KR102143446B1 - Authentication apparatus in wireless communication system, method thereof and computer recordable medium storing the method - Google Patents

Abstract

The present invention relates to an apparatus for authentication processing in a wireless communication system, a method therefor, and a computer-readable recording medium on which the method is recorded, and the present invention relates to a UE moving from an LTE network to a 3G network, and then to an LTE network. Suppose the situation goes to. That is, the UE moves from the old MME to the SGSN and back to the MME. The MME does not obtain authentication information by querying the HSS for the authentication procedure for the UE, but obtains the authentication information of the UE from the old MME. That is, the MME must exchange an Authentication Information Request message and an Authentication Information Answer message for HSS and UE authentication, but does not obtain authentication information from the HSS, but obtains authentication information from the old MME. . For this reason, the load on the HSS is reduced. Since the HSS is operated with a relatively small number of nodes, reducing the load on the HSS eventually reduces the load on the entire network.

Description

An apparatus for authentication processing in a wireless communication system, a method therefor, and a computer-readable recording medium recording the method thereof.

The present invention relates to wireless communication technology, and more particularly, to an apparatus for authentication processing in a wireless communication system, a method therefor, and a computer-readable recording medium on which the method is recorded.

As a representative 4G mobile communication standard, there is LTE-A (LTE advanced) which is an improved LTE (Long Term Evolution). Also included as. LTE is based on Release 8, a wireless high-speed data packet access standard confirmed in December 2008 by the 3GPP (3rd Generation Partnership Project), and is aimed at 4G wireless technology (4G) designed to increase the capacity and speed of the network. It is the technology of the previous stage. LTE is an all-IP-based network that provides differentiated QoS (Quality of Service) for real-time and non-real-time services, providing efficiency of network resources, and also by introducing smart antenna technology (MIMO). By expanding the bandwidth for wireless communication, it supports more than 12 times faster speed than HSDPA. LTE-A is defined as improving the above-described LTE to provide a maximum transmission rate of 1 Gbps down and 500 Mbps upstream when stopped. Such LTE-A provides higher data throughput than LTE through carrier aggregation (CA) and Coordinate Multi-Point (CoMP) technologies that are not supported by LTE. Here, CA is a technology that expands and uses a frequency bandwidth by grouping and using different frequency bands at the same time, and CoMP is a technology that increases throughput at a cell boundary through interference control by cooperation between neighboring base stations. Accordingly, in the current mobile communication system, two or more mobile communication services according to different standards such as LTE and LTE-Advanced are mixed and supported.

Korean Patent Application Publication No. 2011-0045764, published on May 04, 2011 (Name: communication method and system therefor in mobile communication network)

It is an object of the present invention to provide an apparatus for authentication processing in a wireless communication system capable of reducing traffic generated in an authentication procedure in a wireless communication system, a method therefor, and a computer-readable recording medium on which the method is recorded.

The mobility management server for authentication processing according to a preferred embodiment of the present invention for achieving the above object is an interface unit that receives a tracking area update request from a user device that has moved through a packet exchange support node in the old mobility management server. And, receiving the mobility management context for the user device from the packet exchange support node through the interface unit, extracting the identifier of the old mobility management server from the received mobility management context, and using the extracted identifier And a controller configured to authenticate the user device through the obtained authentication information after obtaining authentication information of the user device from the mobility management server.

The method for authentication processing of a mobility management server for authentication processing according to a preferred embodiment of the present invention for achieving the above object is to update a tracking area from a user device that has moved through a packet exchange support node in the old mobility management server. Receiving a request, acquiring an identifier of an old mobility management server from the packet exchange support node, and acquiring authentication information of the user device from the old mobility management server using an identifier of the old mobility management server And performing authentication for the user device through the authentication information.

The present invention assumes a situation in which a user equipment (UE, user equipment) moves from an LTE network to a 3G network and then moves back to the LTE network. At this time, according to the present invention, when the tracking area of the UE is updated, the procedure of inquiring to the home subscriber server (HSS) can be omitted from the authentication and security procedure in progress, thereby reducing the load on the home subscriber server. . Since the home subscriber server is operated with a relatively small number of nodes, reducing the load on the home subscriber server ultimately reduces the load on the entire network.

1 is a diagram for explaining a schematic configuration of a wireless communication system according to an embodiment of the present invention.
2 is a diagram for explaining an identifier assigned to a user device according to an embodiment of the present invention.
3 is a conceptual diagram illustrating an authentication processing method according to an embodiment of the present invention.
4 is a view for explaining the configuration of a mobility management server according to an embodiment of the present invention.
5A and 5B are flowcharts illustrating an authentication processing method in a tracking area update procedure according to an embodiment of the present invention.
6 is a flowchart illustrating an authentication processing method of a mobility management server according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in the accompanying drawings, the same components are denoted by the same reference numerals as possible. In addition, detailed descriptions of well-known functions and configurations that may obscure the subject matter of the present invention will be omitted. For the same reason, some components in the accompanying drawings are exaggerated, omitted, or schematically illustrated.

1 is a diagram for explaining a schematic configuration of a wireless communication system according to an embodiment of the present invention.

Referring to FIG. 1, a wireless communication system according to an embodiment of the present invention includes a base station (eNodeB, hereinafter "eNB", 100), a mobility management server (Mobility Management Entity, hereinafter, "MME", 200), and a serving gateway ( Serving Gateway, hereinafter "SGW", 300), Packet Data Network Gateway (hereinafter, "PGW", 400), Home Subscriber Server (hereinafter, "HSS", 500), charge policy management Server (Policy Control and Charging Rules Function, hereinafter "PCRF", 600), and a packet switching support node (Serving General Packet Radio Service (GPRS) Supporting Node, hereinafter "SGSN", 700).

The above-described system is called EPS (Evolved Packet System), and EPS is an IP-based packet switched core network such as Evolved Packet Core (EPC) and Evolved-Universal Terrestrial Radio Access Network (E-UTRAN). It includes a Radio Access Network (RAN). Here, the EPC includes the MME (200), SGW (300), PGW (400) and HSS (500).

Each of the entities according to the above-described embodiment of the present invention will be described.

The MME 200 performs access to a network connection of a user equipment (hereinafter, "UE", 10), allocation of network resources, tracking, paging, roaming, handover, and the like. It is an element that performs signaling and control functions to support. The MME 200 controls control plane functions related to subscriber and session management. The MME 200 manages a plurality of eNBs 100 and performs signaling to select a conventional gateway for handover to another 2G/3G network. In addition, the MME 200 performs functions such as security procedures, terminal-to-network session handling, and idle terminal location management.

The SGW 300 operates as a boundary point between a radio access network (RAN) and a core network, and is an element that functions to maintain a data path between the eNB 100 and the PGW 400. In addition, when the UE 10 moves over an area served by the eNB 100 (eg, handover, etc.), the SGW 300 serves as an anchor point for the movement. That is, packets may be routed through the SGW 300 for mobility within the E-UTRAN. In addition, the SGW 300 is another 3GPP network (RAN defined before 3GPP Release 8, for example, UTRAN or GERAN (Global System for Mobile Communication) / EDGE (Enhanced Data rates for Global Evolution) Radio Access Network) In addition, the SGW 300 may perform functions such as idle mode downlink packet buffering and lawful interception of the E-UTRAN idle mode downlink. .

The PGW 400 corresponds to a termination point of a data interface toward a packet data network. PGW 400 includes policy enforcement features, packet filtering, charging support, lawful interception, UE IP allocation, and packet screening. It can perform functions such as. In addition, mobility management between 3GPP networks and non-3GPP networks (e.g., untrusted networks such as I-WLAN (Interworking Wireless Local Area Network), Code Division Multiple Access (CDMA) networks or trusted networks such as WiMax) Can serve as an anchor point for

The HSS 500 manages user subscription information (or subscription data or subscription record) and location information. In particular, the HSS 500 includes an Authentication Center (Auc). The LTE key (K) and IMSI, which are master keys for EPS, are stored in the UE 10 and AuC. The LTE key (K) and IMSI are stored at the time of manufacturing the USIM card mounted on the UE 10, and provisioned at AuC when the user subscribes to the operator network.

The PCRF 600 manages a policy to be applied to the UE 10 and a quality of service (QoS). The PCC (Policy and Charging Control) rule generated in PCRF is transmitted to the PGW 400.

The SGSN 700 handles all packet data, such as user mobility management and authentication to other 3GPP networks (eg, GPRS networks).

The present invention assumes a situation in which the UE 10 moves from an LTE network to a 3G network, then moves back to the LTE network, and performs a tracking area update procedure. Since the LTE network uses an MME Pool (S1-Flex), most of the UE 10 camps with a different MME from the previous MME. That is, it is assumed that the UE 10 camps on the previous MME in the LTE network, moves to the SGSN 700 of the 3G network, and then moves to the MME 200 of the LTE network again. The MME 200 typically requests the HSS 500 to obtain authentication information and then proceeds with the authentication process. However, according to an embodiment of the present invention, the MME 200 obtains authentication information from the previous MME to which the UE 10 previously camped, and proceeds with the authentication procedure. However, since the UE 10 has not moved from the previous MME, the MME 200 cannot identify the previous MME. Accordingly, the MME 200 receives information for identifying the previous MME from the SGSN 700, that is, the MME identifier, and obtains authentication information of the UE 10 from the previous MME through this. The MME 200 needs to exchange messages with the HSS 500 in order to receive authentication information for the UE 10, but because it obtains authentication information from the previous MME, the load on the HSS 500 is reduced. Since the HSS 500 is operated with a relatively small number of nodes, by reducing the load of the HSS 500, it is possible to reduce the load of the entire network.

2 is a diagram for explaining an identifier assigned to a user device according to an embodiment of the present invention.

Meanwhile, referring to FIG. 2, when the UE 10 initially accesses the LTE network (Initial Attach), it requests an access using an International Mobile Subscriber Identity (IMSI). IMSI is a permanent value that uniquely identifies a mobile communication subscriber, and if frequently exposed on a wireless link, a security problem may arise. Accordingly, upon initial access, the MME 200 allocates a Globally Unique Temporary Identifier (GUTI) capable of uniquely identifying a subscriber to the UE 10 on behalf of IMSI. Thereafter, when the UE 10 reconnects, GUTI is used instead of IMSI.

GUTI includes a Globally Unique MME Identifier (GUMMEI) and an MME Temporary Mobile Subscriber Identity (M-TMSI). GUMMEI is an identifier for identifying the MME 200, and consists of a PLMN ID (Public Land Mobile Network Identifier) that can identify a mobile communication service provider and an MMEI (MME Identifier) that can distinguish the MME 200 within the PLMN.

Here, the PLMN ID is composed of MCC (Mobile Country Code) and MNC (Mobile Network Code), and GUMMEI is composed of MMEC (MME Code) and MMEGI (MME Group Identifier). Within one operator network, MME can be classified by MMEI, and outside the operator network, MME can be classified by GUMMEI.

M-TMSI is an identifier assigned by the MME 200 to the UE 10 camping on the MME 200 in order to uniquely identify the UE 10 within one MME 200. Eventually, the MME 200 allocates the M-TMSI to the UE 10 camping on it, and provides the UE 10 with a GUTI that combines the M-TMSI and the MME 200's own identifier GUMMEI. In this way, unlike IMSI, GUTI is a temporary value allocated by the MME 200 each time the UE 10 registers in the LTE network, so if the GUTI is known, the identifier (GUMMEI) of the MME 200 is Able to know.

As described above, the MME 200 may deliver the GUTI to the UE 10 through an Attach Accept message during initial access. In addition to this, the MME 200 may deliver the GUTI through a Tracking Area Update Accept message upon registration update.

3 is a conceptual diagram illustrating an authentication processing method according to an embodiment of the present invention.

Referring to FIG. 3, an embodiment of the present invention assumes a case in which the UE 10 moves from an LTE network to a 3G network and then returns to the LTE network. That is, the UE 10 camps on the old MME 203 of the EPC in the LTE network, moves to the SGSN 700 of the 3G network, and then moves to the MME 200 of the LTE network again. In particular, since the LTE network uses an MME Pool (S1-Flex), most of the UE 10 camps with an MME 200 different from the old MME 203. In this case, the UE 10 camps a new MME ( Since 200) has never performed an authentication procedure for the UE 10, it does not have authentication information for the UE 10, and the present invention assumes this situation.

Upon initial access, the UE 10 transmits the IMSI to the old MME 203 in step S1, and the old MME 203 requests authentication information from the HSS 500 in step S2. This is accomplished by sending an Authentication Information Request message. In response, the HSS 500 transmits the authentication information to the old MME 203 through an Authentication Information Answer message in step S3. The authentication information may be, for example, an authentication vector. The old MME 203 may authenticate the UE 10 through the authentication information received from the HSS 500. In particular, the old MME 203 stores this authentication information in step S4. The old MME 203 keeps the stored authentication information until a deletion request is made. Meanwhile, the old MME 203 may allocate a GUTI in step S5. And the old MME 203 provides the GUTI to the UE 10 in step S6.

Next, the UE 10 moves from the LTE network to the 3G network in step S7, accesses the SGSN 700 of the GPRS (General Packet Radio Service) core in step S8, and camps on the SGSN 700. At this time, the SGSN 700 configures a mobility management context (MM (Mobility Management) context) for mobility management of the UE 10 in step S9. The SGSN 700 includes the GUTI assigned from the MME 203, where the UE 10 first camped, in the mobility management context. This may be received from the UE 10 or may be extracted from the context received from the old MME 203 by requesting the context from the old MME 203.

Subsequently, the UE 10 may move back from the 3G network to the LTE network in step S10 and make a request to update the tracking area to the MME 200 of the EPC in step S11. At this time, since the MME 200 receiving the tracking area update request does not have authentication information for the UE 10, it can be confirmed that the MME that the UE 10 has previously camped on is not itself.

Accordingly, the MME 200 requests a context from the SGSN 700 in step S12, and accordingly, the SGSN 700 provides a context, that is, a mobility management context, to the MME 200 in step S13. The mobility management context includes the GUTI of the old MME 203. Accordingly, the MME 200 can extract the identifier (GUMMEI) of the old MME 203 from the GUTI of the old MME 203, and can identify the old MME 203.

The MME 200 performs an authentication procedure when the UE 10 initially accesses or when the tracking area update procedure is performed.According to an embodiment of the present invention, the MME 200 performs an HSS ( 500) does not request authentication information. Since the MME 200 can identify the old MME 203 and the old MME 203 will store the authentication information, the MME 200 requests the old MME 203 for authentication information in step S15. . Then, the old MME 203 provides authentication information to the MME 200 in step S16. Accordingly, the MME 200 may perform authentication for the UE 10 through the authentication information received from the old MME 203 in step S17.

As can be seen, for this authentication procedure, traffic with the old MME 203 increases, but traffic between the MME 200 and the HSS 500 does not occur. HSS 500 is basically, since the number of nodes is small, and a large number of MMEs 200 generate traffic with the HSS 500 for authentication of the UE 10, when considering the load of the HSS 500, The load on the entire network can be significantly reduced.

4 is a view for explaining the configuration of a mobility management server according to an embodiment of the present invention.

Referring to FIG. 4, the MME 200 includes an interface unit 210, a storage unit 220 and a control unit 230.

The interface unit 210 performs a role of communicating through different interfaces, such as the eNB 100, the SGW 300, the HSS 500, and the SGSN 700, respectively. The interface unit 210 transmits a message input from the control unit 230 to the eNB 100, SGW 300, HSS 500, SGSN 700, etc. through a corresponding interface, and transmits the message input from the control unit 230 to the eNB 100 and the SGW. When a message is received from 300, HSS 500, SGSN 700, etc., it is transmitted to the control unit 230.

The storage unit 220 is for data storage, and may store various types of data according to an embodiment of the present invention. For example, the storage unit 220 may store a Globally Unique Temporary Identifier (GUTI) assigned to the UE 10 that it serves, location information, and a context including authentication information.

The controller 230 may control the overall operation of the MME 200 and a signal flow between internal blocks of the MME 200, and may perform a data processing function of processing data. The controller 230 may be a processor such as a central processing unit (CPU).

The control unit 230 may receive a tracking area update request message from the UE 10 through the interface unit 210. The tracking area update request message includes an identifier used in the core network in which the UE 10 previously camped. Accordingly, the control unit 230 can know that the UE 10 has moved from the SGSN 700. In addition, since the control unit 230 does not store the context or authentication information for the UE 10, before moving to the SGSN 700, it is possible to know that the old MME 203 camping in the LTE network is not itself. have.

Accordingly, the control unit 230 obtains a mobility management context by requesting the SGSN 700 through the interface unit 210. The mobility management context includes the GUTI of the old MME 203. Accordingly, the controller 230 extracts the identifier (GUMMEI) of the old MME 203 from the acquired GUTI of the old MME 203. Then, the control unit 230 makes a request to the old MME 203 through the interface unit 210, and obtains the authentication information of the UE 10 from the old MME 203. Accordingly, the controller 230 may perform authentication for the UE 10 through the acquired authentication information.

5A and 5B are flowcharts illustrating an authentication processing method in a tracking area update procedure according to an embodiment of the present invention.

5A and 5B, it is assumed that the UE 10 moves from the LTE network to the 3G network and then returns to the LTE network. In more detail, the UE 10 camps on the old MME 203 of the EPC, camps on the SGSN 700 of the GPRS core, and then moves to the EPC. At this time, it is assumed that the UE 10 has moved to the MME 200 without moving to the old MME 203.

Referring to FIG. 5A, in order to perform location registration for the UE 10, a tracking area update (TAU) procedure may be started in step S100.

The UE 10 transmits a Tracking Area Update Request message to the eNB 100 requesting to update the tracking area in step S101. Then, the eNB 100 transmits a tracking area update request message to the MME 200 in step S102. The tracking area update request message includes an identifier assigned to the UE 10 by the SGSN 700, and the MME 200 can identify the SGSN 700 through this identifier. In addition, since the MME 200 receiving the tracking area update request message does not have authentication information for the UE 10, it can be confirmed that the MME that the UE 10 has previously camped on is not itself.

Accordingly, the MME 200 transmits an SGSN Context Request message to the SGSN 700 in step S103. In response to this, the SGSN 700 transmits an SGSN Context Response message in step S104. The SGSN 700 configures a mobility management context (MM (Mobility Management) Context) for the UE 10 when the UE 10 initially accesses the 3G network. The mobility management context includes the GUTI assigned to the UE 10 by the old MME 203 before the UE 10 moves to the SGSN 700. The SGSN Context Response message contains the mobility management context including the GUTI of the old MME 203.

Upon receiving the SGSN Context Response message, the MME 200 may extract the GUMMEI of the old MME 203 from the GUTI. That is, as described above, since the GUTI consists of GUMMEI and M-TMSI, the MME 200 can extract the GUMMEI of the old MME 203 from the GUTI.

The MME 200 extracting the GUMMEI of the old MME 203 may obtain authentication information (eg, an authentication vector) from the old MME 203 in step S105. For example, when the MME 200 transmits an authentication information request message requesting authentication information to the old MME 203, the old MME 203 transmits the authentication information to the MME 200, and so on. Here, the authentication information transmitted by the old MME 203 is received by requesting the HSS 500 when the UE 10 initially accesses the old MME 203. The old MME 203 maintains this authentication information until it receives a Cancel Location message, which will be described below.

Having obtained the authentication information, the MME 200 may perform authentication and security procedures in step S106. For example, the MME 200 performs a subscriber authentication with the UE 10 on behalf of the HSS 500 through an authentication vector for the UE 10, and when authentication is completed, a security setup procedure is performed. The UE (10), the eNB (100), and the MME (200) extract and share a security key used for communication between the UE (10) and the eNB (100) and MME (200) from the authentication vector through a security setting procedure. I can.

As can be seen, for this authentication procedure, traffic with the old MME 203 increases, but traffic between the MME 200 and the HSS 500 does not occur. HSS (500) is basically, since the number of nodes is small, and all MMEs generate traffic with the HSS (500) for authentication of the UE (10), when considering the load of the HSS (500), for the entire network The load can be significantly reduced. When the above-described authentication procedure is completed, the MME 200 transmits an SGSN Context Acknowledge message to the SGSN 700 in step S107.

Next, the network establishes a bearer to serve to the UE 10. That is, the MME 200 transmits a Create Session Request message to the SGW 300 in step S109, and the SGW 300 transmits a Modify Bearer Request message in step S110 to the PGW 400 To send. Then, the PGW 400 proceeds with an IP connection access network session modification (PCEF initiated IP-CAN Session Modification) procedure in step S111. Then, the PGW (400) transmits a bearer modification response (Modify Bearer Response) message to the SGW (300) in step S112. Accordingly, the SGW 300 transmits a Create Session Response message to the MME 200 in step S113 to finish the bearer setup.

When the bearer is successfully established, the MME 200 transmits an Update Location Request message in step S114 to inform the HSS 500 that the location of the UE 10 has changed. Accordingly, the HSS 500 changes the location of the UE 10 in its database. The HSS 500 transmits a location cancellation message to the old MME 203 in step S115 to notify that the location of the UE 10 has changed. Accordingly, the old MME 203 deletes the stored authentication information for the UE 10 and the like. Then, the old MME (203) transmits a location cancellation confirmation (Cancel Location Ack) message to the HSS (500) in step S116.

Subsequently, the HSS 500 transmits a cancel location message to the SGSN 700 in step S117 to notify that the location of the UE 10 has changed.

Then, the SGSN 700 transmits a lu interface release command message to the RNC BSC 101 in step S118 to release the lu interface connection. After releasing the lu interface connection, the RNC BSC 101 transmits a lu interface release complete message to the SGSN 700 in step S119. Accordingly, the SGSN 700 transmits a Cancel Location Ack message to the HSS 500 in step S120.

Meanwhile, the HSS 500 receiving the Cancel Location Ack message informs that the location update has been completed by transmitting an Update Location Ack message to the MME 200 in step S121. Accordingly, the MME 200 transmits a Tracking Area Update Accept message to the UE 10 in step S122. The tracking area update acceptance message may include a new GUTI and TAI list allocated by the MME 200. Accordingly, the UE 10 may update the GUTI and TAI list upon receiving the tracking area update acceptance message. Then, the UE 10 transmits a Tracking Area Update Complete message to the MME 200 in step S123. Thereby, the tracking area update procedure ends.

6 is a flowchart illustrating an authentication processing method of a mobility management server according to an embodiment of the present invention.

Referring to FIG. 6, the controller 230 receives a Tracking Area Update Request message requesting to update the tracking area of the UE 10 through the interface unit 210 in step S210. Through the tracking area update request message, the controller 230 can recognize that the UE 10 has moved from the SGSN 700, and can confirm that the MME that has camped before that is not itself.

Accordingly, the controller 230 obtains a mobility management context (MM) from the SGSN 700 through the interface unit 210 in step S220. In step S220, the control unit 230 transmits an SGSN Context Request message to the SGSN 700 through the interface unit 210, and the SGSN context response (SGSN Context Request) including the mobility management context from the SGSN 700 Response)　Receive a message.

Next, the controller 230 extracts the identifier of the old MME 203, that is, GUMMEI, from the mobility management context in step S230. Since the GUTI consists of GUMMEI and M-TMSI, the MME 200 can extract the GUMMEI of the old MME 203 from the GUTI.

Then, the control unit 230 may obtain authentication information (eg, authentication vector) from the old MME 203 in step S240. Since the old MME 203 can be identified through the old MME 203's identifier (GUMMEI), the control unit 230 provides authentication information for the MME 200 to request authentication information from the old MME 203 in step S240. The request message is transmitted, and authentication information of the UE 10 is received from the old MME 203. Here, the authentication information may be an authentication vector.

The controller 230 that has obtained the authentication information may perform authentication and security procedures in step S250. For example, the controller 230 performs authentication with the UE 10 on behalf of the HSS 500 through an authentication vector for the UE 10, and proceeds with a security setting procedure when authentication is completed.

The MME 200 must exchange an authentication information request message and an authentication information response message for authentication of the HSS 500 and the UE 10. However, according to the embodiment of the present invention, since authentication information is obtained from the old MME 203 rather than from the HSS 500, the load on the HSS 500 can be reduced.

The method for authentication processing according to an embodiment of the present invention as described above may be provided in the form of a computer-readable medium suitable for storing computer program instructions and data. In this case, a computer-readable medium suitable for storing computer program commands and data is, for example, a recording medium such as a hard disk, a floppy disk, and a magnetic medium such as a magnetic tape, and a CD-ROM (Compact Disk Read Only Memory). , Optical Media such as DVD (Digital Video Disk), Magneto-Optical Media such as Floptical Disk, and ROM (Read Only Memory), RAM (RAM) , Random Access Memory), flash memory, EPROM (Erasable Programmable ROM), and EEPROM (Electrically Erasable Programmable ROM). The processor and memory can be supplemented by, or incorporated into, special-purpose logic circuits. Examples of program instructions may include high-level language codes that can be executed by a computer using an interpreter, as well as machine language codes such as those produced by a compiler. Such a hardware device may be configured to operate as one or more software modules to perform the operation of the present invention, and vice versa.

This specification includes details of many specific implementations, but these should not be understood as limiting on the scope of any invention or claim, but rather as a description of features that may be specific to a particular embodiment of the particular invention. It should be understood. Certain features that are described in this specification in the context of separate embodiments may be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment may also be implemented individually or in any suitable sub-combination in a plurality of embodiments. Furthermore, although features operate in a particular combination and may be initially described as so claimed, one or more features from a claimed combination may in some cases be excluded from the combination, and the claimed combination may be a subcombination. Or sub-combination variations.

Likewise, although the operations are depicted in the drawings in a particular order, it should not be understood that such operations should be performed in the particular order shown or in sequential order, or that all shown actions should be performed in order to obtain desirable results. In certain cases, multitasking and parallel processing may be advantageous. In addition, separation of the various system components of the above-described embodiments should not be understood as requiring such separation in all embodiments, and the program components and systems described are generally integrated together as a single software product or packaged in multiple software products. You should understand that you can.

On the other hand, the embodiments of the present invention disclosed in the specification and drawings are merely presented as specific examples to aid understanding, and are not intended to limit the scope of the present invention. It is apparent to those skilled in the art to which the present invention pertains that other modified examples based on the technical idea of the present invention can be implemented in addition to the embodiments disclosed herein.

The present invention relates to an apparatus for authentication processing in a wireless communication system, a method therefor, and a computer-readable recording medium on which the method is recorded. The present invention relates to a user equipment (UE, User Equipment) in an LTE network. It is assumed that the user moves to the 3G network and then moves to the LTE network again. That is, the UE moves from the old MME to the SGSN and back to the MME. The MME does not obtain authentication information by querying the HSS for the authentication procedure for the UE, but obtains the authentication information of the UE from the old MME. That is, the MME must exchange an Authentication Information Request message and an Authentication Information Answer message for HSS and UE authentication, but does not obtain authentication information from the HSS, but obtains authentication information from the old MME. . For this reason, the load on the HSS is reduced. Since the HSS is operated with a relatively small number of nodes, reducing the load on the HSS eventually reduces the load on the entire network. The present invention is commercially available or commercially feasible, as well as a degree that can be practically clearly implemented, and thus has industrial applicability.

100: base station, eNB 200: mobility management server, MME
210: interface unit 220: storage unit
230: control unit 300: serving gateway, SGW
400: packet data network gateway, PGW
500: Home Subscriber Server, HSS 600: Rate Policy Management Server, PCRF
700: packet switching support node, SGSN

Claims (8)

An interface unit for receiving a tracking area update request from a user device moved from the packet switching support node after moving from the old mobility management server to the packet switching support node; And
After acquiring the identifier of the old mobility management server from the packet exchange support node through the interface unit, acquiring authentication information of the user device from the old mobility management server using the acquired identifier, the user device through the obtained authentication information The mobility management server for authentication processing comprising a; control unit for performing authentication. The method of claim 1,
The control unit
Receiving the identifier of the user device assigned to the user device by the old mobility management server from the packet exchange support node, and extracting the identifier of the old mobility management server from the user device ID. Management server. According to claim 2,
The identifier of the user device is a Globally Unique Temporary Identifier (GUTI),
The mobility management server for authentication processing, characterized in that the identifier of the old mobility management server is GUMMEI (Globally Unique MME Identifier). The method of claim 1,
The above authentication information is
A mobility management server for authentication processing, characterized in that the old mobility management server is an authentication vector obtained from a home subscriber server. After moving from the old mobility management server to a packet switching support node, receiving a tracking area update request from the moved user device from the packet switching support node;
Acquiring an identifier of an old mobility management server from the packet switching support node;
Obtaining authentication information of the user device from the old mobility management server by using the identifier of the old mobility management server; And
And performing authentication for the user device through the authentication information. The method of claim 5,
The obtaining step
Receiving a mobility management context including an identifier of the user device allocated to the user device by the old mobility management server from the packet switching support node; And
And extracting the identifier of the old mobility management server from the user device identifier. The method of claim 5,
After the step of performing authentication for the user device,
By transmitting a location update request message for the user device to the home subscriber server, the home subscriber server transmits a location cancellation message to the old mobility management server and stores the authentication information of the user device stored in the old mobility management server. The method for authentication processing of the mobility management server further comprising a; step of deleting. A computer-readable recording medium on which a method for authentication processing according to any one of claims 5 to 7 is recorded.

Images