JPH06261033A - Verification control system - Google Patents

Abstract

PURPOSE:To allow a network to simply decide the verification system without notifying the verification system of a terminal equipment by providing plural verification means to the network, selecting one of them and informing the selected system to the terminal equipment and allowing the terminal equipment to select one of the executionable verification systems when it is included in the notice and giving a reply to the network. CONSTITUTION:A terminal equipment T makes a call to a network N. Upon the receipt of a connection request from the terminal equipment T, the network N sends information about verification systems a-c possessed by the network N to the terminal equipment T. The terminal equipment T discriminates whether or not a system coincident with the verification system of its own is in existence among the verification systems noticed from the network N. When there is any coincident verification system, the terminal equipment T informs the verification system to the network N. Since the verification system noticed from the terminal equipment T is coincident with that informed from the network N, the network N verifies the terminal equipment T and the network N and the terminal equipment T are interconnected.

Description

Detailed Description of the Invention

[0001]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to an authentication control system, and more particularly to an authentication control system for a communication system which requires authentication for checking the validity of a terminal from the network side to protect security in communication.

[0002]

2. Description of the Related Art A conventional first authentication method will be described. As a method for performing the authentication necessary for the mobile communication system, see "Hanaoka, Onoue, Uebayashi," Authentication Method in Digital Mobile Communication Network ", IEICE, Autumn National Convention, pp. 2-
232, 1990 ”. This method uses a secret encryption key K1 shared between users who perform authentication, and sends a ciphertext C using an appropriate plaintext and a key K1 from a user who initiates authentication. Then, the authenticated user generates a ciphertext C ′ from the received plaintext by using the cipher key K1 and sends it back to the authentication invoking user. Here, if the ciphertexts C and C ′ are the same, the authentication is successful. become.

Next, a conventional method of performing the second authentication will be described. FIG. 6 is a block diagram showing an example of a second conventional authentication method. In the figure, the network N1 has an authentication method a,
The network N2 has the authentication method b. Further, the terminal T1 has the authentication method a and the terminal T2 has the authentication method b.

At this time, between the terminal T1 having the same authentication method and the network N1, when the terminal T1 requests the connection to the network N1, the network N1 outputs the authentication information determined by the authentication key.
And request the terminal T1 for authentication. The terminal T1 responds to the network N1 with a response including authentication response information corresponding to the authentication information from the network N1. After the network N1 confirms the validity of the authentication response information, the connection of the terminal T1 is confirmed.

On the other hand, in the same figure, when the authentication methods of the network N and the terminal T are different as shown by the dotted line, the authentication between the network N and the terminal T is not permitted. Therefore, the security is protected because the connection is not made with different authentication.

Here, the terminal T1 having the authentication method a
Then, it is assumed that there is a network N2 that adopts the authentication method b. In order to enable the connection between this terminal T1 and the network N2, the network N2
And terminal T1 must have a plurality of authentication methods. For example, in order for the network N2 to confirm the legitimacy of the terminal T1 by authentication, the terminal T is added to the authentication method specified by the network N2.
If the terminal T1 is equipped with the authentication method specified for the network N2, the authentication is established.

Therefore, in order to enable the same terminal to be used in a plurality of communication systems adopting different authentication methods, mutual authentication methods must be provided between systems capable of mutual connection. .

FIG. 7 shows a network memory in the second conventional authentication method. As shown in the figure, the network stores the authentication method 11 provided for each terminal in the memory 10. In the example of the figure, each terminal has an authentication method such that the authentication method of the terminal T1 is a, the authentication method of the terminal T2 is b, and the authentication method of the terminal T3 is a. For example, the network N notifies the terminal T of b from the in-memory information 11 (authentication method) stored in the memory 10, and if the terminal notifies the authentication method of b, the network N authenticates the terminal T. To do.

There is also a system in which a terminal desiring to connect to a network has a network authentication system. FIG. 8 shows an authentication method of a terminal in the second conventional authentication method. In the figure, the terminal is assumed to be equipped with the authentication method of the network to which it desires to connect.

In the example of the figure, the terminal internal memory 2 of this terminal
The in-memory information 21 (authentication method) included in 0 is the method a,
Method b, method c, etc. Here, when the method a is notified from the network N, it is authenticated, and the authentication method from the network N is d.
Is notified, since this terminal does not have the authentication method d, it is not authenticated.

[0011]

However, in the first conventional method, the encryption key is preset and the same encryption key is held on the authenticating side and the authenticated side. Even if the encryption key is changed on the side, the change may not be completed on the authenticated side and the key may be inconsistent. In this case, since the ciphertext does not match between the authentication side and the authenticated side, the authentication is not successful. It is also possible that a key is misused by a third party.

Further, in the above-mentioned second method, in order for the network to store the authentication method for each terminal to be authenticated, a storage area corresponding to the number of terminals is required, and in the method having a plurality of authentication methods in the terminal, It is difficult to add an authentication method when the number of systems that require the use of the network increases later.

The present invention has been made in view of the above points,
It is an object of the present invention to provide an authentication control method that solves the above-mentioned conventional problems and can easily determine an authentication method by negotiation between the network and the terminal without being aware of the authentication method that the network has in the terminal. To aim.

[0014]

FIG. 1 is a diagram for explaining the principle of the present invention.

In an authentication control system in a communication system including a network for authenticating the terminal when connecting with the terminal and a terminal having an authenticating means, the network has a plurality of authenticating means for authenticating the terminal, When at least one authenticating means is selected from the authenticating means (step 1), the terminal is notified (step 2), and when the terminal includes the executable authenticating means among the notifications from the network, the terminal selects one of the authenticating means. Select one (step 3) and respond to the network (step 4), the network judges whether the authentication means between the terminals are the same (step 5), and if they are equal, the network and the terminal can be connected. Authenticate (step 6).

[0016]

According to the present invention, the network is provided with a plurality of authentication methods, and the terminal has any one of the authentication methods of the network. Notice. The terminal is not limited to one authentication method from the network, and can make a connection request to the network if the authentication method of the terminal itself is included in the authentication methods notified from the network. On the other hand, even if the network is accessed by an authentication method that the terminal does not have, the network does not permit the connection, so that communication security can be maintained.

[0017]

Embodiments of the present invention will be described below with reference to the drawings.

FIG. 2 is a block diagram of the first embodiment of the present invention. In the figure, the network N includes a plurality of authentication methods a,
b, c, and the terminal T has authentication methods c, d. In this connection, the authentication of the connection between the network N and the terminal T will be described.

FIG. 3 is a timing chart of the processing of the first embodiment of the present invention.

Step 11) First, the terminal T first selects the network N.
(Or an incoming call from the network N).

Step 12) When the network N receives the connection request from the terminal T, it sends to the terminal T the authentication methods a, b and c possessed by the network N.

Step 13) The terminal T receives the authentication methods a, b and c from the network N.

Step 14) The terminal T determines whether or not any of the authentication methods from the network N matches the authentication method of its own terminal.

Step 15) In step 4, if there is a matching authentication method, the authentication method is transmitted to the network N. In the case of this example, since the authentication methods c match, the authentication method c is sent to the network N.

Step 16) As a result, since the authentication method c is the same in the network N, the terminal T is authenticated and the network N and the terminal T are connected.

If the terminal T has the authentication methods d and c, the authentication method notified from the network N does not include the authentication methods d and e, and thus the terminal T is not authenticated.

Next, as a second embodiment of the present invention, a case where the authentication method is determined in advance based on the authentication strength will be described. In this embodiment, a method using an authentication method corresponding to the authentication strength will be described.

FIG. 4 is a diagram for explaining the setting of the authentication method according to the second embodiment of the present invention. In the figure, an authentication setting unit 40 of the network N or the terminal T and an interface unit 50 for performing communication from the network N to the terminal T or from the terminal T to the network N are configured. The authentication setting unit 40 includes a buffer memory 41, a strength comparing unit 42, an authentication method table creating unit 43, and an authentication method table 44.

In setting the authentication method in this embodiment, first, the authentication strength based on the importance is input to the authentication setting unit 40 of the network N or the terminal T, and the input authentication strength is stored in the buffer memory 41. Next, the strength comparison unit 42 compares the authentication strength input in advance and sorts it in the buffer memory 41 in descending order of strength. The authentication method table creation unit 43 sets the highest strength as strength 1 and sets it as the authentication method a. Further, the second strength is designated as strength 2 and is designated as authentication method b. Similarly, the third strength is set as strength 3 and authentication method c is set. In this way, the authentication method corresponding to the strength is set in the authentication method table 44.

For example, when there is a connection request from the terminal N through the interface unit 50, the network N reads out the authentication method set in the authentication method table 44 in this way and notifies the terminal T of it. The authentication method is set in advance on both the network N side and the terminal T side.

FIG. 5 shows a network and terminal authentication system according to a second embodiment of the present invention. In the network N, the strength 1 is set as the authentication method a, the strength 2 is set as the authentication method b, and the strength 3 is set as the authentication method c. Further, the terminal T has two authentication methods in which the strength 1 is the authentication method a and the strength 3 is the authentication method c.

Authentication in FIG. 5 will be described. The sequence for performing authentication is the same as the sequence shown in FIG. In the following description, the network N will be described as a radio network controller in mobile communication, and the terminal T will be described as a mobile station.

First, a call connection request is made by calling from the mobile station to the radio network controller. Upon receiving the connection request, the wireless line control station notifies the mobile station of the authentication methods a, b, and c of its own.

The mobile station determines whether the authentication method of its own terminal is included in the authentication methods a, b, and c notified from the radio network controller. In the example of FIG. 5, since the authentication methods a and c are included, the authentication methods a and b are sent to the radio network controller. Upon receiving the notification from the mobile station, the radio network controller authenticates the mobile station having the same authentication method and establishes a call connection between the mobile stations.

When the mobile station has the authentication method b of strength 2 and the authentication method d of strength 4, the mobile station has the authentication method included in the authentication methods notified from the radio network controller. Since it is not available, authentication from the radio network controller is not performed. Therefore, no call connection is established between the radio network controllers.

Although the present invention holds a plurality of authentication methods in both the network and the terminal, it is sufficient if there are a plurality of authentication methods notified from the network side to the terminal, and the terminal side always has a plurality of authentication methods. There is no need to keep the scheme.

Note that the present invention is not limited to the above-described embodiment and can be variously modified as long as the terminal can be authenticated from the network without departing from the spirit of the present invention.

[0038]

As described above, according to the authentication control method of the present invention, the network notifies the terminal of the authentication method without being aware of the authentication method of the terminal, and the terminal does not use any of the authentication methods of the network. If it has, the network can authenticate the terminal. On the other hand, if the terminal does not have the authentication method notified from the network, the terminal is not authenticated, so that security in communication can be maintained.

Further, since the authentication methods can be set to each other in accordance with the relation between the network and the terminal such as the degree of importance, it is possible to connect in the descending order of the degree of relation importance.

[Brief description of drawings]

FIG. 1 is a diagram illustrating the principle of the present invention.

FIG. 2 is a block configuration diagram of a first embodiment of the present invention.

FIG. 3 is a sequence chart of processing according to the first embodiment of this invention.

FIG. 4 is a diagram illustrating setting of an authentication method according to a second embodiment of this invention.

FIG. 5 is a diagram showing a network and terminal authentication method according to a second embodiment of the present invention.

FIG. 6 is a block diagram showing an example of a second conventional authentication method.

FIG. 7 is a diagram showing a memory of a network in a second conventional authentication method.

FIG. 8 is a diagram showing an authentication method included in a terminal in the second conventional authentication method.

[Explanation of symbols]

 N, N1, N2 network T terminal 10 memory 11 information in memory (authentication method) 20 terminal memory 21 information in terminal memory (authentication method) 40 authentication setting unit 41 buffer memory 42 strength comparison unit 43 authentication method table creation unit 44 authentication method Table 50 interface section

Claims (1)

[Claims] 1. In an authentication control system in a communication system including a network for authenticating a terminal when connecting to the terminal and a terminal having an authenticating means, the network comprises a plurality of authenticating means for authenticating the terminal. And at least one authentication means is selected from the authentication means, and the terminal is notified, and when the terminal includes an executable authentication means in the notification from the network, One of them is selected and responds to the network, the network determines whether the authentication means between the terminals are the same, and if they are equal, authenticates that the network and the terminal can be connected. Authentication control method.