KR101272576B1 - Android mobile device capable of connecting with I-WLAN, and method of connecting android mobile device with I-WLAN - Google Patents

Abstract

In the interworking wireless LAN (I-WLAN) connection method of the Android terminal, the connection between the Wi-Fi connection manager and the wireless access device included in the Android terminal is performed, and after the connection is completed, the wireless access device establishes a local IP (Internet) to the Android terminal. Assigning a protocol, and after the local IP is allocated, the I-WLAN native service unit included in the Android terminal performs tunneling with a packet data gateway (PDG) and is connected to the PDG (Authentication Authorization and Accounting). ) After the authentication of the Android terminal is performed through the server, the remote IP is allocated to the Android terminal.

Description

Android mobile device capable of connecting with I-WLAN, and method of connecting android mobile device with I-WLAN}

The present invention relates to a mobile communication terminal that can be connected to an interworking wireless LAN (I-WLAN), and more particularly, an Android terminal capable of connecting to an I-WLAN, and an I-WLAN of an Android terminal. Connection method.

I-WLAN (internetworking wireless LAN or interworking wireless LAN) is an international standard technology that enhances the security level of wireless LAN (wi-fi) used in coffee shops or subway stations up to now, and is connected from the terminal to the Wi-Fi network. It is a technology that encrypts the entire wired / wireless section up to the gateway to the backbone network.

Wi-Fi security is largely achieved by two methods of encrypting data to and from the network of authorized users. However, the data encryption method (WPA, Wi-Fi Protected Access) has been able to protect only data in the wireless section from a digital terminal such as a mobile phone or a computer or a notebook computer to a Wi-Fi access device (AP). Therefore, if I-WLAN is applied, security can be further enhanced by encrypting not only wireless sections but also Wi-Fi networks and subsequent wired networks.

An object of the present invention is to provide an Android terminal capable of accessing an I-WLAN, and an I-WLAN access method of an Android terminal.

In order to achieve the above technical problem, I-WLAN access method of the Android terminal according to an embodiment of the present invention, (a) the connection between the Wi-Fi connection manager and the wireless access device included in the Android terminal is performed and the connection is completed Assigning, by the wireless access device, a local IP (Internet Protocol) to the Android terminal; And (b) after the allocation of the local IP of step (a) is completed, the I-WLAN native service unit included in the Android terminal performs tunneling with a packet data gateway (PDG) and is connected to the PDG (Authentication Authorization). and Accounting) may include the step of assigning a remote IP to the Android terminal after the authentication of the Android terminal through the server.

The I-WLAN native service unit, when the connection through the Wi-Fi connection manager is performed by Extensible Authentication Protocol (EAP) -Authentication Key Agreement (AKA) full authentication, the I-WLAN native service unit fast I-WLAN connection authentication This can be done with EAP-AKA based on re-authentication.

The I-WLAN native service unit, when the I-WLAN automatic connection setting is enabled after completion of the connection between the Wi-Fi connection manager and the wireless access device through a UI (user interface) provided by the Wi-Fi connection manager, After the connection is completed, I-WLAN connection can be attempted automatically.

The I-WLAN native service unit may perform Internet Key Exchange v2 (IKEv2) based on the PDG and EAP-AKA and perform IPSec tunneling.

Step (b) may include: (b1) the I-WLAN native service unit and the PDG performing cryptographic algorithm negotiation, random number exchange, and Diffie-Hellman key exchange through IKE_SA_INIT message exchange; (b2) after the step (b1), the I-WLAN native service unit and the PDG performing EAP-AKA and IPsec security association (SA) initialization through an IKE_AUTH message; And (b3) after the step (b2), the I-WLAN native service unit and the PDG may complete a traffic selector negotiation for a new CHILD SA negotiation and an I-WLAN access policy transmission through an SA.

In the I-WLAN access method of the Android terminal, (c) after authentication is performed between the Android terminal and the AAA server, a data packet transmitted between the Android terminal and the PDG is IPsec (internet protocol security) ESP (Encapsulation). Security payload) may further include the step of encrypting.

In order to achieve the above technical problem, an Android terminal according to an embodiment of the present invention, a Wi-Fi connection manager for connecting to an external wireless access device (WiFi); And IKE (Internet Key Exchange) based on Packet Data Gateway (PDG) and Extensible Authentication Protocol (EAP) -Authentication and Key Agreement (AKA) for interworking wireless LAN (I-WLAN) connection after completion of the connection by the Wi-Fi connection manager. It may include an I-WLAN native service unit that performs (IKEv2) and performs IPSec tunneling.

According to the present invention, an Android terminal capable of accessing an I-WLAN and an I-WLAN access method of an Android terminal may include EAP (Extensible Authentication Protocol) -AKA ((Authentication) when an I-WLAN tunneling connection is performed after a Wi-Fi connection. and key agreements, and strong encryption of IPsec (Encapsulation Security Payload) ESP (encryption security payload) for tunneled data traffic. A service provider of a carrier may be provided in an AP or a WIBRO egg or tethering, and strong security may be provided over WiFi.

The present invention performs tunneling with a packet data gateway (PDG) based on all Wi-Fi APs, and when attempting tunneling, an Internet key exchange v2 (IKEv2) using EAP-AKA based on a universal subscriber identity module (USIM). After the tunneling, IPsec ESP is applied by determining whether to apply tunneling according to the policy (traffic selector) downloaded from the PDG, so that you can safely access the 3G service network infrastructure of the carrier in the Wi-Fi connection environment. To help.

In addition, an Android terminal capable of accessing an I-WLAN according to the present invention, and an I-WLAN access method of an Android terminal include a client of a virtual private network (VPN) for I-WLAN connection. It may be possible to connect to the I-WLAN.

In order to more fully understand the drawings used in the detailed description of the invention, a brief description of each drawing is provided.
1 is a view illustrating an I-WLAN access method of an Android terminal 100 according to an embodiment of the present invention.
FIG. 2 is a diagram for explaining an embodiment of the I-WLAN connection step shown in FIG.
3 is a diagram illustrating an I-WLAN environment to which an Android terminal 100 is connected to an embodiment of the present invention.
4 is a block diagram illustrating an Android terminal 100 that can access an I-WLAN according to an embodiment of the present invention.

BRIEF DESCRIPTION OF THE DRAWINGS For a better understanding of the present invention and the objects attained by the practice of the invention, reference should be made to the accompanying drawings, which illustrate embodiments of the invention, and to the description in the accompanying drawings.

BEST MODE FOR CARRYING OUT THE INVENTION Hereinafter, the present invention will be described in detail with reference to embodiments of the present invention with reference to the accompanying drawings. Like reference numerals in the drawings denote like elements.

1 is a view illustrating an I-WLAN access method of an Android terminal according to an embodiment of the present invention.

Referring to FIG. 1, according to the Wi-Fi connection step (or Wi-Fi connection and connection step) S102, a Wi-Fi connection manager (WiFi CM) included in the Android terminal 100, which is an I-WLAN support terminal, and wirelessly The WiFi AP 200 as an access device communicates with each other through an IPsec driver included in the Android terminal 100 to perform WiFi access. Thereafter, the WiFi AP 200 assigns a local IP address (or local IP (private IP)) to the Android terminal 100. Wi-Fi access step (S102) refers to a state in which the Android terminal 100 is connected to the AP 200 and successfully acquires an IP after completing the WLAN security setting and is able to use the Internet. That is, according to the Wi-Fi connection step (S102), the connection between the Wi-Fi connection manager (WiFi CM) included in the Android terminal 100 and the wireless access device 200 is performed, and after the connection is completed, the wireless access device 200 Local IP (Internet Protocol) is assigned to the Android terminal 100.

The I-WLAN connection manager (I-WLAN CM) (or I-WLAN native service unit) included in the Android terminal 100 is connected to the Wi-Fi connection step (S102) through the IPsec driver of the Android terminal 100. Attempt to connect I-WLAN with PDG 300 automatically. When the I-WLAN native service unit of the Android terminal 100 has enabled the I-WLAN automatic connection setting after completing the WiFi connection through a UI (user interface) provided by the WiFi CM, the Wi-Fi connection step (S102) ) Attempt to connect to I-WLAN automatically after WiFi connection is completed. The UI provided by the WiFi CM provides a notification for inducing I-WLAN access. If disabled, the Android terminal 100 does not automatically attempt to connect to the I-WLAN according to the WiFi connection, but attempts to manually connect through the UI provided by the WiFi CM.

I-WLAN native service unit included in the Android terminal 100, if the WiFi connection (WiFi connection / connection) of the Wi-Fi connection step (S102) is performed by EAP-AKA full authentication, I-WLAN of the Android terminal 100 The native service unit performs I-WLAN access authentication with fast re-authentication based EAP-AKA. At this time, the I-WLAN native service unit confirms that the WiFi connection is performed by EAP-AKA through interworking with the WiFi CM in the Android terminal 100, and includes a fast re-authentication ID and necessary key values (for example, MK ( master key)). That is, if there is a fast re-authentication ID of EAP-AKA delivered from WiFi CM, the I-WLAN native service unit of the Android terminal 100 performs the PDG 300 with fast re-authentication based on the corresponding information. Therefore, efficient tunneling can be performed.

At this time, when fast re-authentication fails, when authentication is requested from AAA (Authentication Authorization and Accounting) server 400, which is an authentication server interworking with PDG 300, Pseudonym ID attempts authentication. If authentication fails due to a request for authentication using a Permanent ID, the authentication attempt is performed using a Permanent ID based on an IMSI (international mobile subscriber identity) stored in a USIM card included in the Android terminal 100 (or obtained from the USIM card).

The Android terminal 100 provides fast re-authentication in addition to Permanent ID and Pseudo ID based full authentication. The EAP-AKA procedure using fast re-authentication may be classified into an EAP procedure between the Android terminal 100 and the AP 200 and an AKA procedure inside the Android terminal 100 and the Android terminal 100. The Android terminal 100 responds to the Re-authentication ID received from the AAA server 400 in the previous full authentication with respect to the EAP-Request / Identity transmitted from the AP 200. If the Android terminal 100 does not receive the Re-authentication ID to be used for the next authentication from the AAA server 400, the Android terminal 100 attempts full authentication in the next authentication.

I-WLAN native service unit included in the Android terminal 100, if the WiFi connection (WiFi connection / connection) of the Wi-Fi connection step (S102) is not performed by EAP-AKA full authentication (private AP), Android terminal 100 ) Performs I-WLAN access authentication with full authentication based EAP-AKA using Permanent ID or Pseudonym ID. At this time, the Android terminal 100 attempts to authenticate with the Pseudonym ID when the initial authentication attempt after the purchase of the terminal or the initial authentication attempt after the USIM change, and when the authentication fails with the Pseudonym ID and requests the authentication with the Permanent ID, IMSI Attempt authentication with a base Permanent ID. The Android terminal 100 performs EAP-AKA authentication using Pseudonym ID or Re-Authenticaion ID after the initial EAP-AKA authentication attempt (first authentication attempt after purchase of a terminal) and USIM for Permannent ID security. The Android terminal 100 stores the Pseudonym ID or the Re-Authenticaion ID transmitted by the AAA server 400 without analyzing and uses the same for subsequent authentication. Pseudonym ID information stored in the Android terminal 100 is maintained even after rebooting the terminal and shared with the WiFi CM.

When there are a plurality of PDGs 300, the Android terminal 100 selects one of them before performing tunneling with the PDGs 30. The Android terminal 100 configures the FQDN using the network identifier of the PDG 30 and the HPMN ID (Operator Identifier), and then performs a DNS query for FQDN resolution. At this time, the DNS response of the PDG 30 responds to one or more PDG IPs according to a standard DNS (Domain Name Server) query procedure, and the Android terminal 100 stores all of the IPv4-based PDG IP addresses of the DNS response in an internal file form. Save as.

According to the first IKE negotiation phase (S104), the I-WLAN native service unit of the Android terminal 100 and the packet data gateway (PDG) 300 negotiate a cryptographic algorithm and exchange a random number through an IKE_SA_INIT message exchange. Exchange, and Diffie-Hellman key exchange. The IKE_SA_INIT message exchange is performed through the IPsec driver of the Android terminal 100. In the first IKE negotiation step (S104), after IKE_SA_INIT, IKE_SA required for IKE message protection is generated, and through this, a SKEYSEED for deriving keys used for encryption / decryption is generated. The Android terminal 100 accesses the PDG 300 and performs a security association (SA) procedure to determine an authentication key (AK) management, mode, and encryption algorithm. The ISAKMP (IPsec key exchange and management) protocol).

IPSec is a protocol developed for security at the packet processing layer of network communication. The IPSec is a protocol used to protect data transmitted and received through a virtual private network (VPN) from public network users.

In order to use IPSec, the communication terminal performs a private IP assignment and authentication process through a VPN network and then performs a key distribution process (IKE: internet key exchange). IKE generates an encryption key determined according to a security protocol and an encryption algorithm selected by IPsec, and sets the encryption key on the transmitting and receiving terminal.

In the second IKE negotiation step (S106), an EAP-AKA authentication process between the I-WLAN native service unit of the Android terminal 100 and the PDG 300 is performed. That is, according to the second IKE negotiation step S106, after the first IKE negotiation step S104, the Android terminal 100 and the PDG 300 initialize the EAP-AKA and IPsec security association (SA) through the IKE_AUTH message. To perform. At this time, the IKE_AUTH message is encrypted and guaranteed using the SK_e (encryption) and SK_a (authentication) derived based on the SKEYSEED generated through the IKE_SA_INIT except for the header (HDR). In addition, the Android terminal 100 transmits a user ID (Permanent ID or Pseudonym ID or Pseudonym ID) through the IKE_AUTH request message and starts the CHILD SA negotiation. The Android terminal 100 checks the EAP-AKA result through the IKE_AUTH Response message including the EAP-AKA result (EAP-Sucess or EAP-Failure) transmitted by the PDG 300. The Android terminal 100 transmits the IKE_AUTH Request message including the AUTH generated for the first IKE_SA_INIT message to the PDG 300 using the MSK (master session key) generated as a result of the EAP-AKA.

According to the authentication step (S108), the IKEv2-based EAP message transmitted from the Android terminal 100 is transmitted to the AAA server 300 via the PDG 300 (extracting the EAP message from the PDG 300). The PDG 300 requests authentication and the AAA server 400 responds to the PDG 300 authentication request.

The Android terminal 100 and the AAA server 400 perform mutual authentication through the PDG 300. The Android terminal 100 responds to the identity requested by the AAA server 400 to identify the identifier in the order of Fast Re-Authentication ID, Pseudonym ID, and Permanent ID. When the authentication is performed, the IMSI value stored in the USIM card of the Android terminal 100 may be used.

According to the IKE negotiation completion step (S110), the I-WLAN native service unit of the Android terminal 100 authenticates the second IKE_SA_INIT message through authentication verification included in the IKE_AUTH response transmitted by the PDG 300, and the Android terminal 100 The I-WLAN native service unit and the PDG 300 complete the traffic selector negotiation for delivery of the new CHILD SA and I-WLAN access policy through the SA. At this time, the Android terminal 100 sets the remote IP (authorized IP) included in the CP (CFG_REPLY) of the PDG 300 as an IP (destination IP) for the I-WLAN of the terminal. That is, the Android terminal 100 obtains a remote IP address through the configuration payload of IKEv2. Before completing the new CHILD SA negotiation through the SA, the Android terminal 100 may perform a CREATE_CHILD_SA process for generating an additional IPsec SA necessary for performing IPSec with the PDG 300 after IKE_AUTH with the PDG 300. The Android terminal 100 stores Remote IP information allocated or manually set from the PDG 300 after the I-WLAN connection so that the I-WLAN native service inside the Android terminal 100 can be utilized. In the IKE negotiation completion step (S110), a security negotiation (SA) of IPsec is completed based on a key exchange and an algorithm for establishing a tunnel in actual user traffic.

The Android terminal 100 transmits an IKE message with the PDG 300 by using a user datagram protocol (UDP) port 4500 and / or 500, and transmits one IKE message per UDP datagram (packet).

As described above, the first IKE negotiation phase (S104), the second IKE negotiation phase (S106), and the IKE negotiation completion phase (S110) (or the first IKE negotiation phase (S104), the second). IKE negotiation step S106, IKE negotiation completion step S110, and transmission step S108) may constitute an I-WLAN connection step. According to the I-WLAN connection step, the Android terminal 100 performs IKEv2-based tunneling for IPsec SA agreement with PDG 300 for I-WLAN connection in a state where WiFi connection with the wireless access device 200 is completed. -WLAN connection and authentication.

The I-WLAN access step refers to a successful IP acquisition state for providing an I-WLAN-based service since the Android terminal 100 successfully performs IKEv2 and IPsec tunneling with the PDG 300 based on WiFi access / connection.

According to the I-WLAN access step, after the allocation of the local IP in the Wi-Fi access step (S102) is completed, the I-WLAN native service unit included in the Android terminal 100 performs tunneling with the PDG 300 and the PDG ( After the authentication of the Android terminal 100 is performed through the AAA server 400 linked to 300, the remote IP is allocated to the Android terminal 100.

The Android terminal 100 determines whether tunneling is applied according to the policy (traffic selector) downloaded from the PDG 300 after tunneling and applies the IPsec ESP.

According to the encryption step (S112), when the user tries to access the IP range of the I-WLAN application target destination IP (Destination IP) using the UI of the Android terminal 100, I- of the Android terminal 100 The WLAN native service unit (service application) encrypts the data packet to be transmitted through an IPsec Encapsulating Security Payload (ESP). The Android terminal 100 is based on 4500 port or 500 port for providing NAT-Traversal (NAT-T) function to perform IKEv2 and IPsec ESP in a NAT (network address translation) environment where a private IP is allocated in WiFi access / connection. Based UDP Encapsulation function is provided. The Android terminal 100 and the PDG 300 always include NAT_DECTION_SOURCE_IP and NAT_DECTION_DESTINATION_IP of the Notify payload in the IKE_SA_INIT message for NAT-T support. When the Android terminal 100 and the PDG 300 detect that NAT is applied through the Notify Payload, the UE 100 applies the UDP-encapsulation during the IPsec ESP process through the port 4500 by applying the NAT-T.

According to the transmission step (S114), the Android terminal 100 transmits the encrypted data packet to the PDG 300 through the IPsec ESP. According to the decryption step S116, the PDG 300 decrypts the encrypted data packet through the IPsec ESP transmitted in the transmission step S114.

According to the delivery / response step S118, the PDG 300 delivers the decrypted plane packet to a web server (or a content server) 500 that is a 3G service infrastructure, and the web server. 500 transmits the requested content packet to the PDG 300 in response to the plane packet.

According to the encryption step (S120), the PDG 300 encrypts the content packet delivered in the delivery / response step (S118) via the IPsec ESP.

According to the transmission step (S122), PDG (300) transmits the encrypted content packet through the IPsec ESP to the Android terminal 100 through the wired Internet network and the wireless access device 200 in the encryption step (S120).

In the transmission step (S114) and the transmission step (S122), after authentication is performed between the Android terminal 100 and the AAA server 400, the data packet transmitted between the Android terminal 100 and the PDG 300 is IPsec ( internet protocol security (Encryption Security Payload)

According to the decryption step (S124), the Android terminal 100 decrypts the encrypted IPsec ESP using the cryptocurrency unit therein and transmits the decrypted IPsec IP to the internal I-WLAN native service unit (application application).

If the IP transmitted from the Android terminal 100 is not an I-WLAN application target packet, the Android terminal 100 communicates with an external wired Internet network through the wireless LAN (AP) 200 without passing through the PDG 300. do.

FIG. 2 is a diagram for explaining an embodiment of the I-WLAN connection step shown in FIG. That is, FIG. 2 illustrates a process in which the Android terminal 100 performs tunneling through the PDG 300 and the IKEv2 procedure.

Referring to FIG. 2, in the first IKE negotiation step S104, the Android terminal 100 transmits [HDR, SAi1, KEi, Ni, N] to the PDG 300 including the IKE_SA_INIT message. The PDG 300 includes [HDR, SAr1, KEr, Nr, N] in the IKE_SA_INIT message with respect to the IKE_SA_INIT message transmitted by the Android terminal 100.

According to the second IKE negotiation step (S106), the Android terminal 100 transmits to the PDG 300 including [HDR, SK IDi, CP, SAi2, TSi, TSr, IDr}] in the IKE_AUTH Request message. The PDG 300 transmits to the Android terminal 100 including [HDR, SK {IDr, EAP-Request / AKA-Challenge (or Reauthentication)}] in the IKE_AUTH Response message.

In addition, according to the second IKE negotiation step (S106), the Android terminal 100 is transmitted to the PDG 300 by including [HDR, SK {EAP-Response / AKA-Challenge (or Reauthentication)}] in the IKE_AUTH Request message do. The PDG 300 includes [HDR, SK {EAP-Success or EAP-Failure}] in the IKE_AUTH Response message to the Android terminal 100.

According to the IKE negotiation completion step (S110), the Android terminal 100 transmits the PDG 300 including [HDR, SK {AUTH}] in the IKE_AUTH Request message. The Android terminal 100 utilizes the MSK generated after EAP-AKA as a shared key according to RFC 4306 for generating authentication data of AUTH Payload. The PDG 300 includes [HDR, SK {AUTH, CP, SAr2, TSi, TSr}] in the IKE_AUTH Response message to the Android terminal 300. The PDG 300 utilizes the MSK generated after EAP-AKA as a shared key according to RFC 4306 for generating Authentication Data of AUTH Payload. The CP corresponds to a remote IP as a configuration payload, and the TSi and TSr correspond to I-WLAN access policy information as a Traffic Selector-Initiator Payload and a Traffic Selector-Responder Payload, respectively.

A method of releasing tunneling connected based on an INFORMATIONAL message of IKEv2 between an Android terminal (100 in FIG. 2) and a PDG (300 in FIG. 2) according to an embodiment of the present invention will be described as follows.

When the user releases tunneling through the I-WLAN connection manager (I-WLAN CM) included in the Android terminal 100, the terminal-initiated tunneling release is performed. The Android terminal 100 first transmits a Release Tunnel Request to the PDG 300. The Android terminal 100 receiving the Acknoledgement for the Release Tunnel Request from the PDG 300 releases the terminal resource and control information used for tunneling.

In the case of timeout of the tunneling connection, the PDG 300 requests the tunneling release due to the request of the AAA server, the need for the existing tunneling release, and the like. At this time, the PDG 300 transmits a Release Tunnel Request to the Android terminal 100. Then, the Android terminal 100 waits for the reception of the INFOTMATIONAL message transmitted by the PDG 300, and upon receiving a Release Tunnel request from the PDG 300, releases the terminal resource and related control information used for tunneling and acquires the acknowledgment. To the PDG 300.

3 is a diagram illustrating an I-WLAN environment to which an Android terminal 100 is connected to an embodiment of the present invention.

Referring to FIG. 3, the Android terminal 100 of the present invention is connected to an AP 200, a PDG 300, and a web server (or a web application server) 500 to access an I-WLAN. Send / receive data via path. The AP 200 is connected to the PDG 300 via the Wu interface. The AP 200 may be located in a Wi-Fi zone such as netspot.

The Android terminal 100 may request authentication from the AAA server 400 through the PDG 300 of the Third Generation Partnership Project (3GPP) network. This can be referred to as CN (corresponding node) authentication. In another embodiment of the present invention, the Android terminal 100 is an AAA server 400 via a signal path through an internet account management system (IAMS) server or an internet report access system (IRS) server. You can request certification at. This may be referred to as access node (AN) authentication.

A charging server such as a charging data function (CDF) and an IP location server (IPLS) may be connected to the PDG 300 through a signal path. The web server 500 may include a proxy server (PAS) and a download pack server. The web server 500 may be connected to IPLS via a signal path.

4 is a block diagram illustrating an Android terminal 100 that can access an I-WLAN according to an embodiment of the present invention. The Android terminal 100 may be used for the I-WLAN access method of the Android terminal shown in FIG. 1.

Referring to FIG. 4, the Android terminal 100 includes (built in) an Android operating system (OS) and an Android platform for I-WLAN connection.

The Android terminal 100 is a terminal for I-WLAN connection based on WiFi network and public WiFi network connection, and is equipped with Wi-Fi hardware (WiFi H / W) and I-WLAN connection function for Wi-Fi (WiFi) connection. The OS is mounted.

The Android platform may be divided into a user space and a kernel space. In the user space, an I-WLAN manager service unit 102, an I-WLAN native service unit 104, and a control socket manager 106 which is an android control socket are provided. Arranged (positioned). In the kernel space, an IPSec (internet protocol security) driver 110 is disposed. The PF_KEY / NETLINK interface unit 108 is a kernel interface that interfaces the I-WLAN native service unit 104 and the IPSec driver 110.

The Android platform may be an I-WLAN connection manager (I-WLAN CM) (I-WLAN access terminal client).

The I-WLAN CM includes an I-WLAN manager service unit 102, an I-WLAN native service unit 104, a control socket manager 106, a PF_KEY / NETLINK interface unit 108, and an IPSec driver 110. Include.

I-WLAN CM (or I-WLAN native service unit 104) performs the search, access, and service control information management of Wi-Fi hardware (WiFi H / W) and Wi-Fi (WiFi), and is included in I-WLAN CM. After the Wi-Fi connection using Wi-Fi Connection Manager (206) (206) (complete), perform PDG (300 in FIG. 1) and EAP-AKA-based IKEv2 for I-WLAN connection and IPSec tunneling Do this. The I-WLAN native service unit 104 performs tunneling with the IKEv2-based EAP-AKA for IPsec SA agreement with the PDG 300. The Wi-Fi Connection Manager 210 connects to an external wireless access device 200 and Wi-Fi.

The I-WLAN manager service unit 102 transmits the information to the user, receives the user's command (connection, cancellation, environment setting, and the like), and receives the JNI (Java Native) of the control socket manager 106 which is an application program interface (API). Command) to the I-WLAN native service unit 104. The control socket manager 106 is an application that controls socket communication between the I-WLAN manager service unit 102 and the I-WLAN native service unit 104. The control socket manager 106 is responsible for the communication between the native service and the manager service.

The I-WLAN native service unit 104 is developed in the form of a Linux daemon, and performs IKEv2 transmitted from the I-WLAN manager service unit 102 through the JNI of the control socket manager 106, and performs PF_KEY and The IPsec driver 110 is controlled through the NETLINK interface unit 108.

The I-WLAN manager service unit 102 transmits a user command received from the UI to a daemon that performs IKE and IPsec of the I-WLAN native service unit 104 through a socket, and sends a message received from the daemon back to the UI. It performs the function of passing to.

The I-WLAN CM interworks with the Wi-Fi Connection Manager 210 and the USIM interface unit 212, obtains information on the Wi-Fi connection and connection status, and shares the connection status of the I-WLAN, thereby providing a communication service provider. Allows voice and data fixed mobile convergence (FMC) applications to run on an I-WLAN basis.

The I-WLAN manager service unit 102 includes an I-WLAN user interface (UI) 202, a manager service unit 204, a WiFi connection manager (WiFi CM) 210, and a USIM interface unit (USIM I / F). 212. The I-WLAN UI 202 provides a user interface to the user of the Android terminal 100.

The manager service unit 204 includes an IKE / I-WLAN service unit and an event manager unit. The IKE / I-WLAN service unit 206 periodically checks the standard output stream to obtain log information, and a native service logger to control the native service. It includes.

The event manager 208 obtains information of the WiFi CM 210 and obtains a user event of the UI. The event manager 208 may include a state information manager that stores a native service state and stores user information and I-WLAN configuration information.

The USIM (Universal Subscriber Identity) interface unit 212 (or USIM manager) obtains user information of the USIM card 250. The USIM card 250 may store an international mobile subscriber identity (IMSI) value (identification number) and store an EAP-AKA algorithm used for authentication. The USIM card 250 is embedded (installed) in the Android terminal 100. The USIM card 250 may store a master key (MK) value.

The I-WLAN native service unit 104 may include a crypto unit, an authentication unit, an IKE manager, a protocol parser, a logger, and a kernel interface.

The crypto unit performs encryption and decryption of IKEv2 to maintain confidentiality and integrity of transmitted / received data (for example, performs IPsec Encapsulating Security Payload (ESP)). The authentication unit may be referred to as EAP-AKA Manager, and it is a module that performs user authentication. It provides two types of USIM-based user authentication, full authentication and fast re-authentication. To perform.

The IKE manager performs and manages a PDG (300 of FIG. 1), an IKE SA (security association), and a CHILD SA negotiation. The protocol parser parses the transmission data and the reception data between the terminal and the PDG 300. The logger records and views log information in the I-WLAN CM. The kernel interface communicates with the IPsec driver 110.

The IPsec driver 110 delivers the data processed in the I-WLAN CM including the I-WLAN native service unit 104 to an external server such as the PDG 300 shown in FIG. 1 or processed by an external server. It delivers data to the internal I-WLAN CM.

The IPsec driver 110 may include an IPsec ESP part, an SA database part, a security policy (SP) database part, and a crypto part.

The IPsec ESP unit builds an IPsec application related database according to the send / receive IP network address, protocol, and port number. Depending on whether it is applied, it can be transmitted as a normal traffic without IPsec, or IPsec can be applied or dropped. The SA database unit includes a function of storing and managing IKEv2 SA information. The SP database unit includes a function of storing and managing policy information. The crypto section encrypts and decrypts the data.

The I-WLAN native service unit 104 interworks with the WiFi CM 210 to provide fast re-authentication during EAP-AKA. The I-WLAN native service unit 104 performs fast re-authentication for the I-WLAN connection when the WiFi CM 210 accesses the EAP-AKA. To this end, the WiFi CM 210 and the I-WLAN native service unit 104 acquire a pseudonym ID, a fast re-authenticaiton ID, and key values in association with the API. The I-WLAN CM mounted on the Android terminal 100 interworks with the WiFi CM 210 to perform WiFi-based I-WLAN access and fast re-authentication.

The I-WLAN native service unit 104 shares the connection state of the I-WLAN in cooperation with the USIM interface unit 212. The USIM interface unit 212 obtains I-WLAN state information provided by the I-WLAN Nati service unit 104. The I-WLAN native service unit 104 transmits the I-WLAN connection state change to the USIM interface. To this end, the I-WLAN native service unit 104 uses the intent of Android by default. I-WLAN status information intent is broadcasted and is executed after all internal processing is completed. The I-WLAN native service unit 104 performs a USIM interface for performing EAP-AKA full authentication.

Other applications such as USIM interface 212 and WiFi CM 210 may also obtain I-WLAN status information.

The I-WLAN CM (or I-WLAN native service unit 104) attempts to connect to the I-WLAN according to the request of the service application in association with the service application including the FMC client. For this purpose, the connection between the service application and the I-WLAN CM and the connection result response processing are basically linked using Android's intent. The connection attempt to the I-WLAN in the I-WLAN unconnected state may be performed in a manner that the I-WLAN CM broadcasts an intent for the result after the service application sends the corresponding intent.

The I-WLAN UI (service application) 202 may check the I-WLAN connection state provided through the USIM interface unit 250.

If the I-WLAN is not connected, the I-WLAN connection request intent is broadcast. When the I-WLAN CM receives an I-WLAN access request intent, the I-WLAN attempts to connect to the I-WLAN, which is the default profile.

If the connection succeeds in I-WLAN CM, it broadcasts the IWLAN connection success intent. If the connection fails in the I-WLAN CM, it broadcasts the IWLAN connection failure intent. After the service application receives the intent for the I-WLAN connection result, the service application performs the remaining operations of the service application.

In order to know the connection status of I-WAN from web application server (WAS), related information is stored in SQLite-based DB (database) provided by Android.

I-WLAN CM internally stores the I-WLAN connection profile. I-WLAN CM saves and manages connection profile created by user in internal DB including basic I-WLAN connection profile.

I-WLAN CM stores and manages in DB obtained through interworking with WiFi CM 210 for fast re-authentication support. I-WLAN CM stores and manages I-WLAN connection status information in the internal DB.

The I-WLAN CM should store two pieces of I-WLAN authentication classification information for the PDG (300 of FIG. 1) and the EAP-AKA authentication type performed in the IKEv2 process. I-WLAN CM saves whether it is a public IP or a private IP of the dynamically allocated remote IP in IKEv2.

After completion of the IKEv2 process, the I-WLAN CM (or I-WLAN native service unit 104) stores two states of encryption algorithm and integrity algorithm information used in performing IPsec ESP. The I-WLAN CM shares the fast re-authentication ID, keys, and pseudonym ID with the WiFi CM 210 and utilizes the EAP-AKA authentication. That is, the WiFi CM 210 utilizes the pseudonym ID received from the Authentication Authorization and Accounting (AAA) server when EAP-AKA is authenticated when the I-WLAN CM performs EAP-AKA of the I-WLAN CM. The CM utilizes the pseudonym ID received from the AAA server when performing the EAP-AKA of the I-WLAN CM when performing the EAP-AKA of the WiFi CM 210.

If the USIM changes, the I-WLAN CM performs EAP-AKA with the permanent ID. The user ID is shared with the WiFi CM as an API (Application Program Interface) for sharing fast re-authentication ID, keys, and pseudonym IDs between the I-WLAN CM and the WiFi CM 210.

Wu interface for IKEv2-based IPsec tunneling between the Android terminal 100 and the PDG 300 is supported. The Android terminal 100 starts IPsec tunneling. The Android terminal 100 performs I-WLAN access and authentication through IKEv2-based tunneling with the PDG 300.

The I-WLAN UI 202, the IKE / I-WLAN Service Unit 206, the Event Manager 208, the I-WLAN Native Service Unit 104, and the IPsec Driver 110 may be a virtual private network (VPN) client ( client). The present invention checks the WiFi connection status according to the intent provided by Android, and when WiFi is connected, attempts to automatically connect to the I-WLAN (or expose a notification to induce the connection) and tunnel the PDG and IKEv2-based tunneling. By attempting to connect to the secure I-WLAN. In addition, in the present invention, since the key generated through tunneling can be used by the I-WLAN native service unit in the Android terminal, IPSec-based encryption or decryption can be performed.

As described above, the present invention applies the I-WLAN technology to the Android terminal. That is, the present invention provides a structure of an Android terminal and an operation method of the Android terminal when the I-WLAN technology is applied to the Android terminal. The Android may refer to an operating system of an Android terminal, which is a smart phone.

On the other hand, the above-described method of the present invention can be prepared by a computer program. Code and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the created program can be stored in a computer-readable recording medium (information storage medium), and can be read and executed by a computer to implement the method of the present invention. The recording medium may include any type of computer readable recording medium.

As described above, the embodiments have been disclosed in the drawings and specification. Although specific terms are used herein, they are used for the purpose of describing the present invention only and are not used to limit the scope of the present invention described in the claims or the claims. Therefore, it will be understood by those skilled in the art that various modifications and equivalent embodiments are possible from the present invention. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

100: Android terminal
200: wireless access device
300: packet data gateway (PDG)
400: AAA Server
500: web server
104: I-WLAN Native Service Division
210: WiFi connection manager
250: USIM card

Claims (7)

In the I-WLAN (interworking wireless LAN) connection method of the Android terminal,
(a) performing a connection between a Wi-Fi connection manager included in the Android terminal and a wireless access device and allocating a local IP (Internet Protocol) to the Android terminal after completion of the connection; And
(b) After the allocation of the local IP of step (a) is completed, the I-WLAN native service unit included in the Android terminal performs tunneling with a packet data gateway (PDG) and is linked with the PDG (Authentication Authorization and Accounting) includes the step of assigning a remote IP to the Android terminal after the authentication of the Android terminal through the server,
The step (b)
(b1) the I-WLAN native service unit and the PDG performing cryptographic algorithm negotiation, random number exchange, and Diffie-Hellman key exchange through IKE_SA_INIT message exchange;
(b2) after the step (b1), the I-WLAN native service unit and the PDG performing EAP-AKA and IPsec security association (SA) initialization through an IKE_AUTH message; And
(b3) After the step (b2), the I-WLAN native service unit and the PDG complete the traffic selector negotiation for the new CHILD SA negotiation and the I-WLAN access policy transmission through the SA. -WLAN connection method. The method of claim 1,
When the connection through the Wi-Fi connection manager is performed with EAP (Extensible Authentication Protocol) -Authentication Key Agreement (AKA) full authentication, the I-WLAN native service unit forwards the I-WLAN connection authentication to the fast re-authentication-based EAP-AKA. I-WLAN access method of the Android terminal to perform. The method of claim 1,
The I-WLAN native service unit, when the I-WLAN automatic connection setting is enabled after completion of the connection between the Wi-Fi connection manager and the wireless access device through a UI (user interface) provided by the Wi-Fi connection manager, I-WLAN connection method of Android terminal to automatically try to connect after completion of connection. The method of claim 1,
The I-WLAN native service unit performs an IAP-LAN connection of the Android terminal to perform Internet Protocol Exchange (IPSec) tunneling with the PDG and EAP-AKA-based Internet Key Exchange v2 (IKEv2). delete The method of claim 1, wherein the I-WLAN connection method of the Android terminal,
(c) after the authentication is performed between the Android terminal and the AAA server, the data packet transmitted between the Android terminal and the PDG is further encrypted through IPsec (Internet Protocol Security) Encapsulation Security Payload (ESP). I-WLAN connection method of the Android terminal. A Wi-Fi connection manager which connects to an external wireless access device and Wi-Fi; And
IKE (Internet Key Exchange) based on Packet Data Gateway (PDG) and Extensible Authentication Protocol (EAP) -Authentication and Key Agreement (AKA) for interworking wireless LAN (I-WLAN) connection after the Wi-Fi connection manager is completed. IKEv2) and I-WLAN native service department that performs IPSec tunneling,
The I-WLAN native service unit and the PDG perform cryptographic algorithm negotiation, random number exchange, and Diffie-Hellman key exchange through IKE_SA_INIT message exchange,
The I-WLAN native service unit and the PDG perform EAP-AKA and IPsec security association (SA) initialization through an IKE_AUTH message.
The I-WLAN native service unit and the PDG through the SA Android terminal to complete a new CHILD SA negotiation and traffic selector negotiation for I-WLAN access policy delivery.

Images