KR20050016850A - System for authenticating EV-DO service on mobile network and operating method thereof - Google Patents

Abstract

PURPOSE: An EV-DO service authentication processing system in a mobile communication network and an operating method thereof are provided to perform a terminal authentication process for deciding whether an EV-DO service usage is legal through an authentication center, thereby cutting off EV-DO service usage by an illegally copied portable terminal. CONSTITUTION: A portable terminal(100) requests a terminal authentication for EV-DO service supplying by using a call history count, updates the call history count, and supplies an EV-DO service. An AN(Access Network) AAA server(400) transmits authentication request information transmitted from the portable terminal(100) to an AC(Authentication Center)(500) to request the portable terminal(100) to be authenticated, and sends result information to an ANC(Access Network Controller)(300). A DB(600) stores the call history count, and is interworked with the AC(500). The AC(500) receives the authentication request information, extracts a call history count to compare with the stored call history count, updates the stored call history count if the compared counts are the same, and transmits authentication results to the AAA server(400).

Description

System for authenticating EV-DO service on mobile network and operating method

The present invention relates to an EV-DO service authentication processing system and a method of operating the same in a mobile communication network, and more particularly, to authenticate a portable terminal (eg, a mobile phone, etc.) according to a user's use of an EV-DO service through an authentication center. The present invention relates to an EV-DO service authentication processing system and a method of operating the same.

Recently, with the rapid development of high-speed wireless Internet technology, a video service using a portable terminal (eg, a mobile phone) has been expanded. Examples thereof include movies, music videos, games, and video phones. These video services are provided through the CDMA2000 1 × EV-DO (EV-DO) network (hereinafter referred to as EV-DO), which supports high-speed wireless Internet with data transfer rates up to 20 times faster than the 'CDMA2000 1 ×' network. This is also called an EV-DO service. Representative examples of EV-DO services include SKT's June.

Hereinafter, an authentication process of a corresponding terminal when providing an EV-DO service through a portable terminal will be described.

1 is a schematic configuration diagram of a conventional EV-DO service authentication processing system. As shown in FIG. 1, a conventional EV-DO service authentication processing system includes a portable terminal (eg, SCH-V300, SCH-V300SS, SCH-V330, etc.) 10 supporting an EV-DO service, a wireless communication network ( 20), ANC (Access Network Controller, hereinafter referred to as Access Network Controller) (30), AN-AAA (Access Network Authentication Authorization Accounting, hereinafter referred to as Access Network AAA Server) (40), DLR (Data Link Register, Hereinafter referred to as a data link register).

First, when an EV-DO service is requested by a user, the portable terminal 10 transmits basic terminal information (for example, a mobile identity number (MIN) and an ESN (electric serial number) to the access network controller 30 through the wireless communication network 20. Number), etc.] to request terminal authentication for using the EV-DO service.

The access network controller 30 receives the authentication request of the portable terminal 10 through the wireless communication network 20 and transmits basic information of the portable terminal 10 to the access network AAA server 40 to request terminal authentication. do.

The access network AAA server 40 constructs and manages basic information on portable terminals of subscribers who have subscribed to the EV-DO service in a separate database (not shown), and accesses a predetermined portable terminal from the access network controller 30. 10) If the basic information is delivered, the database is checked with the received basic information, and if the mobile terminal 10 currently requested to be authenticated is confirmed to be subscribed to the EV-DO service, the terminal 10 is authenticated, and the The result is transmitted to the access network controller 30. At this time, the access network AAA server 40 also transmits identification information (eg, callback ID) of a predetermined Packet Data Service Node (PDSN) (not shown).

When the access network controller 30 is notified of the authentication of the portable terminal 10 from the access network AAA server 40, the access network controller 30 notifies the portable terminal 10 of the authentication succession through the wireless communication network 20.

At this time, the portable terminal 10 requests the access network controller 30 to establish a Point to Point Protocol (PPP) session through the wireless communication network 20 according to the terminal's own authentication success.

When a PPP session is requested from the portable terminal 10, the access network controller 30 transmits identification information of the packet data service node received from the access network AAA server 40 to the data link register 50 to establish a PPP session. Ask.

Finally, the data link register 50 allocates a predetermined PPP session according to the PPP session establishment request from the access network controller 30, and establishes a connection to the corresponding packet data service node with the received packet data service node identification information. Attempt to provide an EV-DO service to the portable terminal 10 via the assigned PPP session.

As described above, the conventional EV-DO service authentication processing system authenticates the portable terminal according to the use of the EV-DO service, and only the subscriber who is legally subscribed to the EV-DO service through his / her portable terminal. The advantage is that the service can be provided.

However, the conventional EV-DO service authentication processing system can fundamentally block the use of the EV-DO service for a mobile terminal that illegally steals the basic information of another user's mobile terminal by authenticating the corresponding terminal with only the basic information of the mobile terminal. There is a problem that can not be, because of this, EV-DO service subscribers may be charged an unfair service fee.

Accordingly, the present invention has been made to solve the above-mentioned conventional problems, a terminal for determining whether to use the EV-DO service through a predetermined portable terminal through the authentication center by adding an authentication center to the mobile communication network; It is an object of the present invention to provide an EV-DO service authentication processing system and a method of operating the same in a mobile communication network which can block the use of an EV-DO service through an illegally copied portable terminal by performing authentication.

The EV-DO service authentication processing system in a mobile communication network according to the present invention for achieving the above object has a call history count that is history information according to terminal authentication, and if the EV-DO service is requested by the user, the call history count A mobile terminal for requesting terminal authentication processing for providing an EV-DO service, updating a call history count according to the result, and providing an EV-DO service; When the information according to the authentication request from the portable terminal is transmitted through the access network controller, the received authentication request information is transmitted to the authentication center to request the authentication of the portable terminal, and the access network transmits the result information to the access network controller. AAA server; A database storing call history counts, which are history information according to mobile terminal authentications of subscribers subscribing to the EV-DO service, and linked to an authentication center; And receiving the authentication request information of a predetermined mobile terminal through the access network AAA server, extracting the call history count of the portable terminal based on the received authentication request information, and comparing it with the call history count of the corresponding portable terminal stored in the database. The call center may include an authentication center for updating the call history count of the portable terminal stored in the database and transmitting the authentication result of the portable terminal to the access network AAA server.

In addition, the operating method of the EV-DO service authentication processing system in a mobile communication network according to the present invention for achieving the above object is (a) the call history count is the history information according to the authentication of the mobile terminal of the subscriber subscribers EV-DO service Constructing and managing a database; (b) the mobile terminal having a call history count which is history information according to the terminal authentication, and requesting terminal authentication using the call history count when the user requests the EV-DO service; (c) the AAA server requesting authentication of the mobile terminal by transmitting information corresponding to the authentication request from the mobile terminal received through the access network controller to the authentication center; (d) The authentication center extracts the call history count of the portable terminal based on the authentication request information of the portable terminal received through step (c) and compares it with the call history count of the corresponding portable terminal stored in the database. Updating the call history count of the mobile terminal stored in the mobile terminal, and transmitting the mobile terminal authentication result to the access network AAA server; And (e) the portable terminal being notified of the authentication approval from the access network AAA server through the access network controller, updating the provided call history count, and providing the EV-DO service.

Hereinafter, a preferred embodiment of an EV-DO service authentication processing system and its operation method in a mobile communication network according to the present invention will be described with reference to the accompanying drawings.

2 is a schematic configuration diagram of an EV-DO service authentication processing system in a mobile communication network according to the present invention. As shown in FIG. 2, the EV-DO service authentication processing system according to the present invention includes a portable terminal (eg, a mobile phone) 100, a wireless communication network 200, and an access network controller (ANC) supporting an EV-DO service. 300, an access network AAA server (AN-AAA) 400, an authentication center (AC) 500, a database 600, and a data link register (DLR) 700. Here, FIG. 2 is a view illustrating only some network components necessary for authentication of a corresponding terminal when using the EV-DO service through the portable terminal 100 supporting the EV-DO service, and FIG. 2 illustrates a voice service (that is, voice). In the call), network components (eg, base station, base station controller, mobile switch, etc.) necessary for authentication of the terminal may be included.

The database 600 includes basic information (eg, MIN, ESN, etc.) of subscribers of subscribers who subscribe to the EV-DO service, subscriber secret key (A-key), temporary secret key (required for authentication of each portable terminal). Shared Secret Data (SSD), call history count (COUNT: Call History COUNT) and authentication algorithms (eg, CAVE (Cellular Authentication & Voice Encryption) algorithm), which are historical information on authentication of the mobile terminal, and the authentication center 500 It is linked to).

In addition, the portable terminal 100 is a terminal supporting the EV-DO service, the subscriber secret key, temporary secret key, call history count, authentication algorithm and basic information that is the history information according to the terminal authentication from the authentication center 500 Is provided in the same manner as the database 600.

When the EV-DO service is requested by the user, the portable terminal 100 generates a random number (RAND: Random Number) using a random number generation algorithm provided in advance, and generates the generated random number, temporary secret key, and basic information. The authentication algorithm is used to calculate the authentication request value (AUTH-Result). Here, the process of calculating the authentication request value in the portable terminal 100 is the same as the process of calculating the authentication request value made in the portable terminal during voice call processing, and thus, further description thereof will be omitted.

Thereafter, the portable terminal 100 transmits basic information, authentication request value, call history count (eg, COUNT = 'n-1'), and random number of the terminal to the access network controller 300 through the wireless communication network 200. Request for authentication based on the EV-DO service of the corresponding terminal by transmitting. Here, the call history count represents the total number of records according to terminal authentication until the current authentication request of the portable terminal 100 occurs. The wireless communication network 200 includes an access network transport station (ANTS), and the ANTS in the EV-DO service is well known to those skilled in the art, and a detailed description thereof will be omitted.

When the access network controller 300 receives information (hereinafter referred to as authentication request information) for requesting authentication of the corresponding terminal 100 from a predetermined portable terminal 100 through the wireless communication network 200, the received authentication request information Transmits to the access network AAA server 400 and requests authentication of the portable terminal 100. At this time, the authentication request information includes the basic information, the authentication request value, the call history count and the random number for the mobile terminal 100 that has requested the current authentication.

The access network AAA server 400 transmits the authentication request information about the predetermined portable terminal 100 received through the access network controller 300 to the authentication center 500 to request authentication of the portable terminal 100.

The authentication center 500, when the authentication request information for the predetermined portable terminal 100 is transmitted through the access network AAA server 400, by analyzing the received authentication request information, the basic information of the portable terminal 100 currently requested authentication Extract and check whether the portable terminal 100 subscribes to the EV-DO service by querying the database 600 with the extracted basic information.

In addition, the authentication center 500 performs an authentication algorithm with the random number extracted from the random number based on the received authentication request information and the temporary secret key and basic information stored in the database 600, and performs an authentication algorithm (AUTH-Result). ) Is calculated. At this time, the authentication center 500 calculates an authentication result through the same process as that of the portable terminal 100. In addition, the process of calculating the authentication result value in the authentication center 500 is the same as the process of calculating the authentication request value made in the authentication center during the terminal authentication process according to the voice call.

Subsequently, the authentication center 500 determines whether the calculated authentication result value and the authentication request value included in the received authentication request information are the same. At this time, if the authentication result value and the authentication request value is the same, it is determined whether the call history count of the corresponding portable terminal 100 stored in the database 600 is identical to the call history count included in the authentication request information. 600 and the portable terminal 100 determine that the temporary secret keys provided do not match, and perform an update process for matching the temporary secret keys with each other. Here, the temporary secret key update process between the portable terminal 100 and the authentication center 500 is the same as the temporary secret key update process performed during the terminal authentication process according to the voice call, so a detailed description thereof will be omitted.

In addition, the authentication center 500 is a call history count (eg, COUNT = 'n-1') of the corresponding portable terminal 100 stored in the database 600 and the call history count (for example included in the currently received authentication request information) , COUNT = 'n-1') is determined to be the same, and the call history count of the mobile terminal 100 stored in the database 600 is authenticated by authenticating the mobile terminal 100 with 'COUNT =' n '. Update and re-save, and transmit the authentication approval result of the portable terminal 100 to the access network AAA server 400.

Meanwhile, the authentication center 500 may include a call history count (eg, COUNT = 'n') of the portable terminal 100 stored in the database 600 and a call history count (eg, CONNT =) included in the currently received authentication request information. If it is determined that 'n-1' is not the same, it is determined that the portable terminal 100 currently requested to be authenticated is not the terminal of the subscriber who has actually subscribed to the EV-DO service, and the authentication failure result of the portable terminal 100 is determined. It is transmitted to the access network AAA server 400.

The access network AAA server 400 receives the authentication result information for the mobile terminal 100 from the authentication center 500, analyzes the received authentication result information, and when the authentication approval of the mobile terminal 100 is confirmed, a predetermined packet The identification information (for example, callback ID) of the packet data service node (PDSN) (not shown) is transmitted to the access network controller 300 to notify the authorization approval of the portable terminal 100. Here, the access network AAA server 400 must of course have identification information on the packet data service node installed for each mobile communication provider.

The access network controller 300 is notified of the authentication approval for the portable terminal 100 through the access network AAA server 400, and notifies the mobile terminal 100 of the authentication success via the wireless communication network 200.

The portable terminal 100 is notified of the authentication approval through the access network controller 300, updates the call history count (eg, COUNT = 'n-1') provided therein, and then accesses it through the wireless communication network 200. The network controller 300 requests a point to point protocol (PPP) session establishment. At this time, the portable terminal 100 has a 'n' value as the call history count. As a result, as the portable terminal 100 is authenticated, the portable terminal 100 and the database 600 each have a call history count of the same value. On the other hand, when the mobile terminal 100 is notified of the authentication failure, the mobile terminal 100 outputs an authentication failure result to inform the user that the EV-DO service cannot be used.

When the access network controller 300 is requested to establish a PPP session from the portable terminal 100, the access network controller 300 data link the identification information of the packet data service node received from the access network AAA server 400 as the portable terminal 100 is authenticated. Send to register 700 to request a PPP session establishment.

When a PPP session is requested from the access network controller 300, the data link register 700 allocates a predetermined PPP session, and transmits the PPP session to the corresponding packet data service node with identification information of the packet data service node received when the PPP session is requested. Attempt to connect. Thereafter, the portable terminal 100 receives the EV-DO service through the PPP session allocated by the data link register 700 and displays the EV-DO service on the screen to provide the user.

Here, after the authentication approval for the mobile phone terminal 100 is completed, the PPP session establishment process between the mobile phone terminal 100, the access network controller 300, and the data link register 700 is a general operation process for providing an EV-DO service. As it is well known to those skilled in the art, further detailed description thereof will be omitted.

3 is a flowchart illustrating a method of operating an EV-DO service authentication processing system in a mobile communication network according to the present invention. Referring to FIG. 3, first, the authentication center 500 of the EV-DO service authentication processing system according to the present invention stores information necessary for authentication of the mobile terminal 100 of subscribers who have subscribed to the EV-DO service to the database 600. Build (s100). Here, since the description of the database 600 has already been described with reference to FIG. 2, duplicate description thereof will be omitted.

The portable terminal 100 according to the present invention is a terminal supporting the EV-DO service, and has information necessary for terminal authentication in the same manner as the database 600 built in step S100 (S120).

When the EV-DO service is requested by the user (s140), the portable terminal 100 calculates basic information, an authentication request value, a call history count (eg, COUNT = 'n-1') and a random number of the corresponding terminal. It transmits to the access network controller 300 through the wireless communication network 200 and requests authentication according to the use of the EV-DO service of the terminal. Here, the terminal requests the terminal authentication according to the use of the EV-DO service by deriving information (that is, authentication request information) for requesting authentication of the call history terminal and transmitting the information to the access network controller 300 through the wireless communication network 200 ( s160). Here, the description of step S160 will be described in more detail with reference to FIG. 4A.

When the authentication for the predetermined portable terminal 100 is requested through step s160, the access network controller 300, the access network AAA server 400, and the authentication center 500 have the corresponding authentication request information transmitted in the authentication request. The authentication of the terminal 100 is determined (S180). Here, the description of step S180 will be described in more detail with reference to FIG. 4B.

Subsequently, if it is determined that the terminal's own authentication is approved through step s180 (s200), the portable terminal 100 updates the call history count, which is the total number of logs according to terminal authentication until the current authentication request is made (s220). In operation S240, the basic operation process for providing the EV-DO service is performed. In this case, step s240 is a general operation process performed after completion of the authentication approval of the portable terminal 100, and thus a detailed description thereof will be omitted.

4A is a flowchart illustrating a mobile terminal authentication request process s160 according to the present invention. Referring to FIG. 4A, first, the mobile terminal 100 generates a random number using a random number generation algorithm provided in operation S161. ). The authentication request value is calculated by performing an authentication algorithm with the random number generated in step s161, the temporary secret key and basic information provided (s162). Subsequently, basic information about the mobile terminal 100, authentication request value calculated in step s162, call request count and the authentication request information including the random number is derived (s163), and through the wireless communication network 200 Transmission to the access network controller 300 (s164).

Figure 4b is a flow diagram for the process of determining the portable terminal authentication (s180) according to the present invention. Referring to FIG. 4B, first, the access network controller 300 receives an authentication request from the portable terminal 100 (s181), and transmits the authentication request information received in the authentication request to the access network AAA server 400. The portable terminal 100 requests authentication (s182).

The access network AAA server 400 transmits the authentication request information about the predetermined portable terminal 100 received through step s182 to the authentication center 500 and requests authentication of the portable terminal 100 (s183).

The authentication center 500 receives the authentication request information for the predetermined portable terminal 100 through step s183, and has the basic information of the corresponding portable terminal 100 included in the received authentication request information of the portable terminal 100. Check whether the EV-DO service is subscribed (s184). The authentication result is calculated by performing an authentication algorithm with the random number included in the authentication request information transmitted through the operation s183 and the temporary secret key and the basic information stored in the database 600 (s185). Then, it is checked whether the calculated authentication result value and the authentication request value included in the authentication request information are the same (s186), and whether the call history count stored in the database 600 and the call history count included in the authentication request information are the same. In operation S187, the mobile terminal 100 may be authenticated according to the result (S188). Finally, the call history count, which is the total number of histories according to the current previous authentication of the portable terminal 100 stored in the database 600, is updated (s189), and the portable terminal 100 is authenticated by the access network AAA server 400. The approval result is transmitted (s190).

The access network AAA server 400 notifies the approval of the portable terminal 100 to the access network controller 300 when the authentication approval of the portable terminal 100 is confirmed based on the authentication result information received through step s190. (s191). At this time, the access network AAA server 400 transmits identification information (eg, callback ID) of the packet data service node.

The access network controller 300 is notified of the authentication approval of the portable terminal 100 through step s191, and notifies the success of the authentication to the portable terminal 100 (s192).

The above description is only for explaining one embodiment, and the present invention is not limited to the above-described embodiment and can be variously changed within the scope of the appended claims. For example, the shape and structure of each component specifically shown in the embodiment of the present invention can be modified.

According to the present invention, when the user requests to use the EV-DO service, the authentication request value (AUTHR) generated on the portable terminal side and the authentication result value (AUTHR) generated on the authentication center side are the same, and are provided on the portable terminal side. Only if the call history count and the call history count provided in the authentication center are the same, the use of the EV-DO service through the corresponding terminal can be authenticated, thereby effectively blocking the use of the EV-DO service through the illegally copied portable terminal. There is an advantage.

In addition, by blocking the use of the EV-DO service due to illegal duplication of the portable terminal, it is possible to improve the reliability of the service to the subscribers of the EV-DO service, thereby increasing the use of the EV-DO service, An additional advantage is that DO service providers can benefit from increased EV-DO service usage.

1 is a schematic configuration diagram of a conventional EV-DO service authentication processing system,

2 is a block diagram of an EV-DO service authentication processing system in a mobile communication network according to the present invention;

3 is a flowchart illustrating a method of operating an EV-DO service authentication processing system in a mobile communication network according to the present invention;

4A is a flowchart illustrating an authentication request process of a portable terminal capable of EV-DO service according to the present invention;

4b is a flowchart illustrating a process of determining whether to authenticate a portable terminal capable of EV-DO service according to the present invention.

* Description of the symbols for the main parts of the drawings *

100: portable terminal 200: wireless communication network

300: ANC 400: AN-AAA

500: AC 600: Database

700: DLR

Claims (8)

If the user has a call history count, which is history information according to terminal authentication, and an EV-DO service is requested by the user, a terminal authentication process for providing the EV-DO service is requested using the call history count, and according to the result A portable terminal providing an EV-DO service after updating the history count; When the information according to the authentication request from the portable terminal is transmitted through the access network controller, the received authentication request information is transmitted to the authentication center to request the authentication of the portable terminal, and the access network transmits the result information to the access network controller. AAA server; A database storing call history counts, which are history information according to mobile terminal authentications of subscribers subscribing to the EV-DO service, and linked to an authentication center; And When the authentication request information of a predetermined mobile terminal is received through the access network AAA server, the call history count of the portable terminal is extracted based on the received authentication request information and compared with the call history count of the corresponding portable terminal stored in the database. And an authentication center for updating the call history count of the corresponding portable terminal stored in the database and transmitting the authentication result of the portable terminal to the access network AAA server. . The method of claim 1, The portable terminal further includes a subscriber secret key, temporary secret key, authentication algorithm and terminal basic information for terminal authentication processing. The database may further store basic information on portable terminals of subscribers subscribed to the EV-DO service, subscriber secret key, temporary secret key, and authentication algorithm required for authentication of each portable terminal. -DO service authentication processing system. The portable terminal of claim 2, wherein the portable terminal When an EV-DO service is requested by a user, a random number is generated, an authentication algorithm is calculated based on the generated random number, a temporary secret key, and basic information of the portable terminal, and an authentication request value is calculated. EV-DO service authentication processing system in a mobile communication network, characterized in that requesting terminal authentication by transmitting the basic information, authentication request value, call history count and random number to the access network controller via a wireless communication network. The method of claim 3, wherein the authentication center Based on the authentication request information received, the authentication result is calculated by extracting the random number and the extracted random number and the temporary secret key and basic information of the corresponding portable terminal stored in the database. EV-DO service authentication processing system for a mobile communication network characterized in that the authentication process, if the result of comparing the extracted authentication request value based on the received authentication request information. (a) the authentication center constructing and managing a call history count, which is history information according to portable terminal authentication of EV-DO service subscribers, as a database; (b) the mobile terminal having a call history count which is history information according to the terminal authentication, and requesting terminal authentication using the call history count when the user requests the EV-DO service; (c) the AAA server requesting authentication of the mobile terminal by transmitting information corresponding to the authentication request from the mobile terminal received through the access network controller to the authentication center; (d) The authentication center extracts the call history count of the portable terminal based on the authentication request information of the portable terminal received through step (c) and compares it with the call history count of the corresponding portable terminal stored in the database. Updating the call history count of the mobile terminal stored in the mobile terminal, and transmitting the mobile terminal authentication result to the access network AAA server; And (e) the mobile terminal being informed of the authorization approval from the access network AAA server through the access network controller, updating the call history count provided, and then providing the EV-DO service. Operation method of EV-DO service authentication processing system in communication network. The method of claim 5, The database further stores basic information on portable terminals of subscribers subscribed to the EV-DO service, subscriber secret key, temporary secret key, and authentication algorithm required for authentication of each portable terminal. The portable terminal further comprises a subscriber secret key, temporary secret key, authentication algorithm and terminal basic information for terminal authentication processing. The method of claim 6, wherein step (b) (b1) generating a random number using a predetermined algorithm, (b2) calculating an authentication request value by performing an authentication algorithm with the generated random number, the temporary secret key, and basic information on the portable terminal; (b3) EV-DO service authentication in a mobile communication network, comprising the steps of requesting authentication by transmitting basic information, authentication request value, call history count, and random number of the corresponding portable terminal to an access network controller through a wireless communication network. Operation of the treatment system. The method of claim 7, wherein the step (c) and (d) The authentication center receives the authentication request information of the mobile terminal through step (c), extracts a random number based on the received authentication request information, and extracts the random number and temporary secret key and basic information about the mobile terminal stored in the database. Calculating an authentication result by performing an authentication algorithm, and determining whether the authentication request value extracted based on the calculated authentication result value and the authentication request information is the same. Of the EV-DO service certification processing system