KR102003816B1 - Subscriber device authenticating apparatus and control method thereof - Google Patents

Abstract

The present invention is characterized in that, in an environment where a plurality of applications for IMS-based services adopting different IMS authentication schemes are installed / used in a subscriber terminal, different identification information for each IMS authentication method is assigned to one and the same subscriber terminal The present invention proposes a subscriber terminal authentication apparatus and an operation method of the same that can effectively perform an authentication procedure according to different IMS authentication schemes using one terminal identification information in an IMS network.

Description

Technical Field [0001] The present invention relates to a subscriber terminal authentication apparatus and a subscriber terminal authentication apparatus,

The present invention relates to a technology for performing an authentication procedure for different authentication schemes required by a subscriber terminal, and more particularly, to an environment in which a plurality of IMS-based service applications adopting different IMS authentication schemes are installed / used at a subscriber terminal The present invention relates to a subscriber terminal authentication apparatus and an operation method of a subscriber terminal authentication apparatus that enable an authentication procedure according to different IMS authentication schemes to be effectively performed in an IMS network using one terminal identification information.

The IP Multimedia Subsystem (IMS) is a standard for providing multimedia services such as voice, audio, video and data based on the Internet Protocol (IP). It is an initial All-IP network broadband code division multiple access (W- ) Network, it is currently being expanded to support various wired / wireless integrated networks based on IP networks as well as mobile systems.

Due to the expansion of the IMS technology, various IMS-based service applications for mobile terminals have been developed and used.

Such an IMS-based service application performs an authentication procedure for confirming whether the subscriber is a legitimate subscriber through an IMS authentication method assigned to the IMS-based service when accessing an IMS network for executing a service supported by the application.

However, there are a plurality of different IMS authentication schemes such as AKA scheme and Digest scheme, and one of many different IMS authentication schemes is adopted for each application for IMS based service.

Therefore, in an environment where a plurality of IMS-based service applications are installed / used in a mobile terminal, different IMS authentication schemes may be mixed for one same mobile terminal.

In the current IMS network, a separate user identity is assigned to one IMS-based service application for an IMS-based service application, and an authentication procedure according to the corresponding IMS authentication scheme .

However, considering that the types of applications for IMS-based services are becoming more diverse due to continuous development and the types of IMS authentication schemes can be further diversified in the future, considering the current status of allocating different identification information to mobile terminals The system can be said to be inefficient.

Therefore, according to the present invention, an authentication procedure according to different IMS authentication schemes using one terminal identification information is effectively performed in the IMS network, instead of allocating and using separate identification information for each IMS authentication method for one same mobile terminal I would like to propose a way to do this.

SUMMARY OF THE INVENTION The present invention has been made in view of the above circumstances, and an object of the present invention is to provide an IMS-based service in which, in an environment where a plurality of IMS-based service applications are installed / used in a mobile terminal, So that the authentication procedure according to the method can be effectively performed in the IMS network.

According to a first aspect of the present invention, there is provided an apparatus for authenticating a subscriber terminal, the apparatus comprising: an authentication unit configured to store authentication information for each of a plurality of different authentication methods, An authentication information storage unit; An authentication method checking unit for checking a specific authentication method related to the call setup request among the plurality of authentication methods when a call setup related to the terminal identification information is requested; And an authentication procedure execution unit for performing an authentication procedure according to the specific authentication method to the subscriber terminal based on the authentication information mapped to the identified specific authentication method among the authentication information for each authentication method stored in the terminal identification information do.

Preferably, the first authentication information mapped to the first authentication scheme among the plurality of authentication schemes includes authentication key information for authenticating the subscriber station according to the first authentication scheme, and a security key received from the subscriber terminal And an authentication key generation algorithm for generating the authentication key information by using the authentication key information.

Preferably, the authentication information storage unit stores, based on the provisioning information of the subscriber station, information indicating that the subscriber station is loaded with an application requiring an authentication procedure according to the first authentication scheme, The first authentication information for the terminal can be acquired and stored in association with the terminal identification information of the subscriber terminal.

The second authentication information mapped to the second authentication method among the plurality of authentication methods may include password information for authenticating the subscriber terminal according to the second authentication method.

Preferably, the authentication information storage unit stores the second authentication information including the obtained password information in the terminal identification information of the subscriber terminal, Can be stored in correspondence with each other.

The authentication method checking unit may identify the specific authentication method associated with the call setup request among the plurality of authentication methods based on the authentication method identification parameter included in the call setup request.

According to a second aspect of the present invention, there is provided an operation method of a subscriber station authentication apparatus according to the second aspect of the present invention, the method comprising: performing authentication for each authentication method in which authentication information is mapped to a plurality of different authentication schemes, An authentication information storing step of storing information; An authentication method checking step of checking a specific authentication method related to the call setup request among the plurality of authentication methods when a call setup related to the terminal identification information is requested; And performing an authentication procedure for the subscriber terminal according to the specific authentication method based on the authentication information mapped to the identified specific authentication method among the authentication information for each authentication method stored in the terminal identification information .

Preferably, the first authentication information mapped to the first authentication scheme among the plurality of authentication schemes includes authentication key information for authenticating the subscriber station according to the first authentication scheme, and a security key received from the subscriber terminal Wherein the second authentication information is mapped to the second authentication method among the plurality of authentication methods, and the second authentication information is mapped to the subscriber terminal according to the second authentication method And may include password information for authentication.

Preferably, the authentication information storing step may include a step of, when it is confirmed based on the provisioning information of the subscriber terminal that an application requiring an authentication procedure according to the first authentication method is mounted on the subscriber terminal, The first authentication information for the subscriber terminal can be acquired and stored in association with the terminal identification information of the subscriber terminal.

Preferably, the authentication information storing step may include a step of acquiring the password information provided from the specific configuration apparatus to the subscriber terminal, and transmitting the second authentication information including the acquired password information to the terminal identification information As shown in FIG.

According to the operation method of the subscriber terminal authentication apparatus and the subscriber terminal authentication apparatus of the present invention, in an environment in which a plurality of applications for IMS-based services adopting different IMS authentication schemes are installed / used in a subscriber terminal, It is possible to effectively perform an authentication procedure according to different IMS authentication schemes in the IMS network using one terminal identification information, rather than assigning different identification information for each IMS authentication method.

1 is a configuration diagram illustrating a system including a subscriber station authentication apparatus according to a preferred embodiment of the present invention.
2 is a block diagram illustrating a configuration of a subscriber station authentication apparatus according to a preferred embodiment of the present invention.
3 is a control flowchart of a system including a subscriber station authentication apparatus according to a preferred embodiment of the present invention.
4 is a flowchart illustrating an operation method of a subscriber station authentication apparatus according to a preferred embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

FIG. 1 is a diagram illustrating a system including a subscriber station authentication apparatus according to a preferred embodiment of the present invention.

As shown in FIG. 1, the system in which the present invention is implemented performs an authentication procedure according to a plurality of different authentication methods based on one terminal identification information with respect to the subscriber terminal 10 and the subscriber terminal 10 And a subscriber terminal authentication apparatus 100 for allowing the subscriber terminal authentication apparatus 100 to perform authentication.

In addition, the system in which the present invention is reflected may further include the call processing apparatus 200, the configuration apparatus 300, the subscription system 400 and the authentication apparatus 500 as shown in FIG.

Here, as shown in FIG. 1, the subscriber terminal 10 is a terminal in which a plurality of applications 13 are installed and can use it.

For example, the plurality of applications 130 may include an application 1 supporting a VoIP service based on an IMS network, and an application 2 supporting a multimedia content download service based on an IMS network.

The application 1 and the application 2 can adopt a different authentication method when connecting to the IMS network. For convenience of explanation, the application 1 adopts the AKA scheme and the application 2 adopts the digest scheme would.

The subscriber station authenticating device 100 stores authentication information for each authentication method in which the authentication information is mapped for each of a plurality of different authentication methods for one terminal identification information (PUID: Private User ID) related to the subscriber terminal 10 .

Here, a plurality of different authentication schemes may refer to an authentication scheme adopted by an IMS network-based application installed / used by the subscriber terminal 10.

For example, if the application 1 and the application 2 are installed in the subscriber terminal 10 as described above, the subscriber terminal authentication apparatus 100 can acquire a plurality of different pieces of terminal identification information (PUID) related to the subscriber terminal 10 The authentication information for each authentication method to which the authentication information is mapped, for example, according to the AKA method and the digest method.

Accordingly, the authentication information for each authentication method may include authentication information mapped to the AKA method (hereinafter referred to as first authentication information) and authentication information mapped to the digest method (hereinafter referred to as second authentication information).

The subscriber terminal authentication apparatus 100 may be an IMS subscriber management server (HSS) of an IMS network.

Hereinafter, a procedure for storing authentication information for each authentication method in the subscriber terminal authentication apparatus 100 with respect to the terminal identification information (PUID) of the subscriber terminal 10 will be described.

When the subscriber terminal 10 is opened, the subscription system 400 provides the provisioning information of the subscriber terminal 10 to the subscriber terminal authentication apparatus 100 and the configuration apparatus 300.

Here, the provisioning information includes service subscription information (e.g., PUID, PUID, USIM secret key information, etc.) for the subscriber terminal 10, (E.g., Private User ID, PUID) necessary for authentication of the subscriber terminal 10, and an ISIM identifier parameter required for authentication of the AKA scheme.

Here, the IP Multimedia Subscriber Identity Module (ISIM) is an application for the connection of the IMS network and the authentication procedure of the AKA scheme, and can be installed in a USIM (Universal Subscriber Identity Module) 15 of the subscriber terminal 10 . In addition, the secret key information of the subscriber terminal 10 may be stored in the secret key 15.

Therefore, the ISIM identifier parameter included in the provisioning information of the subscriber terminal 10 records the installed ISIM identification information when the ISIM application is installed in the subscriber terminal 10, and the ISIM application is installed in the subscriber terminal 10 If not, it will be blank.

If the subscriber terminal 10 supports the AKA scheme based on the provisioning information of the subscriber terminal 10 provided / received from the subscription system 400, the subscriber terminal authentication apparatus 100 transmits the authentication information from the authentication apparatus 500 to the subscriber terminal 10, Acquires the first authentication information for performing the AKA authentication procedure with respect to the subscriber terminal 10 and stores it in association with the terminal identification information (PUID) of the subscriber terminal 10. [

For example, the subscriber station authentication apparatus 100 may request the first authentication information by providing at least one of the ISIM identification information and the secret key information identified in the provisioning information of the subscriber terminal 10 to the authentication apparatus 500.

The authentication apparatus 500 having the AKA authentication key generation algorithm generates authentication key information according to the AKA authentication key generation algorithm using at least one of ISIM identification information and secret key information provided from the subscriber terminal authentication apparatus 100 Can be generated.

Then, the authentication apparatus 500 can provide the subscriber terminal authentication apparatus 100 with the first authentication information including the generated authentication key information and the AKA authentication key generation algorithm.

The subscriber terminal authentication apparatus 100 can store the first authentication information for the subscriber terminal 10 acquired from the authentication apparatus 500 in association with the terminal identification information (PUID) of the subscriber terminal 10.

On the other hand, if the subscriber terminal 10 supports the digest method, the subscriber terminal authentication apparatus 100 may be configured to transmit the subscriber terminal 10 to the subscriber terminal 10 based on the provisioning information of the subscriber terminal 10 provided / And the second authentication information including the obtained password information may be stored in association with the terminal identification information (PUID) of the subscriber terminal 10. In this case,

For example, based on the provisioning information of the subscriber terminal 10 provided / received from the subscription system 400 or on the basis of the information provided from the subscriber terminal 10 connected thereto, When it is confirmed that the terminal 10 supports the Digest method, the subscriber terminal 10 can generate password information for performing a Digest authentication procedure.

Accordingly, the configuration apparatus 300 can provide the generated password information to the environment setting information to be downloaded to the subscriber terminal 10 when the subscriber terminal 10 is first accessed after opening the subscriber terminal 10.

The environment setting apparatus 300 can provide the generated password information to the subscriber terminal authentication apparatus 100 separately from providing the generated password information to the subscriber terminal 10 as well. The configuration apparatus 300 may be a configuration server.

The subscriber terminal authentication apparatus 100 transmits the second authentication information for performing the digest authentication procedure including the password information provided from the configuration apparatus 300 to the terminal identification information PUID of the subscriber terminal 10 ).

The subscriber station authenticating apparatus 100 according to the present invention is able to identify one terminal identification information (PUID) related to the subscriber terminal 10 in accordance with a plurality of different authentication methods, for example, an AKA method and a digest method The authentication information for each authentication method to which the first authentication information and the second authentication information are mapped can be stored.

Thereafter, when the application installed in the subscriber terminal 10 is executed, the subscriber terminal 10 requests the call processing device 200 to set the call according to the execution of the application. That is, the subscriber terminal 10 requests a call setup to the call processing device 200 according to application execution, thereby attempting to connect to the IMS network.

At this time, the subscriber terminal 10 includes an authentication method identification parameter indicating the terminal identification information (PUID) of the subscriber terminal 10 itself and the authentication method adopted by the currently executed application It is desirable to request. For example, the authentication scheme identification parameter may include an identifier indicating the AKA scheme or an identifier indicating the digest scheme.

When the subscriber terminal authentication apparatus 100 confirms a call setup request including the terminal identification information (PUID) and the authentication method identification parameter through the call processing apparatus 200, Confirm the specific authentication method associated with the setup request.

Then, the subscriber station authenticating device 100 determines whether or not the subscriber terminal authenticating device 100 is authentic to the specific authentication method based on the authentication information mapped to the identified authentication method among the stored authentication information for the authentication method for the terminal identification information (PUID) , It is possible to perform an authentication procedure for confirming whether or not the call setup request from the subscriber terminal 10 confirmed by the present authentication is due to a legitimate subscriber.

Hereinafter, a subscriber terminal authentication apparatus according to a preferred embodiment of the present invention will be described in more detail with reference to FIG.

The subscriber station authentication apparatus 100 according to the present invention stores authentication information for storing authentication increments for each authentication method to which authentication information is mapped for each of a plurality of different authentication schemes with respect to one terminal identification information related to the subscriber terminal 10 An authentication method checking unit 120 for checking a specific authentication method related to the call setup request among the plurality of authentication methods when a call setup related to the terminal identification information is requested, (130) for performing an authentication procedure according to the specific authentication method with respect to the subscriber terminal based on the authentication information mapped to the identified specific authentication method among the authentication information for each authentication method stored in the storage unit .

The authentication information storage unit 110 stores the authentication increment for each authentication method in which the authentication information is mapped for each of a plurality of different authentication methods, with respect to one terminal identification information (PUID) related to the subscriber terminal 10. [

Hereinafter, for convenience of description, it is mentioned that the first authentication method and the second authentication method are included among a plurality of authentication methods, and more specifically, the AKA method is used as the first authentication method, the digest method is explained as the second authentication method I will.

Here, the first authentication information mapped to the first authentication scheme, i.e., the AKA scheme, among the plurality of authentication schemes, includes authentication key information for authenticating the subscriber terminal 10 according to the AKA scheme, authentication key information for authenticating the subscriber terminal 10, Or an AKA authentication key generation algorithm for generating authentication key information using the authentication key generation algorithm.

Hereinafter, the process of storing the first authentication information mapped to the AKA scheme with respect to the terminal identification information (PUID) of the subscriber station 0 will be described in more detail.

As described above with reference to FIG. 1, the subscriber station authentication apparatus 100 according to the present invention receives the provisioning information of the subscriber terminal 10 to be activated.

If the subscriber terminal 10 supports the AKA scheme on the basis of the provisioning information of the subscriber terminal 10, the authentication information storage unit 110 transmits authentication information to the subscriber terminal 10 from the authentication apparatus 500, The first authentication information for performing the procedure can be acquired and stored in association with the terminal identification information (PUID) of the subscriber terminal 10. [

More specifically, the authentication information storage unit 110 stores an application, for example, an IMS network-based VoIP service requiring an authentication procedure according to the AKA scheme, to the subscriber terminal 10 based on the provisioning information of the subscriber terminal 10 It is possible to acquire the first authentication information for the subscriber terminal 10 from the authentication device 500 when it is confirmed that the supporting application 1 is mounted.

Alternatively, if the ISIM identification information is recorded in the ISIM identifier parameter included in the provisioning information of the subscriber terminal 10, the authentication information storage unit 110 may store an application requiring an authentication procedure according to the AKA scheme in the subscriber terminal 10 It is possible to obtain the first authentication information for the subscriber terminal 10 from the authentication device 500. [

The authentication information storage unit 110 stores at least one of the ISIM identification information and the secret key information identified in the provisioning information of the subscriber terminal 10 to the authentication apparatus 500, To request the first authentication information.

The authentication apparatus 500 having the AKA authentication key generation algorithm generates authentication key information according to the AKA authentication key generation algorithm using at least one of ISIM identification information and secret key information provided from the subscriber terminal authentication apparatus 100 And provides first authentication information including the generated authentication key information and the AKA authentication key generation algorithm to the subscriber terminal authentication apparatus 100, in particular, the authentication information storage unit 110. Here, the generation of the authentication key information according to the AKA authentication key generation algorithm is the same as the operation of generating the authentication key information by adopting one of the various existing AKA authentication related algorithms, and a detailed description thereof will be omitted.

The authentication information storage unit 110 stores the first authentication information for the subscriber terminal 10 acquired from the authentication apparatus 500 in association with the terminal identification information (PUID) of the subscriber terminal 10. [

Meanwhile, the second authentication information mapped to the second authentication method, that is, the digest method, among the plurality of authentication methods may include password information for authenticating the subscriber terminal 10 according to the digest method.

Hereinafter, the process of storing the second authentication information mapped to the digest scheme with respect to the terminal identification information (PUID) of the subscriber station 0 will be described in more detail.

As described above with reference to FIG. 1, the subscriber station authentication apparatus 100 according to the present invention receives the provisioning information of the subscriber terminal 10 to be activated.

If the subscriber terminal 10 supports the digest scheme based on the provisioning information of the subscriber terminal 10, the authentication information storage unit 110 stores a password for performing the digest authentication procedure with respect to the subscriber terminal 10 And store the second authentication information including the acquired password information in association with the terminal identification information (PUID) of the subscriber terminal 10. [

More specifically, as described above with reference to Fig. 1, the configuration apparatus 300 is configured to transmit the information provided from the subscriber terminal 10 connected to the subscriber terminal 10, based on the provisioning information of the subscriber terminal 10 If it is confirmed that the subscriber terminal 10 supports the digest scheme, the subscriber terminal 10 generates password information for performing a digest authentication procedure with respect to the subscriber terminal 10, It is possible to include the generated password information in the environment setting information sent to the subscriber terminal 10 at a time.

At this time, the configuration apparatus 300 can provide the password information generated for the subscriber terminal 10 to the subscriber terminal authentication apparatus 100, particularly, the authentication information storage unit 110.

Alternatively, the authentication information storage unit 110 may request the configuration apparatus 300 to generate password information for performing a digest authentication procedure with respect to the subscriber terminal 10 based on the provisioning information of the subscriber terminal 10 And may receive the generated password information accordingly.

The authentication information storage unit 110 stores the second authentication information for performing the digest authentication procedure including the password information acquired from the configuration apparatus 300 to the terminal identification information PUID of the subscriber terminal 10 ).

The authentication information storage unit 110 stores the first authentication information PUID for each different authentication method, for example, the AKA method and the digest method, according to the process described above, And authentication information for each authentication method to which the second authentication information is mapped.

When a call setup related to the terminal identification information of the subscriber terminal 10 is requested, the authentication method confirmation unit 120 identifies a specific authentication method related to the call setup request among a plurality of authentication methods.

At this time, based on the authentication method identification parameter included in the call setup request, the authentication method confirmation unit 120 can confirm a specific authentication method related to the call setup request among the plurality of authentication methods.

More specifically, when the application installed in the subscriber terminal 10 is executed, the subscriber terminal 10 determines whether the terminal identification information (PUID) of the subscriber terminal 10 itself and the authentication method adopted by the currently executed application are To the call processing apparatus 200 to make a connection to the IMS network.

When the authentication method checking unit 120 confirms a call setup request including the terminal identification information (PUID) and the authentication method identification parameter through the call processing device 200, And confirms the specific authentication method according to the authentication method identification parameter included in the setting request.

For example, if the application 1 of the IMS network-based VoIP service adopting the AKA scheme is executed in the subscriber terminal 10, the authentication scheme checking unit 120 determines whether the application 1 of the IMS network- We will check the AKA method as a specific authentication method.

Of course, if application 2 of the IMS network-based multimedia content download service adopting the digest scheme is executed in the subscriber terminal 10, the authentication scheme checking unit 120 may determine that the currently established call setup request The digest method will be confirmed as the specific authentication method concerned.

The authentication procedure performing unit 130 selects a specific authentication method (e.g., an AKA method or an authentication method) identified by the authentication method checking unit 120 from the stored authentication information for the authentication method for the terminal identification information (PUID) Digest method).

Accordingly, the authentication procedure execution unit 130 can perform the authentication procedure according to the authentication method corresponding to the subscriber terminal 10 based on the identified authentication information.

For example, if the authentication method checking unit 120 confirms the AKA method, the authentication procedure performing unit 130 may obtain the first authentication information mapped to the AKA scheme among the authentication information of each authentication method stored for the terminal identification information (PUID) I will confirm.

Accordingly, the authentication procedure execution unit 130 can perform the authentication procedure according to the AKA scheme corresponding to the subscriber terminal 10 based on the first authentication information.

More specifically, for example, the authentication procedure performing unit 130 may use the security key received through the call setup request from the subscriber terminal 10 or received separately from the subscriber terminal 10, And generates the authentication key information according to the AKA authentication key generation algorithm included in the authentication information. Here, the secret key may be at least one of ISIM identification information and secret key information of the subscriber terminal 10. [

Then, the authentication procedure performing unit 130 confirms whether the authentication key information generated by itself and the authentication key information included in the first authentication information, that is, the authentication key information generated by the authentication device 500 are the same, And can perform the authentication procedure according to the AKA authentication method for checking whether the call setup request from the identified subscriber terminal 10 is due to a legitimate subscriber.

Of course, there may be a variety of AKA-based authentication methods that are somewhat changed or differentiated from detailed authentication procedures.

Accordingly, the authentication procedure execution unit 130 may perform various existing AKA authentication procedures for the subscriber terminal 10 based on the first authentication information for various AKA authentication methods.

On the other hand, if the authentication method checking unit 120 confirms the digest method, the authentication procedure performing unit 130 may obtain the second authentication information mapped to the digest method among the authentication information for each authentication method stored in the terminal identification information (PUID) I will confirm.

Thus, the authentication procedure execution unit 130 can perform the authentication procedure according to the digest method corresponding to the subscriber terminal 10 based on the second authentication information.

More specifically, for example, the authentication procedure performing unit 130 may be configured to determine whether the password information received through the call setup request from the subscriber terminal 10 or received separately from the subscriber terminal 10 and the second authentication information It is possible to perform the authentication procedure according to the digest authentication method for confirming whether or not the call setup request from the subscriber terminal 10 confirmed by the currently confirmed subscriber is due to a legitimate subscriber by checking whether the included password information is identical.

Of course, there may be a variety of Digest-based authentication methods that are somewhat altered or differentiated in the detailed authentication process.

Accordingly, the authentication procedure execution unit 130 may perform the existing various digest authentication procedures for the subscriber terminal 10 based on the existing second authentication information for the various digest authentication methods.

Generally, the Digest method performs an authentication procedure to determine whether the Digest method is the same using ID and password information.

In the present invention, the second authentication information for the digest authentication includes the password information, and the authentication procedure performing unit 130 receives the authentication information from the subscriber terminal 10 via the call setup request from the subscriber terminal 10 By checking whether the separately received password information and the password information included in the second authentication information are the same or not, a digest authentication method for confirming whether or not the call setup request from the subscriber terminal 10 confirmed by the subscriber terminal 10 is due to a legitimate subscriber And the like.

In this case, the terminal identification information (PUID) of the subscriber terminal 10 included in the call setup request and the terminal identification information (PUID) serving as a reference for storing the authentication information for each authentication method in the authentication information storage unit 110, As shown in FIG.

Of course, in this case as well, the authentication procedure performing unit 130 may include the terminal identification information (PUID) and the password information received through the call setup request from the subscriber terminal 10 or separately received from the subscriber terminal 10, It is confirmed whether or not the terminal identification information (PUID) used for checking the second authentication information and the password information included in the second authentication information are the same, so that the call setup request from the subscriber terminal 10 confirmed this time is sent to a legitimate subscriber The authentication process may be performed according to the Digest authentication method.

If a Digest authentication procedure is to be performed using a different ID than the PUID, the subscriber terminal 10 stores separate ID and password information, and the subscriber terminal authentication apparatus The authentication procedure execution unit 130 receives the authentication request from the subscriber terminal 10 or receives the subscriber terminal 10 separately from the subscriber terminal 10 by receiving the second authentication information including the ID and the password information, Which confirms whether the ID and password information included in the second authentication information are identical to each other by checking whether the call setup request from the subscriber terminal 10 confirmed by the subscriber terminal 10 is due to a legitimate subscriber The authentication process according to the authentication scheme may be performed.

Meanwhile, according to another exemplary embodiment, the subscriber station authentication apparatus 100 may determine that the subscriber terminal 10 (the subscriber station 10) It is possible to select an authentication method most used in the subscriber terminal 10 among a plurality of authentication methods or to select an authentication method set to a default.

As described above, according to the subscriber terminal authentication apparatus of the present invention, in an environment where a plurality of applications for IMS-based services adopting different IMS authentication methods are installed / used in a subscriber terminal, It is possible to effectively perform an authentication procedure according to different IMS authentication schemes using one terminal identification information in an IMS network rather than assigning different identification information for each scheme.

Hereinafter, an operation method of the subscriber terminal authentication apparatus according to the present invention will be described with reference to FIG. 3 to FIG.

3, a control flow of a system including a subscriber station authentication apparatus according to an embodiment of the present invention will be described.

When the subscriber terminal 10 is opened, the subscriber terminal authentication apparatus 100 and the configuration apparatus 300 receive the provisioning information of the subscriber terminal 10 from the subscription system 400 (S10, S15).

If the subscriber terminal 10 supports the AKA scheme based on the provisioning information of the subscriber terminal 10, the subscriber terminal authentication apparatus 100 authenticates the subscriber terminal 10 from the authentication apparatus 500 through the AKA authentication procedure (S20). ≪ / RTI >

On the other hand, if the subscriber terminal 10 supports the digest method based on the provisioning information of the subscriber terminal 10, the subscriber terminal authentication apparatus 100 transmits the digest method to the subscriber terminal 10 from the configuration apparatus 300 And acquires password information for performing the authentication procedure (S30).

Here, steps S20 and S30 may not be performed first, and may be performed simultaneously.

Accordingly, the subscriber terminal authentication apparatus 100 can obtain first authentication information and password information for each different authentication method, for example, the AKA method and the digest method, for one terminal identification information (PUID) related to the subscriber terminal 10 And the authentication information for each authentication method to which the included second authentication information is mapped (S40).

The subscriber terminal 10 receives the configuration information provided by the configuration apparatus 300 to the subscriber terminal 10 at the first access to the configuration apparatus 300 after the connection is established (S50). At this time, The generated password information may be included.

Subsequently, when the application installed in the subscriber terminal 10 is executed (S60), the subscriber terminal 10 requests the call processing device 200 to set the call according to the execution of the application (S70). That is, the subscriber terminal 10 requests a call setup to the call processing device 200 according to application execution, thereby attempting to connect to the IMS network.

At this time, the subscriber terminal 10 includes an authentication method identification parameter indicating the terminal identification information (PUID) of the subscriber terminal 10 itself and the authentication method adopted by the currently executed application It is desirable to request. For example, the authentication scheme identification parameter may include an identifier indicating the AKA scheme or an identifier indicating the digest scheme.

When the subscriber terminal authentication apparatus 100 confirms a call setup request including the terminal identification information (PUID) and the authentication method identification parameter through the call processing apparatus 200, The specific authentication method associated with the setting request is confirmed (S80).

Then, the subscriber station authenticating device 100 determines whether or not the subscriber terminal authenticating device 100 is authentic to the specific authentication method based on the authentication information mapped to the identified authentication method among the stored authentication information for the authentication method for the terminal identification information (PUID) (S90), and can perform an authentication procedure for confirming whether or not the call setup request from the subscriber terminal 10, which is confirmed this time, is based on a legitimate subscriber.

Hereinafter, an operation method of a subscriber station authentication apparatus according to a preferred embodiment of the present invention will be described in detail with reference to FIG.

The operation method of the subscriber station authentication apparatus according to the present invention receives the provisioning information of the subscriber terminal 10 to be activated (S100).

The method for operating the subscriber terminal authentication apparatus according to the present invention is a method for operating the subscriber terminal 10 from the authentication apparatus 500 to the subscriber terminal 10 if the subscriber terminal 10 supports the AKA scheme based on the provisioning information of the subscriber terminal 10 The first authentication information for performing the AKA authentication procedure can be acquired and stored in association with the terminal identification information (PUID) of the subscriber terminal 10. [

More specifically, the method of operating the subscriber terminal authentication apparatus according to the present invention is a method for operating an authentication method using an AKA-based authentication method, for example, an IMS network Based VoIP service is installed (Yes in S110), the first authentication information for the subscriber terminal 10 can be obtained from the authentication device 500 (S120).

Alternatively, if the ISIM identification information is recorded in the ISIM identifier parameter included in the provisioning information of the subscriber terminal 10, the authentication method according to the AKA scheme is performed in the subscriber terminal 10 (S110 Yes), the first authentication information for the subscriber terminal 10 can be obtained from the authentication device 500 (S120).

The method for operating the subscriber terminal authentication apparatus according to the present invention is characterized in that the first authentication information for the subscriber terminal 10 acquired from the authentication apparatus 500 is associated with the terminal identification information (PUID) of the subscriber terminal 10 Can be stored.

If the subscriber terminal 10 supports the digest scheme, the subscriber terminal 10 may perform a digest authentication process to the subscriber terminal 10 based on the provisioning information of the subscriber terminal 10, And stores the second authentication information including the acquired password information in association with the terminal identification information (PUID) of the subscriber terminal 10. [

More specifically, as described above with reference to Fig. 1, the configuration apparatus 300 is configured to transmit the information provided from the subscriber terminal 10 connected to the subscriber terminal 10, based on the provisioning information of the subscriber terminal 10 If it is confirmed that the subscriber terminal 10 supports the digest scheme, the subscriber terminal 10 generates password information for performing a digest authentication procedure with respect to the subscriber terminal 10, It is possible to include the generated password information in the environment setting information sent to the subscriber terminal 10 at a time.

At this time, the operation method of the subscriber station authentication apparatus according to the present invention can receive / acquire the password information generated from the configuration apparatus 300 for the subscriber terminal 10 (S130).

Alternatively, the operation method of the subscriber terminal authentication apparatus according to the present invention may be configured such that the configuration apparatus 300 is provided with a password for performing the digest authentication procedure with respect to the subscriber terminal 10, based on the provisioning information of the subscriber terminal 10 Requesting the information generation and receiving / acquiring the generated password information (S130).

The method for operating the subscriber terminal authentication apparatus according to the present invention further includes the step of transmitting the second authentication information for performing the digest authentication procedure including the password information acquired from the configuration apparatus 300 to the subscriber terminal 10 It can be stored in association with the identification information (PUID).

The method of operating the subscriber terminal authentication apparatus according to the present invention through the process described above can be applied to a method of operating the subscriber terminal 10 by using the AKA method and the digest method according to different authentication methods for one terminal identification information (PUID) The authentication information for each authentication method to which the first authentication information and the second authentication information are mapped can be stored (S140).

When a call setup related to the terminal identification information of the subscriber terminal 10 is requested, the operation method of the subscriber station authentication apparatus according to the present invention checks the authentication method identification parameter included in the call setup request (S150).

Therefore, the operation method of the subscriber station authentication apparatus according to the present invention can confirm the specific authentication method related to the call setup request among the plurality of authentication methods based on the authentication method identification parameter included in the call setup request.

More specifically, when the application installed in the subscriber terminal 10 is executed, the subscriber terminal 10 determines whether the terminal identification information (PUID) of the subscriber terminal 10 itself and the authentication method adopted by the currently executed application are To the call processing apparatus 200 to make a connection to the IMS network.

The method of operating the subscriber station authentication apparatus according to the present invention is characterized in that when a call setup request including the terminal identification information (PUID) and the authentication method identification parameter is confirmed through the call processing device 200, The specific authentication method according to the authentication method identification parameter included in the call setup request confirmed at this time is checked (S160).

The operation method of the subscriber station authentication apparatus according to the present invention is characterized in that when the AKA method (first authentication method) is confirmed as a specific authentication method related to the call establishment request confirmed in the plurality of authentication methods as a result of the authentication method check (S160 ), The first authentication information mapped to the AKA scheme will be checked from the authentication information for each authentication method stored in the terminal identification information (PUID).

The method for operating the subscriber terminal authentication apparatus according to the present invention is characterized in that the authentication procedure according to the AKA scheme corresponding to the subscriber terminal 10 is performed based on the first authentication information, It is possible to authenticate whether the setup request is made by a legitimate subscriber (S170).

Meanwhile, when the digest method (second authentication method) is confirmed as a specific authentication method related to the call setup request that has been confirmed from among a plurality of authentication methods as a result of the authentication method check, the method of operating the subscriber station authentication device according to the present invention S160 (2)), the second authentication information mapped to the Digest method will be checked from the authentication information for each authentication method stored in the terminal identification information (PUID).

The operation method of the subscriber terminal authentication apparatus according to the present invention is characterized in that the authentication procedure according to the digest scheme corresponding to the subscriber terminal 10 is performed based on the second authentication information, It is possible to authenticate whether the setup request is made by a legitimate subscriber (S180).

As described above, according to the method of operating the subscriber station authentication apparatus according to the present invention, in an environment where a plurality of applications for IMS-based services adopting different IMS authentication schemes are installed / used at a subscriber station, It is possible to effectively perform an authentication procedure according to different IMS authentication schemes in the IMS network using one terminal identification information, rather than assigning different identification information for each IMS authentication method.

The method of operating the subscriber station authentication apparatus according to an exemplary embodiment of the present invention may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions recorded on the medium may be those specially designed and configured for the present invention or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware devices described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention.

According to the operation method of the subscriber terminal authentication apparatus and the subscriber terminal authentication apparatus according to the present invention, in an environment in which a plurality of applications for IMS-based services adopting different IMS authentication schemes are installed / used at a subscriber terminal, In order to effectively perform the authentication procedure according to different IMS authentication methods in the IMS network, it is possible that the devices which are applied not only to the related technology but also to the market or business In addition, it is an invention that can be used industrially because it is practically possible to carry out clearly.

100: Subscriber terminal authentication device
110: authentication information storage unit 120: authentication method confirmation unit
130: Authentication procedure performing unit

Claims (10)

An authentication information storage unit for storing authentication information for each authentication method to which authentication information is mapped for each of a plurality of different authentication methods for one terminal identification information related to a subscriber terminal;
An authentication method checking unit for checking a specific authentication method related to the call setup request among the plurality of authentication methods when a call setup related to the terminal identification information is requested; And
And an authentication procedure performing unit for performing an authentication procedure according to the specific authentication method to the subscriber terminal based on the authentication information mapped to the identified specific authentication method among the authentication information for each authentication method stored in the terminal identification information, ,
The authentication information storage unit stores,
If it is confirmed that the application requiring the authentication procedure according to the first authentication scheme among the plurality of authentication schemes is loaded on the subscriber station, acquires the first authentication information mapped to the first authentication scheme for the subscriber station, And stores the information in association with the terminal identification information of the subscriber terminal. ◈ Claim 2 is abandoned due to payment of registration fee. The method according to claim 1,
Wherein the first authentication information includes:
And an authentication key generation algorithm for generating the authentication key information using the authentication key information for authenticating the subscriber terminal and the security key received from the subscriber terminal according to the first authentication method Subscriber terminal authentication device. delete ◈ Claim 4 is abandoned due to the registration fee. 3. The method according to claim 1 or 2,
Wherein the second authentication information, which is mapped to the second authentication method among the plurality of authentication methods,
And password information for authenticating the subscriber terminal according to the second authentication method. ◈ Claim 5 is abandoned due to the registration fee. 5. The method of claim 4,
The authentication information storage unit stores,
Acquires the password information provided from the specific configuration apparatus to the subscriber terminal and stores the second authentication information including the obtained password information in association with the terminal identification information of the subscriber terminal. Authentication device. ◈ Claim 6 is abandoned due to the registration fee. The method according to claim 1,
Wherein the authentication-
And confirms the specific authentication method related to the call setup request among the plurality of authentication methods based on the authentication method identification parameter included in the call setup request. An authentication information storing step of storing authentication information for each authentication method in which authentication information is mapped for each of a plurality of different authentication methods with respect to one terminal identification information related to a subscriber terminal;
An authentication method checking step of checking a specific authentication method related to the call setup request among the plurality of authentication methods when a call setup related to the terminal identification information is requested; And
And performing an authentication procedure according to the specific authentication method for the subscriber terminal based on the authentication information mapped to the identified specific authentication method among the authentication information for each authentication method stored for the terminal identification information In addition,
The authentication information storing step may include:
If it is confirmed that the application requiring the authentication procedure according to the first authentication scheme among the plurality of authentication schemes is loaded on the subscriber station, acquires the first authentication information mapped to the first authentication scheme for the subscriber station, Wherein the terminal identification information is stored in association with the terminal identification information of the subscriber terminal. ◈ Claim 8 is abandoned due to the registration fee. 8. The method of claim 7,
Wherein the first authentication information includes:
And an authentication key generation algorithm for generating the authentication key information using the authentication key information for authenticating the subscriber terminal according to the first authentication method and the security key received from the subscriber terminal,
Wherein the second authentication information, which is mapped to the second authentication method among the plurality of authentication methods,
And password information for authenticating the subscriber terminal according to the second authentication method. delete ◈ Claim 10 is abandoned due to the registration fee. 9. The method of claim 8,
The authentication information storing step may include:
Acquires the password information provided from the specific configuration apparatus to the subscriber terminal and stores the second authentication information including the obtained password information in association with the terminal identification information of the subscriber terminal. A method of operating an authentication device.

Images