which is the identification number of this user terminal, and holds them in a predetermined database as authentication information.

The transfer unit 313 transfers the data packet transmitted from the user terminal 10 to the authentication server 2 with the assigned IP address as the source.

FIG. 4 is a sequence diagram showing the flow of the authentication method according to this embodiment.
This sequence shows the flow when the user terminal 10 accesses the corresponding authentication server 2 in order to use the contracted service on the Internet after the communication connection between the user terminal 10 and the base station 20 is established. there is

In step S<b>1 , the user terminal 10 transmits a data packet destined for the authentication server 2 to the base station 20 .

In step S<b>2 , the base station 20 identifies the UPF 30 as the transfer destination based on the network slice number recorded in the SIM of the user terminal 10 .

At step S3, the base station 20 forwards the received data packet to the UPF 30 identified at step S2.

In step S<b>4 , the UPF 30 determines whether or not an IP address related to the current session with the authentication server 2 has been assigned to the user terminal 10 . If the determination is YES, the process moves to step S6, and if the determination is NO, the process moves to step S5.

In step S<b>5 , the UPF 30 generates a new session number, calculates a new IP address including a value encrypted together with the IMSI of the user terminal 10 , and assigns it to the user terminal 10 .

In step S6, the UPF 30 transmits a data packet to the authentication server 2 using the IP address assigned to the user terminal 10 as the source.

According to this embodiment, the authentication system 1 generates a different session number for each session with respect to the user terminal 10 accessing the authentication server 2 on the Internet in the UPF 30 and calculates it with the identification number of the user terminal 10 . , an IP address containing a value encrypted with a key shared in advance with the authentication server 2 and a session number.
Therefore, by transferring the data packet of the user terminal 10 to the authentication server 2 with the assigned IP address as the source, the authentication server 2 can obtain the IMSI of the user terminal 10 from the source IP address using the shared key. can be derived to perform user authentication.
As a result, since the IP address of the user terminal 10 is different for each session, tracking by a third party can be avoided and security in line authentication can be improved.

Specifically, a secure line authentication system can be easily constructed by using the IMSI recorded in the SIM as the identification number of the user terminal 10 .

Furthermore, the authentication system 1 installs a plurality of UPFs 30 in correspondence with the authentication server 2 provided for each service (enterprise), so that the key unique to each UPF 30 is shared with the corresponding authentication server 2. . At this time, the base station 20 transfers the data packet to the UPF 30 linked to the user terminal 10 in advance, so that only the corresponding authentication server 2 can derive the IMSI from the IP address and perform authentication.

Specifically, the UPF 30 is provided corresponding to the network slice assigned to the user, and the authentication system 1 implements the line authentication mechanism only for the authorized authentication server 2 according to the contract details for each user. can provide.

As a result, for example, safer Internet access can be realized, so it is important to realize Goal 9 of the Sustainable Development Goals (SDGs) led by the United Nations, which states, "Build resilient infrastructure, promote sustainable industrialization, It will be possible to contribute to "expanding innovation".

Although the embodiments of the present invention have been described above, the present invention is not limited to the above-described embodiments. Moreover, the effects described in the above-described embodiments are merely enumerations of the most suitable effects produced by the present invention, and the effects of the present invention are not limited to those described in the embodiments.

An authentication method by the authentication system 1 is realized by software. When it is implemented by software, a program constituting this software is installed in an information processing device (computer). Further, these programs may be recorded on removable media such as CD-ROMs and distributed to users, or may be distributed by being downloaded to users' computers via a network. Furthermore, these programs may be provided to the user's computer as a web service through the network without being downloaded.

1 Authentication System 2 Authentication Server 10 User Terminal 20 Base Station 30 UPF (Communication Control Unit)
31 control unit 32 storage unit 311 application unit 312 holding unit 313 transfer unit

Claims (5)

For a user terminal accessing an authentication server on the Internet, a different session number is generated for each session, calculated with the identification number of the user terminal, and a value encrypted with a key shared in advance with the authentication server; an assigning unit that assigns an IP address including a session number;
a transfer unit that transfers a data packet of the user terminal to the authentication server using the assigned IP address as a transmission source, thereby causing the authentication server to derive an identification number of the user terminal from the IP address; communication control device. 2. The communication control apparatus according to claim 1, wherein the identification number of said user terminal is a subscriber identification number recorded in SIM. a plurality of communication control devices according to claim 1 or claim 2 corresponding to each of a plurality of authentication servers;
a base station that communicates with the user terminal;
The base station transfers the data packet received from the user terminal to the communication control device pre-associated with the user terminal;
An authentication system in which the communication control device shares the unique key with one of the plurality of authentication servers in advance. 4. The authentication system according to claim 3, wherein said communication control device is provided for each network slice assigned to said user terminal. A communication control program for causing a computer to function as the communication control device according to claim 1 or 2.

Images