KR101003159B1 - Broadband Convergence Network For Mobile Node Fast Authentication And Mobility Management, And Fast Authentication And Mobility Management Method Thereof - Google Patents

Abstract

The present invention minimizes the authentication and mobility management procedures due to reconnection when the terminal is handed off in a broadband integrated network, thereby minimizing the delay due to authentication and mobility management, and thus providing a fast handoff and thereby providing a high quality data service. The present invention relates to a broadband integrated network for mobile terminal high speed authentication and mobility management, and a high speed authentication and mobility management method.

A broadband integrated network according to the present invention is a broadband integrated network including a core network and a plurality of access networks connected to the core network to provide a data service including voice to a mobile node. The mobile node for creating a registration request message; A POE that configures wireless communication with the mobile node and grants a second layer ID (L2_ID) included in the registration request message when the mobile node accesses the access network; A network access server (NAS) which configures the POE and the access network, is connected to the mobile node by the POE, and adds its own IP address (NAS_IP) to the registration request message transmitted from the mobile node. ; A core mobility management server constituting the core network and determining whether a connection of the mobile node is an initial connection or a handoff connection when the registration request message is transmitted from the network access server, and selecting an authentication process according to the determination result; An authentication authorization server performing connection authentication according to the initial connection of the mobile node according to a request of the core mobility management server and providing the connection authentication result and authentication information according to the initial connection to the core mobility management server; It is configured to include.

Broadband integrated network, handoff, handover, access, authentication

Description

Broadband converged network, high speed authentication and mobility management method for mobile terminal high speed authentication and mobility management {Broadband Convergence Network For Mobile Node Fast Authentication And Mobility Management, And Fast Authentication And Mobility Management Method Thereof}

The present invention relates to access authentication for a mobile node in a broadband integrated network, and in particular, by minimizing authentication and mobility management procedures due to reconnection when a terminal is handed off in a broadband integrated network, thereby minimizing delay by authorization and mobility management. The present invention relates to a broadband integrated network for high speed authentication and mobility management of a mobile terminal for providing fast handoff and high quality data service, and a high speed authentication and mobility management method.

Broadband Convergence Network (BcN) is a next-generation network that enables broadband, anytime, anywhere access to quality multimedia services that combine communication, broadcasting, and the Internet. Such a broadband integrated network is implemented in consideration of a situation in which a user may freely move at any time, regardless of the location or type of terminal, through various access networks while using a multimedia service. To this end, mobility control technology is essential in a broadband integrated network to provide continuous quality guaranteed services regardless of the location of a user or the type of terminal used. However, there is no proven solution for providing terminal mobility between heterogeneous access networks in the current broadband integrated network.

In order to provide mobility of a terminal, terminal handoff (or handover) between heterogeneous networks or homogeneous networks needs to be supported, and in order to provide a high quality service, it is necessary to reduce latency and simplify mobility management procedures.

1 is an exemplary diagram illustrating a configuration of a general broadband integrated network.

Referring to FIG. 1, generally, a broadband integrated network (BcN) includes a core network (Nc) supporting a connection between heterogeneous networks and an access network (N _An : N _A1 to N _A3 ) connected to the core network (Nc). do. Corner network (Nc) is the AAA server (Authentication Authorization Account, 101) server performing the access authentication function of the access network (N _An : N _A1 to N _A3 ) of the terminal, the home agent (HA: Home) that performs location registration and management functions Agent 102 is configured. In addition, each access network (N _An : N _A1 to N _A3 ) is in charge of the connection with the core network (Nc), and assigns an IP (Internet Protocol) address when the terminal (MN: Mobile Node, 112) initially connected, A network access server (NAS: 103 to 105) equipped with a foreign agent (FA) function is configured to act as a registration procedure for the home agent 102 during handoff. The network access server 103 to 105 establishes a wireless connection with the terminal 112 through PoA (Point Of Attachment, 106 to 111).

2 is a signal flow diagram illustrating a terminal access and a handoff process of a terminal in the broadband integrated network of FIG. 1.

Referring to FIG. 2, when the terminal 112 is supplied with power and is in an operating state, or when the terminal 112 is initially connected to the first access network N _A1 , the terminal 112 is connected to the type of the network access card NIC mounted in the terminal 112. Accordingly, the PoA 106 and the L2 connection step 201 are performed through the L2 (second layer) link connection process. This step is performed using the L2 layer technology provided by each access network (N _An : N _A1 to N _A3 ). After the L2 layer connection is completed, the L3 (third layer) access authentication step for the terminal 112 is performed. In general, when the connection authentication is made to the AAA server 101 of the telecommunication service provider to which the terminal 112 is subscribed through a user ID and a password, the network access server 103 of the access network N _An : N _A1 to N _A3 . ) Transmits the user information for initiating L3 authentication to the AAA server 101 using a unique protocol (203). In this case, the AAA server 101 inserts necessary data values into an authentication request message according to a unique algorithm, for example, EAP-MD5, EAP-AKA, EAP-TLS, USIM, for user authentication of the terminal 112. Transfer to the terminal 112 via the network access server 103 (204, 205). The terminal 112 receiving the authentication message generates a hash value (HV) authentication information corresponding to the authentication request message, and transmits the authentication value to the AAA server 101 through the network access server 103 (206 and 207). The AAA server 101 compares the hash value HV generated by the algorithm with the hash value HV of the authentication information transmitted from the terminal 112 (208), and compares the resulting authentication result with the terminal 112. (209, 210). In this case, when authentication is preempted, the terminal 112 is allocated an IP address that can be used for transmission of an IP packet from the access network N _A1 (211). When the L3 address is normally allocated to the terminal 112 by the above process, the L3 registration step is performed on the home agent 102 of the core network Nc according to the mobility protocols (MIP and PMIP) of the used L3 (212). . Through this, the home agent 102 configures binding information of the terminal 112 composed of the L2 address of the terminal 112 and the home address (HoA) and the home agent 102 of its own IP address, and the terminal 112 of the terminal 112. Recorded in the binding table (213). Through this, the terminal 112 can access a network and use a desired service.

When the terminal 112, which has been initially connected in the broadband integrated network BcN, moves to another access network N _A2 or N _A3 , handoff is performed. In general, the handoff in the existing broadband integrated network (BcN) is performed in almost the same way as the initial connection described above. However, the difference between the initial connection and the handoff of the terminal 112 in the existing broadband integrated network (BcN) is that the secondary address (CoA) is assigned in the access network (N _A2 ) moved according to the handoff, the home agent 102 The binding information is created and stored by the information connecting the auxiliary address CoA to the home address HoA.

That is, in the conventional broadband integrated network (BcN), the access network connection authentication procedure and the technique do not consider the reconnection authentication method of the terminal 112 according to the L3 handoff, and the new connection and the handoff are practically the same. Is performed. For this reason, in the conventional broadband integrated network (BcN), the access authorization of the terminal 112 is performed through the same authentication process as the initial access network access procedure, and the registration procedure according to the L3 movement of the terminal is performed only after the access authorization is made. Therefore, considerable delay time occurs in handoff of the terminal, and it is an obstacle in providing high quality and high speed data service.

Accordingly, an object of the present invention is to minimize authentication and mobility management procedures according to reconnection when handoff of a terminal in a broadband integrated network, to minimize delay due to authorization and mobility management, and to provide fast handoff and thereby high quality data service. It is to provide a broadband integrated network for the mobile terminal high-speed authentication and mobility management to provide a high-speed authentication and mobility management method.

In order to achieve the above object, a broadband integrated network according to the present invention is a broadband integrated network including a core network and a plurality of access networks connected to the core network to provide a data service including voice to a mobile node. The mobile node creating a registration request message to access the access network; A POE that configures wireless communication with the mobile node and grants a second layer ID (L2_ID) included in the registration request message when the mobile node accesses the access network; A network access server (NAS) which configures the POE and the access network, is connected to the mobile node by the POE, and adds its own IP address (NAS_IP) to the registration request message transmitted from the mobile node. ; A core mobility management server constituting the core network and determining whether a connection of the mobile node is an initial connection or a handoff connection when the registration request message is transmitted from the network access server, and selecting an authentication process according to the determination result; An authentication authorization server performing connection authentication according to the initial connection of the mobile node according to a request of the core mobility management server and providing the connection authentication result and authentication information according to the initial connection to the core mobility management server; It is configured to include.

The core mobility management server checks whether the binding information is stored in the connection information of the mobile node in order to determine whether the connection of the mobile node is the first connection or the handoff connection, and the binding information is stored. If present, the mobile node is recognized as the handoff connection.

The core mobility management server, when the connection of the mobile node is the first connection, requests the authentication authorization server to authenticate the connection of the mobile node by using the registration request message.

The core mobility management server includes a second layer ID included in the registration request message, the IP address (NAS_IP) of the network access server, and the mobile node together with authentication information provided according to the initial access authentication of the mobile node. Create and store binding information having any one or more of the location information.

When the connection of the mobile node is the handoff connection, the core mobility management server performs connection authentication of the mobile node using authentication information of the binding information, and updates and stores binding information of the mobile node.

Mobile node high-speed authentication and mobility management method according to the present invention is connected to the core network and the core network including the authentication authorization server and the core mobility management server to provide a data service including voice to the mobile node, A mobile node fast authentication and mobility management method for authentication and access according to initial access and handoff in a broadband integrated network having a plurality of access networks including a network access server, the method comprising: A second layer connection step of performing a two-layer connection and granting a second layer ID to the mobile node from the POE; A registration request step of creating a registration request message by the mobile node to request access authentication; A registration information transfer step of transmitting the registration request message to the core mobility management server through the network access server; Determining whether there is binding information in which previous connection information is recorded to determine whether the connection authentication is due to the initial connection of the mobile node or the handoff connection; An authentication step of performing initial authentication according to the initial connection of the mobile node when the binding information does not exist, and performing handoff access authentication according to the handoff connection when the binding information exists; And an authentication result delivery step of delivering the authentication result of the authentication step to the mobile node through the network access server.

The registration request message created in the registration request step includes the second layer ID.

In the registration information delivery step, the network access server adds the IP address (NAS_IP) information of the network access server to the registration request message.

The initial authentication step of the authentication step includes the core mobility management server requesting authentication of the mobile node from the authentication authorization server by the registration request message; The authentication of the mobile node by the authentication authorization server; Transmitting, by the authentication authorization server, the authentication result and authentication information according to the authentication to the core mobility management server; and the core mobility management server together with the authentication information, a second layer ID included in the registration request message, And generating and storing binding information having at least one of the IP address (NAS_IP) of the network access server and the location information of the mobile node.

The handoff access authentication step of the authentication step is performed by the core mobility management server to perform connection authentication of the mobile node using the authentication information included in the binding information and the binding information according to the connection authentication. It further comprises an update step of updating.

The broadband integrated network and the fast authentication and mobility management method for mobile terminal high speed authentication and mobility management according to the present invention minimize authentication and mobility management procedures due to reconnection when the terminal is handed off in a broadband integrated network, thereby managing authentication and mobility. By minimizing the delay caused, it is possible to provide a fast handoff and thereby provide a high quality data service.

Hereinafter, exemplary embodiments of the present invention will be described with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. In the accompanying drawings, it should be noted that the same reference numerals are used in the drawings to designate the same configuration in other drawings as much as possible. In describing the present invention, when it is determined that a detailed description of a related known function or known configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, certain features set forth in the drawings are enlarged or reduced or simplified for ease of description, and the drawings and their components are not necessarily drawn to scale. However, those skilled in the art will readily understand these details.

3 is an exemplary configuration diagram showing a configuration of a broadband integrated network according to an embodiment of the present invention.

Broadband integrated network according to an embodiment of the present invention is configured to include an authentication authorization server 310, core mobile management server 320, network access server 330, POE 360 and mobile node 370.

Authentication Auhorization Account (hereinafter referred to as "AAA server", 310) is the core mobility management server (Core Mobility Manger, hereinafter referred to as "CMM server", 320) to configure the core network (Nc), mobile The node 370 performs connection authentication. To this end, the AAA server 310 performs an access authentication procedure of the mobile node 370 according to the authentication request message (A_RE) transmitted from the CMM server 320 when the mobile node 370 is initially connected, and determines whether to authenticate the access. The CMM server 320 and a network access server (Network Access Server, hereinafter referred to as "NAS server", 360) through the mobile node 370 is delivered. The authentication request message (A_RE) is generated from the mobile node 370 is delivered to the CMM server 320 through the NAS server 330. The authentication request message A_RE includes the IP address of the NAS server 330 via the L2 ID L2_ID of the mobile node 370 and is transmitted. That is, in the embodiment of the present invention, unlike the conventional broadband integrated network (BcN), the access authentication is performed by the AAA server 310 only at the first connection of the mobile node 370, and in the subsequent handoff process, the AAA server. Authentication and mobility management is made through the CMM server 320 without access to (310).

The CMM server 320 configures the AAA server 310 and the core network Nc, and performs location registration and mobility control functions of the mobile node 370 connected through the access networks NA: NA1 to NA3. The CMM server 320 authenticates the connection of the imitating node 370 to the AAA server 310 by using the authentication request message A_RE transmitted through the NAS server 330 when the mobile node 370 is initially connected. Request, and transmits the authentication response according to the access authentication to the mobile node 370 through the NAS server 330. In addition, in this process, the CMM server 320 creates, stores and manages binding information (MN_BI) of the mobile node 370 according to the authentication. To this end, the CMM server 320 records and manages binding information (MN_BI) by using information of a CIT (Customer Interaction Tracker, not shown). The L2 ID L2_ID, the authentication information AU_D, and the location information of the mobile node 370 are recorded and stored in the binding information MN_BI. Meanwhile, the CMM server 320 performs connection authentication of the mobile node 370 using the authentication information (AU_D) stored when the mobile node 370 is handed off, and uses the information included in the authentication request message A_RE. Update and store the location information included in the binding information MN_BI. In the present invention, the authentication is performed according to the handoff by the CMM server 320, it is possible to omit the time required for the authentication process with the AAA server 310 to provide a service without a delay due to the connection.

The NAS server 330 forms an access network (NA: NA1 to NA3) together with a POE (PoA: 360, referred to as “PoA”, 360), and is connected to the mobile node 370 through the PoA 360. ) Is connected to the core network (Nc). The NAS server 330 transmits a registration request message A_RE, which is created and transmitted from the mobile node 370 to the CMM server 320 of the core network Nc, upon initial connection or handoff of the mobile node 370. . At this time, the NAS server 330 adds its IP address to the registration request message (A_RE) and delivers it. A plurality of PoAs 360 may be connected to the NAS server 330 to form an access network NA. To this end, the NAS server 330 is configured to include an access network mobility manager (AMM: " AMM "), and includes a mobile node including processing of a registration request message (A_RE) by this AMM. Mobility management of 370 is performed.

The PoA 360 configures an access server (NA) with the NAS server 330. The PoA 360 serves as an access point for the mobile node 370, and for this purpose, establishes a wireless communication environment with the mobile node 370. To this end, the PoA 360 performs an L2 connection between the mobile node 370 and the mobile node 370 when entering the access network NA.

The mobile node 370 is used as a terminal for a user to use a service provided through a broadband integrated network (BcN). The mobile node 370 creates an authentication request message (A_RE) upon initial entry of the access network (NA) or handoff between the access networks (NA), and delivers it to the NAS server 330 through the PoA 360. . At this time, the mobile node 370 transfers the L2 ID (L2_ID) used for L2 access authentication to the authentication request message (A_RE).

4 is a flowchart illustrating a fast authentication and mobility management method according to the present invention.

Referring to Figure 4, the fast authentication and mobility management method according to the present invention L2 connection step (S100), MN registration request step (S110), MN registration information transfer step (S120), binding information presence step (S130), MN authentication step (S140, S150), the authentication result delivery step (S160), the service providing step (S170) and the connection termination is determined, including the step (S180). Here, the MN authentication step (S140, S150) step further comprises AAA-MN authentication step (S140), CMM authentication step (S150).

In the L2 access step (S100), the mobile node 370 performs a connection for communication with the PoA 360 according to initial entry or handoff to the access network NA. This L2 connection step (S100) proceeds using the L2 layer technology provided by each access network (NA). In addition, in this L2 connection step (S100), the mobile node 370 is given an L2 ID (L2_ID) for L2 connection.

In the MN registration request step (S110), the mobile node 370 connects to the PoA 360 by the L2 access step (S100), and performs an authentication process for access of the access network (NA). To this end, in the MN registration request step (S110), the mobile node 370 prepares a registration request message A_RE for accessing the access network NA. The registration request message A_RE generated in the MN registration request step S110 includes the L2 ID L2_ID given in the aforementioned L2 connection step S100.

MN registration information transfer step (S120) is a registration request message (A_RE) created in the mobile node 370 is delivered to the CMM server 320 and AAA server 310 of the core network (Nc) through the NAS server 330 Step. To this end, the MN registration information transfer step (S120) is a step in which a registration request message (A_RE) is transferred from the mobile node 370 to the NAS server 330, and the NAS server to the registration request message (A_RE) by the NAS server 330. The IP address (NAS_IP) of 330 is added, and the registration request message A_RE is transmitted from the NAS server 330 to the CMM server 320. That is, the registration request message A_RE generated by the mobile node 370 in the MN registration information transfer step S120 is transmitted to the NAS server 330 through the PoA 360. The NAS server 330 receiving the registration request message A_RE rewrites the registration request message A_RE by adding the IP address (NAS_IP) of the NAS server 330 to the registration request message A_RE. The request message A_RE is transmitted to the core network Nc. Here, the L2 ID (L2_ID) and the IP address (NAS_IP) added to the registration request message (A_RE) are used for recognition and classification of the mobile node 370, and the home node (HoA) and hand of the mobile node when initially connected. It may be information used as an auxiliary address (CoA) of the mobile node 370 when off. In addition, the L2 connection step (S110), MN registration request step (S120) and MN registration information transfer step (S130) is the same procedure is performed even if the mobile node 370 is initially connected to the access network (NA) or handed off. .

Binding information check step (S130) is a step of distinguishing whether the access network (NA) connection of the mobile node 370 is the first connection or the connection by handoff. In the binding information confirmation step (S130), the CMM server 320 that receives the registration request message A_RE is whether the mobile node 370 that transmits the registration request message A_RE is initially connected or reconnected by handoff. In order to check, the binding information MN_BI for the mobile node 370 is searched through the CIT. For example, when the mobile node 370 accesses the access network NA differently by handoff, the binding information MN_BI of the mobile node 370 exists, and the CMM server 320 uses the mobile node ( It is recognized that 370 is handed off and requested to reconnect. On the other hand, if there is no binding information (MN_BI) for the mobile node 370, it is recognized as the initial access and proceeds thereafter.

In the MN authentication step (S140, S150), connection authentication of the mobile node 370 is performed. MN authentication step (S140, S150) is divided into two forms. One is an initial authentication process performed by the mobile node 370 first accessing the access network NA, and the other is a handoff authentication generated by the mobile node 370 moving the access network NA. If the binding information (MN_BI) for the mobile node 370 is present in the above-described binding information existence step (S130), the handoff, otherwise the initial connection is recognized and the process proceeds. Because of the process for each of these MN authentication step (S140, S150) is configured to further include AAA-MN authentication step (S140) and CMM authentication step (S150).

First, the AAA_MN authentication step (S140) corresponds to the initial authentication process, and the connection authentication regarding the mobile node 370 is performed between the AAA server 310 and the CMM server 320. The AAA_MN authentication step (S140) specifically includes an authentication request, authentication response, and binding information creation step. In the AAA_MN authentication step (S140), the CMM server 320 receives a registration request message (A_RE) transmitted through the NAS server 330. Accordingly, the CMM server 320 requests the AAA server 310 to authenticate the access to the mobile node 370. The AAA server 310 performs a connection authentication process according to the access authentication request of the CMM server 320, and provides the CMM server 320 with an authentication response according to the result. If the connection authentication of the mobile node 370 succeeds according to the authentication response, the CMM server 320 creates the binding information (MN_BI) of the mobile node 370 by using the information of the authentication response and the registration request message (A_RE). It is stored and managed through CIT. Here, the binding information MN_BI includes authentication information, L2 ID L2_ID, and IP address (NAS_IP) information of the NAS server 330. In addition, the authentication process between the AAA server 310 and the CMM server 320 may use the EAP-MD5, AKA, TLS and USIM algorithm, for this purpose, the registration request message (A_RE) in the CMM server 320 is a mobile node ( The hash of each mobile node 370 may be included and transmitted to perform the authentication process on behalf of 370. However, this does not limit the present invention. In addition, the location information of the mobile node 370 is recorded and stored in the binding information MN_BI stored by the CMM server 320.

On the other hand, the CMM authentication step (S150) corresponds to the handoff authentication is performed by the CMM server 320 itself. It is determined that the binding information (MN_BI) of the mobile node 370 exists in the binding information presence check step (S130), and the registration request message A_RE received is determined to be due to the handoff of the mobile node 370. do. According to the handoff of the mobile node 370, when the registration request message A_RE is transmitted by the above-described L2 connection step S110 to MN path information delivery step S120, the CMM server 320 binds to the binding information MN_BI. Using the authentication information stored in the) to perform the access authentication process of the mobile node 370. The CMM server 320 determines the access authentication of the mobile node 370 according to the processing of the authentication process, and updates the location information of the mobile node 370 recorded in the binding information MN_BI, for example, the NAS address (NAS_IP). Will be stored.

The authentication result delivery step (S160) is a step in which the CMM server 320 delivers the result of the connection authentication performed in the aforementioned MN authentication steps S140 and S150 to the NAS server 330 and the mobile node 370. In the authentication result delivery step (S160), the CMM server 320 is the NAS server 330 and the mobile node (3) to which the mobile node 370 accesses the authentication result according to the connection authentication or its own connection authentication by the AAA server 310 ( 370 to notify that the access authentication is complete.

In the service providing step S170, the mobile node 370, which has been informed of the completion of the access authentication, uses a wide area service such as voice / data communication and a broadcast service provided through the broadband integrated network through the access network NA.

In the connection termination determination step (S180), the mobile node 370 is a step of determining whether the power is turned off, the call is released, or the handoff is made. This connection termination determination step (S180) is a step performed by the PoA 360, NAS server 330, CMM server 320 and AAA server 310 comprehensively. That is, when the power of the mobile node 370 is turned off, it is determined that the connection is terminated when the mobile node 370 is removed, and the service is stopped, while the CMM server 320 deletes the stored binding information or separate storage space. Management procedures such as storing them in the library will be performed. On the other hand, when the mobile node 370 is continuously connected, the handoff is determined by determining whether to perform a new L2 connection and generating an MN registration request.

As can be seen from the above description, the broadband integrated network for mobile terminal high speed authentication and mobility management according to the present invention, and the high speed authentication and mobility management method use separate authentication methods for initial connection and handoff connection. Authenticate In particular, when a connection occurs due to handoff, the authentication process between the AAA server and the mobile node 370 is omitted and managed by the CMM server, thereby preventing connection delay due to repeated authentication during handoff. Such matters can be more easily confirmed through FIG. 5 to be described below.

5 is a signal flow diagram illustrating a flow of signals and procedures between components in a broadband integrated network for mobile terminal high speed authentication and mobility management according to the present invention, and a high speed authentication and mobility management method.

Referring to FIG. 5, the mobile node 370 enters the first access network NA1 of the access network NA and attempts to access the mobile node 370. Accordingly, L2 connection is performed with the first PoA 361 of the first access network NA1 (S210). When the L2 connection between the mobile node 370 and the first PoA 361 is completed, the mobile node 370 receives a registration request message (A_RE) including an L2 ID (L2_ID) obtained according to the L2 connection to authenticate the connection. The created registration request message A_RE is transmitted to the first NAS server 331 of the first access network NA1 (S220).

The first NAS server 331 that receives the registration request message A_RE adds its NAS address NAS_IP to the registration request message A_RE, and writes the rewritten registration request message A_RE into the core network Nc. It passes to the CMM server 320 (S230). Upon receiving the registration request message A_RE from the first NAS server 331, the CMM server 320 requests connection authentication from the AAA server 310 according to the received registration request message A_RE (S240). When an access authentication request occurs, the AAA server 310 processes the authentication process according to the request and transmits a response to the CMM server 320 (S250). When a response to the authentication is received from the AAA server 310, the CMM server 320 creates binding information (MN_BI) to be stored and managed through the CIT (S260). In addition, the CMM server 320 transfers the registration result for the access authorization request to the first NAS server 331 (S270), and the first NAS server 331 transfers the registration result to the mobile node 370 again. This is a series of initial connection processes.

On the other hand, when the mobile node 370 authenticated by the connection is handed off from the first access network NA1 to the second access network NA2, the re-authentication process is performed. This re-authentication process, i.e., handoff connection, proceeds in a procedure similar to that of the initial connection, as shown in FIG. The handoff connection is basically performed in the same manner as the initial connection, but there is a difference in the authentication process by the CMM server 320. Therefore, detailed description of the same process as described above will be omitted. In the handoff connection, the L2 connection process is performed according to the L2 handoff (S210 '), a registration request is generated from the mobile node 370, and transferred to the second NAS server 332 (S270'), and the second NAS server. 332 transmits the registration request message (A_RE) to the CMM server (320).

In this handoff connection, the CMM server 320 performs connection authentication for the mobile node 370 instead of the AAA server 310. In the initial connection, the CMM server 320 receives a response to the authentication result from the AAA server 310, and in this case, receives the authentication information necessary for authentication in addition to the authentication result and stores it as binding information (MN_BI). When the handoff connection is performed, the CMM server 320 performs connection authentication to the mobile node 370 without going through the AAA server 310 using the authentication information and other information recorded in the binding information MN_BI. Then, when the connection authentication is made, the CMM server 320 updates the location information according to the handoff of the mobile node 370 (wherein the location information update includes the update of the NAS address NAS_IP). MN_BI) is updated and stored, and then the authentication result is notified to the second NAS server 332 and the mobile node 370 as described above (S270 ', S280').

1 is an exemplary diagram showing a configuration of a general broadband integrated network.

FIG. 2 is a signal flow diagram illustrating a terminal access and a handoff process of a terminal in the broadband integrated network of FIG.

3 is an exemplary configuration diagram showing a configuration of a broadband integrated network according to an embodiment of the present invention.

4 is a flow chart illustrating a fast authentication and mobility management method according to the present invention.

5 is a signal flow diagram illustrating a flow of signals and procedures between components in a broadband integrated network for mobile terminal high speed authentication and mobility management according to the present invention, and a high speed authentication and mobility management method.

<Description of the symbols for the main parts of the drawings>

101, 310: AAA server

102: home agent

103, 104, 105, 330: network access server

106, 107, 108, 109, 110, 111, 360: PoA

112, 370: Mobile nodes

320: CMM server

Claims (10)

In the broadband integrated network comprising a core network and a plurality of access networks connected to the core network to provide data services including voice to the mobile node, The mobile node creating a registration request message to access the access network; A POE that configures wireless communication with the mobile node and grants a second layer ID (L2_ID) included in the registration request message when the mobile node accesses the access network; A network access server (NAS) which configures the POE and the access network, is connected to the mobile node by the POE, and adds its own IP address (NAS_IP) to the registration request message transmitted from the mobile node. ; A core mobility management server constituting the core network and determining whether a connection of the mobile node is an initial connection or a handoff connection when the registration request message is transmitted from the network access server, and selecting an authentication process according to the determination result; And An authentication authorization server that performs connection authentication according to the initial connection of the mobile node according to a request of the core mobility management server, and provides the connection authentication result and authentication information according to the initial connection to the core mobility management server; Broadband integrated network, characterized in that configured to include. The method of claim 1, The core mobility management server In order to determine whether the connection of the mobile node is the first connection or the handoff connection, it is determined whether to store the binding information in which the connection information of the mobile node is recorded, and if the binding information is stored, And recognizing a connection as the handoff connection. The method of claim 2, The core mobility management server, And a connection request of the mobile node to the authentication authorization server by using the registration request message when the mobile node is connected for the first time. The method of claim 3, wherein The core mobility management server includes a second layer ID included in the registration request message, the IP address (NAS_IP) of the network access server, and the mobile node together with authentication information provided according to the initial access authentication of the mobile node. Broadband integrated network, characterized in that for creating and storing binding information having any one or more of the location information. The method of claim 4, wherein The core mobility management server, If the connection of the mobile node is the handoff connection, authentication of the mobile node is performed using authentication information of the binding information, Broadband integrated network, characterized in that for updating and storing the binding information of the mobile node. In order to provide a data service including voice to a mobile node, a core network including an authentication authorization server and a core mobility management server, and a plurality of access networks connected to the core network and configured to include a POE and a network access server In the high-speed mobile node authentication and mobility management method for authentication and access according to initial access and handoff in a broadband integrated network, A second layer connection step of performing a second layer connection between the mobile node and the POE and granting a second layer ID to the mobile node from the POE; A registration request step of creating a registration request message by the mobile node to request access authentication; A registration information transfer step of transmitting the registration request message to the core mobility management server through the network access server; Determining whether there is binding information in which previous connection information is recorded to determine whether the connection authentication is due to the initial connection of the mobile node or the handoff connection; An authentication step of performing initial authentication according to the initial connection of the mobile node when the binding information does not exist, and performing handoff access authentication according to the handoff connection when the binding information exists; And The authentication result delivery step of delivering the authentication result of the authentication step to the mobile node through the network access server; Mobile node high-speed authentication and mobility management method comprising a. The method of claim 6, The mobile node high-speed authentication and mobility management method, characterized in that the registration request message created in the registration request step includes the second layer ID. The method of claim 7, wherein The registration information delivery step, The method of claim 1, wherein the network access server adds the IP address (NAS_IP) information of the network access server to the registration request message. The method of claim 8, The initial authentication step of the authentication step Requesting, by the core mobility management server, authentication of the mobile node from the authentication authorization server by the registration request message; The authentication of the mobile node by the authentication authorization server; Transmitting, by the authentication authorization server, an authentication result and authentication information according to the authentication to the core mobility management server; The core mobility management server, together with the authentication information, binding information having at least one of a second layer ID included in the registration request message, the IP address (NAS_IP) of the network access server, and location information of the mobile node. Mobile node high-speed authentication and mobility management method characterized in that it further comprises the step of creating and storing. The method of claim 9, The handoff connection authentication step of the authentication step An authentication step of the core mobility management server performing access authentication of the mobile node using the authentication information included in the binding information; Mobile node high-speed authentication and mobility management method characterized in that it further comprises the step of updating the binding information in accordance with the access authentication.

Images