KR101058100B1 - Node authentication and noce operation methods within service and asccess networks for bundle authentication bewteen service and access networks in NGN environment - Google Patents

Abstract

Disclosed are a method for operating a node and a node operating in a service network and an access network for bundle authentication between a service network and an access network in a next generation network. The present invention provides a bundle authentication method of a terminal in a network including an entity for network access control (NAC) and an entity for service control (SC), the method comprising: accessing a network after authentication at an NAC entity; Sending a SIP register message to the SC entity; And if the authentication at the SC entity is successful, receiving a message from the SC entity.

Description

Node authentication and noce operation methods within service and asccess networks for bundle authentication bewteen service and access networks in NGN environment}

The present invention relates to a bundle authentication, in particular, when a subscriber joins a service network and an access network together in a next generation network (NGN), a service network for bundle authentication between a service network and an access network of a subscriber station And a method for authenticating and operating nodes in an access network.

Assume that access lines and service providers share physical line information in advance in NGNs of existing International Telecommunication Union-Telecommunication Standardization Sector (ITU-T) and The Telecoms & Internet converged Services & Protocols for Advanced Networks (TISPAN) lets do it. In this case, if the access authentication is successful when the subscriber accesses the access network, the subscriber with the same line information is authenticated in the service network without a special authentication key exchange mechanism.

Looking at the current ITU-T and TISPAN documents, the SCF (Service Control Function), which is responsible for session control, registration, authentication, and authorization at the service level, accesses the NGN service to obtain physical line information. The network attachment identification functions (NACFs), which provide network level identification / authentication functions for registration functions of subscribers, are queried for line information using an IP address as a key. In general, however, there are several NACFs in one SCF, i.e., when there are various NACFs, there is no specific statement as to which NACF the SCF selects.

On the other hand, according to the existing SCF-NACF bundle authentication, when the access authentication managed by a specific NACF succeeds only for fixed subscribers, the terminal performs the SCF-NACF bundle authentication with the IP address and realm that the terminal successfully authenticated. If a subscribed service user ID is required, that is, a PUID (PUblic user ID) and a PRID (PRivate user ID), the service authentication is successful. This is because there are four conditions.

Upon successful access authentication, a subscriber ID that successfully accesses the access network is assigned a relam with one IP address per line ID. The P-CSC-FE (Proxy Call Session Control Functional Entity) obtains a service user ID, IP and realm, from a terminal, and obtains a line ID using IP and realm from a transport location management functional entity (TLM-FE). When a particular SCF and NACF are bundled in a SUP-FE (Service User Profile Functional Entity), the line ID of NACF is stored in advance for the service user ID (for fixed subscribers, the specific line ID is fixed to the subscriber). have). The Serving Call Session Control Functional Entity (S-CSC-FE) determines whether the line ID received from the P-CSC-FE and the line ID received from the SUP-FE are the same to authenticate.

In addition, the NACF-SCF bundle authentication scheme in the ITU-T and TISPAN documents is line-based and therefore only applicable to fixed networks such as xDSL. Therefore, it cannot be used in a WLAN or WiBro network in which a terminal moves.

The technical problem to be achieved by the present invention is to register the TLM-FE address of the NACF to the P-CSC-FE to provide an SCF and NACF node authentication and operation method for SCF-NACF bundle authentication for mobile subscribers.

In order to achieve the above technical problem, the present invention provides a bundle authentication method of a terminal in a network including an entity for network access control (NAC) and an entity for service control (SC), wherein the network after authentication in the NAC entity Connecting; Sending a SIP register message to the SC entity; And receiving a message from the SC entity when the authentication at the SC entity is successful.

In order to achieve the above technical problem, the present invention provides a bundle authentication method of an NAC entity in a network including an entity for network access control (NAC) and an entity for service control (SC), the method comprising: authenticating a terminal; And transmitting subscriber identification information and authentication information to the SC entity.

In order to achieve the above technical problem, the present invention provides a proxy call session service function entity (P-CSC-PE) of the SC entity in a network including an entity for network access control (NAC) and an entity for service control (SC). An authentication method in a), the method comprising: receiving a SIP register message from a terminal; Sending a request message for authentication information to the NAC entity; Receiving authentication information of the terminal from the NAC entity; And adding the received authentication information to the SIP register message and transmitting the received authentication information.

In order to achieve the above technical problem, the present invention provides a serving call session control function entity (S-CSC-PE) of the SC entity in a network including an entity for network access control (NAC) and an entity for service control (SC). A bundle authentication method according to claim 1, comprising: receiving a SIP register message to which first authentication information is added; Sending an authentication request message to a service user profile function entity (SUP-PE); Receiving a response message including second authentication information from the SUP-PE; And comparing and authenticating the first authentication information with the second authentication information.

In order to achieve the above technical problem, the present invention provides a service user profile function entity (SUP-PE) of the SC entity in a network including an entity for network access control (NAC) and an entity for service control (SC). A bundle authentication method, comprising: receiving an authentication request message from a serving call session control function entity (S-CSC-PE) of the SC entity; And transmitting a response message including authentication information to the S-CSC-PE.

According to the present invention, NACF-SCF bundle authentication may be performed regardless of wired or wireless access in the NGN. While the conventional invention is capable of NACF-SCF bundle authentication only in a wired line, the present invention can be applied regardless of wired or wireless subscribers. In addition, when using the present invention, if NACF-SCF authentication is registered in NGN, if authentication is successful in NACF, the additional authentication procedure is simplified in SCF, and the service user can simplify the service authentication procedure and additionally enter a password. Can be reduced.

1 is a block diagram of a system to which the present invention is applied.
2 is a flowchart illustrating a bundle authentication method between a service network and an access network for a wired / wireless terminal in an NGN.
3 is a flowchart illustrating a method of performing bundle authentication between a service network and an access network of a wired / wireless terminal using a bundle authentication management server 14 in NGN.

1 is a block diagram of a system to which the present invention is applied.

The illustrated system comprises an NGN terminal section 10, a connection section 11, a NACF section 12 and an SCF section 13. If necessary, the system may further include a bundle authentication management server 14. Reference numerals 15 and 16 also denote wired and wireless communication networks. There may be a plurality of wired and wireless communication networks 15 and 16, and accordingly, a plurality of NACF units 12 and SCF units 13 may be provided.

The NGN terminal unit 10 includes a WLAN terminal 101, a WiBro terminal 102, a cable terminal 103, and an ADSL terminal 104.

The connection unit 11 is a device for packet connection of each NGN terminal, an access point (111) connected to the WLAN terminal 101, a remote access server 112 connected to the WiBro terminal 102, and a cable. It is connected to the terminal 103, and comprises a CM unit 113 consisting of a cable modem (CM) and a cable modem termination system (CMTS). ADSL terminal 104 connects to wired and wireless communication network 16 via an ADSL line.

The NACF unit 12, which is an access control network, is in charge of IP address allocation and access authentication for an access, an access management functional entity 121 for performing access management, and a TLM-FE for managing a transmission location. Location Management Functional Entity (122), Transport Authentication & Authorization Functional Entity (TAA-FE) / TUP-FE (Transport User Profile Functional Entity, 123) in charge of authentication.

The SCF unit 13, which is a service control network, is in charge of service routing and service authentication, and serves as a proxy call session control functional entity (P-CSC-FE) 131 (S-CSC-FE / I-CSC-FE). Control Functional Entity / Interrogating Call Session Control Functional Entity (132), Service Authentication & Authorization Functional Entity (SAA-FE) / Service User Profile Functional Entity (133).

The bundle authentication management server 14 is responsible for exchanging authentication information between the NACF unit 12 and the SCF unit 13, and stores a service user ID corresponding to the subscriber ID when the subscriber subscribes to the bundle.

2 is a flowchart illustrating a bundle authentication method between a service network and an access network for a wired / wireless terminal in an NGN.

First, the terminal of the NGN terminal unit 10 receives access authentication from the TAA-FE / TUP FE 123 through the AM FE 121 (step 20). If authentication is successful, the TAA-FE / TUP FE 123 determines whether the corresponding subscriber is subscribed to the NACF-SCF bundle service (step 21). When subscribed, the TAA-FE / TUP FE 123 transmits authentication information to the TLM-FE 122 using the global IP address as a key, and the TLM-FE 122 transmits the authentication information and its address to the P-CSC-. Send to FE 131 (step 22). In addition, the TAA-FE / TUP FE 123 sends authentication information to the SAA-FE / SUP FE 133 using the subscriber ID as a key (step 37). Here, the SAA-FE / SUP FE 133 stores a service user ID corresponding to the subscriber ID when the subscriber subscribes to the bundle.

If the subscriber is also subscribed to the NGN SCF and attempts to authenticate service registration, the subscriber station transmits a Session Initiation Protocol (SIP) register message to the P-CSC-FE 131 (step 23).

The P-CSC-FE 131 checks whether the service user is subscribed to the NACF-SCF bundle (step 24). The check is made by determining whether there is valid access authentication information mapped to the global IP address of the terminal. If there is no valid access authentication information, the P-CSC-FE 131 requests authentication information from the TLM-FE 122 using the address of the TLM-FE 122 (step 25), and the TLM-FE ( 122, authentication information is received (step 26).

The P-CSC-FE 131 includes the authentication information in the SIP register message and sends it to the S-CSC-FE / I-CSC-FE 132 (step 27). The SIP register message is obtained from the subscriber when the subscriber subscribes. Includes PUID and PRID.

The S-CSC-FE / I-CSC-FE 132 sends the SAA-FE / SUP-FE 133 with the PUID and PRID included in the SIP register message as a bundle and whether the SAA-FE / SUP-FE ( In step 133, a MAR (Multimedia Authentication Request) message for requesting authentication information registered is sent (step 28), and a MAA (Multimedia Authentication Answer) message including authentication information is obtained (step 29).

The S-CSC-FE / I-CSC-FE 132 compares the authentication information received from the TLM-FE 122 with the authentication information received from the SAA-FE / SUP-FE 133 to determine whether they are the same (30). step). If the two authentication information is not the same, it is determined that the authentication has failed and informs that the terminal authentication has failed through the P-CSC-FE 131 (step 31). If the authentication is successful, the S-CSC-FE / I-CSC-FE 132 sends the SA-CSC-FE information to which the user terminal belongs by using the Server Assignment Request (SAR) message. ), And receives the service user's profile and billing information from the SAA-FE / SUP-FE 133 using a Server Assignment Answer (SAA) message (step 33).

The S-CSC-FE / I-CSC-FE 132 sends a service registration success message for the SIP register to the subscriber station through the P-CSC-FE 131 (step 34).

3 is a flowchart illustrating a method of performing bundle authentication between a service network and an access network of a wired / wireless terminal using a bundle authentication management server 14 in NGN. In FIG. 3, the steps having the same reference numerals as those of FIG. 2 have the same operation, and thus a detailed description thereof will be omitted and only the steps having different reference numbers will be described.

In step 22 illustrated in FIG. 2, the TAA-FE / TUP-FE 123 transmits authentication information to the bundle authentication management server 14 using the subscriber ID as a key (step 45). The TAA-FE / TUP FE 123 also sends the authentication information to the bundled authentication management server 14 using the subscriber ID as a key (step 46). Here, the bundle authentication management server 14 stores a service user ID corresponding to the subscriber ID when the subscriber subscribes to the bundle.

In addition, when the S-CSC-FE / I-CSC-FE 132 requests the SAA-FE / SUP-FE 133 to verify the bundle authentication and authentication information using the MAR message in step 28 shown in FIG. 2, The SAA-FE / SUP-FE 133 transmits PRID and PUID to the bundle authentication management server 14 to request authentication information (step 40). Bundled authentication management server 14 delivers the authentication information for the subscriber to the SAA-FE / SUP-FE 133, SAA-FE / SUP-FE 133 includes the authentication information in the MAA message S- The data is transmitted to the CSC-FE / I-CSC-FE 132 (step 41).

The S-CSC-FE / I-CSC-FE 132 compares the authentication information received from the TLM-FE 122 with the authentication information received from the bundle authentication management server 14 to determine whether they are the same (step 42). If the two authentication information is not the same, it is determined that the authentication has failed and informs that the terminal authentication has failed through the P-CSC-FE 131 (step 31). If the authentication is successful, the S-CSC-FE / I-CSC-FE 132 registers the S-CSC-FE information to which the user terminal belongs by using the SAR message to the SAA-FE / SUP-FE 133 ( In step 43, a service user profile and billing information are received using the SAA message (step 44).

The S-CSC-FE / I-CSC-FE 132 sends a service registration success message for the SIP register to the subscriber station through the P-CSC-FE 131 (step 34).

Table 1 shows an example in which a subscriber ID, an IP address, a Realm, bundle information between an accessor network and a service network, an access authentication method, an authentication context, and a line ID are stored in a database of the TAA-FE / TUP-FE 123 of FIG. 1. It is shown.

Subscriber ID IP address Realm Bundle Information Access authentication method Authentication context Line ID sub1@etri.re.kr 123.456.789.123 etri.com Line Based SCF-NACF EAP-AKA RAND || AUTN || XRES || CK || IK xDSL line sub1@etri.re.kr 123.456.789.124 etri.com Authentication Information Based SCF-NACF nonce || response sub2@etri.re.kr 123.456.789.124 etri.com Not registered RAND || AUTN || XRES || CK || IK … … … … … … …

According to Table 1, one subscriber ID and authentication related information are matched in the form of a look-up table.

Table 2 stores PRID, PUID, IP address, Realm, bundle information between access network and service network, service authentication method, authentication context, line ID and valid time in database of P-CSC-FE 131 of FIG. An example is shown.

PRID PUID IP address Realm Bundle Information Service authentication method Authentication context Line ID Effective time user1@etri.re.kr sip: user1@etri.re.kr 123.456.789.123 etri.com Line Based SCF-NACF Line Based SCF-NACF xDSL line 60 user1@etri.re.kr tel: 01123456789 123.456.789.124 etri.com Authentication Information Based SCF-NACF Authentication Information Based SCF-NACF RAND || AUTN || XRES || CK || IK 50 user2@etri.re.kr sip: user2@etri.re.kr 123.456.789.124 etri.com Not registered Digest-MD5 … … … … … … … … …

In Table 2, PRID and PUID are keys.

Table 3 shows PRID, PUID, subscriber ID, IP address, bundle information between access network and service network, service authentication method, authentication context, in database of S-CSC-FE / I-CSC-FE 132 of FIG. An example of storing a line ID and a valid time is shown.

PRID PUID Bundle Information Service authentication method Authentication context Line ID Effective time user1@etri.re.kr sip: user1@etri.re.kr Line Based SCF-NACF Line Based SCF-NACF xDSL line 60 user1@etri.re.kr tel: 01123456789 Authentication Information Based SCF-NACF Authentication Information Based SCF-NACF RAND || AUTN || XRES || CK || IK 50 user2@etri.re.kr sip: user2@etri.re.kr Not registered Digest-MD5 … … … … … … …

Table 4 shows PRID, PUID, subscriber ID, Realm, bundle information between access network and service network, service authentication method, authentication context, line in database of S-CSC-FE / I-CSC-FE 132 of FIG. An example of storing an ID and a valid time is shown.

PRID PUID Subscriber ID Bundle Information Service authentication method Authentication context Line ID Effective time user1@etri.re.kr sip: user1@etri.re.kr sub1@etri.re.kr Line Based SCF-NACF Line Based SCF-NACF xDSL line 60 user1@etri.re.kr tel: 01123456789 sub1@etri.re.kr Authentication Information Based SCF-NACF Authentication Information Based SCF-NACF RAND || AUTN || XRES || CK || IK 50 user2@etri.re.kr sip: user2@etri.re.kr sub2@etri.re.kr Not registered Digest-MD5 … … … … … … … …

Table 5 shows PRID, PUID, subscriber ID, Realm, bundle information between access network and service network, access authentication method, authentication context, line ID and valid time in the database of the bundle authentication server 14 of FIG. An example is shown.

PRID PUID Subscriber ID Bundle Information Access authentication method Authentication context Line ID Effective time user1@etri.re.kr sip: user1@etri.re.kr sub1@etri.re.kr Line Based SCF-NACF EAP-AKA RAND || AUTN || XRES || CK || IK xDSL line 60 user1@etri.re.kr tel: 01123456789 sub1@etri.re.kr Authentication Information Based SCF-NACF EAP-AKA RAND || AUTN || XRES || CK || IK 50 user2@etri.re.kr sip: user2@etri.re.kr sub2@etri.re.kr Not registered … … … … … … … …

The invention can also be embodied as computer readable code. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD_ROM, magnetic tape, floppy disks, optical data storage devices, and the like, and also include those implemented in the form of carrier waves, for example, transmission over the Internet. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Herein, specific terms have been used, but they are used only for the purpose of illustrating the present invention and are not intended to limit the scope of the present invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

Claims (17)

delete delete delete delete In a network including an entity for network access control (NAC) and an entity for service control (SC), an authentication method in a proxy call session service function entity (P-CSC-FE) of an entity for the SC,
Receiving, by the proxy call session service function entity (P-CSC-FE) of the entity for the SC, a SIP register message from the terminal;
The proxy call session service function entity of the entity for the SC (P-CSC-FE) sending a request message for authentication information to the entity for the NAC;
Receiving, by the proxy call session service function entity (P-CSC-FE) of the entity for the SC, the authentication information of the terminal from the entity for the NAC; And
The interrogation call session control function entity (I-CSC-) of the entity for the SC by adding the received authentication information to the SIP register message by the proxy call session service function entity (P-CSC-FE) of the entity for the SC. FE); bundle authentication method in a P-CSC-FE comprising a. The method of claim 5,
The proxy call session service function entity (P-CSC-FE) of the entity for the SC transmits a request message for authentication information to the entity for the NAC, wherein the request message is sent to the entity for the NAC. Bundle authentication method in a P-CSC-FE comprising the step of transmitting to the management function entity (TLM-FE). The method of claim 5,
The receiving of the authentication information of the terminal from the entity for the NAC by the proxy call session service function entity (P-CSC-FE) of the entity for the SC may include a transmission location management function entity (TLM) of the entity for the NAC. -FE) receiving the authentication information of the terminal from the bundle authentication method in the P-CSC-PE characterized in that it comprises a. delete In a network including an entity for network access control (NAC) and an entity for service control (SC), a bundle authentication method in a serving call session control function entity (S-CSC-FE) of an entity for the SC ,
Receiving, by the serving call session control function entity (S-CSC-FE) of the entity for the SC, a SIP register message to which first authentication information is added;
Sending, by the serving call session control function entity (S-CSC-FE) of the entity for the SC, an authentication request message to a service user profile function entity (SUP-FE);
Receiving, by the serving call session control function entity (S-CSC-FE) of the entity for the SC, a response message including second authentication information from the SUP-FE; And
And a step of authenticating, by the serving call session control function entity (S-CSC-FE) of the entity for the SC, by comparing the first authentication information with the second authentication information. Bundle Authentication Method in. The method of claim 9,
The serving call session control function entity (S-CSC-FE) of the entity for the SC may transmit the authentication request message to the service user profile function entity (SUP-FE) in a multimedia authentication request (MAR). The bundle authentication method in S-CSC-FE comprising the step of transmitting a message. 10. The method of claim 9,
The serving call session control function entity of the entity for the SC (S-CSC-FE), if the authentication is successful, transmitting its information to the SUP-FE; S-CSC further comprises a Bundle Authentication Method in FE. The method of claim 11,
S-CSC-FE of the entity for the SC for transmitting the information of its own transmitting step using a server assignment request (SAR) message; S characterized in that it comprises a Bundle Authentication Method in CSC-FE. The method of claim 9,
The serving call session control function entity of the entity for the SC (S-CSC-FE), if the authentication is successful, further comprising the step of transmitting a response message to the terminal; Bundle authentication method. In a network including an entity for network access control (NAC) and an entity for service control (SC), a bundle authentication method in a service user profile function entity (SUP-FE) of an entity for the SC,
Receiving, by the service user profile function entity (SUP-FE) of the entity for the SC, an authentication request message from the serving call session control function entity (S-CSC-FE) of the entity for the SC; And
Transmitting, by the service user profile function entity (SUP-FE) of the entity for the SC, a response message including authentication information to the S-CSC-FE; and a bundle authentication method in the SUP-FE . The method of claim 14,
And before the service user profile function entity (SUP-FE) of the entity for the SC receives the authentication request message, receiving subscriber identification information and authentication information from the entity for the NAC. Bundle authentication method in SUP-FE. The method of claim 14,
If authentication at the S-CSC-FE is successful, the service user profile function entity (SUP-FE) of the entity for the SC receives the information of the S-CSC-FE from the S-CSC-FE; Bundle authentication method in the SUP-FE characterized in that it further comprises. 17. The method of claim 16,
Receiving information of the S-CSC-FE by the service user profile function entity (SUP-FE) of the entity for the SC includes receiving the service allocation request (SAR) message. Bundle authentication method in SUP-FE.

Images