JP5931802B2 - Terminal authentication method and system in network - Google Patents

Description

  The present invention relates to an authentication technique for performing authentication processing of a terminal in cooperation with each other in a plurality of communication networks operated by a communication carrier.

  In network technology, authentication processing for confirming the validity of a user terminal is one of important technologies. There are various authentication techniques according to the network form. For example, the one described in Non-Patent Document 1 is one of the simplest authentication technologies, and a pair of ID and password managed by the terminal or terminal user and the authentication function is transmitted and received between the terminal and the authentication function. To confirm that the terminal is valid. Non-Patent Documents 2 to 4 are authentication technologies in the next generation network (NGN), and verify the validity of a terminal that connects to a certain line and transmits a registration request (SIP Register). In order to confirm, it is checked whether the terminal ID matches the line information.

  By the way, in recent years, communication networks operated by a communication business are connected to each other, and a case where connection authentication to the other communication network is performed using an authentication technique in one communication network is being studied. As a typical example, the one described in Non-Patent Document 5 is known. Non-Patent Document 5 stores authentication information in a mobile network in EAP (Extensible Authentication Protocol), which is an authentication method for a terminal connected to a wireless local area network (LAN) that forms part of a fixed network. SIM (Subscriber Identity Module) card is used. Thereby, the terminal can be connected to the fixed network using the authentication information of the mobile network, and the user does not need to operate the terminal when connecting to the wireless LAN.

Nikkei NETWORK, "Cryptography and Authentication", Nikkei Business Publications, pp.84-88 "Telecommunications and Internet converged Services and Protocols for Advanced Networking (TISPAN); NGN Security; Security Architecture", ETSI ES 187 003 v2.3.2, [online], [May 23, 2013 search], Internet <URL: http : //www.etsi.org/deliver/etsi#ts/187000#187099/187003/02.03.02#60/ts#187003v020302p.pdf> "3rd Generation Partnership Project; Technical Specification Group Core Network and Terminals; IP Multimedia (IM) Subsystem Cx and Dx interfaces; Signaling flows and message contents", 3GPP TS 29.228 v11.7.0, [online], [May 23, 2013 Day search], Internet <URL: http: //www.3gpp.org/ftp/Specs/html-info/29228.htm> Kentaro Takahashi, “The service has finally started NGN Anatomy 3rd line authentication: Sending caller ID when distributing addresses”, [online], April 2, 2008, Itpro, [May 14, 2013 search] , Internet <URL: http: //itpro.nikkeibp.co.jp/article/COLUMN/20080324/296895/> H. Haverinen, J. Salowey, "Extensible Authentication Protocol Method for Global System for Mobile Communications (GSM) Subscriber Identity Modules (EAP-SIM)", RFC4186, Internet Engineering Task Force, January 2006

  However, the device described in Non-Patent Document 5 has a problem that it cannot be applied to a terminal that does not include a SIM card, for example, a home appliance such as a Wi-Fi dedicated tablet, a TV, and a refrigerator. On the other hand, although the thing of a nonpatent literature 1 is applicable also in the network system | strain in which several communication networks cooperated, there existed a problem that usability was low, since it takes a user's effort to input ID and a password. In addition, what is described in Non-Patent Documents 2 to 4 is not premised on a network system in which a plurality of communication networks cooperate in the first place, so that it is difficult to operate in a network system as described in Non-Patent Document 5. There was a problem. For example, in Non-Patent Document 2, it is a fixed network operator that generally manages a set of user information (line unit) and line information, and a mobile network operator uses line information. There is a problem that cannot be done. Also, even if the line information is notified from the fixed network operator to the mobile network operator, the user information (terminal unit) managed by the mobile network operator and the line information notified from the fixed carrier are There is a problem that it cannot be connected.

  The present invention has been made in view of the above circumstances, and can perform authentication processing even in a terminal that does not have authentication information for a communication network in an authentication system in which a plurality of communication carriers' communication networks are linked. It is to provide an authentication method and system.

  In order to achieve the above object, a terminal authentication method according to the present invention includes a first communication network provided by a first communication carrier, and a second communication business provided to be communicably connected to the first communication network. Two communication networks, a subscriber premises device for connecting the user's home LAN to the second communication network, a user accommodation device arranged in the second communication network and accommodating the subscriber premises device, and arranged in the first communication network And a first authentication server for authenticating the validity of the user terminal in the first communication network using the authentication information for the first communication network, wherein the first user terminal is the authentication information for the first communication network. A first authentication request including the step of transmitting to the user accommodation device via the subscriber premises device; and the line identification information of the line in which the user accommodation device accommodates the subscriber premises device that is the transmission source of the first authentication request. Add to one authentication request for the first authentication server A sending step, a step in which the first authentication server performs authentication processing using the authentication information included in the first authentication request, sends a first authentication result to the first user terminal, and a first authentication server sends a first authentication request. The authentication information and the line identification information included in the information stored in a predetermined storage means, and the second user terminal sends a second authentication request not including the first communication authentication information to the user via the subscriber premises device. A step of transmitting to the accommodation device, and the user accommodation device assigns to the second authentication request the line identification information of the line in which the subscriber premises device from which the second authentication request is transmitted is sent to the first authentication server The authentication information associated with the line identification information is acquired from the storage means based on the line identification information included in the second authentication request, and an authentication process is performed using the authentication information. Characterized by comprising a step of have sent a second authentication result to the second user terminal.

  Further, the terminal authentication system according to the present application includes a first communication network provided by a first communication carrier, a second communication network provided by a second communication business that is connected to the first communication network, and a user home. A subscriber premises device for connecting the local area network to the second communication network, a user accommodation device arranged in the second communication network for accommodating the subscriber premises device, and arranged in the first communication network for the first communication network. In a network including a first authentication server that authenticates a connection of a user terminal to a first communication network using authentication information, the user accommodating device responds to the authentication request received from the user terminal by adding a subscriber premises to the authentication request. Line information adding means for adding the line identification information of the line in which the apparatus is accommodated to the first authentication request and sending the line identification information to the first authentication server. The first authentication server receives the authentication request received from the user accommodation apparatus. Authentication information for the first communication network In the case of a device related to the first user terminal, the authentication information is used to perform an authentication process, and an authentication result is sent to the first user terminal, and the authentication information included in the authentication request is associated with the line identification information. In the case where the authentication request received from the user accommodating device is related to the second user terminal that does not have the authentication information for the first communication network, the line identification information included in the authentication request is stored in the predetermined storage means. Based on this, authentication information for the first communication network associated with the line identification information is acquired from the storage means, authentication processing is performed using the authentication information, and an authentication result is sent to the second user terminal.

  As an example of a preferred aspect of the present invention, the first authentication server stores in advance a user profile associated with the authentication information of the first user terminal in a predetermined storage unit, and the first authentication server stores the second authentication. When acquiring the authentication information associated with the line identification information from the storage means based on the line identification information included in the request, the user profile associated with the authentication information is obtained, and the user profile is stored together with the second authentication result. It transmits to 2 user terminals, It is characterized by the above-mentioned.

  As another example of the preferred embodiment of the present invention, the first user terminal includes terminal identification information capable of identifying the first user terminal in the first authentication request, and the first authentication server transmits the first authentication request. The authentication information, the line identification information, and the terminal identification information included in the information are stored in a predetermined storage unit, and the second user terminal transmits the second authentication request from the first user terminal to the terminal of the first user terminal. The identification information is acquired, the terminal identification information is included in the second authentication request, and the first authentication server includes the line identification information and the terminal identification information based on the line identification information and the terminal identification information included in the second authentication request. The associated authentication information is acquired from the storage means.

  According to the present invention, when the first user terminal performs authentication processing at the first authentication server using the authentication information for the first communication network, the first user terminal can communicate with the first communication network via the same subscriber premises device. Even if the second user terminal does not have the authentication information, authentication processing can be performed by the first authentication server using the authentication information of the first user terminal.

Configuration diagram of an authentication system according to an embodiment of the present invention An example of a user profile according to the first embodiment Authentication sequence according to the first embodiment Authentication sequence according to the first embodiment An example of a user profile according to the second embodiment Authentication sequence according to the second embodiment Authentication sequence according to the second embodiment

(First embodiment)
An authentication method and system according to a first embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a system configuration diagram for explaining the outline of the present invention. In the present embodiment, a case where a mobile network is used as the first communication network and a fixed network is used as the second communication network is illustrated. Here, the mobile network means a network provided by a communication carrier in order to provide a communication service (for example, Internet connection or the like) to a mobile terminal by radio such as 3G / LTE. The fixed network means a network provided by a telecommunications carrier in order to connect to a user's home network and provide a communication service (for example, Internet connection or the like). In the fixed network, the connection form of the terminal in the user's home network may be either wired (for example, Ethernet (registered trademark)) or wireless (for example, Wi-Fi, Bluetooth, femtocell, etc.). Further, the physical medium (access line) that connects the user's home and the equipment of the fixed network operator may be either wired, wireless, or a combination thereof.

  As shown in FIG. 1, the mobile network 100 and the fixed network 200 include core networks 101 and 201, respectively. The core network 101 of the mobile network 100 and the core network 201 of the fixed network 200 are connected to each other by gateways 102 and 202 arranged at the edges of the core networks 101 and 201 so that they can communicate with each other. The core network 101 of the mobile network 100 and the core network 201 of the fixed network 200 are connected to an external network 900 such as the Internet via external gateways 103 and 203, respectively.

  The mobile network 100 manages various applications 191 and a service infrastructure 192 for providing services to terminals, a router 110 for transferring packets in the core network 101, and subscriber information 125 including a user profile. In addition, an AAA server 120 that performs user authentication, authorization, and accounting is provided. Examples of the AAA server 120 include an HLR (Home Location Register) and an HSS (Home Subscriber Server). The AAA server 120 authenticates a terminal (hereinafter referred to as “SIM terminal”) 10 equipped with a SIM (Subscriber Identity Module) card using authentication information in the SIM card (hereinafter referred to as “SIM information”). An example of a user profile included in the subscriber information 125 managed by the AAA server 120 is shown in FIG. The user profile is associated with the SIM information. In the example of FIG. 2, the user profile, the SIM information, and the user profile are associated with IMSI (International Mobile Subscriber Identity) as a key. Details of the authentication operation in the AAA server 120 will be described later.

  As shown in FIG. 1, the fixed network 200 includes a router 210 for transferring packets in the core network 201, a Wi-Fi access point 220 as a subscriber premises device installed in the user's home, and a subscriber home. Edge function unit 230 serving as a user accommodation device that accommodates a Wi-Fi access point 220 that is a subscriber premises device installed at the end of the network, and an AAA proxy 240 that relays a message related to authentication processing using the AAA server 120 And. The Wi-Fi access point 220 constitutes the LAN 300 at the user's home and functions as an access point for the Wi-Fi terminal. Details of the configuration and operation of the edge function unit 230 will be described later. In general, a predetermined authentication process is required for the Wi-Fi access point 220 to connect to the edge function unit 230 as a subscriber premises device, but here the contents of the authentication process and the authentication process are necessary. It should be noted that a description of a simple configuration is omitted, and it is assumed that the Wi-Fi access point 220 is already connected to the edge function unit 230.

  In the present invention, even a terminal that does not have a SIM card, that is, a terminal that does not have SIM information that is authentication information for the AAA server 120 (hereinafter referred to as a “non-SIM terminal”) 20 is an AAA server. The purpose is to perform the authentication processing by 120. For this reason, in the present invention, when authenticating the non-SIM terminal 20, the SIM terminal that has been subjected to authentication processing by the AAA server 120 via the same subscriber premises apparatus (Wi-Fi access point 220 in the present embodiment) Ten SIM information is used. The features of the present invention will be described in detail below.

  In response to an authentication request sent from the terminal in the LAN 300 to the AAA server 120 via the Wi-Fi access point 220, the edge function unit 230 according to the present invention sends the Wi-Fi access point 220 to the subscriber premises device. A line identification information addition function unit 235 that acquires line identification information that is uniquely identifiable information and adds the line identification information to the authentication request. As the line identification information, for example, VLAN-ID or line subscriber ID can be used. As a method for acquiring the line identification information, for example, based on an identifier for identifying the edge function unit 230 and a physical or logical port number of the edge function unit 230 to which the line to the Wi-Fi access point 220 is connected, A method of inquiring an authentication server (not shown) in the fixed network 200 can be used.

  In response to the authentication request received via the edge function unit 230 / AAA proxy 240, the AAA server 120 relates to the SIM terminal 10 and the SIM request is included in the authentication request. Then, an authentication process is performed using the SIM information. Then, the AAA server 120 returns an authentication result to the SIM terminal 10 that is the transmission source. Further, the AAA server 120 acquires the line identification information added by the edge function unit 230 from the authentication request, and stores the line identification information in a predetermined storage unit (not shown) in association with the SIM information.

  On the other hand, the AAA server 120, in response to the authentication request received via the edge function unit 230 / AAA proxy 240, relates to the non-SIM terminal 20, and the authentication request does not include SIM information. In this case, the line identification information added by the edge function unit 230 is acquired from the authentication request, and the SIM information associated with the line identification information is acquired from the storage unit. Then, the AAA server 120 performs an authentication process using the SIM information, returns an authentication result to the non-SIM terminal 20 that is a transmission source, and transmits a user profile associated with the SIM information to the non-SIM terminal 20. The authentication result and the user profile transmission timing may be simultaneous or independent.

  Next, the terminal authentication method according to the present embodiment will be described with reference to the sequence charts of FIGS. Here, an example in which the present invention is applied to an EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) as an authentication procedure of the SIM terminal 10 will be described. It should be noted that the present invention can be applied to other authentication procedures such as an ID / password authentication procedure and a challenge response authentication procedure. It should be noted that the authentication procedure used in the SIM terminal 10 and the authentication procedure / protocol used in the non-SIM terminal 20 are not necessarily the same. Furthermore, in FIG. 3, the authentication sequence by EAP-SIM is simplified for the sake of simplicity. Refer to Non-Patent Document 5 for details of EAP-SIM.

  Prior to the authentication process of the non-SIM terminal 20, the SIM terminal 10 is first authenticated. As shown in FIG. 3, the SIM terminal 10 connects to the Wi-Fi access point 220 and sends an authentication request message including SIM information to the edge function unit 230 via the Wi-Fi access point 220 (step S1). ). Next, the edge function unit 230 adds circuit identification information to the received authentication request message (step S2), and transfers the authentication request message to the AAA proxy 240 via the router 210 (step S3). The AAA proxy 240 transfers the received authentication request message to the AAA server 120 via the gateways 202 and 102 (step S4). At this time, the AAA proxy 240 may select a mobile network as a connection destination from among a plurality by referring to the SIM information included in the authentication request message.

  Next, the AAA server 120 authenticates the SIM terminal 10 by comparing the SIM information included in the received authentication request message with the subscriber information 125 managed by the AAA server 120 (step S5), and is included in the authentication request message. The SIM information and the line identification information are associated with each other and stored in a predetermined storage unit (step S6). The AAA server 120 notifies the authentication result to the Wi-Fi access point 220 via the gateways 102 and 202, the AAA proxy 240, the router 210, and the edge function unit 230 (step S7). The Wi-Fi access point 220 notifies the SIM terminal 10 of the authentication result (step S8) and pays out the IP address to the SIM terminal 10 (step S9).

  Next, as shown in FIG. 4, the non-SIM terminal 20 connects to the Wi-Fi access point 220 and sends an authentication request message addressed to the address of the AAA server 120 of the mobile network 100 recorded in the terminal itself. The data is sent to the edge function unit 230 via the Wi-Fi access point 220 (step S11). Next, the edge function unit 230 adds circuit identification information to the received authentication request message (step S12), and transfers the authentication request message to the AAA proxy 240 via the router 210 (step S13). The AAA proxy 240 transfers the received authentication request message to the AAA server 120 via the gateways 202 and 102 (step S14). At this time, the AAA proxy 240 is connected to the connection destination by an address resolution means such as a DNS server (not shown) (which may be included in the mobile network 100, the fixed network 200, or the external network 900, but is not limited thereto). A mobile network may be selected from a plurality.

  Next, the AAA server 120 extracts SIM information corresponding to the line identification information from a predetermined storage unit using the line identification information included in the received authentication request message as a key (step S15), and uses the SIM information to obtain a non-SIM terminal. 20 is authenticated (step S16). Then, the AAA server 120 extracts a user profile corresponding to the SIM information from the subscriber information 125 (step S17), and passes the authentication result and the user profile through the gateways 102 and 202, the AAA proxy 240, the router 210, and the edge function unit 230. Then, the Wi-Fi access point 220 is notified (step S18). The Wi-Fi access point 220 notifies the non-SIM terminal 20 of the authentication result and the user profile (step S19), and pays out the IP address to the non-SIM terminal 20 (step S20).

  As described above in detail, according to the terminal authentication system according to the present embodiment, the SIM terminal 10 performs the authentication process in the AAA server 120 by using the SIM information, and the SIM information is passed through the same Wi-Fi access point 220. For example, even if the non-SIM terminal 20 does not have SIM information, the AAA server 120 can perform authentication processing using the SIM information of the SIM terminal 10 and acquire a user profile associated with the SIM terminal 10. Can do.

(Second Embodiment)
An authentication method and system according to a second embodiment of the present invention will be described with reference to the drawings. The present embodiment is different from the first embodiment in that only the line identification information is used as information for the AAA server 120 to acquire the SIM information of the SIM terminal 10 in response to the authentication request from the non-SIM terminal 20. In addition, terminal identification information that can identify the SIM terminal 10 in which the SIM information is stored is also used. The system configuration of this embodiment is the same as that of the first embodiment. Here, the differences will be described in detail.

  In the present embodiment, the SIM terminal 10 includes not only SIM information but also terminal identification information that can identify the SIM terminal 10 in response to the authentication request to the AAA server 120. Various types of terminal identification information can be used. For example, when the SIM terminal 10 has a Bluetooth function, it can be considered to use a Bluetooth ID. As another example, a MAC (Media Access Control) address, a telephone number, a name, SIM information itself, a part of SIM information (for example, ICCID included in the SIM information, lower four digits of IMSI, etc.) are conceivable. Is not limited to these), and a method using an ID / password (including an ID for single sign-on such as OpenID) registered on software is conceivable.

  The SIM terminal 10 can peer with the non-SIM terminal 20 and transmit terminal identification information to the non-SIM terminal 20. The terminal identification information may be transmitted in a push format from the SIM terminal 10 or in a format in response to a request from the non-SIM terminal 20. Examples of peering include, but are not limited to, Bluetooth, RFID (Radio Frequency IDentification), wireless LAN, physical contact, and the like. Then, the non-SIM terminal 20 includes the terminal identification information acquired from the SIM terminal 10 in the authentication request to the AAA server 120.

  In response to the authentication request received via the edge function unit 230 / AAA proxy 240, the AAA server 120 relates to the SIM terminal 10 and the SIM request is included in the authentication request. Then, an authentication process is performed using the SIM information. Then, the AAA server 120 returns an authentication result to the SIM terminal 10 that is the transmission source. Further, the AAA server 120 acquires the terminal identification information and the line identification information added by the edge function unit 230 from the authentication request, associates the line identification information and the terminal identification information with the SIM information, and stores a predetermined storage unit (not shown). ).

  On the other hand, the AAA server 120, in response to the authentication request received via the edge function unit 230 / AAA proxy 240, relates to the non-SIM terminal 20, and the authentication request does not include SIM information. In this case, the terminal identification information and the line identification information added by the edge function unit 230 are acquired from the authentication request, and the SIM information associated with the line identification information and the terminal identification information is acquired from the storage unit. Then, the AAA server 120 performs an authentication process using the SIM information, returns an authentication result to the non-SIM terminal 20 that is a transmission source, and transmits a user profile associated with the SIM information to the non-SIM terminal 20. The authentication result and the user profile transmission timing may be simultaneous or independent.

  An example of a user profile stored in advance as subscriber information 125 in the AAA server 120 is shown in FIG. As shown in FIG. 5, the user profile is associated with the SIM information. In the example of FIG. 5, the user profile, the SIM information, and the user profile are associated with IMSI (International Mobile Subscriber Identity) as a key. The user profile includes terminal identification information of the SIM terminal 10.

  Next, the terminal authentication method according to the present embodiment will be described with reference to the sequence charts of FIGS. Here, an example in which the present invention is applied to an EAP-SIM (Extensible Authentication Protocol-Subscriber Identity Module) as an authentication procedure of the SIM terminal 10 will be described. It should be noted that the present invention can be applied to other authentication procedures such as an ID / password authentication procedure and a challenge response authentication procedure. It should be noted that the authentication procedure used in the SIM terminal 10 and the authentication procedure / protocol used in the non-SIM terminal 20 are not necessarily the same. In FIG. 6, the authentication sequence by EAP-SIM is simplified for the sake of simplicity. Refer to Non-Patent Document 5 for details of EAP-SIM.

  Prior to the authentication process of the non-SIM terminal 20, the SIM terminal 10 is first authenticated. As shown in FIG. 6, the SIM terminal 10 is connected to the Wi-Fi access point 220, and sends an authentication request message including SIM information to the edge function unit 230 via the Wi-Fi access point 220 (step S31). ). Here, the present embodiment is different from the first embodiment in that terminal identification information of the SIM terminal 10 is included in the authentication request message. Next, the edge function unit 230 adds circuit identification information to the received authentication request message (step S32), and transfers the authentication request message to the AAA proxy 240 via the router 210 (step S33). The AAA proxy 240 transfers the received authentication request message to the AAA server 120 via the gateways 202 and 102 (step S34). At this time, the AAA proxy 240 may select a connection destination mobile network from among a plurality of mobile networks with reference to the SIM information included in the authentication request message.

  Next, the AAA server 120 authenticates the SIM terminal 10 by comparing the SIM information included in the received authentication request message with the subscriber information 125 managed by the AAA server 120 (step S35), and is included in the authentication request message. The SIM information is associated with the line identification information and the terminal identification information and stored in a predetermined storage unit (step S36). Then, the AAA server 120 notifies the authentication result to the Wi-Fi access point 220 via the gateways 102 and 202, the AAA proxy 240, the router 210, and the edge function unit 230 (step S37). The Wi-Fi access point 220 notifies the authentication result to the SIM terminal 10 (step S38) and pays out the IP address to the SIM terminal 10 (step S39).

  Next, as illustrated in FIG. 7, the non-SIM terminal 20 peers with the SIM terminal 10 and acquires terminal identification information of the SIM terminal 10 (step S41). Then, the non-SIM terminal 20 connects to the Wi-Fi access point 220, and sends an authentication request message addressed to the address of the AAA server 120 of the mobile network 100 recorded in the terminal via the Wi-Fi access point 220. To the edge function unit 230 (step S42). Here, the present embodiment is different from the first embodiment in that terminal identification information of the SIM terminal 10 is included in the authentication request message. Next, the edge function unit 230 adds circuit identification information to the received authentication request message (step S43), and transfers the authentication request message to the AAA proxy 240 via the router 210 (step S44). The AAA proxy 240 transfers the received authentication request message to the AAA server 120 via the gateways 202 and 102 (step S45). At this time, the AAA proxy 240 is connected to the connection destination by an address resolution means such as a DNS server (not shown) (which may be included in the mobile network 100, the fixed network 200, or the external network 900, but is not limited thereto). The mobile network may be selected from a plurality.

  Next, the AAA server 120 extracts SIM information corresponding to the line identification information and the terminal identification information from a predetermined storage unit using the line identification information and the terminal identification information included in the received authentication request message as keys (step S46). The non-SIM terminal 20 is authenticated by the SIM information (step S47). Then, the AAA server 120 extracts the user profile corresponding to the SIM information from the subscriber information 125 (step S48), and passes the authentication result and the user profile through the gateways 102, 202, the AAA proxy 240, the router 210, and the edge function unit 230. Then, the Wi-Fi access point 220 is notified (step S49). The Wi-Fi access point 220 notifies the non-SIM terminal 20 of the authentication result and the user profile (step S50), and pays out the IP address to the non-SIM terminal 20 (step S51).

  As described above in detail, according to the terminal authentication system according to the present embodiment, the SIM terminal 10 performs the authentication process on the AAA server 120 by the SIM terminal 10 in the same manner as in the first embodiment. The non-SIM terminal 20 having no SIM information can be authenticated by the AAA server 120 using the SIM information of the SIM terminal 10 through the Wi-Fi access point 220 of the SIM terminal 10. The user profile associated with can be acquired.

  Here, this embodiment is different from the first embodiment in that not only the line identification information but also the identification of the SIM terminal 10 is obtained when acquiring the SIM information of the SIM terminal 10 in the authentication process of the non-SIM terminal 20. The information is also used. In the present invention, when a plurality of SIM terminals 10 perform authentication processing with the AAA server 120 using the same Wi-Fi access point 220, the AAA server 120 has a plurality of SIM information associated with the line identification information. It will be. For this reason, in the authentication process of the non-SIM terminal 20, it is necessary to select which SIM terminal 10 to acquire the SIM information by some logic. Therefore, in the present embodiment, the AAA information is stored in the AAA server 120 in association with the line identification information and the terminal identification information. The non-SIM terminal 20 acquires the terminal identification information from the SIM terminal 10 prior to the start of the authentication process, and includes the terminal identification information in the authentication request. As a result, one SIM terminal 10 can be identified from a plurality of SIM terminals 10 and an authentication process using the SIM information of the SIM terminal 10 can be performed, and a user profile associated with the SIM terminal 10 is acquired. be able to.

  As mentioned above, although embodiment of this invention was explained in full detail, this invention is not limited to this. For example, in each of the above embodiments, the Wi-Fi access point 220 issues an IP address after notifying the SIM terminal 10 or the non-SIM terminal 20 of the authentication result. However, the IP address is issued prior to the authentication process. It may be. In each of the above embodiments, the Wi-Fi access point 220 pays out the IP address to the SIM terminal 10 or the non-SIM terminal 20, but the payout may be performed by another device. For example, a device in the mobile network 100 may issue an IP address.

  In each of the above embodiments, when transmitting the authentication result to the non-SIM terminal 20, the user profile corresponding to the SIM information of the SIM 10 terminal used in the authentication process is transmitted together with the authentication result. Transmission of the user profile is not always necessary.

  In each of the above embodiments, the function as a subscriber premises apparatus and the function as an access point for constructing a wireless LAN in the user's house are integrated in the Wi-Fi access point 220. You may make it mount as another apparatus. In addition, a plurality of access points may be provided in the LAN 300 at the user's home regardless of whether or not they are integrated in the subscriber premises equipment. Furthermore, the mounting form of each device in the mobile network 100 and the fixed network 200 is not questioned, and it can be distributed in a plurality of devices or aggregated in one device. For example, various implementations for managing the subscriber information 125 in the mobile network 100 and implementations for storing and managing the line identification information (and terminal identification information) and the SIM information in association with each other are adopted. be able to.

  Further, in each of the above embodiments, the non-SIM terminal 20 that does not have SIM information performs an authentication process using the SIM information of the SIM terminal 10 by performing an authentication procedure according to the sequence of FIG. 4 or FIG. However, a SIM terminal having SIM information may perform the authentication procedure. That is, in this case, the SIM terminal performs an authentication process using SIM information related to another SIM terminal instead of its own SIM information.

  Further, in each of the above embodiments, since the case where the first communication network is the mobile network 100 has been illustrated, the example using the SIM information stored in the SIM card as the authentication information in the mobile network 100 has been described. If authentication is possible, other authentication information may be used. Moreover, although the case where the first communication network is a mobile network has been described in the above embodiment, the present invention can also be applied to other communication networks. For example, the first communication network may be a communication network of a service provider that provides various services to users on the network. For example, the Internet is configured by connecting a plurality of communication networks to each other, and a service (for example, a search service) is provided to a user in one of the configuration networks, and the service is provided. When user authentication is performed, the present invention can be applied with the communication network related to the service provision as the first communication network. That is, it should be noted that the first communication network does not necessarily require direct access means from the user terminal. On the other hand, it should be noted that since the second communication network requires line identification information, it needs to be a fixed network having a subscriber premises apparatus and an access line. Moreover, in the said embodiment, although illustrated about the case where there was one 1st communication network, the case where there are multiple 1st communication networks may be sufficient.

  DESCRIPTION OF SYMBOLS 100 ... Mobile network, 120 ... AAA server, 200 ... Fixed network, 220 ... Wi-Fi access point, 230 ... Edge function part, 235 ... Line identification information provision function part, 240 ... AAA proxy

Claims (5)

A first communication network provided by a first communication carrier, a second communication network provided by a second communication business that is communicably connected to the first communication network, and a user home LAN are connected to the second communication network. A subscriber premises device, a user accommodation device arranged in the second communication network for accommodating the subscriber premises device, and a validity of the user terminal arranged in the first communication network in the first communication network in the first communication network In a network including a first authentication server that authenticates using authentication information for
The first user terminal transmitting a first authentication request including authentication information for the first communication network to the user accommodation device via the subscriber premises device;
A step in which the user accommodation device adds the line identification information of the line in which the subscriber premises device of the transmission source of the first authentication request is accommodated to the first authentication request and sends it to the first authentication server;
A first authentication server performing authentication processing using authentication information included in the first authentication request and sending a first authentication result to the first user terminal;
A step in which the first authentication server associates the authentication information and the line identification information included in the first authentication request and stores them in a predetermined storage means;
The second user terminal transmitting a second authentication request not including the authentication information for the first communication to the user accommodation device via the subscriber premises device;
A step in which the user accommodation device attaches the line identification information of the line in which the subscriber premises device of the transmission source of the second authentication request is accommodated to the second authentication request and sends it to the first authentication server;
The first authentication server acquires authentication information associated with the line identification information from the storage unit based on the line identification information included in the second authentication request, performs an authentication process using the authentication information, and obtains a second authentication result. A terminal authentication method in a network, comprising: a step of sending to a second user terminal. The first authentication server stores in advance a user profile associated with the authentication information of the first user terminal in a predetermined storage unit,
The first authentication server acquires a user profile associated with the authentication information when acquiring the authentication information associated with the line identification information from the storage unit based on the line identification information included in the second authentication request; The terminal authentication method in the network according to claim 1, wherein the user profile is sent to the second user terminal together with the second authentication result. The first user terminal includes terminal identification information capable of identifying the first user terminal in the first authentication request,
The first authentication server associates the authentication information, the line identification information, and the terminal identification information included in the first authentication request and stores them in a predetermined storage unit,
The second user terminal acquires the terminal identification information of the first user terminal from the first user terminal prior to transmission of the second authentication request, includes the terminal identification information in the second authentication request,
The first authentication server acquires authentication information associated with the line identification information and the terminal identification information from the storage unit based on the line identification information and the terminal identification information included in the second authentication request. 3. A terminal authentication method in the network according to 1 or 2. The first communication network is a mobile network, and the second communication network is a fixed network.
The terminal authentication method in a network according to any one of claims 1 to 3, wherein A first communication network provided by a first communication carrier, a second communication network provided by a second communication business that is communicably connected to the first communication network, and a user home LAN are connected to the second communication network. A first user terminal using authentication information for the first communication network, the user accommodation device arranged in the second communication network, the user accommodation device arranged in the second communication network and accommodating the subscriber household device, and the first communication network. In a network including a first authentication server that authenticates connection to a communication network,
In response to the authentication request received from the user terminal, the user accommodating apparatus adds the line identification information of the line in which the subscriber premises apparatus is accommodated to the authentication request to the first authentication server and transmits the line to the first authentication server. With information adding means,
When the authentication request received from the user accommodation device is related to the first user terminal having the authentication information for the first communication network, the first authentication server performs an authentication process using the authentication information and obtains the first authentication result. The authentication information transmitted to the user terminal and associated with the authentication information included in the authentication request and the line identification information are stored in a predetermined storage means, and the authentication request received from the user accommodating device is the authentication information for the first communication network. In the case of a second user terminal having no authentication information, authentication information for the first communication network associated with the line identification information is acquired from the storage means based on the line identification information included in the authentication request, and the authentication is performed. A terminal authentication system in a network, wherein authentication processing is performed using information and an authentication result is sent to a second user terminal.

Images