JP5701718B2 - Communication control device and mobile communication system - Google Patents

Description

  The present invention relates to a communication control apparatus and a mobile communication system, and more particularly to a communication control apparatus and a mobile communication system that are applied to a system in which an authentication server apparatus authenticates a mobile terminal when the mobile terminal is registered in a network. About.

When an attach operation is performed at a mobile terminal located in the LTE (Long Term Evolution) network, connection processing to a PDN (Packet Data Network) is performed simultaneously with the Attach processing on the network side. For this reason, if the connection to the PDN fails, Attach also fails.
Further, in this way, the mobile terminal that has failed in Attach automatically and repeatedly transmits an Attach registration request regardless of the user's Attach operation. Therefore, for example, when the Attach fails because the authentication information is determined to be unauthenticated by the PDN authentication server device because the user has incorrectly set the authentication information, the Attach registration request is repeatedly transmitted from the mobile terminal. As a result, the connection process to the PDN is also repeatedly performed.

  For example, as shown in FIG. 14, when an attach operation such as power-on of a mobile terminal (UE; User Equipment) 101 is performed (step S701), the mobile terminal (UE) 101 is connected to an EPC (Evolved Packet Core) network. In order to register in 102, an “Attach registration request” is transmitted from the mobile terminal (UE) 101 to the devices constituting the EPC network 102 (step S702). Upon receiving this “Attach registration request”, the Attach process is performed in the apparatus constituting the network 102 and the connection process to the PDN is performed, and a Radius (Remote Authentication Dial-In User Service) server which is a PDN authentication server apparatus. A “Radius authentication request” (step S703) including the user ID and password is transmitted to the device 103.

Upon receiving this “Radius authentication request”, the RADIUS server apparatus 103 authenticates the mobile terminal (UE) 101 based on the user ID and password of the mobile terminal (UE) 101 included in the “Radius authentication request”, and the authentication result Is transmitted to the devices constituting the EPC network 102.
If the authentication result is authentication NG (authentication is not possible), a “Radius authentication NG response” indicating authentication NG is transmitted from the Radius server device 103 (step S704). Upon receiving the “Radius authentication NG response”, the devices constituting the EPC network 102 transmit an “Attach Reject signal” that rejects registration of the mobile terminal (UE) 101 to the EPC network 102 to the mobile terminal (UE) 101. (Step S705).

In this case, for example, “EMM Cause: # 19 ESM failure”, “ESM Cause: # 29 User authentication failed”, etc. are set in the “Attach Reject signal” to be transmitted.
When the mobile terminal (UE) 101 receives the “Attach Reject signal”, it automatically retransmits the “Attach registration request” (step S706). When an “Attach Reject signal” is received as a response, an “Attach registration request” is retransmitted.

  For example, as shown in FIG. 15, this “Attach registration request” is retransmitted by repeating the “Attach registration request” (Attach Request) every predetermined time (for example, every 10 seconds) a predetermined number of times (for example, a total of 5 times). This is done by transmitting (step S707 in FIG. 14). When the mobile terminal (UE) 101 transmits an “Attach registration request” five times every 10 seconds (about 40 seconds + α seconds), a predetermined waiting time (for example, 12 minutes) has elapsed. (Step S708), the “Attach registration request” is again transmitted five times every 10 seconds. Thereafter, the mobile terminal (UE) 101 repeatedly performs the process of transmitting the “Attach registration request” five times every 10 seconds when a predetermined standby time (12 minutes) elapses.

  With the re-transmission of the “Attach registration request” described above, each time the “Attach registration request” is received, the apparatus constituting the EPC network 102 performs the Attach process and the connection process to the PDN, “Radius authentication request (Access-Request)” is transmitted. The Radius server apparatus 103 authenticates the mobile terminal (UE) 101 every time it receives a “Radius authentication request”. While the authentication result is authentication NG, a “Radius authentication NG response (Access-Reject)” is transmitted to the EPC network 102. The above operation (processing) is described in Non-Patent Document 1.

3GPP TS 24.301 V8.3.0 (2009-09) 3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; Non-Access-Stratum (NAS) protocol for Evolved Packet System (EPS); Stage 3 (Release 8)

  Here, the Radius server device 103 has an account that locks the account of the mobile terminal (UE) 101 that is the transmission source of the “Attach registration request” from the security point of view when the authentication is NG consecutively for a predetermined number of times. Some have a lock function. If the threshold value of the number of times to lock the account is set as, for example, 5 times, the Radius server device 103 locks the account when it is determined that the authentication is NG 5 times.

  Therefore, although it is a legitimate user, there is an error in the user ID or password set in the mobile terminal (UE) 101 as the authentication information, so even when the RADIUS server device 103 determines that the authentication is NG, When the “Attach registration request” is automatically retransmitted after the power is turned on and transmitted five times in total, the account lock is performed in the Radius server device 103.

  That is, if the authentication information of the mobile terminal (UE) 101 is not updated, an “Attach registration request” including the same authentication information as the previous time is transmitted even at the time of retransmission. Therefore, if the RADIUS server apparatus 103 determines that authentication is not possible due to a setting error in authentication information, the same authentication information as the authentication information determined to be unauthenticated unless the authentication information of the mobile terminal (UE) 101 itself is updated. An “Attach registration request” including information is transmitted. Therefore, every time the “Attach registration request” is retransmitted, the Radius server device 103 determines that the authentication is impossible, and the account lock is performed when the “Attach registration request” is transmitted a total of five times. become.

For this reason, even if the authentication information is set incorrectly, account lock is performed, and usability is poor.
The present invention has been made for the purpose of solving the problems of the background art described above, and it is an object of the present invention to appropriately suppress account lock and provide a user-friendly mobile communication system.

The communication control device according to one aspect of the present invention, when receiving a connection-related signal transmitted with a connection request from a mobile terminal to a network, an authentication request for instructing authentication for the mobile terminal and the connection-related The communication control unit that transmits the authentication information set in the mobile terminal received together with the signal to the authentication server device, the authentication information storage area that holds the authentication information, and the authentication information storage area of the authentication information A holding control unit that controls the holding of the authentication information, and the authentication information determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area when the connection related signal is received and the connection related When the authentication information set in the mobile terminal received together with the signal is the same, the communication control unit sends the authentication request to the authentication server device. And a determination unit for inhibiting, the holding control section, when receiving the connection-related signals, when the authentication information authentication information in the storage area is not held, is held in the authentication information storage area When the authentication information holding time is equal to or longer than a preset authentication information holding time, the authentication information set in the mobile terminal received together with the connection related signal is the authentication information held in the authentication information storage area; Only in any one of the cases, the authentication information set in the mobile terminal received together with the connection related signal is started to be held in the authentication information storage area, and the authentication information is held in the authentication information storage area only in any one of the cases The start time is stored as an authentication information update time in the authentication information storage area in association with the authentication information set in the mobile terminal received together with the connection related signal. The authentication information holding time is set for each APN (Access Point Name), and the determination unit has a holding time in the authentication information storage area that is less than the authentication information holding time based on the authentication information update time. When the authentication information is determined to be the authentication information determined to be unauthenticated, and the authentication information and the authentication information set in the mobile terminal received together with the connection related signal are the same, the communication control unit Suppressing transmission of the authentication request to the authentication server device and using the authentication information holding time corresponding to the APN that is the connection request destination of the mobile terminal that has transmitted the connection request to the network, to determine whether the determined authentication information and said Rukoto.

By configuring the communication control device in this way, among the authentication information stored in the authentication information storage area, the authentication information that is determined to be unauthenticated by the authentication server device and the mobile terminal that made the connection request are set. If the authentication information is the same, the authentication information determined to be unauthenticated by the authentication server device is transmitted again to the authentication server device in order to suppress transmission of the authentication request to the authentication server device. Therefore, it is possible to avoid the authentication from being performed in the authentication server device.
Further, by configuring the communication control device as described above, it is possible to easily acquire authentication information that is determined to be unauthenticated by the authentication server device.
Further, by configuring the communication control device as described above, it is possible to determine whether the authentication information is determined to be unauthenticated using the authentication information holding time suitable for the packet data network corresponding to each APN. it can.

The communication control device according to another aspect of the present invention is characterized in that the holding control unit holds the authentication information and the authentication information update time for each APN (Access Point Name).
By configuring the communication control device as described above, whether or not the authentication information is determined to be appropriately unauthenticated even when one mobile terminal designates a plurality of APNs as connection request destination APNs. Can be determined.

Et al is, the communication control device according to another aspect of the present invention, when receiving a connection-related signal transmitted along with the request for connection to the network from the mobile terminal, authentication indicating the authentication of the mobile terminal An authentication server device having an account lock function that locks an account of a mobile terminal that has been authenticated for a predetermined number of times as a result of authentication of the request and the authentication information set in the mobile terminal received together with the connection related signal A communication control unit that transmits the authentication information, an authentication information storage area that holds the authentication information, and when the connection-related signal is received, if the authentication information is not held in the authentication information storage area, the authentication information storage area When the holding time of the held authentication information is equal to or longer than a preset authentication information holding time, or the mobile terminal received together with the connection related signal The authentication information set in the mobile terminal received together with the connection related signal is only in one of the cases where the authentication information set in the authentication information is different from the authentication information held in the authentication information storage area. The authentication information storage area starts to be held, and the time when the authentication information is held in the authentication information storage area is set as the authentication information update time in association with the authentication information set in the mobile terminal received together with the connection related signal. A holding control unit that performs control to be held in the authentication information storage area, and authentication that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area when the connection-related signal is received When the information and the authentication information set in the mobile terminal received together with the connection related signal are the same, the transfer by the communication control unit is performed. Characterized in that it and a determination part for preventing the transmission of the authentication request to a different said authentication server device and the terminal.

Also of al, the communication control device according to one embodiment of the present invention, the determination unit, based on the authentication information update time, the authentication information holding time at the authentication information storage area is less than the authentication information holding time The authentication information determined to be unauthenticated, and when the authentication information and the authentication information set in the mobile terminal received together with the connection related signal are the same, the authentication by the communication control unit The transmission of the authentication request to the server device is suppressed .
In the communication control apparatus according to an aspect of the present invention, the authentication information holding time is set for each APN (Access Point Name), and the determination unit is a connection request destination of the mobile terminal that has transmitted the connection request to the network. The authentication information holding time corresponding to a certain APN is used to determine whether the authentication information is determined to be unauthenticated.
The communication control apparatus according to an aspect of the present invention is characterized in that the holding control unit holds the authentication information and the authentication information update time for each APN (Access Point Name).

A mobile communication system according to an aspect of the present invention authenticates a mobile terminal using a communication control device provided in a network to which the mobile terminal is connected and authentication information set in the mobile terminal, and sets in advance A mobile communication system including an authentication server device having an account lock function for invalidating the account of the mobile terminal when it is determined that the authentication is not possible continuously for a predetermined number of times. When receiving a connection related signal transmitted along with a connection request, an authentication request for instructing authentication of the mobile terminal and authentication information set in the mobile terminal received together with the connection related signal A communication control unit to be transmitted to the apparatus, an authentication information storage area for storing the authentication information, and holding of the authentication information in the authentication information storage area. And when receiving the connection-related signal, the authentication information determined to be unauthenticated by the authentication server device and the connection-related signal among the authentication information held in the authentication information storage area. A determination unit that suppresses transmission of the authentication request to the authentication server device by the communication control unit when the authentication information set in the mobile terminal is the same, and the holding control unit includes: When authentication information is not held in the authentication information storage area when a connection related signal is received, the holding time of the authentication information held in the authentication information storage area is equal to or longer than a preset authentication information holding time. If the authentication information set in the mobile terminal received together with the connection related signal is different from the authentication information held in the authentication information storage area, Only in this case, the authentication information set for the mobile terminal received together with the connection related signal is started to be held in the authentication information storage area, and the time when the authentication information is started to be held in the authentication information storage area is The authentication information is stored in the authentication information storage area in association with the authentication information set in the mobile terminal received together with the connection related signal as the authentication information update time, and the authentication information holding time is set for each APN (Access Point Name), The determination unit determines, based on the authentication information update time, authentication information whose retention time in the authentication information storage area is less than the authentication information retention time as authentication information determined to be unauthenticated, When the authentication information and the authentication information set in the mobile terminal received together with the connection related signal are the same, the communication control unit The transmission of the authentication request to the authentication server device is suppressed, and the authentication information holding time corresponding to the APN that is the connection request destination of the mobile terminal that has transmitted the connection request to the network is It is characterized by determining whether it is the judged authentication information .
By configuring the mobile communication system as described above, among the authentication information held in the authentication information storage area, the authentication information determined to be unauthenticated by the authentication server device and the mobile terminal that has made the connection request are set. If the authentication information is the same, the authentication information determined to be unauthenticated by the authentication server device is transmitted again to the authentication server device in order to suppress transmission of the authentication request to the authentication server device. Therefore, it is possible to avoid the authentication from being performed in the authentication server device.
Further, by configuring the mobile communication system as described above, it is possible to easily acquire authentication information that is determined to be unauthenticated by the authentication server device.
Further, by configuring the communication control device as described above, it is possible to determine whether the authentication information is determined to be unauthenticated using the authentication information holding time suitable for the packet data network corresponding to each APN. it can.

A mobile communication system according to another aspect of the present invention authenticates a mobile terminal using a communication control device provided in a network to which the mobile terminal is connected and authentication information set in the mobile terminal, A mobile communication system including an authentication server device having an account lock function for invalidating an account of the mobile terminal when it is determined that authentication cannot be performed continuously for a predetermined number of times, to the network from the mobile terminal When a connection related signal transmitted with the connection request is received, an authentication request for instructing authentication for the mobile terminal and authentication information set in the mobile terminal received together with the connection related signal are The result is sent to the authentication server device having an account lock function that locks the account of the mobile terminal that has been unable to authenticate a predetermined number of times. When the communication control unit, the authentication information storage area that holds the authentication information, and the connection-related signal are received, if the authentication information is not held in the authentication information storage area, the authentication information storage area is held in the authentication information storage area Authentication information set in the mobile terminal received together with the connection-related signal is stored in the authentication information storage area when the authentication information holding time of the authentication information is not less than a preset authentication information holding time And the authentication information set in the mobile terminal received together with the connection related signal is started to be stored in the authentication information storage area, and the authentication information is stored in the authentication information storage area only in any one of the cases The authentication information description is associated with the authentication information set in the mobile terminal that has been received together with the connection related signal as the authentication information update time as the start time of holding. An authentication information that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area when the connection-related signal is received; A determination unit that suppresses transmission of the authentication request to the authentication server device different from the mobile terminal by the communication control unit when the authentication information set in the mobile terminal received together with the connection related signal is the same And.

Further, in the mobile communication system according to another aspect of the present invention, the determination unit determines the authentication information whose retention time in the authentication information storage area is less than the authentication information retention time based on the authentication information update time. When the authentication information is determined to be unauthenticated, and the authentication information and the authentication information set in the mobile terminal received together with the connection related signal are the same, the server for authentication by the communication control unit Transmission of the authentication request to the device is suppressed .

Na us, the communication control device may be configured as a device provided in a single housing together above components, it may be configured to provided a plurality of housing and dispersing the respective units. In the case of a configuration in which the above units are distributed and provided in a plurality of cases, the units may be connected via a network. Thus, not only when each unit is realized by a single device, but also when each unit is realized by a plurality of devices and each device is connected via a network, “communication” in this specification Corresponds to "control device".

  According to the present invention, among the authentication information held in the authentication information storage area, the authentication information determined to be unauthenticated by the authentication server device is the same as the authentication information set in the mobile terminal that has made the connection request. In this case, since the transmission of the authentication request to the authentication server device is suppressed, the authentication information determined to be unauthenticated by the authentication server device is transmitted again to the authentication server device, and based on this, the authentication server It is possible to avoid authentication in the device.

It is a block diagram which shows an example of the mobile communication system by this Embodiment. It is a block diagram which shows an example of a structure of a gateway apparatus (P-GW). It is a sequence diagram which shows an example of the processing content at the time of an attach process. It is a flowchart which shows an example of the process sequence of an authentication information management process. It is a sequence diagram which shows an example of the processing content at the time of an attach process. It is a block diagram which shows an example of the memory | storage part in 2nd Embodiment. It is a flowchart which shows an example of the processing content at the time of the attach process in 2nd Embodiment. It is a sequence diagram which shows an example of the processing content at the time of the attach process in 2nd Embodiment. It is a block diagram which shows the other example of a memory | storage part. 10 is a flowchart illustrating an example of a processing procedure of authentication information management processing when the storage unit has the configuration of FIG. 9. FIG. 10 is a sequence diagram illustrating an example of processing contents during an attach process when the storage unit has the configuration of FIG. 9. It is a block diagram which shows an example of a structure of the policy control apparatus (PCRF) in 3rd Embodiment. It is a sequence diagram which shows an example of the processing content at the time of the attach process in 3rd Embodiment. It is a sequence diagram which shows an example of the processing content at the time of the conventional attach process. It is a sequence diagram which shows an example of the processing content at the time of the conventional attach process.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings referred to in the following description, the same parts as those in the other drawings are denoted by the same reference numerals.
(First embodiment)
First, a first embodiment of the present invention will be described.
(Overall configuration of mobile communication system)
An example of the overall configuration of the mobile communication system in the present embodiment will be described with reference to FIG.
The mobile communication system according to the first embodiment includes a mobile terminal (UE) 1, a PDN (Packet Data Network) 4, a Radius server device 5 as an authentication server device that performs authentication of the mobile terminal (UE) 1, The mobile terminal (UE) 1, the PDN 4, and the EPC network 10 to which the Radius server device 5 is connected are configured.

  The EPC network 10 includes a gateway device (S-GW) 11, a gateway device (P-GW) 12, a packet data network gateway 12, and a policy control device (PCRF), which mainly constitute a core network that does not depend on radio access. Focusing on Policy and Charging Rules Function (13), mobility management node (MME) 14 and radio base stations (eNodeB) 15 and 3G (3rd) constituting an LTE (Long Term Evolution) radio access accommodation network Generation) SGSN (Serving Generator) constituting a wireless access accommodating network (hereinafter abbreviated as 3G network) l Packet Radio Service Support Node) 16 and RNC (Radio Network Controller) / NodeB17, and the like.

The gateway device (S-GW) 11 accommodates the LTE network and the 3G network, transmits user data, and serves as a point for switching the user data transfer path between the LTE network and the 3G network wireless access accommodation network. It is a packet gateway.
The gateway device (P-GW) 12 is connected to a packet data network (PDN4) other than the core network such as IMS (IP Multimedia Subsystem) that provides voice services and the like through i-mode (registered trademark) and a packet network. Yes, it is a gateway that performs IP address assignment and the like. The HSS (Home Subscriber Server) 18 is a subscriber information management server that stores information indicating that the mobile terminal (UE) 1 is connected to the mobile management node (MME) 14.

  The policy control device (PCRF) 13 determines policy control such as QoS and charging control rules to be applied in the gateway device (P-GW) 12 and the gateway device (S-GW) 11. Note that the gateway device (P-GW) 12 and the gateway device (S-GW) 11 perform control in units of packets based on transmission information from the policy control device (PCRF) 13.

The mobility management node (MME) 14 is used for mobility management, authentication (security control) of the mobile terminal (UE) 1 in the LTE radio access system, and between the gateway device (S-GW) 11 and the radio base station (eNodeB) 15. The user data transfer path setting process is performed.
Similar to the mobility management node (MME) 14, the SGSN 16 performs terminal mobility management, authentication (security control), etc. in the 3G radio access system, and continues communication even when switching between the LTE and 3G radio access systems. It is a node that sets a communication path so that

The mobile terminal (UE) 1 transmits an “Attach registration request” for registering the mobile terminal (UE) 1 itself in the EPC network 10 when an attach operation is performed such as when the power is turned on. The mobile terminal (UE) 1 communicates with the EPC network 10 after completing registration with the EPC network 10 and connection to a predetermined PDN.
The Radius server device 5 is connected to the EPC network 10, receives a “Radius authentication request” transmitted from the EPC network 10, and based on the authentication information (user ID, password) included in the “Radius authentication request” (UE) 1 is authenticated. Further, the Radius server device 5 has an account lock function for locking the account (user's) of the mobile terminal when the authentication results in authentication NG (authentication impossible) continuously for a predetermined number of times.

(Configuration example of gateway device (P-GW) 12)
As shown in FIG. 2, the gateway device (P-GW) 12 in the first embodiment includes a processing unit 20 that performs processing such as IP address allocation as described above, and also stores an authentication information processing unit 21 and storage. Part 22. The processing unit 20 performs communication processing with other devices in addition to the above-described processing such as IP address assignment. The communication processing executed by the processing unit 20 includes communication processing with the Radius server device 5, and the processing unit 20 transmits “Create Session” transmitted when the “Attach registration request” is transmitted from the mobile terminal (UE) 1. When the “Request signal” is received, communication processing with the Radius server device 5 is performed in accordance with an instruction from the authentication information processing unit 21.

That is, the processing unit 20 transmits a “Radius authentication request” to the Radius server device 5 when a normal communication process is instructed from the authentication information processing unit 21. Then, the authentication result is received from the Radius server device 5 and the authentication result is notified to the mobile terminal (UE) 1 via each unit such as the gateway device (S-GW) 11.
On the other hand, when connection inhibition is instructed from the authentication information processing unit 21, the processing unit 20 does not transmit a “Radius authentication request” to the Radius server device 5. And it notifies that it is authentication NG to the mobile terminal (UE) 1 via each part, such as the gateway apparatus (S-GW) 11.

The authentication information processing unit 21 executes an authentication information management process when receiving the “Create Session Request signal”, and based on the authentication information set in the mobile terminal (UE) 1 included in the “Create Session Request signal”. It is determined whether or not to transmit a “Radius authentication request” to the Radius server device 5, and the normal communication processing or connection suppression is instructed to the processing unit 20.
The storage unit 22 is a storage area for storing information necessary for authentication information management processing. The storage unit 22 includes an authentication information holding time storage area 22a for storing an authentication information holding time, which will be described later, and an authentication information storage area 22b for storing authentication information.

(Operation during Attach processing)
Next, operations of main parts constituting the mobile communication system during the Attach process will be described with reference to FIG. In FIG. 3, the mobility management node (MME) 14 and the gateway device (S-GW) 11 are configured as an MME / S-GW unit 11 a that is one block.
In FIG. 3, the mobile terminal (UE) 1 transmits an “Attach registration request” for making a registration request to the EPC network 10 when the power is turned on (step S101). The “Attach registration request” is transmitted to the MME / S-GW unit 11a via a radio base station (eNodeB) 15 (not shown). In response to the “Attach registration request”, Attach processing and connection processing to the PDN are performed, and the “Create Session Request signal” for making a line connection request from the MME / S-GW unit 11a is the gateway device (P-GW) 12. (Step S102).

  Here, in the authentication information holding time storage area 22a of the storage unit 22 of the gateway device (P-GW) 12, the authentication information holding time is stored as shown in FIG. This authentication information holding time is a preset time for determining the time that the authentication information notified from the mobile terminal (UE) 1 is held in the authentication information storage area 22b. Seconds ". In addition, it is not restricted to 125 seconds, It can set arbitrarily.

In the authentication information storage area 22b of the storage unit 22, authentication information and an authentication information update time indicating the time when the authentication information is registered or updated in the authentication information storage area 22b are stored in association with each other.
The authentication information stored in the authentication information storage area 22b is the user ID and password set in the mobile terminal (UE) 1, and is included in the “Create Session Request signal” in the present embodiment.

  If the authentication information and the authentication information update time are not stored in the authentication information storage area 22b of the storage unit 22, the gateway device (P-GW) 12 and the authentication information included in the “Create Session Request signal” and the “Create Session Request” are stored. The time when the “signal” is notified is associated with and stored in the authentication information storage area 22b (step S103).

  Further, the gateway device (P-GW) 12 transmits a “Radius Access-Request signal” for making an authentication request to the Radius server device 5 (step S104). The “Radius Access-Request signal” includes the user ID and password set in the mobile terminal (UE) 1 that transmitted the “Attach registration request”, that is, authentication information.

The Radius server device 5 performs an authentication process based on the authentication information included in the “Radius Access-Request signal” (step S105). If the authentication result is normal, the Radius server device 5 transmits a “Radius Access-Accept signal” to the gateway device (P-GW) 12.
On the other hand, when there is an error in the user ID or password and it is determined that the authentication is NG (authentication is not possible), the Radius server device 5 transmits a “Radius Access-Reject signal” to the gateway device (P-GW) 12 (step). S106).

  The gateway device (P-GW) 12 that has received the “Radius Access-Reject signal” performs a “Creation Response Response signal (Cause: User authorization failed)” for performing a line connection response to the line connection request in Step S102. "Is transmitted to the MME / S-GW unit 11a (step S107).

  The MME / S-GW unit 11a that has received the “Create Session Response signal (Cause: User authentication failed)” transmits an “Attach Reject signal” indicating failure of attachment to the mobile terminal (UE) 1 (step S108). ). At this time, for example, “EMM Cause: # 19 ESM failure” or “ESM Cause: # 29 User authentication failed” is set in the “Attach Reject signal” as a cause.

The mobile terminal (UE) 1 that has received the “Attach Reject signal” retransmits the “Attach registration request” (step S109).
The MME / S-GW unit 11a that has received the “Attach registration request” again performs Attach processing and connection processing to the PDN, and transmits a “Create Session Request signal” to the gateway device (P-GW) 12 (step S110). ).
The gateway device (P-GW) 12 determines whether or not to make an authentication request to the Radius server device 5 based on the received “Create Session Request signal”.

  Specifically, the gateway device (P-GW) 12 determines whether authentication information and authentication information update time are stored in the authentication information storage area 22b. When the authentication information and the authentication information update time are stored in the authentication information storage area 22b, the gateway device (P-GW) 12 is based on the authentication information update time stored in the authentication information holding time storage area 22a. It is determined whether or not the authentication information in the authentication information storage area 22b is held for at least the authentication information holding time stored in the authentication information holding time storage area 22a. When the authentication information is not held for the authentication information holding time, the gateway device (P-GW) 12 further transmits the authentication information stored in the authentication information storage area 22b and the newly received “Create Session Request signal”. It is determined whether the included authentication information is the same (step S111).

  Then, the gateway device (P-GW) 12 obtains the authentication information based on the authentication information update time stored in the authentication information storage area 22b and the authentication information holding time stored in the authentication information holding time storage area 22a. When it is determined that the holding time is shorter than the authentication information holding time and the authentication information is the same, it is determined that the connection is rejected. When it is determined that the connection is rejected, the gateway device (P-GW) 12 does not transmit a “Radius Access-Request signal” to the Radius server device 5. Then, the gateway device (P-GW) 12 transmits a “Create Session Response signal” to the MME / S-GW unit 11a (step S112).

Receiving the “Create Session Response signal”, the MME / S-GW unit 11a transmits an “Attach Reject signal” indicating that the attach has failed to the mobile terminal (UE) 1 (step S113).
Since the mobile terminal (UE) 1 receives the “Attach Reject signal”, it retransmits the “Attach registration request”. Thereafter, when the above process is repeated and an “Attach registration request” is repeatedly transmitted a predetermined number of times, for example, a total of 5 times, a response signal permitting connection to the line is not received as a response to the “Attach registration request”. After a predetermined waiting time (for example, 12 minutes) has elapsed, “Attach registration request” is retransmitted.

Thereafter, as long as the response signal for permitting connection to the line is not received as a response to the “Attach registration request”, transmission of a predetermined number of transmissions (for example, a total of 5 times) and waiting for a standby time (for example, 12 minutes) To repeat the “Attach registration request”.
That is, in FIG. 3, the processes of steps S109, S110, S111, S112, and S113 are repeated.

(Authentication information management process)
The authentication information processing unit 21 of the gateway device (P-GW) 12 performs authentication information management processing according to the flowchart shown in FIG.
That is, when the “Create Session Request signal” is received (step S1), the process proceeds to step S2, and it is determined whether the authentication information and the authentication information update time are held in the authentication information storage area 22b of the storage unit 22. If these are not held, the process proceeds to step S3, the authentication information included in the “Create Session Request signal” is updated and stored in the authentication information storage area 22b, and the current time is set as the authentication information update time. The information update time is stored in association with the authentication information.

And the authentication information processing part 21 of the gateway apparatus (P-GW) 12 instruct | indicates a normal communication process with respect to the process part 20 (step S4).
Accordingly, the processing unit 20 transmits a “Radius Access-Request signal” to the Radius server device 5 and transmits a response to the MME / S-GW unit 11 a.
On the other hand, when the authentication information and the authentication information update time are held in the authentication information storage area 22b of the storage unit 22 in step S2, the process proceeds to step S5, and the authentication information is stored for a predetermined time, that is, the authentication information holding time storage area 22a. It is determined whether the authentication information is stored in the storage unit 22 and stored in the storage unit 22.

  When the authentication information is held in the storage unit 22 for a certain period of time (current time ≧ authentication information update time + authentication information holding time), the process proceeds to step S3, and the “Create Session Request signal” received in step S1. The authentication information included and the authentication information update time that is the current time are updated and stored in the storage unit 22. On the other hand, when the authentication information is not held in the storage unit 22 for a certain period of time (current time <authentication information update time + authentication information holding time), the process proceeds to step S6 and the authentication included in the received “Create Session Request signal”. It is determined whether the information is the same as the authentication information stored in the authentication information storage area 22b. If they are not the same, the process proceeds to step S3, and the authentication information included in the “Create Session Request signal” received in step S1 and the authentication information update time that is the current time are updated and stored in the authentication information storage area 22b of the storage unit 22. . And it transfers to step S4 and instruct | indicates a normal communication process with respect to the process part 20. FIG.

The processing unit 20 transmits an authentication request (“Radius Access-Request signal”) to the Radius server device 5. Further, the processing unit 20 receives the authentication result from the Radius server device 5 and transmits it to the gateway device (S-GW) 11.
On the other hand, if the notified authentication information is the same as the authentication information stored in the authentication information storage area 22b, the process proceeds to step S7, where it is determined that the connection to the Radius server device 5 is rejected, and the processing unit 20 is instructed. To instruct connection suppression.

  That is, if the authentication information included in the “Create Session Request signal” received in step S1 is the same as the authentication information stored in the authentication information storage area 22b, the RADIUS server device 5 performs the authentication again. Since the authentication information is incorrect, the result is the same. That is, it becomes authentication NG. Therefore, in this case, it is determined that the connection to the Radius server device 5 is refused, and the processing unit 20 is instructed to inhibit connection to the Radius server device 5.

The processing unit 20 does not transmit an authentication request (“Radius Access-Request signal”) to the Radius server device 5, and sends a “Create Session Response signal” as a response to the “Create Session Request signal” received in step S 1. It transmits to the MME / S-GW unit 11a.
(Specific operation during Attach processing)

Next, the operation during Attach processing will be described with reference to FIG.
When an “Attach registration request” for starting a new connection is transmitted from the mobile terminal (UE) 1, such as when power is turned on in the mobile terminal (UE) 1, FIG. When, for example, authentication information is transmitted as “A” from the mobile terminal (UE) 1 (step S201), the gateway device (P-GW) 12 is in the initial connection and stores the authentication information. Since the authentication information is not stored in the area 22b, the authentication information “A” included in the received “Attach registration request” is stored in the authentication information storage area 22b and the connection time “05:00: 00 ”is stored in the authentication information storage area 22b as authentication information update time in association with the authentication information“ A ”(step S202; steps S1 to S3 in FIG. 4). Then, an authentication request is made to the Radius server device 5 (step S203; step S4 in FIG. 4).

As a result, authentication processing is performed in the Radius server device 5, and when it is determined that the authentication is OK (authentication is possible) as a result of the authentication processing, the Radius server device 5 transmits a “Radius Access-Accept signal” indicating authentication OK. Then, the mobile terminal (UE) 1 is notified of the authentication OK via the gateway device (P-GW) 12 or the like.
Thereby, registration to the EPC network 10 and connection processing to the PDN are completed, and the mobile terminal (UE) 1 can communicate via the EPC network 10.

  On the other hand, when the authentication result is determined to be authentication NG in the Radius server device 5, a “Radius Access-Reject signal” indicating the authentication NG is transmitted from the Radius server device 5, and the gateway (P-GW) device 12 is used. Then, an “Attach Reject signal” is transmitted to the mobile terminal (UE) 1. For this reason, the mobile terminal (UE) 1 retransmits the “Attach registration request”.

  Here, when an “Attach registration request” of authentication information: A is received before a fixed time (authentication information holding time) has elapsed since the first connection in FIG. 5A, that is, the same as the first connection. When the “Attach registration request” of the authentication information is received (step S211 in FIG. 5B), the authentication information “A” is already stored in the authentication information storage area 22b, and the authentication information update time is “05: 00:00 ".

Since it is before the fixed time (authentication information holding time 125 seconds) has elapsed, the process proceeds from step S1 in FIG. 4 to steps S2 and S5 to step S6.
Here, “A” is stored as authentication information in the authentication information storage area 22b, and the authentication information included in the notified “Attach registration request” is “A”, which is the same. Therefore, the process proceeds from step S6 in FIG. 4 to step S7, and it is determined that the connection to the Radius server device 5 is denied. Therefore, no authentication request is made to the Radius server device 5 (step S212). Then, the gateway apparatus (P-GW) 12 transmits a “Create Session Response signal” as a response to the “Create Session Request signal”, and thereby transmits an “Attach Reject signal” to the mobile terminal (UE) 1. (Step S213). For this reason, the mobile terminal (UE) 1 retransmits the “Attach registration request”.

  This operation is repeated until a certain time elapses. Therefore, during this period, even if the same “Attach registration request” that is determined to be authentication NG is automatically and repeatedly transmitted from the mobile terminal (UE) 1, the Radius server device 5 determines that it is authentication NG. The “Radius Access-Request signal” including the same authentication information as when the request is made is not transmitted.

  Here, when the Radius server device 5 has the account lock function, the account is locked when it is determined that the authentication is NG continuously for a predetermined number of times or more. As described above, since the mobile terminal (UE) 1 automatically retransmits the “Attach signal”, the “Radius Access-Request signal” including the same authentication information as that determined as the authentication NG is sent. When received, the Radius server device 5 performs an account lock. That is, even if the authentication information is set by mistake, account lock is performed, and connection to the EPC network 10 becomes impossible.

  However, in the present embodiment, as described above, since the “Radius Access-Request signal” having the same authentication information as that determined as authentication NG is suppressed from being sent to the Radius server device 5, the account lock As a result, it is possible to prevent the mobile terminal (EU) 1 from being unable to connect to the EPC network 10 due to account lock.

On the other hand, as shown in FIG. 5 (c), after the initial connection (FIG. 5 (a)) such as when the power is turned on, an “Attach registration request” is transmitted again from the mobile terminal (UE) 1, and for a certain time from the time of the initial connection. When an “Attach registration request” whose authentication information is “A” is transmitted after the (authentication information holding time) has elapsed (step S221), at this time, the authentication information storage area 22b already has the authentication information. It is remembered. However, the authentication information update time of this authentication information is “05:00:00”, the connection time is “05:05:00”, and this authentication information is held for a certain time (authentication information holding time) or more. Therefore, the process proceeds to step S3 through steps S1, S2, and S5 of FIG. 4, and the notified authentication information “A” is updated and stored in the authentication information storage area 22b, and the connection time “05: "05:00" is updated and stored in the authentication information storage area 22b as the authentication information update time (step S222). Further, an authentication request is made to the Radius server device 5 (step S223; FIG. 4 (step S4)).
Therefore, at this time, the radius server apparatus 5 performs the authentication process for the authentication information “A”.

  Further, as shown in FIG. 5D, when an “Attach registration request” of authentication information “B” different from that at the time of the initial connection (FIG. 5A) is received (step S231), the authentication information storage area Since authentication information “A” is stored in 22b, the process proceeds from step S2 in FIG. 4 to step S5. If authentication information “A” is held in the authentication information storage area 22b for a predetermined time or more, step S5 is performed. From step S5 to step S3 through step S6, and an authentication request is made to the Radius server device 5 (steps S232 and S233). FIG. 4 step S7).

  Therefore, when the user of the mobile terminal (UE) 1 resets the authentication information and transmits the “Attach registration request” again, regardless of whether or not the authentication information “A” is held for a certain period of time, In response to the “Attach registration request” from the mobile terminal (UE) 1, the authentication process by the Radius server device 5 is not rejected. That is, when the user of the mobile terminal (UE) 1 resets the authentication information and transmits the “Attach registration request” again, the authentication process can be quickly performed by the Radius server device 5, and the EPC network 10 can be processed. It is possible to achieve a prompt line connection.

  Furthermore, in the first embodiment, even when the authentication information stored in the authentication information storage area 22b is the same as the authentication information included in the received “Create Session Request signal”, the authentication information is retained. Every time elapses, a “Radius Access-Request signal” is transmitted to the Radius server device 5 to perform authentication processing.

  Therefore, in the situation where retransmission is performed by the mobile terminal (UE) 1, when an attach operation is performed again such as when the power is turned on, the attach operation is performed again when the authentication information holding time has elapsed. The authentication process in the Radius server device 5 can be promptly performed on the authentication information included in the later “Radius Access-Request signal”.

  Further, every time the authentication information holding time elapses, a “Radius Access-Request signal” is transmitted to the Radius server device 5. Therefore, by adjusting the length of the authentication information holding time, the timing at which the Radius server device 5 performs the authentication process on the authentication information included in the “Radius Access-Request signal” after the reattach operation is adjusted. be able to.

  Further, every time the authentication information holding time elapses, the “Radius Access-Request signal” is transmitted to the Radius server device 5 and the authentication process is performed. Therefore, the time until the account lock is performed is determined by the authentication information holding time. Is done. Therefore, by setting the authentication information retention time in consideration of the time from when the attach operation is performed until the account lock is performed, “the line connection cannot be made despite the attach operation. This is because the setting of the authentication information is incorrect ”, the user can be made aware before the account lock is activated.

  As described above, the authentication information holding time can be arbitrarily set. At this time, for example, when the authentication information holding time is set to “0”, the authentication information stored in the authentication information storage area 22b and the authentication information included in the “Attach registration request” are the same. Regardless of the case, the process proceeds to step S4 through steps S1, S2, S5, and S3 of FIG. An authentication process is performed in the Radius server device 5 for (UE) 1. In other words, this is the same processing as the normal communication processing that does not suppress the transmission of the authentication request to the Radius server device 5. Therefore, by changing the authentication information holding time, it is possible to easily switch between suppressing the transmission of the authentication request to the Radius server device 5 and performing the normal communication process.

When the authentication information holding time is set to “0”, it is not necessary to hold the previous authentication information, so that the process of step S2 in FIG. 4 is not performed and the process proceeds from step S2 to step S4. It may be configured.
Further, in the mobile terminal (UE) 1, when the authentication OK is notified in response to the “Attach registration request”, the “Attach registration request” is not retransmitted, and the “Attach Reject” is notified. Only “Attach registration request” is retransmitted. Therefore, when the gateway apparatus (P-GW) 12 continuously receives the “Attach registration request” repeatedly, the “Attach registration request” is transmitted by the mobile terminal (UE) 1 being retransmitted. It can be regarded as the transmitted “Attach registration request”. That is, the authentication information included in the “Attach registration request” can be regarded as the authentication information determined to be authentication NG.

  Therefore, the “Attach registration request” having the same authentication information that is repeatedly received within the authentication information holding time is due to retransmission at the mobile terminal (UE) 1 and is authentication information determined to be authentication NG. Therefore, even if the authentication process is performed by the Radius server device 5 for this authentication information, the authentication request to the Radius server device 5 is suppressed when it is known that the authentication is judged as NG. It is possible to suppress unnecessary authentication processing in the device 5, that is, it is possible to reduce the load on the Radius server device 5.

(Summary)
As described above, in the first embodiment, when an “Attach registration request” having the same authentication information as the authentication information that has been authenticated NG is received, the gateway device (P-GW) 12 sends it to the Radius server device 5. The transmission of “Radius Access-Request signal” is suppressed for a certain period of time (authentication information holding time). For this reason, even when an “Attach registration request” having the same authentication information as the authentication information that has been authenticated as NG due to retransmission at the mobile terminal (UE) 1 is repeatedly transmitted, the “Attach registration request” Before the account lock is activated in the Radius server device 5 that performs authentication based on the included authentication information, the user can be directed to recognize that the setting of the authentication information is incorrect. However, it is possible to prevent the account lock from operating due to a setting error of the authorization information.

In addition, since the account lock in the Radius server device 5 can be suppressed by executing the authentication information management process in the gateway device (P-GW) 12, the specifications of the mobile terminal (UE) 1 and the Radius server device 5 And can be realized without changing any processing functions. Therefore, the account lock of the Radius server device 5 can be suppressed without changing the specifications and processing functions of the existing mobile terminal (UE) 1 and the Radius server device 5, which is effective.
In addition, each part which comprises the gateway apparatus (P-GW) 12 is implement | achieved when an arithmetic processing unit (CPU) runs the program memorize | stored in the said gateway apparatus (P-GW) 12. FIG.

(Second Embodiment)
Next, a second embodiment of the present invention will be described.
Since the second embodiment is the same as the first embodiment except that the information stored in the storage unit 22 is different, the same parts are denoted by the same reference numerals, and detailed description thereof is omitted.
In the second embodiment, as shown in FIG. 6, the authentication information holding time storage area 22a of the storage unit 22 is associated with an APN (Access Point Name) for connecting to the PDN and an authentication information holding time. The authentication information holding time can be stored for each of the plurality of APNs. Further, in the authentication information storage area 22b, the APN that is the connection request destination of the mobile terminal (UE) 1 that has notified the “Attach registration request” (hereinafter also referred to as connection destination APN), the notified authentication information, The authentication information update time is stored in association with each other. In this authentication information storage area 22b, for one piece of authentication information, the APN that is the connection request destination of the mobile terminal (UE) 1 that has notified the authentication information and the authentication information update time can be stored.

  Then, the authentication information processing unit 21 of the gateway device (P-GW) 12 receives an “Attach registration request” from the mobile terminal (UE) 1 and sends a “Create Session Request signal” as shown in the flowchart of FIG. When received, it is determined whether or not authentication information is stored in the authentication information storage area 22b in the same procedure as in the first embodiment (steps S1 and S2). If the authentication information is not stored, step The process proceeds to S3a, and the authentication information set in the mobile terminal (UE) 1 that is the transmission source of the “Attach registration request” included in the “Create Session Request signal” received in step S1, the mobile terminal (UE that is the transmission source) ) APN that is the connection request destination of 1 and the authentication information update time that is the current time are associated with each other. Stored in the area 22b. Then, the authentication information processing unit 21 instructs the processing unit 20 to perform normal communication processing (step S4). Therefore, the processing unit 20 makes an authentication request to the Radius server device 5. The “Create Session Request signal” in the second embodiment includes the authentication information of the mobile terminal (UE) 1 that has made the “Attach registration request”, and the connection request of the mobile terminal (UE) 1. The previous APN is included.

  On the other hand, if the authentication information is already stored in the authentication information storage area 22b, the authentication information processing unit 21 proceeds from step S2 in FIG. 7 to step S5a and is included in the “Create Session Request signal” received in step S1. The APN that is the connection request destination of the mobile terminal (UE) 1 that is the transmission source of the “Attach registration request” is extracted, and the authentication information holding time corresponding to the extracted connection destination APN is read from the authentication information holding time storage area 22a.

  Next, the process proceeds to step S5b, where it is determined whether or not the authentication information holding time specified in step S5a is zero. If it is zero, the connection destination APN is excluded from the authentication information management process and the process proceeds to step S4. The communication process is performed. On the other hand, if the authentication information holding time is not zero in step S5b, the process proceeds to step S5, and the holding time of the authentication information stored in the authentication information storage area 22b has passed the authentication information holding time read in step S5a. Determine whether. Thereafter, processing is performed in the same manner as in the first embodiment.

(Specific operation during Attach processing)
Next, the operation during the Attach process in the second embodiment will be described with reference to FIG.
As shown in FIG. 8A, when an “Attach registration request” for starting a new connection is transmitted from the mobile terminal (UE) 1, such as when power is turned on in the mobile terminal (UE) 1. If, for example, authentication information “A” is notified from the mobile terminal (UE) 1 (step S301; FIG. 7, step S1), the authentication information is stored in the authentication information storage area 22b at the time of the first connection. If not, the gateway device (P-GW) 12 stores the authentication information “A” in the authentication information storage area 22 b in association with the APN 2 that is the connection request destination of the mobile terminal (UE) 1. The connection time “05:00:00”, which is the current time, is stored as the authentication information update time (step S302). Then, an authentication request is made to the Radius server device 5 (step S303; steps S2 to S4 in FIG. 7).

  As a result, when it is determined that the authentication is successful as a result of the authentication at the Radius server device 5, the “Radius Access-Accept signal” indicating the authentication OK is transmitted from the Radius server device 5, and a notification of the authentication OK is sent to the gateway device ( Notification is made to the mobile terminal (UE) 1 via the P-GW 12 or the like. Thereby, registration to the EPC network 10 and connection processing to the PDN are completed, and the mobile terminal (UE) 1 can communicate via the EPC network 10.

On the other hand, as a result of authentication in the Radius server device 5, when it is determined as authentication NG, an “Attach Reject signal” is notified to the mobile terminal (UE) 1 via the gateway device (P-GW) 12 or the like. For this reason, the mobile terminal (UE) 1 retransmits the “Attach registration request”.
Here, the authentication information holding time corresponding to the APN 2 that is the connection request destination of the mobile terminal (UE) 1 that is the transmission source of the “Attach registration request” stored in the authentication information storage area 22b is, for example, “125 seconds”. To do. As shown in FIG. 8B, if an “Attach registration request” is notified before the authentication information holding time “125 seconds” has elapsed (step S311), the authentication information storage area 22b has already been authenticated. Information “A” is stored, and the authentication information update time is stored as “05: 00: 00: 00”.

  Since the authentication information “A” holding time in the authentication information storage area 22b is shorter than the authentication information holding time, the process proceeds from step S1 in FIG. 7 to steps S6 through steps S2, S5a, S5b, and S5. In the authentication information storage area 22b, “A” is stored as the authentication information, and the authentication information included in the received “Attach registration request” is “A”, which is the same. Therefore, the process proceeds from step S6 to step S7. , It is determined that the connection to the Radius server device 5 is rejected. For this reason, an authentication request is not sent to the Radius server device 5, and authentication NG is transmitted to the mobile terminal (UE) 1 (steps S312 and S313).

  On the other hand, as shown in FIG. 8 (c), after the initial connection (FIG. 8 (a)) due to power-on or the like, after the authentication information holding time has elapsed, an “Attach registration request” is again sent from the mobile terminal (UE) 1 When the authentication information is “A” (step S321), the authentication information is already stored in the authentication information storage area 22b at this point, but the connection time (that is, the current time) is “ 05:05:00 ”, and the authentication information update time stored in the authentication information storage area 22b is“ 05:00:00 ”, and this authentication information is held for at least the authentication information holding time (125 seconds). Therefore, the process proceeds to step S3a through steps S1, S2, S5a, S5b, and S5 in FIG. 7, and the notified authentication information “A” and connection destination APN2 are updated and stored in the authentication information storage area 22b. The connection time "05:05:00" the current time is updated and stored as the authentication information update time in the authentication information storage area 22b (step S322). Also, an authentication request is made to the Radius server device 5 (step S323; step S4 in FIG. 7).

  Further, from this state, as shown in FIG. 8D, when an “Attach registration request” having a connection destination APN1 and authentication information X different from the initial connection (FIG. 8A) is received (step S331). ) Since the authentication information “A” of the connection destination APN2 is already stored in the authentication information storage area 22b, the process proceeds from step S2 in FIG. 7 to step S5a. Here, it is assumed that “0” is set as the authentication information holding time of the connection destination APN1 in the authentication information storage area 22b. In this case, the connection destination APN1 determines that it is not subject to the authentication information management process (step S332; FIG. 7, step S5b). Then, the authentication information update area is not stored in the authentication information storage area 22b, and a “Radius Access-Request signal” for requesting authentication of the authentication information X is notified to the Radius server device 5 (step S333). The response signal is transmitted to the mobile terminal (UE) 1 (step S4 in FIG. 7).

Further, as shown in FIG. 8E, when the authentication information holding time in the authentication information storage area 22b has passed more than the authentication information holding time, not only the case where the authentication information holding time has not passed, When an “Attach registration request” having different authentication information “B” and a connection destination APN is received (step S341), the authentication information is updated and set in the authentication information storage area 22b (step S342; steps S1, S2, FIG. 7). S3a), an authentication request for authentication information B is made to the Radius server device 5 (step S343; step S4 in FIG. 7).
Therefore, the Radius server device for the “Attach registration request” from the mobile terminal (UE) 1 after the user of the mobile terminal (UE) 1 performing the retransmission of the “Attach registration request” resets the authentication information. The authentication request to 5 is not suppressed.

(Summary)
According to the second embodiment, the authentication information holding time can be set for each APN. For this reason, even when the mobile terminal (UE) 1 is connected to a plurality of APNs, the authentication information holding time can be set according to the type and specification of the corresponding PDN for each APN. Can be improved.

(Modification 1)
In the second embodiment, the case where one piece of authentication information is stored in the authentication information storage area 22b has been described. However, the present invention is not limited to this. For example, as shown in FIG. 9, the authentication information storage area 22b is also configured to hold a plurality of authentication information for each APN, and to determine the holding time of the authentication information for each APN. Good.

  In this case, as shown in FIG. 10, the process proceeds from step S1 to step S2a, and the authentication information corresponding to the connection destination APN included in the “Create Session Request signal” received in step S1 is stored in the authentication information storage area. It is determined whether it is stored in 22b. If it is stored, the process proceeds to step S5a, and after specifying the authentication information holding time corresponding to the connection destination APN included in the “Create Session Request signal” from the authentication information holding time storage area 22a, the process proceeds to step S5b. When the authentication information holding time specified in step S5a is zero, it is determined that the connection destination APN included in the “Create Session Request signal” is not subject to the authentication information management process, and the process proceeds to step S4.

  On the other hand, if the authentication information holding time specified in step S5b is not zero, the process proceeds to step S5c, and the authentication information update time of the authentication information corresponding to the connection destination APN included in the “Create Session Request signal” is stored in the authentication information storage area. The authentication information holding time corresponding to the connection destination APN of the mobile terminal (UE) 1 is determined in step S5a based on the specified authentication information update time specified in 22b and the authentication information holding time specified in step S5a. It is determined whether or not the specified authentication information retention time has elapsed. If the authentication information holding time has elapsed, the process proceeds to step S3a. If not, the process proceeds to step S6. Thereafter, the same processing as in the first embodiment is performed.

  In this case, as shown in FIG. 11 (a), when the mobile terminal (UE) 1 is turned on, a “Attach registration request” for starting a new connection is transmitted. If no authentication information is stored in the authentication information storage area 22b, the authentication information is notified as “A” from the mobile terminal (UE) 1 (step S401; step S1 in FIG. 10). In the device (P-GW) 12, the authentication information “A” is stored in the authentication information storage area 22b in association with the connection destination APN2, and the connection time “05:00:00” that is the current time is stored in the authentication information. The update time is stored (step S402). Then, an authentication request is made to the Radius server device 5 (step S403; steps S2a, S3a, S4 in FIG. 10).

As a result, when it is determined that the authentication is successful as a result of the authentication at the Radius server device 5, the Radius server device 5 notifies the “Radius Access-Accept signal” representing the authentication OK, and the authentication OK notification is sent to the gateway device ( Notification is made to the mobile terminal (UE) 1 via the P-GW 12 or the like. This
Registration to the EPC network 10 and connection processing to the PDN are completed, and the mobile terminal (UE) 1 can communicate via the EPC network 10.

  On the other hand, when the authentication result is determined to be NG in the Radius server device 5, a “Radius Access-Reject signal” is transmitted to the gateway device (P-GW) 12, and “1” is sent to the mobile terminal (EU) 1. An Attach Reject signal "is transmitted. For this reason, the mobile terminal (UE) 1 retransmits the “Attach registration request”. Thereafter, processing is performed in the same procedure as in the second embodiment.

  In a situation where the authentication information management process is performed only for the “Attach registration request” from the mobile terminal (UE) 1 having the connection destination APN2 and the authentication information “A”, a different connection destination APN, for example, the connection destination APN1 When the “Attach registration request” having the authentication information “X” is received (step S411 in FIG. 11B), the authentication information is stored in the authentication information storage area 22b, but the authentication information of the connection destination APN1 is Since it is not stored, the process proceeds to step S3a through steps S1 and S2a of FIG. 10, and the authentication information of the connection destination APN1 is stored in the authentication information storage area 22b (step S412). Thereby, the authentication information storage area 22b stores the authentication information of the connection destinations APN1 and APN2.

Then, an authentication request is made to the Radius server device 5 for the “Attach transmission request” having the authentication information “X” from the connection destination APN 1 (step S 413; step S 4 in FIG. 10).
Thereafter, when the “Attach registration request” is received from the connection destination APN1 or the connection destination APN2, the mobile terminal (UE) that is the transmission source of the received “Attach registration request” among the authentication information stored in the authentication information storage area 22b. ) The same processing as described above is performed using the authentication information and the authentication information holding time corresponding to the APN that is the connection request destination of 1.
Accordingly, by setting the authentication information holding time for each APN and storing the authentication information for each APN, the authentication information holding time can be managed for each APN, that is, for each PDN corresponding to the APN.

(Modification 2)
In the second embodiment, only the authentication information storage area 22 b of the storage unit 22 may be provided in the policy control device (PCRF) 13.
That is, when the authentication information holding time is set for each APN as in the second embodiment, the authentication holding time is managed for each APN, and the authentication information is managed for each mobile terminal (UE) 1.

  Here, information for each user is generally managed by a policy control device (PCRF) 13. In addition, information for each APN is generally managed by the gateway device (P-GW) 12. Therefore, by providing an authentication information storage area 22b for storing authentication information, which is information for each user, in the policy control device (PCRF) 13 that mainly manages information for each user, the information for each user is stored in the policy control device (PCRF). ) 13 can be managed collectively, and authentication information can be managed efficiently.

  In this case, for example, when the “Create Session Request signal” transmitted from the mobility management node (MME) 14 illustrated in FIG. 1 is received, the “Proxy Binding Update” transmitted from the gateway device (S-GW) 11 is received. When the gateway device (P-GW) 12 receives the “signal”, the processing is performed in accordance with the authentication information management process. Then, in response to the “Proxy Binding Update signal”, the “CCR (Credit Control Request) signal” transmitted from the gateway device (P-GW) 12 to the policy control device (PCRF) 13 is stored in the authentication information storage area 22b. A command for instructing reading of the connected APN, authentication information, and authentication information update time is added and transmitted. Based on the command instructed to be read added to the “CCR signal”, the policy control device (PCRF) 13 reads the connection destination APN, the authentication information, and the authentication information update time from the authentication information storage area 22b provided in the own device. The connection destination APN, the authentication information, and the authentication information read in the “CCA (Credit Control Answer) signal” transmitted from the policy control device (PCRF) 13 to the gateway device (P-GW) 12 as a response to the “CCR signal”. Add update time. When the authentication information is not stored in the authentication information storage area 22b, the policy control device (PCRF) 13 sets the information for notifying that the authentication information is not stored in the authentication information storage area 22b to “CCA”. To the signal ".

The “CCR signal” is a bearer setting request for requesting to set a core network bearer or a change request for requesting a change in the configuration of the core network bearer.
Then, the gateway apparatus (P-GW) 12 performs processing in the same procedure as described above based on the connection destination APN added to the “CCA signal”, authentication information, and authentication information update time. When it is necessary to store the connection destination APN, authentication information, and authentication information update time in the authentication information storage area 22b, a signal transmitted from the gateway device (P-GW) 12 to the policy control device (PCRF) 13 The authentication information and the authentication information update time to be stored in the authentication information storage area 22b are added to the gateway by adding the connection destination APN, the authentication information and the authentication information update time, or by separately transmitting a signal for transmitting these information. The information is transmitted from the device (P-GW) 12 to the policy control device (PCRF) 13.

Thereby, the same operation effect as the above-mentioned 2nd embodiment can be obtained.
Although the case where the authentication information storage area 22b is provided in the policy control device (PCRF) 13 has been described in the second embodiment, it can be applied to the above (Modification 1). It is also possible to apply to the first embodiment.
In addition, each part which comprises the gateway apparatus (P-GW) 12 is implement | achieved when an arithmetic processing unit (CPU) runs the program memorize | stored in the said gateway apparatus (P-GW) 12. FIG.

(Third embodiment)
Next, a third embodiment of the present invention will be described.
In the third embodiment, the authentication information management processing is executed by the gateway device (P-GW) 12 in each of the above embodiments, but the authentication information management processing is performed by the policy control device (PCRF) 13. It is made to execute in.

That is, as shown in FIG. 12, the policy control device (PCRF) 13 stores an authentication information processing unit 31 having a functional configuration equivalent to the authentication information processing unit 21 and a storage having a functional configuration equivalent to the storage unit 22. Part 32 is provided. The storage unit 32 includes an authentication information holding time storage area 32a and an authentication information storage area 32b corresponding to the authentication information holding time storage area 22a and the authentication information storage area 22b, respectively.
In FIG. 12, the processing unit 30 performs a process for determining the policy control such as the above-described QoS and a charging control rule, and also performs a communication process for another apparatus. This communication processing includes communication processing with the gateway device (P-GW) 12.

  The authentication information processing unit 31 of the policy control device (PCRF) 13 performs the authentication information management process described in the first or second embodiment. In the first and second embodiments, the “Create Session” The third embodiment determines whether or not to make an authentication request to the Radius server device 5 for the authentication information included in the “Create Session Request signal” when the “Request signal” is received. Then, for example, the policy control device (PCRF) 13 receives the “CCR signal” that is transmitted when the gateway device (P-GW) 12 receives a “Create Session Request signal” or a “Proxy Binding Update signal”. Sometimes Policy Control Device (PCRF) 13 determines whether or not to make an authentication request to the Radius server device 5 for the authentication information included in the “CCR signal”.

Hereinafter, a case where the policy control apparatus (PCRF) 13 executes the authentication information management process in the first embodiment will be described.
The policy control device (PCRF) 13 performs authentication information management processing based on the “CCR signal” transmitted from the gateway device (P-GW) 12 to the policy control device (PCRF) 13. In the present embodiment, the “CCR signal” includes the authentication information (user name and password) of the mobile terminal (UE) 1 that is the transmission source of the “Attach transmission request” and the APN that is the connection request destination of the mobile terminal (UE) 1. Including. Here, the authentication information (user name and password) of the mobile terminal (UE) 1 that is the transmission source of the “Attach transmission request” and the connection destination APN of the mobile terminal (UE) 1 are included in the “CCR signal”. However, the present invention is not limited to this, but the authentication information (user name and password) of the transmission source mobile terminal (UE) 1 of the “Attach transmission request” and the connection destination APN of the mobile terminal (UE) 1 May be added to an arbitrary signal and transmitted.

  The policy control device (PCRF) 13 transmits a “CCA signal” to the gateway device (P-GW) 12 as a response to the “CCR signal”. Further, the policy control device (PCRF) 13 transmits connection instruction information for instructing connection inhibition or normal communication processing for inhibiting connection with the Radius server device 5 to the gateway device (P-GW) 12. The policy control device (PCRF) 13 adds this connection instruction information to the “CCA signal” and transmits it. Here, a case has been described in which connection instruction information is added to a “CCA signal” and transmitted, but the present invention is not limited to this, and can be added to an arbitrary signal.

  The policy control device (PCRF) 13 performs processing in the same manner as in the first and second embodiments, and connects when a “CCR signal” having the same authentication information as the authentication information determined to be authentication NG is notified. Judgment is made and “connection inhibition” is set as connection instruction information. On the other hand, when authentication information is not stored in the storage unit 32, when a predetermined authentication information holding time has elapsed since the authentication information was updated and stored in the authentication information storage area 22b, the authentication information is stored in the authentication information storage area 22b. When authentication information different from the authentication information being notified is notified, “normal communication processing” is set as the connection instruction information.

  The gateway device (P-GW) 12 receives the “CCA signal” from the policy control device (PCRF) 13 to acquire connection instruction information, and when normal communication processing is instructed by the connection instruction information, the Radius server device 5 When a “Radius Access-Accept signal” representing the authentication OK is received from the Radius server device 5 as a response to the “Radius Access Request signal”, the authentication OK notification is sent to the gateway device (S-GW). 11. Notify the mobile terminal (UE) 1 via the mobility management node (MME) 14 or the like.

On the other hand, when connection inhibition is instructed by the connection instruction information, the gateway device (P-GW) 12 does not transmit a “Radius Access Request signal” to the Radius server device 5. And the notification of authentication NG is notified to the mobile terminal (UE) 1 via the gateway apparatus (S-GW) 11, the mobility management node (MME) 14, or the like.
FIG. 13 shows the operation of the main part constituting the mobile communication system during the Attach process. In FIG. 13, the mobility management node (MME) 14 and the gateway device (S-GW) 11 are used as an MME / S-GW unit 11 a that is one block.

  The mobile terminal (UE) 1 transmits an “Attach registration request” at the time of power-on or the like, and transmits an “Attach registration request” for making a registration request to the EPC network 10 (step S501). The “Attach registration request” is transmitted to the MME / S-GW unit 11a via a radio base station (eNodeB) 15 (not shown). In response to the “Attach registration request”, the MME / S-GW unit 11a performs an Attach process and a connection process, and a “Create Session Request signal” is transmitted (Step S502). The gateway device (P-GW) 12 that receives the “Create Session Request signal” and receives the “Proxy Binding Update signal” transmitted from the gateway device (S-GW) 11 shown in FIG. 1 receives the “CCR signal”. The policy control apparatus (PCRF) 13 transmits the authentication information to the authentication information storage area 32b of the storage unit 32 in the same procedure as in the first embodiment. The authentication information update time is updated (step S504). Then, connection instruction information for instructing normal communication processing is added to the “CCA signal” as a response to the “CCR signal”, and this “CCA signal” is transmitted to the gateway device (P-GW) 12 (step S505). .

  The gateway device (P-GW) 12 that has received the “CCA signal” is instructed to perform normal communication processing by the connection instruction information included in the “CCA signal”, so that the “Radius Access- "Request signal" is transmitted (steps S506 and S507), the radius server device 5 performs authentication processing (step S508), and transmits the authentication result to the gateway device (P-GW) 12 (step S509).

  At this time, when the authentication result in the Radius server device 5 is authentication NG, the “Radius Access-Reject signal” is transmitted from the Radius server device 5 and the gateway device (P-GW) 12 sends an authentication NG notification to the MME / The data is transmitted to the S-GW unit 11a, and an “Attach Reject signal” is transmitted from the MME / S-GW unit 11a to the mobile terminal (UE) 1 (steps S510 and S511).

  Since the mobile terminal (UE) 1 receives the “Attach Reject signal”, the mobile terminal (UE) 1 retransmits the “Attach transmission request” (step S512), and is transmitted from the “Create Session Request signal” from the MME / S-GW unit 11a. Accordingly, when the “Proxy Binding Update signal” is received by the gateway device (P-GW) 12 (step S513), the gateway device (P-GW) 12 performs policy control in the same manner as the processing of steps S503 to S505. The “CCR signal” is transmitted to the device (PCRF) 13 and the “CCA signal” is received from the policy control device (PCRF) 13. The policy control device (PCRF) 13 performs processing according to the authentication information management process. Do. In this case, since the “Attach registration request” has been retransmitted and the authentication information notified by this “Attach registration request” is the same as the authentication information stored in the authentication information storage area 32b, the policy control device ( PCRF) 13 sets connection instruction information for instructing connection suppression. Therefore, the gateway device (P-GW) 12 does not transmit the “Radius Access-request signal” to the Radius server device 5 and notifies the MME / S-GW unit 11a that the authentication is NG (Step S514). ), And transmits an “Attach Reject signal” from the MME / S-GW unit 11a to the mobile terminal (UE) 1 (step S515).

  After that, while receiving the “Attach Reject signal”, the mobile terminal (UE) 1 retransmits the “Attach registration request” at a predetermined timing, and the policy control device (PCRF) 13 receives the gateway device (P− GW) based on the authentication information included in the “CCR signal” received from 12, it is determined whether or not the RADIUS server device 5 authenticates the mobile terminal (UE) 1 that is the transmission source of the received “Attach registration request”. . The policy control device (PCRF) 13 receives the authentication information stored in the authentication information storage area 32b and the authentication information stored in the authentication information storage area 32b, and the authentication information stored in the authentication information storage area 32b is shorter than the authentication information storage time. When the authentication information included in the request is the same, it is determined that the connection to the Radius server device 5 is rejected, and the authentication request to the Radius server device 5 is not performed. That is, the “CCA signal” is transmitted to the gateway device (P-GW) 12 as connection instruction information for instructing connection inhibition. Since the gateway device (P-GW) 12 is connection instruction information for instructing connection suppression, an authentication request is not sent to the Radius server device 5 and the fact that it is an authentication NG is indicated via the mobile terminal (UE) via each unit. ) 1 is notified.

On the other hand, when the authentication information is not stored in the authentication information storage area 32b, when the elapsed time since the authentication information is updated and stored in the authentication information storage area 32b is equal to or longer than the predetermined authentication information holding time, the authentication information storage area If the authentication information stored in 32b is not the same as the authentication information included in the received “Attach registration request”, the authentication information included in the “Attach registration request” is stored in the authentication information storage area 32b. Update and store. Then, connection instruction information for instructing normal communication processing is added to the “CCA signal” and transmitted to the gateway device (P-GW) 12.
Accordingly, the gateway device (P-GW) 12 that has received the connection instruction information for instructing the normal communication process transmits an authentication request to the Radius server device 5 and notifies the mobile terminal (UE) 1 of the authentication result. To do.

(Summary)
According to the third embodiment, since the authentication information management process is executed by the policy control device (PCRF) 13, the policy control device (PCRF) 13 having a function of storing information for each user has a user. By managing the authentication information set for each user, the information set for each user can be collectively managed by the policy control device (PCRF) 13 and the usability can be improved.
Each unit configuring the policy control device (PCRF) 13 is realized by the arithmetic processing device (CPU) executing a program stored in the policy control device (PCRF) 13.

(Modification)
In the third embodiment, the authentication information processing unit 31 and the storage unit 32 having the same functional configuration as the authentication information processing unit 21 and the storage unit 22 in the first embodiment are replaced with a policy control device (PCRF). However, the present invention is not limited to this, and may be provided in another device constituting the EPC network 10.

  It should be noted that the scope of the present invention is not limited to the illustrated and described exemplary embodiments, but includes all embodiments that provide the same effects as those intended by the present invention. Furthermore, the scope of the invention is not limited to the combinations of features of the invention defined by the claims, but can be defined by any desired combination of particular features among all the disclosed features.

  Here, in the first and second embodiments, the processing unit 20 corresponds to the communication control unit, the “Create Session Request signal” corresponds to the connection related signal, and the “Radius Access-Request signal” corresponds to the connection request. Correspondingly, steps S2, S3, S5, and S6 in FIG. 4, steps S2, S3a, and steps S5a to S6 in step S7, steps S2a, S3a, and steps S5a to S6 in FIG. Each process corresponds to a holding control unit, and the process in step S7 in FIGS. 4, 7, and 10 corresponds to a determination unit.

The Radius server device 5 corresponds to an authentication server device.
In the third embodiment, the gateway device (P-GW) 12 corresponds to the communication control unit, the “CCR signal” corresponds to the connection-related signal, the “Radius Access-Request signal” corresponds to the connection request, The authentication information processing unit 31 corresponds to a holding control unit and a determination unit.
The Radius server device 5 corresponds to an authentication server device.

  INDUSTRIAL APPLICABILITY The present invention can be used when the mobile terminal is authenticated in the authentication server device when the mobile terminal is registered in the network.

1 Mobile terminal (UE)
4 PDN
5 Radius server device 10 EPC network 11 Gateway device (S-GW)
12 Gateway device (P-GW)
13 Policy control device (PCRF)
14 Node for mobility management (MME)
15 Radio base station (eNodeB)
16 SGSN
17 RNC / NodeB
18 HSS
21, 31 Authentication information processing unit 22, 32 Storage unit 22a, 32a Authentication information holding time storage region 22b, 32b Authentication information storage region

Claims (9)

When a connection-related signal transmitted with a connection request from the mobile terminal to the network is received, an authentication request instructing authentication for the mobile terminal and the authentication set in the mobile terminal received together with the connection-related signal A communication control unit that transmits information to the authentication server device;
An authentication information storage area for holding the authentication information;
A holding control unit that controls holding of the authentication information in the authentication information storage area;
When the connection related signal is received, the authentication information that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area and the mobile terminal that is received together with the connection related signal is set. A determination unit that suppresses transmission of the authentication request to the authentication server device by the communication control unit when the authentication information is the same,
The holding control unit
When authentication information is not held in the authentication information storage area when the connection related signal is received, the holding time of the authentication information held in the authentication information storage area is equal to or longer than a preset authentication information holding time. In some cases, the connection-related signal is only in one of the cases where the authentication information set in the mobile terminal received together with the connection-related signal is different from the authentication information held in the authentication information storage area. The authentication information set in the mobile terminal received together with the authentication information storage area starts to be held, and the authentication information update time is received together with the connection related signal as the authentication information update time. Corresponding to the authentication information set in the mobile terminal is held in the authentication information storage area,
The authentication information holding time is set for each APN (Access Point Name),
The determination unit
Based on the authentication information update time, it is determined that authentication information whose retention time in the authentication information storage area is less than the authentication information retention time is authentication information that has been determined to be unauthenticated, and the authentication information and the connection When the authentication information set in the mobile terminal received together with the related signal is the same, the communication control unit suppresses transmission of the authentication request to the authentication server device, and transmits a connection request to the network using said authentication information holding time, the authentication impossible with the determined to that communication control device and judging whether the authentication information corresponding to the APN which is the connection request destination of the mobile terminal which has. The holding control unit for each APN (Access Point Name), the authentication information and the authentication information communication control device according to claim 1, characterized in that to hold the update time. When a connection-related signal transmitted with a connection request from the mobile terminal to the network is received, an authentication request instructing authentication for the mobile terminal and the authentication set in the mobile terminal received together with the connection-related signal A communication control unit for transmitting information to an authentication server device having an account lock function for locking an account of a mobile terminal that has been unauthenticated for a predetermined number of times as a result of authentication ;
An authentication information storage area for holding the authentication information;
When authentication information is not held in the authentication information storage area when the connection related signal is received, the holding time of the authentication information held in the authentication information storage area is equal to or longer than a preset authentication information holding time. The connection-related only in one of the cases where the authentication information set in the mobile terminal received together with the connection-related signal is different from the authentication information held in the authentication information storage area. The authentication information set in the mobile terminal received together with the signal is started to be held in the authentication information storage area, and the time when the authentication information is started to be held in the authentication information storage area is received as the authentication information update time together with the connection related signal. A holding control unit for performing control to be held in the authentication information storage area in association with the authentication information set in the mobile terminal ,
When the connection related signal is received, the authentication information that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area and the mobile terminal that is received together with the connection related signal is set. And a determination unit that suppresses transmission of the authentication request to the authentication server device different from the mobile terminal by the communication control unit when the authentication information is the same. . Before SL judgment unit,
Based on the authentication information update time, it is determined that authentication information whose retention time in the authentication information storage area is less than the authentication information retention time is authentication information that has been determined to be unauthenticated, and the authentication information and the connection when set in the mobile terminal received together with associated signal credentials and are the same, according to claim 3, characterized in that to suppress the transmission of the authentication request to the authentication server by the communication control unit Communication control device. The authentication information holding time is set for each APN (Access Point Name),
The determination unit determines whether the authentication information is determined to be unauthenticated using the authentication information holding time corresponding to the APN that is the connection request destination of the mobile terminal that has transmitted the connection request to the network The communication control apparatus according to claim 4 . The communication control apparatus according to claim 5, wherein the holding control unit holds the authentication information and the authentication information update time for each APN (Access Point Name). The mobile terminal is authenticated using the communication control device provided in the network to which the mobile terminal is connected and the authentication information set in the mobile terminal, and it is determined that the authentication is impossible continuously for a predetermined number of times. A mobile communication system including an authentication server device having an account lock function for invalidating an account of the mobile terminal,
When a connection-related signal transmitted along with a network connection request from the mobile terminal is received, an authentication request for instructing authentication for the mobile terminal and the mobile terminal received together with the connection-related signal are set. A communication control unit for transmitting the authentication information to the authentication server device;
An authentication information storage area for holding the authentication information;
A holding control unit that controls holding of the authentication information in the authentication information storage area;
When the connection related signal is received, the authentication information that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area and the mobile terminal that is received together with the connection related signal is set. A determination unit that suppresses transmission of the authentication request to the authentication server device by the communication control unit when the authentication information is the same ,
The holding control unit
When authentication information is not held in the authentication information storage area when the connection related signal is received, the holding time of the authentication information held in the authentication information storage area is equal to or longer than a preset authentication information holding time. In some cases, the connection-related signal is only in one of the cases where the authentication information set in the mobile terminal received together with the connection-related signal is different from the authentication information held in the authentication information storage area. The authentication information set in the mobile terminal received together with the authentication information storage area starts to be held, and the authentication information update time is received together with the connection related signal as the authentication information update time. Corresponding to the authentication information set in the mobile terminal is held in the authentication information storage area,
The authentication information holding time is set for each APN (Access Point Name),
The determination unit
Based on the authentication information update time, it is determined that authentication information whose retention time in the authentication information storage area is less than the authentication information retention time is authentication information that has been determined to be unauthenticated, and the authentication information and the connection When the authentication information set in the mobile terminal received together with the related signal is the same, the communication control unit suppresses transmission of the authentication request to the authentication server device, and transmits a connection request to the network A mobile communication system, wherein the authentication information holding time corresponding to the APN that is the connection request destination of the mobile terminal is used to determine whether the authentication information is determined to be unauthenticated . The mobile terminal is authenticated using the communication control device provided in the network to which the mobile terminal is connected and the authentication information set in the mobile terminal, and it is determined that the authentication is impossible continuously for a predetermined number of times. A mobile communication system including an authentication server device having an account lock function for invalidating an account of the mobile terminal,
When a connection-related signal transmitted along with a network connection request from the mobile terminal is received, an authentication request for instructing authentication for the mobile terminal and the mobile terminal received together with the connection-related signal are set. A communication control unit that transmits authentication information to an authentication server device having an account lock function for locking an account of a mobile terminal that has been unauthenticated for a predetermined number of times as a result of authentication ;
An authentication information storage area for holding the authentication information;
When authentication information is not held in the authentication information storage area when the connection related signal is received, the holding time of the authentication information held in the authentication information storage area is equal to or longer than a preset authentication information holding time. In some cases, the connection-related signal is only in one of the cases where the authentication information set in the mobile terminal received together with the connection-related signal is different from the authentication information held in the authentication information storage area. The authentication information set in the mobile terminal received together with the authentication information storage area starts to be held, and the authentication information update time is received together with the connection related signal as the authentication information update time. A holding control unit for performing control to be held in the authentication information storage area in association with authentication information set in the mobile terminal ;
When the connection related signal is received, the authentication information that is determined to be unauthenticated in the authentication server device among the authentication information held in the authentication information storage area and the mobile terminal that is received together with the connection related signal is set. And a determination unit that suppresses transmission of the authentication request to the authentication server device different from the mobile terminal by the communication control unit when the authentication information is the same. . Before SL judgment unit,
Based on the authentication information update time, it is determined that authentication information whose retention time in the authentication information storage area is less than the authentication information retention time is authentication information that has been determined to be unauthenticated, and the authentication information and the connection when set in the mobile terminal received together with associated signal credentials and are the same, according to claim 8, wherein the inhibiting the transmission of the authentication request to the authentication server by the communication control unit Mobile communication system.

Images