KR100991371B1 - User authorization system of the wireless data service, authorization method of the wireless data service and authorization apparatus of the wireless data service - Google Patents

Abstract

The present invention relates to a user authentication system, an authentication method, and an authentication apparatus for a wireless data service, wherein the user authentication system for a wireless data service of the present invention includes a first IMSI, a first MSISDN, and a first IMSI of a terminal at a call connection of the terminal. An IP registration system for receiving and registering first terminal information including a source IP address, and a gateway connecting the terminal and a content providing server, the second terminal including a second IMSI, a second MSISDN, and a second source IP address. When receiving a content providing request having second terminal information, one of the second IMSI, the second MSISDN and the second source IP address included in the content providing request is selected and provided to the IP registration system. Information corresponding to one of the second IMSI, the second MSISDN, and the second source IP address provided to the IP registration system from the IP registration system; A gateway that receives at least one piece of information of third terminal information from the IP registration system and compares at least one piece of information of the second terminal with the third terminal information provided from the IP registration system to perform user authentication; It includes.

Content, user authentication

Description

User authentication system, authentication method and authentication apparatus of a wireless data service {user authorization system of the wireless data service, authorization method of the wireless data service and authorization apparatus of the wireless data service}

The present invention relates to a user authentication system, an authentication method, and an authentication apparatus of a wireless data service, and more particularly, to a user authentication system, an authentication method, and an authentication apparatus of a wireless data service which blocks an illegal access attempted by changing a number of a terminal. It is about.

With the development of communication technology, various wireless communication services using a wireless network have been provided. Mobile phones, which are typical of wireless communication services, are being used in various ways beyond their use as communication means. For example, mobile phones have been developed into multimedia communication services utilizing various contents using wireless communication networks.

As the wireless data internet service in the mobile communication is activated, the number of users of the wireless data internet service is greatly increased. On the other hand, as users' understanding of wireless communication networks increases, illegal acts of malicious manipulation of wireless communication networks have occurred.

For example, when using paid content, after the call setup is completed in the network, the terminal charges based on the identification number of the terminal included in the HTTP header or the BILLCOM header transmitted from the terminal to the server. By using this point, there are occurrences in which the identification number of the terminal included in the header is maliciously changed so that the information service fee is charged to another person, or the program of the content provider is malfunctioned.

Accordingly, there is a need for a method of illegally changing a subscriber number of a terminal to block illegal access to use paid contents.

An object of the present invention is to provide a user authentication system of a wireless data service that blocks illegal access attempted by changing the number of a terminal.

Another object of the present invention is to provide a user authentication method of a wireless data service that blocks illegal access attempted by changing the number of a terminal.

Another object of the present invention is to provide an apparatus for authenticating a user of a wireless data service which blocks illegal access attempted by changing the number of a terminal.

Problems to be solved by the present invention are not limited to the above-mentioned objects, and other problems not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a user authentication system of a wireless data service according to an embodiment of the present invention includes a first terminal including a first IMSI, a first MSISDN and a first source IP address of the terminal at the time of call connection of the terminal; An IP registration system for receiving and registering information; And a gateway that connects the terminal to a content providing server, and receives a content providing request having second terminal information including a second IMSI, a second MSISDN, and a second source IP address from the terminal. Select one of the included second IMSI, the second MSISDN and the second source IP address to provide to the IP registration system, the information having information matching the information provided to the IP registration system retrieved from the IP registration system And a gateway configured to receive at least one piece of information of third terminal information from the IP registration system and to perform user authentication by comparing the second terminal information with the third terminal information provided from the IP registration system.

In accordance with another aspect of the present invention, there is provided a method for authenticating a user of a wireless data service, the method comprising: registering first terminal information including a first IMSI, a second MSISDN, and a first source IP address of a terminal connected to an IP registration system; Receiving a content providing request of the terminal from a gateway to which a providing server is connected, wherein the content providing request includes second terminal information including a second IMSI, a second MSISDN, and a second source IP address; Selecting one of a second IMSI, a second MSISDN, and a second source IP address included in the provision request and providing the information to the IP registration system; a third including information corresponding to the information provided by the gateway; Retrieving terminal information from the IP registration system; at least one of the third terminal information in the IP registration system; Providing to the tway and performing the user authentication by comparing the second terminal information with the third terminal information provided from the IP registration system.

An apparatus for authenticating a user of a wireless data service according to an exemplary embodiment of the present invention may include a first data interface configured to receive a content providing request having second terminal information including a second IMSI, a second MSISDN, and a second source IP address from a terminal. Selects one of the second IMSI, the second MSISDN, and the second source IP address included in the content provision request, and provides the selected information to the IP registration system, the information provided from the IP registration system to the IP registration system; A second data interface unit receiving at least one of third terminal information having matching information and at least one third terminal information received from the second data interface unit and second terminal information of the first data interface unit; Comparing the control unit to perform the user authentication.

Specific details of other embodiments are included in the detailed description and the drawings.

According to the user authentication system, the authentication method and the authentication device of the wireless data service of the present invention as described above has the following advantages.

According to a user authentication system, an authentication method, and an authentication apparatus for a wireless data service according to an embodiment of the present invention, authentication may be performed by arbitrarily selecting terminal information, which is a standard for performing authentication, from an IMSI, an MSISDN, and a source IP address. have. That is, any of the IMSI, MSISDN and source IP address information can optionally be provided to the IP registration system to retrieve the terminal information group containing the matching information. Therefore, it is possible to perform a variety of authentication operations, it is difficult to access illegally avoiding such authentication operations. In other words, it is possible to prevent the paid content from being serviced more effectively when illegally changing the information of the terminal such as the identification number of the terminal. In addition, by using the authentication method, such as paid content or financial services that require the authentication of the individual, the authentication operation can be performed more reliably.

Specific details of embodiments of the present invention are included in the detailed description and the drawings.

Advantages and features of the present invention and methods for achieving them will be apparent with reference to the embodiments described below in detail with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but can be implemented in various different forms, and only the embodiments make the disclosure of the present invention complete, and the general knowledge in the art to which the present invention belongs. It is provided to fully inform the person having the scope of the invention, which is defined only by the scope of the claims. Like reference numerals refer to like elements throughout.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the invention. In the present specification, the singular form includes plural forms unless otherwise specified in the specification. As used herein, “comprises” and / or “comprising” refers to the presence of one or more other components, steps, actions and / or devices. Or does not exclude additions.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a wireless data network according to an embodiment of the present invention.

Referring to FIG. 1, a wireless data network includes a terminal 101 of a mobile communication subscriber, a network connecting server (NAS) 110, a charging server 120, and an IP location system (IPLS). 130, a content provider server (CP) 150 is configured.

The terminal 101 is connected to the content providing server 150 through the network access server 110 to receive a wireless data service. In this case, a connection method between the terminal and the network access server 110 may be a wireless LAN method, a code division multiple access (CDMA) method, a wideband code division multiple access (WCDMA) method, or the like.

Network access server 110 is a device that enables the provision and use of wireless Internet services, Interworking Function (IWF), Packet Data Serving Node (PDSN), Gateway GPRS Support Node (Gateway) GPRS Support Node (GGSN), and the like.

The billing server 120 includes AAA (Authentication, Authorization, Accounting), IPAS (IP Accounting System), and the like. The billing server 120 stores information of a subscriber using a wireless data service, manages billing calculation criteria for each service, balance information of the corresponding subscriber, and bills a fee for using a wireless data service.

The IP registration system 130 may include a terminal identification number such as an International Mobile Station Identity (IMSI), a Mobile Station International Integrated Service Digital Network (ISDN) Number (MSSIS), and an Internet Protocol (IP) address of the terminal 101 when a call is connected. Receive and register the information of the terminal, such as). In this case, the information of the terminal stored in the IP registration system 130 is referred to as first terminal information, and specifically includes a first IMSI, a first MSISDN, and a first source IP address.

The gateway 140 connects the terminal 101 and the content providing server 150. In this case, one or more content providing servers 150 connected to the gateway 140 may be provided. The content providing server 150 provides a wireless data service to the terminal 101 connected to the call.

The gateway 140 receives a content providing request from the terminal 101 and connects the corresponding content providing server 140 to the terminal 101. The information of the terminal is recorded in the content providing request received by the gateway 140. That is, the content providing request includes information of the terminal including the IMSI, the MSISDN, the source IP address, and the like. In particular, in the content providing request, the HTTP header of the HTTP page request includes an IMSI or an MSISDN. At this time, the information of the terminal received by the gateway 140 is referred to as second terminal information, and specifically, includes a second IMSI, a second MSISDN, and a second source IP address. In a normal call connection and content providing request, the first terminal information and the second terminal information must be identical.

The gateway 140 provides some of the second terminal information to the IP registration system 130 and receives third terminal information having information equal to the value of the second terminal information provided to the IP registration system 130. Perform user authentication. Meanwhile, the user authentication process may be performed at the content providing server 150 or may be performed at an authentication server that performs authentication. Details of user authentication will be described later.

At this time, if the user authentication is normally handled and determined to be a legitimate connection, the charging server 120 and the wireless data service of the content providing server 150 proceed normally. However, if it is determined that an illegal connection is made, the charging at the charging server 120 is stopped and the service providing at the content providing server 150 is stopped.

Hereinafter, a data service setup process according to an embodiment of the present invention will be described with reference to FIG. 2. 2 is a diagram illustrating a data service setup process according to an embodiment of the present invention.

Referring to FIG. 2, when a subscriber terminal 101 attempts to connect to a call, a PDP context activation request is first made to a support GPRS serving node (SGSN) 112 through a radio network controller (RNC). In step S201, the SGSN 112 transmits a Create PDP Context Request to the GGSN 114 (S203).

When the GGSN 114 receives the PD context setup request from the SGSN 112, the GGSN 114 sends an accounting request (start) to the IPAS 122 (205), and responds to the PDP setup request to the SGSN 112. (Create PDP Context Response) is transmitted (S207).

When the SGSN 112 receives the response to the PDP setting request (S209), a response indicating that the PDP context is set (Active PDP Context Response) is transmitted to the subscriber station 101 (S209).

When the IPAS 122 receives the charging request message, the IPAS 122 starts charging processing (S211), and forwards the charging request message to the registered IP registration system 130 (S213). At this time, the IPAS 122 may forward by adding a proxy-state to the IP registration system 130 or may generate and transmit a separate charging request message.

When the IP registration system 130 receives the charging request message, the IP registration system 130 stores the terminal information of the corresponding subscriber (S215), and transmits an accounting response to the IPAS 122 (S217). When the charging request message received by the IP registration system 130 includes the proxy status, the IP registration system 130 responds to the IPAS 122 without changing the received proxy status. The IPAS 122 transmits an accounting response to the GGSN 114 (Accounting Response) (S219).

Accordingly, packet data service is possible between the subscriber terminal 101 and the GGSN 114.

On the other hand, when the subscriber terminal 101 wants to terminate the call, the PDP context deactivation request (Deactive PDP Context Request) is transmitted to the SGSN 112 through the RNC (S221), the SGSN 112 is the GGSN 114 The PDP context release request is transmitted (S223).

When the GGSN 114 receives the PDP context release request from the SGSN 112, the GGSN 114 performs the release of the specific PDP context or the entire session based on the information transmitted from the SGSN 112. In addition, a charging stop request (Accounting Request (stop)) is transmitted to the IPAS 122 (225), and a response to the PDP release request (Delete PDP Context Response) is transmitted to the SGSN (112) (S227).

When the SGSN 112 receives the response to the PDP release request, a response indicating that the PDP context has been released (Deactive PDP Context Response) is transmitted to the subscriber station 101 (S229).

When the IPAS 122 receives the charging stop request message, the IPAS 122 terminates the charging process (S231), and forwards the charging stop message to the registered IP registration system 130 (S233). At this time, the IPAS 122 may forward by adding a proxy-state to the IP registration system 130 or may generate and forward a separate billing stop request message.

When the IP registration system 130 receives the charge stop request message, the terminal information of the subscriber is deleted (S235), and the IPAS 122 transmits an accounting response to the charge stop request (S237). When the charging stop request message received by the IP registration system 130 includes the proxy status, the IP registration system 130 responds to the IPAS 122 without including the changed proxy status. The IPAS 122 transmits an accounting response to the GGSN 114 in response to the charging stop request (S239).

3 and 4 are diagrams for describing an authentication system for a wireless data service according to an embodiment of the present invention.

1, 3, and 4, an authentication system for a wireless data service according to an embodiment of the present invention includes an IP registration system 130 and a gateway 140.

The IP registration system 130 receives and registers first terminal information including a first IMSI, a first MSISDN, and a first source IP address of the terminal 101 when the terminal 101 connects to a call.

When the gateway 140 receives a content providing request having the second terminal information including the second IMSI, the second MSISDN, and the second source IP address from the terminal 101, the gateway 140 receives the second IMSI, the first IMSI included in the content providing request, and the second IMSI. 2 provide information of one of the MSISDN and the second source IP address to the IP registration system 130 and match the information of one of the second IMSI, the second MSISDN and the second source IP address provided to the IP registration system 130 Receiving at least one information of the third terminal information including the third IMSI, the third MSISDN and the third source IP address from the IP registration system 130 and comparing the second terminal information with the third terminal information. Perform user authentication.

Hereinafter, a method of authenticating a terminal user according to an embodiment of the present invention will be described with reference to FIGS. 1 to 8. 5 is a flowchart illustrating an authentication process according to an embodiment of the present invention. 6 to 8 are diagrams for explaining an authentication method based on data according to an embodiment of the present invention.

1 to 5, first, as shown in FIG. 2, the terminal 101 attempts to connect to a network (S310).

In the call connection from the terminal 101 to the network, the first terminal information of the user is stored in the IP registration system 130 (S320). At this time, the IP registration system 130 stores information indicating the state of the terminal 101 including the first IMSI, the first MSISDN, and the first source IP address.

On the other hand, when the call connection from the terminal 101 to the network is completed, the terminal 101 makes a request for providing content to the gateway 140 (S330). That is, the gateway 140 receives a content providing request including second terminal information including a second IMSI, a second MSISDN, and a second source IP address.

Then, the gateway 140 provides one of the second terminal information included in the content providing request to the IP registration system 130 (S340). Here, one of the second terminal information provided is one of the second IMSI, the second MSISDN and the second source IP address. For example, the second IMSI or the second MSISDN included in the HTTP header of the HTTP page request may be provided, or the second source IP address may be provided.

That is, in the terminal user authentication method according to an embodiment of the present invention, any one of the second IMSI, the second MSISDN, and the second source IP address may be selectively selected by the gateway 140 to authenticate the user. ) Can be provided.

Upon receiving the second terminal information from the gateway 140, the IP registration system 130 searches for third terminal information having information that matches the received second terminal information (S350).

Here, the third terminal information means an information group of a terminal registered in the IP registration system 130 and includes 3 IMSI, a third MSISDN, and a third source IP address.

For example, when the second 140 receives the second IMSI, the gateway 140 searches for third terminal information having the same IMSI information as the second IMSI. In this case, the third terminal information may include a third IMSDN and a third source IP address registered in the IP registration system 130 at the same time as the third IMSI and the third IMSI which are the same as the second IMSI.

When the gateway 140 receives the second MSISDN, the gateway 140 searches for third terminal information having the same MSISDN information as the second MSISDN. In this case, the third terminal information may include a third IMSI and a third source IP address registered in the IP registration system 130 at the same time as the third MSISDN and the third MSISDN, which are the same as the second MSISDN.

When the gateway 140 receives the second source IP address, the third terminal information having the same source IP address information as the second source IP address is retrieved. In this case, the third terminal information may include a third source IP address and a third source IP address identical to the second source IP address, and a third IMSI and a third MSISDN registered in the IP registration system 130 at the same time.

When the third terminal information is retrieved from the IP registration system 130, the IP registration system 130 transmits at least one piece of information of the third terminal information to the gateway 140 (S360).

In this case, the third terminal information transmitted to the gateway 140 should include at least one of the third IMSI, the third MSISDN, and the third source IP address. Accordingly, the IP registration system 130 may transmit all of the third IMSI, the third MSISDN, and the third source IP address to the gateway 140, or may transmit one or two of the three pieces of information. Alternatively, at least one of the three pieces of information and other information included in the third terminal information but not the three pieces of information may be transmitted to the gateway 140.

At this time, the information transmitted to the gateway 140 includes a kind of information different from the information transmitted from the gateway 140 to the IP registration system 130. For example, when the gateway 140 provides the second IMSI to the IP registration system 130, the third terminal information transmitted from the IP registration system 130 to the gate 140 is information other than the third IMSI. Must include.

The gateway 140 compares at least one of the third terminal information received from the IP registration system 130 with the second terminal information recorded in the content providing request (S370).

That is, the gateway 140 compares the third terminal information and the second terminal information to determine whether they match. For example, if all of the third IMSI, the third MSISDN and the third source IP address are transmitted from the IP registration system 140, the third IMSI, the third MSISDN and the third source IP address and the second IMSI, the second The MSISDN and the second source IP address are compared one-to-one. When only a part of the third IMSI, the third MSISDN, and the third source IP address is transmitted, the values of the transmitted third terminal information and corresponding second terminal information are compared with each other. For example, when only the third IMSI is transmitted, the values of the third IMSI and the second IMSI may be compared with each other. In this case, the information provided from the gateway 140 to the IP registration system 130 is of course information other than the second IMSI. According to the user authentication method of the terminal according to an embodiment of the present invention, the gateway 140 provides any information of the second IMSI, the second MSISDN, and the third IP address among the second terminal information from the IP registration system 130. Even if the user authentication of the terminal can be performed.

That is, one of two IMSIs, a second MSISDN, and a third IP address may be arbitrarily selected and provided to the IP registration system 130. Therefore, according to circumstances, the value of the second terminal information to be provided to the IP registration system 130 can be freely changed. That is, the type of the second terminal information used for user authentication can be freely changed, or by changing from time to time, it is possible to more effectively prevent the illegal authentication by changing the IMSI number or the like maliciously.

In this case, if both the second terminal information and the third terminal information are compared and match, the wireless data service proceeds normally to provide contents (S390). That is, when the third terminal information received from the IP registration system 130 and the second terminal information recorded in the content providing request are the same, the wireless data service of the charging server 120 and the content providing server 150 are charged. Proceed normally.

Meanwhile, if any of the second terminal information and the third terminal information do not match, the call is released and the wireless data service is terminated (S380). That is, when the information on the third terminal received from the IP registration system 130 and the information on the second terminal recorded in the content providing request are different, the charging on the charging server 120 is stopped and the content providing server 150 stops. Stop providing services.

6 to 8, the authentication processing method will be described in more detail. FIG. 6 is an information exchange diagram when abnormal information is provided to the IP registration system in the case of an abnormal content provision request. FIG. 7 is a diagram of information exchange when normal information is provided to the IP registration system in the case of an abnormal content provision request. 8 is a diagram of information exchange when normal information is provided to the IP registration system in the case of a normal content providing request.

6 and 7, when the user arbitrarily changes the IMSI recorded in the content providing request, the second IMSI value recorded in the content providing request is equal to the first IMSI value registered in the IP registration system 130. Will be different. That is, when the first IMSI, the first MSISDN, and the first source IP address have values a, b, and c, respectively, if the second IMSI is arbitrarily changed, the second IMSI, the second MSISDN, and the second source IP address are a ', b, c values.

At this time, as shown in FIG. 6, when the gateway 140 provides the second IMSI (a ') to the IP registration system, the IP registration system 130 matches the second IMSI (a'). Retrieve third terminal information having a value of 3 IMSI (a '), wherein the third MSISDN (b') and the third source IP address (c ') included in the third terminal information are the second MSISDN (b). And second source IP address (c).

Here, the IP registration system 130 transmits at least one of the third IMSI (a '), the third MSISDN (b'), and the third source IP address (c '), which are third terminal information, to the gateway 140. . In FIG. 6, all three pieces of information are transmitted to the gateway 140. However, at least one of three pieces of information may be transmitted, and the same may be applied to FIGS. 7 and 8.

However, at least one of the third IMSI (a '), the third MSISDN (b'), and the third source IP address (c ') provided from the IP registration system 130 to the gateway 140 may be provided at the gateway 140. It should include information other than the third IMSI (a ') which is the same value as the information provided to the IP registration system 130. That is, it must include a third MSISDN (b ') and / or a third source IP address (c').

Accordingly, when the gateway 140 compares the second terminal information with the third terminal information, it recognizes that the MSISDN and / or the source IP address do not match and releases the call.

Meanwhile, as shown in FIG. 7, when the gateway 140 provides the IP registration system 130 with information other than the second IMSI (a '), for example, the second source IP address c, The registration system 130 will provide third terminal information with a third source IP address (c) value that matches the second source IP address (c). That is, the third terminal information is the third IMSI (a), the third MSISDN (b), and the third source IP address (c) having the same value as the first terminal information. At this time, the third IMSI (a) included in the third terminal information is different from the second IMSI (a '). Accordingly, when the gateway 140 compares the second terminal information with the third terminal information, it recognizes that the IMSI does not match and releases the call.

Referring to FIG. 8, when a terminal normally provides a content request, if the first IMSI, the first MSISDN, and the first source IP address registered in the IP registration system 130 have a, b, and c values, The second IMSI, the second MSISDN, and the second source IP address recorded in the offer request also have values of a, b, and c, respectively.

At this time, when the gateway 140 provides the second IMSI (a) to the IP registration system, the IP registration system 130 may have a third terminal having a third IMSI (a) value that matches the second IMSI (a). Information, the third terminal information becomes a third IMSI (a), a third MSISDN (b) and a third source IP address (c), respectively. Since the third terminal information is consistent with the second terminal information, even if any information is transmitted to the gateway 140 among the third terminal information, the third terminal information is consistent with the second terminal information. Accordingly, the gateway 140 connects the terminal 101 and the content providing server 150 of FIG. 1 to proceed with the wireless data service normally.

That is, when the user authentication is successfully performed and the content is normally provided, the first terminal information registered in the IP registration system 130, the second terminal information recorded in the content providing request, and the gateway in the IP registration system 130 are provided. The third terminal information provided to 140 has the same value.

According to an authentication method of a wireless data service according to an embodiment of the present invention, authentication may be performed by arbitrarily selecting terminal information, which is a standard for performing authentication, from an IMSI, an MSISDN, and a source IP address. That is, any of the IMSI, MSISDN and source IP address information can optionally be provided to the IP registration system to retrieve the terminal information group containing the matching information. Therefore, it is possible to perform a variety of authentication operations, it is difficult to access illegally avoiding such authentication operations. That is, it is possible to prevent the paid content from being serviced more effectively when illegally changing information of the terminal such as the identification number of the terminal. In addition, by using the authentication method, such as paid content or financial services that require the authentication of the individual, the authentication work to verify the identity can be performed more reliably.

9 illustrates an apparatus for authenticating a wireless data service according to an embodiment of the present invention.

Referring to FIG. 9, the gateway 140 includes a first data interface unit 142, a second data interface unit 144, and a controller 146.

The first data interface unit 142 receives a content providing request having the second terminal information including the second IMSI, the second MSISDN, and the second source IP address from the terminal 101.

The second data interface unit 144 provides the IP registration system 130 with one of the second IMSI, the second MSISDN, and the second source IP address included in the content providing request, and registers the IP from the IP registration system 130. At least one of a third IMSI, a third MSISDN, and a third source IP address among third terminal information having information matching one of the second IMSI, the second MSISDN, and the second source IP address provided to the system 130. You are provided with information.

The controller 146 compares the third terminal information received from the second data interface unit 144 with the second terminal information of the first data interface unit 142 and performs user authentication.

In this specification, authentication by comparing the information stored in the IP registration system 130 with the information of the terminal 101 received by the gateway 140 may be performed in the gateway 140 as described above. In addition, the authentication process may be performed in an authentication server configured separately from the gateway 140. That is, in the present specification, the gateway 140 is illustrated as an authentication device of a wireless data service, but is not limited thereto. The authentication server may detect the illegal terminal number change by comparing the information stored in the IP registration system 130 with the information of the terminal 101 received at the gateway 140. Alternatively, the terminal 101 and the content providing server 150 may proceed. That is, the present invention may include all configurations and systems for comparing the information stored in the IP registration system 130 with the information of the terminal 101 received at the gateway 140 to detect illegal terminal number changes.

Although embodiments of the present invention have been described above with reference to the accompanying drawings, those skilled in the art to which the present invention pertains may implement the present invention in other specific forms without changing the technical spirit or essential features thereof. You will understand that. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive.

1 is a diagram illustrating a wireless data network according to an embodiment of the present invention.

2 is a diagram illustrating a data service setup process according to an embodiment of the present invention.

3 and 4 are diagrams for describing an authentication system for a wireless data service according to an embodiment of the present invention.

5 is a flowchart illustrating an authentication process according to an embodiment of the present invention.

6 to 8 are diagrams for describing an authentication method based on data according to an embodiment of the present invention.

9 is a diagram illustrating an apparatus for authenticating a wireless data service according to an embodiment of the present invention.

<Explanation of symbols on main parts of the drawings>

101: terminal 110: a network access server

112: SGSN 114: GGSN

120: billing server 122: IPAS

130: IP registration system 140: gateway

150: content providing server 142: first data interface

144: second data interface unit

146: control unit

Claims (20)

An IP registration system that receives and registers first terminal information including a first IMSI, a first MSISDN, and a first source IP address of the terminal when the terminal accesses a call; And A gateway that connects the terminal to a content providing server, and receives a content providing request having second terminal information including a second IMSI, a second MSISDN, and a second source IP address from the terminal, and includes the content providing request in the content providing request. Select one of the second IMSI, the second MSISDN, and the second source IP address to provide to the IP registration system; From the IP registration system at least one piece of information of the third terminal information having information corresponding to one of the second IMSI, the second MSISDN and the second source IP address provided from the IP registration system to the IP registration system; And a gateway configured to perform user authentication by comparing the second terminal information and at least one of the third terminal information received from the IP registration system. The method of claim 1, The third terminal information includes a third IMSI, a third MSISDN, and a third source IP address, and at least one of the third terminal information provided to the gateway from the IP registration system is the third IMSI; 3 User authentication system of a wireless data service comprising at least one of an MSISDN and a third source IP address. delete The method of claim 1, Comparing at least one of the second terminal information and the third terminal information provided from the IP registration system to perform user authentication, Compares at least one of the second terminal information and at least one of the third terminal information provided from the IP registration system and releases a call if any one does not match; And comparing the at least one of the second terminal information and the third terminal information and matching all the wireless terminal data. The method of claim 1, Providing one of the second IMSI, the second MSISDN, and the second source IP address included in the content provision request to the IP registration system, And providing a second IMSI or a second MSISDN included in a header of an HTTP page request of the content providing request. The method of claim 1, And a network access server for providing a wireless internet service to the terminal. The method of claim 6, The network access server may include at least one wireless data selected from a group including an interworking function (IWF), a packet data serving node (PDSN), and a gateway GPRS support node (GGSN). User authentication system of the service. The method of claim 6, The wireless communication method of the terminal and the network connection server is wireless LAN, CDMA or WCDMA user authentication system of a wireless data service. The method of claim 6, And a charging server connected to the network access server to charge the wireless data service usage fee. Registering first terminal information including the first IMSI, the second MSISDN, and the first source IP address of the connected terminal to the IP registration system; Receiving a content providing request of the terminal at a gateway to which a content providing server is connected, the content providing request including second terminal information including a second IMSI, a second MSISDN, and a second source IP address; Selecting, at the gateway, one piece of information selected from a second IMSI, a second MSISDN, and a second source IP address included in the content providing request to the IP registration system; Retrieving, from the IP registration system, third terminal information including information corresponding to the information received from the gateway; Providing at least one piece of information of the third terminal information to the gateway in the IP registration system; And And in the gateway, comparing the second terminal information with the third terminal information provided from the IP registration system to perform user authentication. The method of claim 10, The third terminal information includes a third IMSI, a third MSISDN, and a third source IP address, and at least one of the third terminal information provided to the gateway from the IP registration system is the third IMSI; 3 The method of user authentication of a wireless data service comprising at least one of an MSISDN and a third source IP address. delete The method of claim 10, In the step of performing the user authentication by comparing the second terminal information and the third terminal information provided from the IP registration system, Comparing the second terminal information with the third terminal information and disconnecting the call if any one does not match; And comparing the second terminal information with the third terminal information and performing the wireless data service if the second terminal information and the third terminal information match. The method of claim 10, Providing one of a second IMSI, a second MSISDN, and a second source IP address included in the content provision request to the IP registration system, And providing a second IMSI or a second MSISDN included in a header of the content provision request. The method of claim 10, The call connection of the terminal is a user authentication method of a wireless data service performed by a network access server that receives a call connection request to process the call connection. The method of claim 15, And a charging server connected to the network access server to charge the wireless data service fee. A first data interface unit for receiving a content providing request having second terminal information including a second IMSI, a second MSISDN, and a second source IP address from the terminal; Select one of the second IMSI, the second MSISDN, and the second source IP address included in the content provision request and provide the information to the IP registration system, the information corresponding to the information provided from the IP registration system to the IP registration system; A second data interface unit receiving at least one of third terminal information having information; And And a controller configured to perform user authentication by comparing at least one piece of third terminal information received from the second data interface unit and second terminal information of the first data interface unit. The method of claim 17, The third terminal information includes a third IMSI, a third MSISDN, and a third source IP address, and at least one of the third terminal information received from the IP registration system in the second data interface unit may include the third IMSI. 3 apparatus for authenticating users of a wireless data service including at least one of an IMSI, a third MSISDN, and a third source IP address. delete The method of claim 17, In the control unit, Comparing the second terminal information with the third terminal information and disconnecting the call if any one does not match; And comparing the second terminal information with the third terminal information and performing the wireless data service normally.

Images