KR100668660B1 - User authentication method for roaming service between portable internet and 3g network, and router of performing the same - Google Patents

Abstract

A method for processing user authentication for a roaming service between the mobile Internet and the 3G(Generation) network, and a router thereof are provided to enable a mobile Internet user terminal to use a wireless Internet service of a wider range than a case roamed to the 3G network and enable a user to use a high quality wireless Internet service if a 3G user terminal is roamed to the mobile Internet. The router(300) of the second network includes the first receiver(302) receiving a message for requesting the user authentication from a mobile terminal, a subscribed network determiner(304) checking the subscribed network of the mobile terminal by analyzing a network access ID included in the received message, and the first transmitter(306) requesting the user authentication to the first network in the case of the first network. The router(400) of the first network includes the second receiver(402) receiving the message for requesting the user authentication from the second network, a user checker(404), the second transmitter transferring a user authentication starting message to the second network in the case of the legal user(405), and an authentication function performer(408).

Description

USER AUTHENTICATION METHOD FOR ROAMING SERVICE BETWEEN PORTABLE INTERNET AND 3G NETWORK, AND ROUTER OF PERFORMING THE SAME}

1 is a diagram illustrating a network configuration for roaming between a portable Internet network and a 3G network according to an embodiment of the present invention.

2 is a flowchart illustrating a user authentication processing method when roaming from a portable Internet network to a 3G network according to an embodiment of the present invention.

3 is a diagram illustrating the structure of a user authentication request message in FIG. 2 according to an embodiment of the present invention.

4 is a flowchart illustrating a user authentication processing method when roaming from a 3G network to a portable Internet network according to an exemplary embodiment of the present invention.

5 is a diagram illustrating a schematic configuration of a PAR and SGSN performing the user authentication process of FIG. 2 or 4.

The present invention relates to a user authentication processing method for roaming between a portable internet network and a 3G network. When the mobile internet network and a 3G network coexist, the present invention relates to a user authentication process for supporting a wireless internet service when the mobile terminal roams to another network. It is about how to perform.

The portable Internet service supports a 3G (3G) network service having a low data rate and a high communication rate and a high data rate, but has a narrow coverage. It is designed to provide high speed data at low price to users with mobility by overcoming the disadvantage of In other words, the portable Internet service is a system that provides a high-speed wireless Internet service seamlessly indoors and outdoors for a variety of wireless data services including 50Mbps-based video and high-speed packet data using the 2.3GHz band in a medium to low speed mobile environment of less than 60km.

It will take a long time for the mobile Internet network to cover the national network like the current 3G network. Therefore, in the early stage of portable Internet service, there is an area where the portable Internet network and the 3G network overlap, but the area where only the 3G network exists. Therefore, in the early stage of portable Internet service, when the portable Internet service subscriber terminal roams into the 3G network service area, it should be possible to provide wireless Internet service to the user. In addition, when the 3G network service subscriber terminal roams into the mobile Internet network area, it should be possible to provide a better wireless Internet service to the user by providing the portable Internet service.

In this case, when the mobile terminal roams to another network, an authentication procedure must first be performed in order to use the radio resources and network resources of the other network.In the current standard 3GPP Release 6, interworking between a 3G network and a wireless LAN (WLAN) network is performed. The certification procedure is defined for. In particular, it describes only the case that the 3G network service subscriber station roams into a wireless LAN (WLAN) network.

As a prior art, Korean Patent Application No. 2001-79777 (filed Dec. 15, 2001) discloses a method for providing a connection and roaming service for a public local area network service using a wireless local area network (Wires LAN). In public local area network (LAN) service that provides high-speed wireless Internet access service in major areas centered on service competition area, public local area network service by implementing authentication / billing for users, roaming service and application sharing among operators It provides a method to enable the implementation.

In the above-described invention of Korean Patent Application No. 2001-79777, there is a separate roaming service server or an application sharing server that acts as a relay between carrier networks for roaming between different WLAN carrier networks or directly authenticates a corresponding provider network. User authentication is handled by sending a user authentication message to the server.

On the other hand, Korean Patent Application No. 2002-3646 (2002.1.22 application) provides a wireless LAN to a mobile communication terminal having a wireless LAN card using the frequency of the ISM band area, performs terminal authentication, Internet data It provides a wireless LAN system consisting of a plurality of ISP servers for managing a plurality of wireless access devices and wired wireless access devices for transmitting and receiving and providing Internet services.

As described above, the invention of Korean Patent Application No. 2002-3646, when a mobile communication terminal roams between wireless LAN service areas managed by different ISPs and AP devices, does not need to perform a separate complicated service registration process. The wireless LAN service can be used in a wider area by maintaining and providing the wireless LAN service only through the authentication procedure.

On the other hand, Korean Patent Application No. 1996-6884 (1996.3.14 application) has a site authentication for mutual authentication of the manganese having different authentication procedures, such as Code Division Multiple Access (CDMA) network and Group Special Mobile (GSM) network A center and a mutual authentication method between different networks using the same are provided.

In the above-described invention of Korean Patent Application No. 1996-6884, the authentication process is performed by providing a visitor authentication center that temporarily stores and relays user information to authenticate a user roaming between a CDMA network and a GSM network.

In addition, there are many studies on the interworking between 3G network and Wireless LAN (WLAN) network in various papers at home and abroad.

However, as described above, the research on the interworking between the portable Internet network and the 3G network is insufficient compared to the research on interworking between the 3G network and the wireless LAN (WLAN) network.

Therefore, in the early stage of mobile Internet service, the mobile internet network roams from 3G network to 3G network in the early stage of mobile internet service, or from 3G network to 3G network for higher wireless internet service. In case of roaming, there is an urgent need for the necessary authentication procedure to use the wireless Internet service.

The present invention has been made in view of the above problems and provides a user authentication processing method when the mobile terminal roams to another network when the portable Internet network and the 3G network coexist.

According to one aspect of the present invention, a router of a second communication network performing a handover control function and a mobile mobility management function for a mobile terminal roaming from a first communication network to a second communication network according to an aspect of the present invention. CLAIMS 1. A method for processing authentication, comprising: a) receiving a message requesting user authentication from a mobile terminal; b) requesting and receiving a user identity from the mobile terminal that has requested the user authentication; c) confirming a user's subscription network by analyzing a network access identifier of the received user identity; And d) if the checked subscription network is a first communication network, routing a message requesting user authentication of the mobile terminal including the user identity to the first communication network.

At this time, after step d) e) receiving a message to start user authentication from the first communication network; f) sending a message for initiating the user authentication to the mobile terminal; And g) performing user authentication on the mobile terminal.

In addition, after step g), h) a session key generated in the first communication network, wherein the session key is used as a seed of a security key in a wireless section between the mobile terminal and the second communication network, and authentication of the mobile terminal is successful. Receiving an authentication success message notifying of the failure; And i) transmitting the received authentication success message to the mobile terminal.

In step a), the protocol distinguisher is replaced by the GMM protocol, and the message type in charge of EAP packet transmission is replaced by EAP-PAYLOAD-TRANSFER, and the information element is transmitted. And a user authentication request message having a message structure replaced with an EAP payload for the user.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification. In addition, when a part is said to "include" a certain component, which means that it may further include other components, except to exclude other components unless otherwise stated. In addition, the term module described herein refers to a unit for processing a specific function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

A user authentication processing method for roaming between a portable Internet network and a third generation communication network according to an embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

In the present specification, roaming means starting again from an initial wireless access when the mobile terminal moves to another network. In addition, the mobile terminal is provided with a dual system supporting both portable Internet service and 3G network service.

In addition, a roaming consortium must be established between the portable Internet network and the 3G network operator. Here, the 3G network refers to a 3rd generation communication network. Specifically, the 3G network refers to a mobile communication network technology that can theoretically transmit up to 2 Mbps between a mobile phone and a base station, and in particular, 3GPP (where 3GPP is a 3G network). It is a kind of cooperation for developing IMT-2000, a phone, which is based on the core network of GSM, and the wireless section refers to the 3G network of the standard).

1 is a diagram illustrating a network configuration for roaming between a portable Internet network and a 3G network according to an embodiment of the present invention.

First, the portable Internet network uses the EAP-TLS authentication protocol for user authentication, and the 3G network uses the EAP-AKA authentication protocol.

Here, the portable Internet network includes an AT 101, an AP 102, a PAR 103, an AAA server 104, and an HA 105, and the 3G network includes a UTRAN 203, an SGSN 204, and a GGSN ( 205, AAA server 206 and HLR / AuC 207.

The AT 101 wirelessly connects to the IP-based AP 102 to transmit and receive high speed packet data. The AP 102 transmits the information received from the mobile terminal to the PAR 103 or, conversely, converts various information received from the PAR 103 into a radio signal and transmits the information to the AT 101. The PAR 103 is connected to an IP-based core network and performs a handover control function and a mobile IP (hereinafter referred to as MIP) function. The AAA server 104 uses Diameter and EAP-TLS protocols for user authentication. The HA 105 performs a MIP function and the like.

The UTRAN 203 combines the functions of the Node B 201 and the RNC 202. Here, the Node B 201 is a base station and performs control regarding a wireless connection between the mobile terminal and the base station. The RNC 202 performs a function of controlling radio resources with one or more Node Bs 201. The SGSN 204 performs a packet data service function through functions such as mobility management and service connection control of the mobile terminal. And it uses Diameter protocol for authentication when interworking with other networks. The GGSN 205 connects with the SGSN 204 and performs a function for providing a packet data service in association with an external packet network. The AAA server 206 uses the EAP-AKA protocol for user authentication and has an interface with the HLR / AuC 207 to obtain authentication information of the mobile terminal. The HLR / AuC 207 manages the authentication information and the service profile and, upon receiving the authentication information request from the AAA server 206, provides the authentication information of the mobile terminal.

2 is a flowchart illustrating a user authentication processing method when roaming from a portable Internet network to a 3G network according to an embodiment of the present invention.

When the portable Internet network subscriber station, that is, the Hpi AT 200, accesses the 3G network, the 3G wireless access procedure is performed between the Hpi AT 200 and the UTRAN 203 as an initial wireless access procedure (S301).

If the wireless connection procedure between the Hpi AT 200 and the UTRAN 203 is successfully performed, the Hpi AT 200 may be referred to as a GMM (Global Multimedia Mobility). The EAP-Start message is included in the newly defined EAP-PAYLOAD-TRANSFER message using the protocol and sent to the SGSN 204 (S302).

The SGSN 204 transmits a GMM / EAP-PAYLOAD-TRANSFER / EAP-Request / Identity message to the Hpi AT 200 through the UTRAN 203 in order to request an identity of the user (S303).

Hpi AT 200 includes the user's identity in the form of Network Access Identity (NAI) in GMM / EAP-PAYLOAD-TRANSFER / EAP-Response / Identity and sends it to SGSN 204 via UTRAN 203. (S304).

The SGSN 204 analyzes a realm of a user identity in the form of a network access identifier to determine whether the subscriber is a 3G network subscriber or a portable Internet network subscriber (S305).

As a result of the determination, when the subscriber is a mobile internet network, the SGSN 204 includes the EAP-Response / Identity in the EAP-Payload AVP of the Diameter-EAP-Request message to the mobile Internet AAA server 104 through the Diameter protocol. It transmits (S306).

The portable Internet AAA server 104 includes the EAP-Request / TLS-Start in the EAP-Payload AVP of the Diameter-EAP-Answer message after verifying the user's identity in the credential database and initiating SGSN ( 204). (S307).

SGSN 204 transmits a GMM / EAP-PAYLOAD-TRANSFER / EAP-Request / TLS-Star t message to Hpi AT 200 (S308).

When the Hpi AT 200 receives the GMM / EAP-PAYLOAD-TRANSFER / EAP-Request / TLS-Start message, the Hpi AT 200 performs the EAP-TLS operation between the Hpi AT 200 and the mobile Internet AAA server 104 to execute a certificate, an encryption algorithm, or the like. It transmits and receives the included information to each other and performs an authentication function for the user (S309).

When the authentication procedure is successfully performed, the same session key is generated between the Hpi AT 200 and the portable Internet AAA server 104 (310). Here, the session key is used as a seed of a security key to be used for data integrity and security in a wireless section between the Hpi AT 200 and the UTRAN 203.

The portable Internet AAA server 104 informs the SGSN 204 by including the EAP-Success and session key in the Diameter-EAP-Answer message to inform the Hpi AT 200 of the authentication success and to send the session key to the UTRAN 203. It transmits (S311).

The SGSN 204 transmits a RANAP / Session-key message for sending a session key to the UTRAN 203 (S312). The Hpi AT 200 transmits a GMM / EAP-PAYLOAD-TRANSFER / EAP-Success message for notifying authentication success (S313).

3 is a diagram illustrating the structure of a user authentication request message in FIG. 2 according to an embodiment of the present invention.

The user authentication request message shown in the figure shows a message structure for transmitting an EAP payload for user authentication between the terminal and the SGSN 204 when the portable Internet subscriber station roams into a 3G network. The GM protocol is used for mobility management and packet data service support of the mobile terminal between the portable Internet subscriber station and the SGSN 204.

The protocol identifier in the message structure represents the GM protocol and the transaction identifier represents the identifier for request / response of the message. The message type is for EAP packet transmission and is newly defined as an "EAP-PAYLOAD-TRANSFER" message. At this time, the message type value is defined as "00011101". The information element includes an EAP payload to be transmitted.

4 is a flowchart illustrating a user authentication processing method when roaming from a 3G network to a portable Internet network according to an exemplary embodiment of the present invention.

First, in order to access the portable Internet network, the 3G subscriber station, that is, the 3GMS 101, performs a wireless link connection process between the 3GMS 101 and the AP 102 according to the MAC standard of the portable Internet network (S401).

If the radio link connection is successfully performed, the 3GMS 101 transmits an EAP-Start MAC message to the AP 102 to start user authentication (S402).

The AP 102 performs the function of relaying the EAP message between the 3GMS 101 and the PAR 103 and uses the ADTcmd / EAP-Start message using the ADTcmd message defined in the mobile Internet network between the AP 102 and the PAR 103. Is transmitted to the PAR 103 (S403).

The PAR 103 sends an ADTcmd / EAP-Request / Identity message to the AP 102 to request the user's identity (S404).

The AP 102 sends an EAP-Request / Identity MAC message to the 3GMS 101 (S405).

The 3GMS 101 transmits a MAC: EAP-Response / Identity / User's NAI message to the AP 102 (S406).

The AP 102 sends an ADTcmd / EAP-Response / Identity message to the PAR 103 (S407).

The authentication processing function of the PAR 103 analyzes the realm of the identity to determine whether the subscriber is a portable Internet network subscriber or a 3G network subscriber (S408).

As a result of the determination, in the case of the 3G network subscriber, a Diameter-EAP-Request / EAP-Response / Identity message is generated and transmitted to the 3G AAA server 206 (S409).

The 3G AAA server 206 maps the user's identity in the form of NAI to a temporary (IMSI: International Mobile Station Identity) (S410), and then sends a Send Authentication Info / IMSI message for user authentication to HLR /. It transmits to AuC (S411).

The HLR / AuC transmits the RAND, AUTH, XRES, CK, and IK values to the Send Authentication Info AcK to the 3G AAA server 206 (S412).

The EAP-AKA authentication procedure is initiated by the 3G AAA server 206 sending an EAP-Request / AKA-Challenge message to the 3GMS 101 via the PAR 103 and the AP 102. The 3G AAA server 206 and the 3GMS 101 perform an authentication function for the user while sending and receiving authentication parameters through an EAP-Request / AKA-Challenge message and an EAP-Response / AKA- Challenge message (S413).

If the authentication procedure is successfully completed, the same session key is generated between the 3GMS 101 and the 3G AAA server 206 (414). Here, the session key is used as a seed of the security key to be used for data integrity and security in the radio section between the 3GMS 101 and the AP 102.

The 3G AAA server 206 transmits the EAP-Success and the session key in the Diameter-EAP-Answer message to the PAR 103 to inform the 3GMS 101 of the authentication success and to transmit the session key to the AP 102. (S415).

The PAR 103 transmits an ADTcmd / (EAP-Success, Session-Key) message to the AP 102 (S416).

The AP 102 transmits an EAP-Success MAC message to the 3GMS 101 (S417).

5 is a diagram illustrating a schematic configuration of a PAR and SGSN performing the user authentication process of FIG. 2 or 4.

As shown in the figure, receiving a message for requesting user authentication from a mobile terminal to confirm a subscription network, and if the confirmed subscription network is a first communication network for routing the message for requesting user authentication to the first communication network. A router 300 of a second communication network; And a router 400 of a first communication network connected to a router of the second communication network through the Internet, receiving a message for requesting user authentication from a router of the second communication network, and performing a user authentication function of the mobile terminal. Include.

Here, the router 300 of the second communication network may be an SGSN 204 and the router 400 of the first communication network may be a PAR 103. In this case, the subscriber station roams on the 3G network.

In addition, the router 300 of the second communication network may be a PAR 103 and the router 400 of the first communication network may be an SGSN 204. In this case, the 3G network subscriber terminal roams to the portable Internet network.

Now, the router 300 of the second communication network and the router 400 of the first communication network will be described in more detail as follows.

First, the router 300 of the second communication network includes a first receiver 302, a subscription network determiner 304, and a first transmitter 306.

The first receiver 302 receives a message for requesting user authentication from the mobile terminal.

The subscription network determination unit 304 analyzes the network access identifier included in the message for requesting user authentication and determines whether the subscription network of the mobile terminal is the first communication network or the second communication network.

The first transmitter 306 transmits a message for requesting user authentication to the first communication network when the subscription network is the first communication network as a result of the check by the subscription network determining unit 304.

Meanwhile, the router 400 of the first communication network includes a second receiver 402, a subscriber confirmation unit 404, a second transmitter 406, and an authentication function performer 408.

First, the second receiver 402 receives a message for requesting user authentication from the second communication network.

The subscriber identification unit 404 confirms whether the user who requested the user authentication is a valid subscriber to the first communication network through the network access identifier included in the message received by the receiver.

The second transmitter 406 transmits a message for starting user authentication to the second communication network when the subscriber verification unit 404 is a valid subscriber.

The authentication function performing unit 408 performs a user authentication function with the mobile terminal after delivering a message to start user authentication of the second transmitter 406. Further, after the user authentication function is successful, a session key is generated, where the session key is used as a seed of a security key in a wireless section between the mobile terminal and the second communication network, and is sent to the second communication network along with an authentication success message.

The embodiments of the present invention described above are not implemented only through the apparatus and the method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded. Implementation may be easily implemented by those skilled in the art from the description of the above-described embodiments. In addition, the embodiments of the present invention have been described in detail, but the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

According to the above-described configuration, when the portable Internet network and the 3G network coexist, the mobile terminal provides a user authentication method to receive the wireless Internet service when roaming to another network. Therefore, when the mobile internet subscriber terminal roams into the 3G network, a wider area of the wireless internet service can be used, and when the 3G network subscriber terminal roams into the portable internet network, the user can use a high quality wireless internet service. .

Claims (12)

In a method for a user authentication by a router of a second communication network performing a handover control function and a mobile mobility management function for a mobile terminal roaming from a first communication network to a second communication network, a) receiving a message requesting user authentication from a mobile terminal; b) requesting and receiving a user identity from the mobile terminal that has requested the user authentication; c) confirming a user's subscription network by analyzing a network access identifier of the received user identity; And d) if the checked subscription network is a first communication network, routing a message for requesting user authentication of the mobile terminal including the user identity to the first communication network; User authentication processing method comprising a. The method of claim 1, wherein after step d) e) receiving a message initiating user authentication from the first communication network; f) sending a message for initiating the user authentication to the mobile terminal; And g) performing user authentication on the mobile terminal User authentication processing method further comprising. The method of claim 2, wherein after step g), h) a session key generated in the first communication network, wherein the session key is used as a seed of a security key in a wireless section between the mobile terminal and the second communication network and receives an authentication success message indicating the authentication success of the mobile terminal. step; And i) transmitting the received authentication success message to the mobile terminal User authentication processing method further comprising. The method of claim 1, wherein step a) The protocol identifier is replaced by GMM (Global Multimedia Mobility) protocol, the message type responsible for EAP packet transmission is replaced by EAP-PAYLOAD-TRANSFER, and the information element is replaced by EAP payload for transmission. User authentication request message comprising a user authentication request message with a structured message structure. The method of claim 1, wherein step d) User authentication processing method characterized in that the routing using the diameter protocol. A method for a user authentication by a router of a first communication network performing a handover control function and a mobile mobility management function for a mobile terminal roaming from a first communication network to a second communication network, a) receiving a user authentication request message including a user identity of the mobile terminal from the second communication network; b) confirming whether or not the user is a legitimate subscriber using the user identity received in step a); c) transmitting a user authentication start message to the second communication network to start user authentication if the subscriber is a legitimate subscriber; d) performing a user authentication function of the mobile terminal and generating a session key, wherein the session key is used as a seed of a security key in a wireless section between the mobile terminal and a second communication network; And e) transmitting the session key and authentication success message to a second communication network; User authentication processing method comprising a. The method of claim 6, wherein b) A user authentication processing method characterized by mapping a user identity to an interim (IMSI: International Mobile Station Identity). 8. The user authentication processing method according to claim 1, wherein the first communication network is a portable Internet network and the second communication network is a 3G network of a 3GPP standard. The user authentication processing method according to claim 1, wherein the first communication network is a 3G network of 3GPP standard and the second communication network is a portable Internet network. A router for processing user authentication for a mobile terminal roaming from a first communication network to a second communication network, Router of the second network A first receiver configured to receive a message for requesting user authentication from the mobile terminal; A subscription network determination unit for analyzing a network access identifier included in the message for requesting user authentication and confirming a subscription network of the mobile terminal; And A first transmission unit for transmitting a message for requesting user authentication to the first communication network when the subscription network is the first communication network as a result of confirming the subscription network determining unit; Router comprising a. The router of claim 10, wherein the router of the first communication network is A second receiving unit receiving a message requesting user authentication from the second communication network; A subscriber confirmation unit confirming whether a party is a party through a network access identifier included in the message received by the receiver; A second transmitter for transmitting a user authentication start message to the second communication network when the subscriber verification unit is a legitimate subscriber; And Perform a user authentication with the mobile terminal, and generate a session key after the user authentication is successful, wherein the session key is used as a seed of a security key in a wireless section between the mobile terminal and the second communication network and together with the authentication success message. Authentication function performing unit for transmitting to the second communication network Router including. The method of claim 10, wherein the first receiving unit Router for receiving an EAP-PAYLOAD-TRANSFER message defined using the GMM (Global Multimedia Mobility) protocol for requesting user authentication.

Images