KR100986769B1 - Device for authenticating subscribers and method thereof - Google Patents

Abstract

The present invention relates to a subscriber authentication device and a method thereof.

According to the present invention, the subscriber authentication device includes a plurality of interworking modules, a subscriber profile DB, and an authentication processing unit. The plurality of interworking modules interwork with a wireless information management system and an intelligent network for managing subscriber information of a mobile communication network. The subscriber profile DB stores a first subscriber profile and a second subscriber profile, where the second subscriber profile is different from the first subscriber profile and the subscriber profile management and subscriber authentication scheme and is obtained from a wireless information management system. The authentication processor interoperates with a plurality of interworking modules and performs subscriber authentication to confirm whether to allow data packet services based on the first subscriber profile and the second subscriber profile stored in the subscriber profile DB.

As such, since the subscribers of heterogeneous networks that perform different subscriber profile management and subscriber authentication are integrated and managed, it is easy to accommodate additional subscriber information according to subscriber extension without adding existing subscriber authentication equipment.

IP Multimedia Subsystem (IMS), Subscriber Authentication, AAA, Subscription Profile Repository (SPR), Policy and Charging Rules Function (PCRF)

Description

Apparatus for authenticating subscribers and method thereof

The present invention relates to a subscriber authentication device and a method thereof. More particularly, the present invention relates to an apparatus and method for performing subscriber authentication in a network environment in which data communication networks performing different subscriber profile management and subscriber authentication are overlapped.

Recently, interest in IP data services using wireless access such as wireless LAN, WiBro (Wireless Broadband Internet) and WCDMA (WCDMA) has been increasing day by day. have.

Interest in such wireless access is expected to become the mainstream of communication services in the future in that it can provide a variety of communication services to the user.

In addition, recently, each wired and wireless communication service provider has been building an IP Multimedia Subsystem (hereinafter, referred to as 'IMS') network. IMS is in the spotlight as a representative next-generation communication service by integrating various existing communication services on IP networks and providing various multimedia services.

1 shows an IMS network structure of a conventional WPC DM representative of the next generation IP service.

As shown in FIG. 1, the Gateway GPRS Support Node (GGSN) 500 is a wireless access network, an IMS network, and an authentication server (Authentication, Authorization, Accounting, hereinafter referred to as 'AAA') of WPC. It is connected to a packet data network such as an IMS network or the Internet.

The wireless access network includes a Node-B 200 for transmitting and receiving wireless data to and from a mobile terminal (MS) 100 and a Radio Network Controller (RNC) 300 for controlling the Node-B 200. In addition, the GPS network includes a Serving GPRS Support Node (SGSN) 400 for controlling movement of the mobile terminal 100, a Gateway GPRS Support Node (GGSN) for routing data packets and allocating IPs to the mobile terminal 100 ( 500).

In addition, the IMS network of the PCC (Policy Charging Control) standard defined in Rel.7 of 3GPP is currently used in the policy and charging rules function (600), subscription profile repository (SPR) (700), A device called AF (Application Function) 800 is introduced to control the network with the quality of service (QoS) and the policy of the IP network. The SPR 700 stores the service policy and subscriber profile of the IMS subscriber and delivers it when the PCRF 600 requests it. The PCRF 600 generates a policy rule based on the subscriber profile provided from the SPR 700 to cause the GGSN 500 to execute various quality of service (QoS) and policy rules.

In addition, the AAA 900 is a device that is in charge of subscriber authentication for the mobile terminal 100 before the IP address is assigned to the mobile terminal 100. At this time, the AAA 900 is connected with the Wireless Information Service Element (WISE) 1000 and is provided with subscriber information at the same time to handle subscriber authentication during the call processing of the GGSN 500. In addition, the intelligent network service processing is performed by interworking with the DSCP (Data Service Control Point) 1100 which is an intelligent network charging processing device. In addition, the long message service process is performed in association with the Long Message Service Center (LMSC) 1200.

Based on this structure, a conventional subscriber authentication procedure will be described with reference to FIG. 2. 2 shows a subscriber authentication procedure performed in the structure of FIG.

As shown in FIG. 2, when the IMS service is executed (S101), the mobile terminal requests for initiation of an IP Prototol Connectivity Access Network (CAN) bearer to the GGSN (S103).

When the general data service (or wireless Internet service) is executed (S105), the mobile terminal requests activation of the PDP context to the Node B / RNC / SGSN (Activate Packet Data Protocol Context Request) (S107). The Node B / RNC / SGSN requests a PDP context creation to the GGSN (Create Packet Data Protocol Context Request) (S109).

When the call is received, the GGSN determines whether the received call is an IMS call or a general call (ie, a general data service call) (S111). If it is determined that the IMS call requests the PCRF to start the IP CAN session (S113). The PCRF requests a profile from the SPR (S115) and receives a response (S117). Then, the GGSN responds to the IP CAN session start request in step S113 (S119), and the GGSN responds to the IP CAN bearer start request to the mobile station (S121).

On the other hand, if it is determined in step S111 that the general call, GGSN transmits an access request (Access Request) message to the AAA (S123) and receives an access response (Access Response) (S125) performs a subscriber authentication procedure. At this time, if the subscriber authentication is successful, the GGSN responds to the request for creating a PDP context to the Node B / RNC / SGSN (Create Packet Data Protocol Context Response) (S127). The Node B / RNC / SGSN responds to the PDP context activation request (Activate Packet Data Protocol Context Response) to the mobile terminal (S129).

As such, in the related art, once a call is received, the GGSN distinguishes whether the call is an IMS call or a general wireless Internet call, and takes a different operation accordingly. In other words, in the case of an IMS call, the procedure is performed in conjunction with the IMS network, and in the case of a general wireless Internet call, the AAA and the subscriber authentication procedure are performed.

However, WPC subscribers continue to increase. In 2012, WCDMA is expected to reach 90% and CDMA to 10%. If W2CM subscribers are newly added, this subscriber information should be upgraded to AAA. Therefore, as the number of subscribers expands, investment costs are incurred because the use of the existing AAA requires expansion of the AAA itself or upgrade of internal functions. However, considering that AAA is an aging equipment, this investment cost is a significant burden for the operator. In addition, new system equipment for IMS service, which is spotlighted as the next generation communication service, is being introduced into the large network, so the investment cost at this time is also considerable. Therefore, there is a problem in that the burden of the cost occurs double.

SUMMARY OF THE INVENTION The present invention has been made in an effort to provide a subscriber authentication apparatus and method for facilitating the reception of additional subscriber information according to the expansion of subscribers without the addition of existing subscriber authentication equipment.

Subscriber authentication apparatus according to a feature of the present invention in order to achieve the above problems,

An apparatus for performing subscriber authentication for a data packet service, comprising: a wireless information management system for managing subscriber information of a mobile communication network and a plurality of interworking modules respectively interworking with an intelligent network; A subscriber profile DB for storing a first subscriber profile and a second subscriber profile, wherein the second subscriber profile is different from the first subscriber profile and the subscriber profile management and subscriber authentication scheme and is obtained from the wireless information management system; And an authentication processing unit for interworking with the plurality of interworking modules and performing subscriber authentication for confirming whether to allow data packet services based on a first subscriber profile and a second subscriber profile stored in the subscriber profile DB.

In addition, the subscriber authentication method according to another aspect of the present invention,

A method of authenticating a subscriber in a network environment in which data communication networks performing different subscriber profile management and subscriber authentication are overlapped, the method comprising: (a) receiving a data packet service call requesting a session connection from a mobile terminal; ; And (b) confirming whether to allow the data packet service call processing based on the first subscriber profile and the second subscriber profile, wherein the second subscriber profile is different from the first subscriber profile and the subscriber profile management and subscriber authentication scheme. Performing a subscriber authentication procedure.

According to the present invention, even if the number of subscribers is increased because the subscriber profile equipment of the newly introduced IMS network also performs the existing AAA function, it is easy to accommodate additional subscriber information without adding AAA. Therefore, considering the evolution of the network in the future IMS network and WCD is expected to reduce the network operation and investment in an efficient way.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Throughout the specification, when a part is said to "include" a certain component, it means that it can further include other components, without excluding other components unless specifically stated otherwise. In addition, the terms "… unit", "... module" described in the specification means a unit for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software.

In the present specification, a mobile station (MS) is a terminal, a mobile terminal (MT), a subscriber station (SS), a portable subscriber station (PSS), a user device (User). It may refer to an Equipment (UE), an Access Terminal (AT), or the like, and may include all or part of functions of a terminal, a mobile terminal, a subscriber station, a portable subscriber station, a user device, an access terminal, and the like.

In the present specification, Node-B is a base station device (Base Station, BS), access point (Access Point, AP), radio access station (Radio Access Station, RAS), eNB (Evolved Node-B) transmitting and receiving base station ( It may also refer to a base transceiver station (BTS), a mobile multihop relay (MMR) -BS, and the like, and may include all or a part of functions of an access point, a wireless access station, a node B, an eNB, a base transceiver station, an MMR-BS, and the like. It may be.

Now, a subscriber authentication apparatus and method thereof according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

According to an embodiment of the present invention, data communication networks that perform different subscriber profile management and subscriber authentication are applied to overlapping heterogeneous network environments. At this time, one data communication network is an IP Multimedia Subsystem (hereinafter referred to as 'IMS') network that integrates an IP (Internet Procotol) network and a mobile communication environment. The other data communication network is a mobile communication network for providing a wireless Internet service, which is a WCDMA (Wideband Code Division Multiple Access) network.

3 shows a configuration of a subscriber integration system according to an embodiment of the present invention. At this time, about the same structure as a conventional structure, the same code | symbol is attached | subjected and the description is abbreviate | omitted. However, the embodiment of the present invention is applied to the equipment to implement a new function unlike the prior art is attached with different reference numerals.

As shown in FIG. 3, the packet gateway device (hereinafter referred to as 'GGSN') 1300 is connected to the IMS network only without being connected to the existing AAA (Authentication, Authorization, Accounting).

Here, the IMS network performs subscriber authentication for service acceptance check based on the first subscriber profile for the IMS service as well as the second subscriber profile of the mobile communication network for the wireless Internet service.

When the GMSN 1300 receives an IMS call or a wireless Internet call requesting a session connection for a data packet service, the GGSN 1300 performs a subscriber authentication procedure in association with the IMS network and then performs each call processing.

To this end, the GGSN 1300 is connected to a Policy and Charging Rules Function (hereinafter referred to as 'PCRF') 1400 of the IMS network.

The PCRF 1400 is connected to a Subscription Profile Repository (hereinafter referred to as 'SPR') 1500 of the IMS network. Basically, the PCRF (Policy and Charging Rules Function) is a device that controls the network with the quality of service (QoS) and the policy of the IP network. The PCRF 1400 generates a policy rule based on the subscriber profile provided from the SPR 1500 and causes the GGSN 1300 to execute various quality of service (QoS) and policy rules in the GGSN 1300.

In this case, the SPR 1500 is a subscriber authentication device that performs subscriber authentication for data packet service call processing based on profiles having different subscriber profile management and subscriber authentication schemes. The SPR 1500 is interworking with a wireless information management system (WISE) 1000, a data service control point (DSCP) 1100, a long message service center (LMSC) 1200, and the existing AAA (Authentication). It performs subscriber authentication, intelligent network service processing, and long message service processing.

The PCRF 1400 requests subscriber authentication from the SPR 1500 according to the request of the GGSN 1300. The PCRF 1400 requests subscriber authentication using the Diameter protocol or the RADIUS protocol and receives a response. Here, the RADIUS protocol is most widely used as the AAA's de facto industry standard protocol for performing subscriber authentication, authorization verification, and billing information management functions when the mobile subscriber uses the Internet for a secure mobile internet service.

As such, the IMS network has a subscriber integration structure that accommodates not only IMS service subscribers but also subscribers existing in AAA.

4 is a block diagram showing a detailed configuration of a GGSN according to an embodiment of the present invention.

As shown in FIG. 4, the GGSN 1300 includes a receiver 1320 and an authenticator 1340.

The receiver 1320 is connected to the mobile terminal 100 'of the IMS subscriber and the mobile terminal 100 " of the mobile communication service subscriber. The receiver 1320 is connected to the mobile terminal 100' of the IMS subscriber to access the IP access. Receives an access request according to an Internet CAN (Internet CAN) connectivity protocol (IP CAN) bearer protocol protocol, where the reception method may be a call reception by a signaling protocol protocol that can be used for an IP-based multimedia service. Session Initiation Protocol (SIP) may be used to create a session and perform call processing.

The receiver 1320 is connected to the mobile terminal 100 ″ of the mobile communication service subscriber and receives a call for requesting a wireless Internet service. For example, a packet data protocol context for packet data transmission is received. ) Is asked to create.

The authenticator 1340 receives the PCRF 1400 when the receiver 1320 receives the connection request from the mobile terminal 100 ′ of the IMS subscriber or the generation request from the mobile terminal 100 ″ of the mobile communication service subscriber. Request session initiation according to the IP CAN bearer protocol protocol .. In this way, the authenticator 1340 discriminates whether a conventionally received call is an IMS call or a general wireless Internet call (or a data packet service call of a mobile communication network). Unlike proceeding with the call, all call processing proceeds in conjunction with IMS network without any call classification.

5 is a block diagram showing the detailed configuration of a subscriber profile storage according to an embodiment of the present invention.

As shown in FIG. 5, a subscriber profile storage unit (SPR) 1500 functioning as a subscriber authentication device includes a subscriber profile DB 1520, an authentication processing unit 1540, and an interworking unit 1560.

The subscriber profile DB 1520 stores an IMS service subscriber profile (first subscriber profile) and a data packet service subscriber profile (second subscriber profile) of the mobile communication network for the wireless Internet service.

The authentication processor 1540 performs a subscriber authentication procedure requested by the PCRF 1400 based on the first subscriber profile and the second subscriber profile stored in the subscriber profile DB 1520. The subscriber authentication procedure is to determine whether the subscriber inquiring whether the service is allowed by the PCRF 1400 is a legitimate subscriber who can use the service. The authentication processor 1540 is a configuration that is different from the conventional configuration in which the SPR 1500 simply transmits subscriber profiles, policies, and billing information.

The interlocking unit 1560 performs a function of interworking with an external device for service processing performed by the existing AAA. The linkage unit 1560 includes a first linkage module 1562, a second linkage module 1564, and a third linkage module 1566.

The first interworking module 1562 interworks with a wireless information management system (WISE) 1000 that generates a second subscriber profile of a mobile communication network for a wireless Internet service. The second subscriber profile is received from the wireless information management system (WISE) 1000 and stored in the subscriber profile DB 1520.

The second interworking module 1564 performs a long message service process in cooperation with a Long Message Service Center (LMSC) 1200.

The third interworking module 1566 performs intelligent network service processing in association with a data service control point (DSCP) 1100 which is an intelligent network charging processing apparatus.

Meanwhile, although the above-described components GGSN 1300, PCRF 1400, and SPR 1500 are described as separate nodes, they may be configured in a functionally separated form in the same device as a subscriber authentication device.

Now, the subscriber authentication method of the subscriber integrated system will be described based on the above-described configuration.

6 is a flowchart illustrating a subscriber authentication method according to an embodiment of the present invention. First, the mobile terminal is a mobile terminal 100 'of an IMS subscriber or a mobile terminal 100 " of a mobile communication service subscriber.

As shown in FIG. 6, when the mobile terminal 100 ′ of the IMS subscriber executes the IMS service (S201), the mobile terminal 100 ′ transmits an Establish IP CAN Bearer Request message to the GGSN 1300 (S203).

Then, the GGSN 1300 transmits an Indication of IP CAN session establishment message to the PCRF 1400 (S205).

The PCRF 1400 transmits a profile request message to the SPR 1500 (S207). Here, the profile request message is a subscriber profile request message for determining a quality of service and a billing function, which is a message previously defined in the IMS standard. At this time, a subscriber authentication request item is newly added to the profile request message.

The PCRF 1400 receives a profile response message from the SPR 1500 (S209), in which a subscriber authentication response is included. The subscriber authentication response includes a result of determining whether the subscriber of the mobile terminal 100 'of the IMS subscriber who requested the start of the IP CAN session in step S101 is a legitimate subscriber who can use the corresponding service.

The PCRF 1400 transmits an Acknowledge IP CAN session establishment message to the GGSN 1300 (S211), and the GGSN 1300 responds to the IP CAN bearer initiation response to the mobile terminal 100 'of the IMS subscriber. (Establish IP CAN Bearer Response) message is transmitted (S213).

On the other hand, when the mobile terminal 100 "of the mobile communication service subscriber executes a general data service (that is, a data packet service of a mobile communication network such as a wireless Internet service) (S215), the node B / RNC / SGSN (200, 300, 400), the PDP context activation request (Activate Packet Data Protocol Context Request) message is transmitted (S217) Node B / RNC / SGSN (200, 300, 400) to the GGSN (1300) PDP context creation request ( The Create Packet Data Protocol Context Request) message is transmitted (S219).

Then, the GGSN 1300 transmits an Indication of IP CAN session establishment message to the PCRF 1400 (S221). Subsequent steps S223 and S225 are the same as those of steps S207 and S209 when the IMS service described above has been executed.

When the GGSN 1300 receives an IP CAN session initiation response message S227 from the PCRF 1400, the GGSN 1300 generates a PDP context creation response to the Node B / RNC / SGSN 200, 300, and 400. Packet Data Protocol Context Response) message is transmitted (S229). Then, the Node B / RNC / SGSN 200, 300, 400 transmits a PDP Activation Response (Activate Packet Data Protocol Context Response) message to the mobile terminal 100 ″ of the mobile communication service subscriber (S231).

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 illustrates an IMS network structure of a conventional WPC.

2 shows a conventional subscriber authentication procedure.

3 shows a configuration of a subscriber integration system according to an embodiment of the present invention.

4 is a block diagram showing a detailed configuration of a GGSN according to an embodiment of the present invention.

5 is a block diagram showing the detailed configuration of a subscriber profile storage according to an embodiment of the present invention.

6 is a flowchart illustrating a subscriber authentication method according to an embodiment of the present invention.

Claims (9)

An apparatus for performing subscriber authentication for a data packet service in a network environment in which data communication networks performing different subscriber profile management and subscriber authentication are overlapped. A plurality of interworking modules respectively interworking with a wireless information management system and an intelligent network for managing subscriber information of a mobile communication network; A subscriber profile DB for storing a first subscriber profile and a second subscriber profile, wherein the second subscriber profile is different from the first subscriber profile and the subscriber profile management and subscriber authentication scheme and is obtained from the wireless information management system; An authentication processing unit interworking with the plurality of interworking modules and performing subscriber authentication to confirm whether to allow data packet services based on a first subscriber profile and a second subscriber profile stored in the subscriber profile DB; And A data packet service call requesting a session connection, wherein the data packet service call includes subscriber authentication to the authentication processing unit for a call for each data packet service having different subscriber profile management and subscriber authentication schemes. Packet gateway unit for processing all data packet service calls after request and confirmation Subscriber authentication device comprising a. The method of claim 1, The authentication processing unit, Subscriber authentication device characterized in that to support the intelligent network data packet service in conjunction with the intelligent network billing processing device and intelligent network message service device through the plurality of interworking modules. delete The method according to claim 1 or 2, When receiving a request for starting a session for call processing from the packet gateway unit, the rule function unit receives a subscriber authentication from the authentication processing unit and receives a response. Subscriber authentication device further comprising. The method of claim 4, wherein The rule function unit, And receiving a session establishment initialization message according to the IP access network bearer protocol protocol from the packet gateway unit, and transmitting a profile request message including a subscriber authentication request item to the authentication processing unit. The method of claim 5, The packet gateway unit, A receiving unit for receiving an access request according to an IP access network bearer protocol protocol or for receiving a packet data protocol context creation request; And When the receiving unit receives the connection request or the creation request, the authentication unit for requesting the session function to start the session according to the IP access network bearer protocol protocol Subscriber authentication device comprising a. In a method for authenticating subscribers in a network environment in which data communication networks performing different subscriber profile management and subscriber authentication are overlapped, (a) receiving, by the packet gateway unit, a data packet service call requesting a session connection from a mobile terminal; And (b) at the request of the packet gateway unit, the authentication processing unit based on the first subscriber profile and the second subscriber profile, wherein the second subscriber profile is different from the first subscriber profile and the subscriber profile management and subscriber authentication scheme. Performing a subscriber authentication procedure for confirming whether packet service call processing is allowed; The packet gateway unit includes all data packet service calls received from the mobile terminal, wherein all of the data packet service calls include calls for requesting respective data packet services having different subscriber profile management and subscriber authentication schemes. Requesting the subscriber authentication procedure to the authentication processing unit. The method of claim 7, wherein In step (b), (Iii) requesting, by the packet gateway unit, a rule function unit, wherein the rule function unit performs a quality of service and a charging function for data packet service; to initiate a session according to an IP access access network bearer protocol protocol; And (Ii) the rule function unit requesting subscriber authentication for the call received in step (a) to the authentication processing unit and receiving a response; Subscriber authentication method comprising a. The method of claim 8, Step (ii), Subscriber authentication, characterized in that the rule function transmits a profile request message to which the subscriber authentication request item is added, wherein the profile request message is previously defined as a subscriber profile request message for determining service quality and billing function. Way.

Images