KR100567324B1 - Diameter server system and service method for handoff of wireless LAN terminal - Google Patents

Abstract

Disclosed are a diameter protocol server system and a service method for handoff support of a WLAN terminal. The base protocol engine unit receives a predetermined request message through a diameter protocol and transmits a predetermined response message to the request message. After parsing the request message, the main module generates a response message including a group key for multicasting the access point or a pair key for roaming the WLAN terminal according to the content of the request message. . The key management daemon generates and manages a group key and a pair key according to a request of the main module unit. As a result, when the WLAN terminal roams between the access points, IP addresses and key related information necessary for secure handoff of the WLAN terminal may be provided to the access point.

Group key, pair key, request message, response message, access point

Description

Diameter server system and service method for handoff support of wireless LAN terminal {Diameter server system and service method for handoff of wireless LAN terminal}

1 illustrates an interaction between an access point and a Radius server for supporting handoff of a WLAN terminal.

2 is a diagram illustrating a structure in which a diameter protocol server system according to the present invention operates in conjunction with a conventional access point.

3 is a diagram showing the configuration of a diameter protocol server system according to the present invention;

4 is a diagram illustrating a process of processing a registration request message in a diameter protocol server system according to the present invention;

5 is a diagram illustrating a process of processing an IAPP request message in a diameter protocol server system according to the present invention;

FIG. 6 is a diagram illustrating contents of data actually transmitted and received through the message queue IPC described with reference to FIG. 5 according to the present invention; and

7 is a flowchart illustrating a flow of a diameter protocol service method according to the present invention.

The present invention relates to a diameter protocol service system and a service method thereof, and more particularly, to provide secure handoff of a wireless LAN terminal, wireless LAN terminal related information between access points (APs). The present invention relates to a diameter protocol server system and a service method for providing an access point (AP) with IP addresses or key-related information required for secure delivery.

When a WLAN terminal roams between Access Points (APs), in order to support secure handoff of the WLAN terminals, an existing access point (AP) connects to a new access point (AP). It is necessary to safely pass information related to the terminal (authentication information, charging information). At this time, the communication between the access point (AP) needs to know the IP address of the other access point (AP), and the key related information is required for secure communication. In addition, in order to provide an IP address or key information to an access point (AP) in an IAPP server, it is necessary to authenticate whether the access point is properly authorized.

IEEE 802.11f is a standard defined by the IEEE for such an IAPP protocol. IEEE 802.11f recommends that the IAPP server use the Remote Access Dial In User Service (RADIUS) protocol for communication with the access point (AP). Radius is a protocol that defines how a network access server (NAS) that provides network resources exchanges information such as authentication, authorization, configuration information, and connection history records with a central authentication server.

FIG. 1 is a diagram illustrating an interaction between a Radius client and a Radius server for supporting handoff of a WLAN terminal.

Referring to FIG. 1, the Radius client 110 performs the role of an IAPP client and the Radius server 120 performs the role of an IAPP server. Initially, the Radius client 110 sends an Access-Request packet to the Radius server 120 to register itself (S130), and the Radius server 120 authenticates the Radius client 110. Then, the registration procedure is completed by sending an access-accept packet containing a group key for secure multicasting of the AP to the Radius client 110 (S140). .

When roaming of the WLAN terminal 100 occurs, the Radius client 110 sends an IAPP request (Access-Request) packet to the Radius server 120 (S150), and the Radius server 120 has two access points. An Access-Accept packet containing a pair key for secure communication between the original AP and the newly accessed AP is transmitted to the Radius client 110. Radius client 110 receiving the response packet can protect the traffic required to perform the IAPP protocol with a group key or a pair key.

However, existing Radius servers have limitations on the number of attributes, message lengths, and difficulty in supporting global roaming between service providers.

 The technical problem to be achieved by the present invention is a diameter protocol server system and service for providing an access point with IP address information and key information necessary for secure handoff of the WLAN terminal when the WLAN terminal roams between access points. To provide a way.

Another technical problem to be solved by the present invention is to provide a protocol method for providing a protocol for providing IP address information and key related information necessary for secure handoff of a WLAN terminal when the WLAN terminal roams between access points. The present invention provides a computer-readable recording medium that records a program for execution on a computer.

In order to achieve the above technical problem, an embodiment of the diameter protocol server system according to the present invention receives a predetermined request message through a diameter protocol and transmits a predetermined response message to the request message. A base protocol engine unit; After parsing the request message, a main message generating a response message including a group key for multicasting an access point or a pair key for roaming a WLAN terminal according to the content of the request message. A module unit; And a key management daemon unit generating and managing the group key and the pair key according to a request of the main module unit.

In order to achieve the above technical problem, an embodiment of a diameter protocol service method according to the present invention comprises: receiving a predetermined request message through a diameter protocol; Generating and managing a group key for multicasting an access point or a pair key for roaming a WLAN terminal in response to the request message; Generating a response message including the group key or the pair key according to the request message; And transmitting the response message.

As a result, when the WLAN terminal roams between the access points, IP addresses and key related information necessary for secure handoff of the WLAN terminal may be provided to the access point.

Hereinafter, a diameter protocol server system and a service method according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a diagram illustrating a structure in which a diameter protocol server system according to the present invention operates in conjunction with a conventional access point.

Referring to FIG. 2, the diameter protocol server system 220 according to the present invention is connected to the Radius client 200 through a translation agent 210. That is, the conversion agent 210 between the Radius client 200 and the Diameter protocol server system 220 for smooth integration with the conventional system using the Radius client module developed for the conventional Radius client 200. ).

In the structure of the Radius client 200 -conversion agent 210 -diameter protocol server system 220, protocol conversion between the Radius protocol and the Diameter protocol is required. In this case, the conversion agent 210 must perform the role of the Radius server and the role of the client.

In order to perform the role of the Radius server, the conversion agent 210 has the same shared secret as the Radius client 200 (Shared Secret), this information is used to encrypt the password attribute value and the like. Hereinafter, a detailed operation process will be described.

An access-request message of the Radius client 200 is converted into an AA-Request message in the conversion agent and then transmitted to the diameter protocol server system 220 (S235). ). The diameter protocol server system 220 sends a diameter registration response (AA-Response) message to the conversion agent (S240). The conversion agent 210 converts the diameter registration response message into a Radius access-accept message and delivers it to the Radius client (S245).

The IAPP request (access-request) message (S250) is also converted into a diameter IAPP request (AA-Request) message by the conversion agent 210, and then transmitted to the diameter protocol server system (S255). Then, if the diameter protocol server system 220 responds with a diameter IAPP response (AA-Answer) message (S260), the conversion agent 210 sends a diameter IAPP response message to a Radius IAPP response (access-accept) message. After converting to, and forwarded to the Radius client 200 (S265).

3 is a diagram illustrating a configuration of a diameter protocol server system according to the present invention.

Referring to FIG. 3, the diameter protocol server system according to the present invention is separate from a main module unit 300, a timer 305, and a base protocol engine unit 310 and a main module unit 300 which are threads. The key management daemon unit 315, which is a process, and a server database 320 using a memory database.

The server database 320 stores access point information including an access point (BS) ID (BSSID), an access point (AP) ID secret (BSSID Secret), an IP address, and a group key. In addition, since the server database 320 uses a memory database, the server database 320 may improve the performance of the server by enabling faster storage and retrieval. In addition, since the key management daemon 315 and the main module 300 can access the server database 320, respectively, asynchronous data sharing is possible.

The queues 325, 330 and 335 used for the interface between the modules 300, 305 and 310 composed of threads play a very important role. Queues basically consist of a double linked list and have a data structure that can contain messages and events in the queue at the same time. Operation on the queue can be accessed only through the queue write function and the queue read function, and in the case of the queue write function, a mutex lock is used to protect the inside of the queue as a critical area.

When the diameter protocol server system according to the present invention receives a request message (such as a registration request message and an IAPP request message), the base protocol engine unit 310 parses and classifies the message and the application queue 325 when the application message is an application message. Send to the main module unit 300 through (S350).

The main module unit 300 generates a response message (such as a registration response message and an IAPP response message) and sends it to the base protocol engine unit 310 through the session queue 335 (S360). The group key stored in the server database 320 should be updated periodically whenever a group key timeout stored in the configuration file occurs. To this end, the main module unit 300 sets the group key timeout time of the setting file 340 to the timer 305 through the timer queue 330 at the start, and likewise, the timer 305 sets the timer event according to this time. To generate it and deliver it to the main module unit 300 through the application queue 325.

The main module unit 300 receives the timer 305 event and the key management daemon unit 315 updates the group key of the server database 320 through the Message Queue InterProcess Communication (IPC). Request to make (S365). Thus, the group key of the server database 320 is periodically updated (S370).

Since the main module unit 300 and the key management daemon unit 315 are different processes, IPC is required for data exchange, and the processes 300 and 315 may inform that there is new data and simultaneously access data. Use Message Queuing IPC to solve this problem. In addition, by using the message mode in blocking mode waiting for data to come from the receiving side of the data basically, to prevent the blocking indefinitely when there is no response, an interrupt occurs after a predetermined time (the alarm provided by Unix) , signal () function can be used to escape blocking.

4 is a diagram illustrating a process of processing a registration request message in a diameter protocol server system according to the present invention.

Referring to FIG. 4, the base protocol engine unit 410 inserts the received registration request message into the application queue 425 (S450). The main module unit 400 obtains and parses a registration request message of the application queue 425, and then authenticates the access point (AP) based on the access point (AP) ID of the registration request message, and the server database 420. The access point (AP) ID, IP address and access point (AP) ID secret value (BSSID Secret) is recorded in the server database (S460),

Then, the main module unit 400 receives the group key information from the server database through the database query (S465). The main module unit 400 sends a registration response message including group key information to the session queue 435 (S470), and the base protocol engine unit 410 registers a response message received through the session queue 435. Send the registration request message to the access point.

5 is a diagram illustrating a process of processing an IAPP request message in a diameter protocol server system according to the present invention.

The IAPP request message is a message requested by the access point for handoff when the WLAN terminal roams from the current access point to another access point.

Referring to FIG. 5, the base protocol engine unit 510 inserts the received IAPP request message into the application queue 525 (S550). The main module unit 500 obtains and parses the IAPP request message of the application queue 525 and extracts two access point IDs in the IAPP request message (S555). The main module unit 500 has two access point IDs and obtains IP addresses and access point ID secret values for each of the access point IDs through a database query from the server database 520. Imported (S560).

Then, the main module unit 500 passes the IP address and the access point ID secret value to the key management daemon unit 515 through the message queue IPC request (S565), and the key management daemon unit 515 provides two access points ( After encrypting the pair key information for the AP (AP) ID secret value to the access point (AP) ID value, and transmits to the main module unit 500 through the message queue IPC response (S570). When the main module unit 500 generates a response message including encrypted pair key information and passes it to the session queue 535 (S575), the base protocol engine unit 510 performs a task of making a complete diameter message.

FIG. 6 is a diagram illustrating contents of data actually transmitted and received through the message queue IPC described with reference to FIG. 5 according to the present invention.

An access point (AP) originally connected by a WLAN terminal is called an old access point (Old AP) for convenience, and a new access point (AP) newly connected after roaming is called a new AP.

The data to be passed from the main module unit 300 to the key management daemon unit 315 is an old access point ID 620, a new access point ID 625, a new or old access point ID secret value. 630 and 635, an IP address 640, and key setting information 645. Each value 620 through 645 of the data is defined and defined in the form of Type 605, Length 610, Value 615, as shown in FIG. ), The length 610 and the value 615 are sequentially concatenated in the form of one string 600 and transmitted through the message queue IPC.

When the key management daemon 315 receives the string, the key management daemon 315 separates and extracts the type 605, the length 610, and the values 615, respectively, in the reverse process of the data transmission process. And old access point (AP) key information 660. The key management daemon 315 fills the type 605, length 610, and value 615 fields with the new access point (AP) key information 655 and the old access point (AP) key information 660. One string 650 is made and then transferred to the main module unit 300.

The main module unit 300 obtains the scene access point key information 655 and the old access point key information 660 from the received string 650. The new access point key information 655 and the old access point (AP) key information 660 contain pair key information encrypted with respective access point ID secret values.

7 is a diagram illustrating a flow of a diameter protocol service method according to the present invention.

Referring to FIG. 7, the base protocol engine 310 of the diameter protocol server system according to the present invention receives a predetermined request message from an access point (S700). The request message includes a registration request message requesting registration of the access point and an IAPP request message for handoff when the WLAN terminal moves between the access points. If the access point acts as a conventional Radius client, the Diameter protocol server system converts the request message of the Radius protocol output from the access point into a Diameter protocol message. This conversion process may be performed in a device provided separately from the diameter protocol server system according to the present invention or implemented together.

The main module unit 300 requests a group key or a pair key from the key management daemon 315 or the server database 320 according to the received request message. If the received request message is a registration request message, the main module unit 300 searches for and receives a group key for multicasting of the access point in the server database 320. If the received request message is an IAPP request message, the key management daemon unit 315 generates a pair key for roaming the WLAN terminal based on the access point information included in the IAPP request message (S710).

The main module unit 300 generates a response message including a group key or a pair key generated according to the content of the request message (S720). The generated response message is transmitted to the access point which has transmitted the request message by the base protocol engine 310 (S730). At this time, if the access point serves as a conventional Radius client, the response message of the Diameter protocol is converted into a Radius client response message and transmitted. The conversion of the message may be performed in a device provided separately from the diameter protocol server system, or may be performed in the diameter protocol server system.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

According to the present invention, the Diameter protocol server system enables handoff of a WLAN terminal by providing IP address information and key related information necessary for information exchange between access points when the WLAN terminal roams between access points. do.

And, since the key management daemon is separated into a separate process from the main module can be used as a key management daemon according to the present invention by modifying the conventional key management daemon for IP security (IPSec). When modifying and using the conventional key management daemon, it is possible to simultaneously perform the key management function for IP security of the server system and the key management function for the diameter protocol server system according to the present invention.

In addition, the diameter protocol server system according to the present invention can support a variety of functions, such as performance and scalability of the diameter protocol and interworking support between WLAN service providers by using a conventional diameter NAS (Network Access Server) application, The service provider may provide a more efficient and stable system, and the user of the WLAN service may provide a more convenient and stable service. Through the construction of such an efficient and stable wireless LAN service can contribute to the activation of the wireless Internet service using the wireless LAN.

Claims (15)

A base protocol engine unit for receiving a predetermined request message through a diameter protocol and transmitting a predetermined response message to the request message; After parsing the request message, a main message generating a response message including a group key for multicasting an access point or a pair key for roaming a WLAN terminal according to the content of the request message. A module unit; And And a key management daemon unit configured to generate and manage the group key and the pair key according to a request of the main module unit. The method of claim 1, And the main module unit generates a registration response message including a group key corresponding to the access point if the request message received by the base protocol engine unit is a registration request message of the access point. system. The method of claim 2, And the main module unit reads a group key corresponding to the access point from a database managed by the key management daemon unit. The method of claim 1, The main module unit extracts two access point IDs by parsing the IAPP request message if the request message received by the base protocol engine unit is an IAPP request message indicating when roaming of a WLAN terminal occurs. And an IAPP response message including a pair key generated by the key management daemon based on two access point IDs. The method of claim 4, wherein The key management daemon reads an access point secret value stored in the database based on two access point IDs extracted by the main module unit, and generates a pair key encrypted with the secret value. Meter protocol server system. The method of claim 1, And the main module unit and the key management daemon unit transmit and receive data through interprocess communication (IPC). The method of claim 1, A timer for setting a timeout time of the main module unit and the group key, and the main module unit and the base protocol engine unit may be connected through a queue that may simultaneously include a message and an event. Protocol server system. The method of claim 1, A conversion agent for converting a message transmitted from an access point serving as a radius client into a diameter protocol message, converting a message transmitted to the access point into a Radius protocol message, and transmitting the converted protocol message; Diameter protocol server system. The method of claim 1, And a timer for requesting the main module unit to periodically update the group key recorded in the database by the key management daemon unit. Receiving a predetermined request message via a diameter protocol; Generating and managing a group key for multicasting an access point or a pair key for roaming a WLAN terminal in response to the request message; Generating a response message including the group key or the pair key according to the request message; And And transmitting the response message. The method of claim 10, The receiving step includes converting a message transmitted from an access point serving as a Radius client into a diameter protocol message, And wherein said transmitting step comprises converting a message transmitted to said access point into a Radius protocol message. The method of claim 10, The receiving of the request message may include receiving a registration request message for requesting registration of an access point or an IAPP request message indicating roaming of a WLAN terminal. The method of claim 12, The response message generating step, If the request message is the registration request message, reading a group key stored in a database and periodically updated based on information of an access point included in the request message; And And generating a registration response message including the group key. The method of claim 12, The response message generating step, Extracting IDs of two access points included in the IAPP request message if the request message is the IAPP request message; Reading an access point secret value stored in a database based on each extracted ID; Generating a pair key encrypted with the read access point secret value; And Generating an IAPP response message including the pair key; and a diameter protocol service method. Receiving a predetermined request message via a diameter protocol; Generating and managing a group key for multicasting an access point or a pair key for roaming a WLAN terminal in response to the request message; Generating a response message including the group key or the pair key according to the request message; And And transmitting the response message. A computer-readable recording medium having recorded thereon a program for executing a diameter protocol service method on a computer.

Images