KR20050053857A - A personal internet system and an authentication method for the personal internet system - Google Patents

Abstract

The present invention relates to a high speed portable Internet system and an authentication method thereof.

According to the present invention, when the terminal requests device authentication and user authentication from the base station, the base station directly performs device authentication for the terminal, and if the device authentication is successful, the user of the terminal to the authentication server through the packet access router. Request authentication. After the user authentication step between the terminal and the authentication server, the base station stores authentication information related to user authentication of the terminal in the authentication information space and transmits the authentication key and authentication additional information to the terminal.

As described above, according to the present invention, the portable Internet system simultaneously performs device and user authentication, thereby maintaining more stable and stronger security.

Description

Portable Internet System and its Authentication Method {A Personal Internet System and An Authentication Method for the Personal Internet System}

The present invention relates to a high speed portable Internet and an authentication method thereof, and more particularly, to an authentication operation method for performing device and user authentication in a base station of a high speed portable Internet system.

BACKGROUND ART Conventions related to authentication of a portable Internet system include IEEE 802.16 based wireless (manufactured) wireless political area network (MAN) system and IEEE 802.11 based wireless (LAN) system.

The IEEE 802.16 based wireless MAN system verifies the authority for the AT using X.509 certificates through the Privacy Key Manager (PKM) messages in the Medium Access Control (MAC) layer. Only verified devices can have initial access to the wireless MAN system. This wireless MAN system eliminates authentication for subscribers because a single terminal device can be used simultaneously by multiple subscribers. Therefore, according to the IEEE 802.16 based wireless MAN system, there is a problem that authentication is insufficient for an illegal subscriber requesting a service through an authorized device.

In contrast, the IEEE 802.11-based wireless LAN system verifies the authority of the user through interaction with a subscriber station, a wireless access device, a router, and an authentication server to determine whether to accept a service. According to this wireless LAN system, efficient user authentication is achieved by using the Remote Authentication Dial-In User Service (RADIUS) protocol between the wireless access device and the authentication server, and the wireless access device interacts with the authentication server using the RADIUS client function. Is doing. However, in this system, there is no authentication policy in case an authenticated subscriber requests a service with an inappropriate device. In addition, the method of distributing, storing and maintaining keys in real time at the base station has a problem that it is not elastic.

As such, the IEEE 802.16 based wireless MAN system only considers authentication of the device, and the IEEE 802.11 based wireless LAN system provides only user authentication function. Therefore, the two authentication functions complement each other to support stronger authentication function. This is necessary.

The technical problem to be achieved by the present invention is to solve the conventional problems as described above, the present invention is to maintain a more stable and stronger security by simultaneously performing the device and user authentication of the portable Internet system.

In addition, when the device authentication and user authentication for the subscriber is successfully performed, the present invention is more efficient by the base station distributes various authentication information related to the device and the user to the subscribers in real time and stably stored in the base station This is to ensure that the authentication policy is enforced.

Authentication method of a portable Internet system according to a feature of the present invention for achieving the above object is

An authentication method of a portable internet system for authenticating a user terminal (AT) wirelessly connected to the base station in a portable internet system including a base station (AP), a packet access router (PAR), and an authentication (AAA) server,

(a) performing device authentication on a user terminal connected to the base station;

(b) if the device authentication is successful, requesting a user authentication from the base station to the authentication server through the packet access router; And

(c) receiving, by the base station, user authentication related information from the authentication server, and transmitting the received information to the user terminal.

On the other hand, the portable Internet system according to another aspect of the present invention is a portable Internet system for performing the device authentication and user authentication for the user terminal,

An authentication server for performing user authentication on the user terminal and generating an authentication key for the authenticated user;

Perform a control function related to access and service of the user terminal, perform device authentication on the connected user terminal, and request user authentication of the device authenticated user terminal to the authentication server, thereby relating to user authentication. A base station receiving information and transmitting the information to the user terminal; And

A packet access router connected to the base station and the authentication server through a network and performing a packet access routing function and an external agent function of a mobile internet protocol.

According to the present invention, the base station of the portable Internet system first performs authentication on the apparatus of the subscriber of the portable Internet system, and requests to execute user authentication only when authenticated, thereby providing efficient and stable service to all subscribers. Make sure

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

1 is a network structural diagram of a high-speed portable Internet system according to an embodiment of the present invention.

The mobile Internet system network 100 according to an embodiment of the present invention is an access terminal (hereinafter referred to as 'AT', 101), a base station (Access Point) that performs all control functions related to access and service of the AT 101. Hereinafter referred to as an 'AP', a packet access router that performs a packet access routing function and a foreign agent (FA) function of a mobile Internet protocol (IP); 103) and an authentication server (Authentication, Authorization, Accounting; hereinafter referred to as 'AAA', 104) that performs authentication, authorization verification, and authentication key generation functions.

The portable Internet system network 100 may be linked with other providers through an authentication server. To this end, the authentication server according to an embodiment of the present invention uses a standard protocol in progress in the Internet Engineer Task Force (IETF), an international standard organization. The authentication mechanism addressed in the embodiments of the present invention is implemented by the interaction between the AT 101, the AP 102, the PAR 103 and the AAA 104.

2 is a block diagram of a protocol stack for device authentication and user authentication in a mobile Internet system network according to an embodiment of the present invention.

In order to perform the authentication procedure, the user terminal (AT) 101 is equipped with an IEEE 802.16 based physical layer protocol (PHY) 201 and a MAC layer protocol 202 defined in a wireless section, and user mobility in a portable Internet system network. And an Extensible Authentication Protocol (hereinafter referred to as `` EAP '', 203) for delivering user authentication data for enhanced security, and EAP-TLS (EAP-Transport Layer Security), a standardized authentication protocol of a higher layer. EAP-TLS (EAP-Tunneled TLS) 204 is mounted.

The base station (AP) 102 is equipped with protocols for interacting with the user terminal 101 and protocols for interacting with the packet access router 103.

Specifically, the base station 102 is equipped with the IEEE 802.16 based physical layer protocol 201 and the MAC layer protocol 202 for interaction with the terminal, and is based on IEEE 802.3 as a protocol for interworking with the packet access router 103. The first layer protocols (L1, 205) and the second layer protocols (L2, 206), which are the physical layers of the Internet protocol (IP) and the transport layer, SCTP (Stream Control Transmission Protocol) or UDP (User Datagram Protocol). 208 is loaded, and an ANAP (Access Network Application Protocol, 209) protocol, which is an internal protocol negotiated between the base station 102 and the packet access router 103, is loaded.

The packet access router 103 is equipped with a protocol for interacting with the base station 102 and a protocol for interacting with the authentication server 104.

The packet access router 103 is equipped with a first layer protocol 205 and a second layer protocol 206 based on IEEE 802.3 for interworking with the base station 102 and includes an IP 207, SCTP or UDP 208 and ANAP 209 protocols are mounted. In addition, the packet access router 103 is equipped with an EAP 203 to transfer EAP-TLS or EAP-TTLS data, which is a higher authentication protocol with the portable Internet terminal.

In addition, the packet access router 103 is equipped with the first layer protocol 205, the second layer protocol 206, the IP 207, and the SCTP 210 based on the IEEE 802.3 in order to interact with the authentication server. The Diameter Protocol-related Diameter Base Protocol 211 and the Diameter Application Protocol 212 are mounted.

The authentication server 104 includes, for interworking with the packet access router 103, a first layer protocol 205, a second layer protocol 206, an IP protocol 206, an SCTP protocol 210, and a diamond based on IEEE 802.3. The meter base protocol 211 and the diameter application protocol 212 are mounted, and the EAP-TLS or EAP-TTLS protocol 204 is mounted for user authentication with the portable Internet terminal.

3 is a flowchart illustrating device authentication and user authentication in a portable Internet system network according to an embodiment of the present invention.

As shown in FIG. 3, the device authentication and user authentication method according to an embodiment of the present invention is performed after the access step S300 and the basic function negotiation step S310.

In the access step (S300) when the subscriber of the portable Internet system is initially connected, the base station 102 receives the access request (RNG-REQ) from the terminal 101 and knows the MAC address of the terminal (S301). If the ranging request succeeds, the device transmits a Raging Response (RNG-RSP) to the corresponding terminal (S302) and stores the MAC address of the corresponding terminal in the authentication information space.

Then, in order to negotiate the basic function of the terminal, the terminal 101 makes a request for this (SBC-REQ) and the base station 102 receives the response (SBC-RSP).

Then, the actual device authentication and user authentication step (S320) described below is performed.

The terminal 101 transmits an EAP-Transfer Request message, which is one of the PKM-REQ messages of the MAC protocol, to the base station 102 and simultaneously requests device authentication and user authentication (S321). The EAP-Transfer Request message includes parameters for device authentication and EAP-TLS or EAP-TTLS data for user authentication.

Receiving this message, the base station 102 refers to the authentication information space and checks whether the device having the MAC address of the terminal succeeds in authentication. If the corresponding terminal device is already authenticated, the user authentication procedure is immediately performed without device authentication for the corresponding terminal, and if not, the device authentication for the corresponding terminal is performed (S322). This is to reduce repetitive and inefficient device authentication for the same device at the base station by performing device authentication only once when a single device is used by multiple users. At this time, the base station has a certificate of the terminal manufacturer and a certificate of the terminal, and performs the device authentication for the terminal.

If the device authentication fails in step S322, the base station 102 notifies the terminal 101 of the authentication failure through the EAP-Transfer Reply message, which is one of the PKM-RSP messages of the MAC protocol (S328).

On the contrary, if the device authentication for the terminal is successful in step S322, the base station 102 requests a substantial user authentication to the authentication server, for which the base station 102 receives the EAP-Transfer Request received from the terminal 101 The EAP-TLS or EAP-TTLS data included in the message is transmitted to the packet access router 103 using one message of the ANAP protocol (S323).

The packet access router 103 transmits the EAP-TLS or EAP-TTLS data received from the base station 102 to the authentication server 104 which is the user authentication performing agent using the diameter protocol (S324). In response, the authentication server 104 transmits the authentication data to the packet access router 103 (S325), and the packet access router 103 transmits the data to the base station through a message of the ANAP protocol (S326). The base station 102 transmits the EAP-TLS or EAP-TTLS authentication data to the terminal 101 through the EAP-Transfer Reply message (S327).

User authentication for the terminal is performed through the above-described steps (S321, S323 ?? S327) several times, and finally, if the user authentication result in the authentication server 104 is successful, the last user authentication step (S325? S327, the authentication key is encrypted in the EAP-TLS or EAP-TTLS authentication data and transmitted to the terminal 101. At this time, since authentication information including a key transmitted from the authentication server 104 to the base station 102 is encrypted and transmitted to the Internet Protocol Security Protocol (IPSec), safety is ensured.

Upon receiving these authentication information, the base station 102 assigns an authentication key serial number according to the key management mechanism as an identifier for the corresponding authentication key. At this time, the base station 102 stores the authentication key, the valid time and serial number of the corresponding authentication key in the authentication information space. Thereafter, the base station 102 transmits only additional information related to user authentication to the terminal 101 through the final EAP-Transfer Reply message (S327). Since the base station's authentication key is encrypted in the EAP-TLS or EAP-TTLS authentication data, the base station may also transmit this authentication data to the terminal.

When the terminal receives this message and receives the authentication key from the EAP-TLS or EAP-TTLS layer, the user authentication procedure is completed and all authentication procedures for the terminal are terminated.

As described above, according to the authentication procedure of the portable Internet system according to the embodiment of the present invention, when the terminal 101 first requests the base station 102 for device authentication and user authentication, the base station 102 applies to the device authentication. Determine whether to perform with reference to the authentication information space. At this time, the base station 102 directly performs the device authentication if the device authentication is not performed for the terminal, and if the device authentication is successful, the user authentication of the terminal to the authentication server 104 through the packet access router 103 Ask. After the user authentication step between the terminal 101 and the authentication server 104 is finished, the base station 102 stores the authentication information related to user authentication of the terminal in the authentication information space and sends the authentication key and authentication additional information to the terminal 101. During the transmission, the device authentication and user authentication procedures in the portable Internet system network are completed.

4A and 4B illustrate components of MAC messages for device authentication and user authentication in a portable Internet system network according to an embodiment of the present invention.

4A is a diagram illustrating various parameters included in an EAP-Transfer Request message transmitted from a terminal 101 to a base station 102 to request device authentication and user authentication.

The base station 102 according to the embodiment of the present invention performs the device authentication of the corresponding terminal using the CA-Certificate 401 and the SS-Certificate 402 among the parameters of the EAP-Transfer Request message shown in FIG. 4A. . The Security-Capabilities 403 and SAIDs 404 are additional parameters for an algorithm required for control message or traffic transmission / reception between the base station and the terminal after the authentication procedure. The EAP Payload 405 includes authentication data of EAP-TLS or EAP-TTLS required for user authentication, which is transmitted to the authentication server through the packet access router 103 without interpretation by the base station 102. That is, if the base station 102 succeeds in authenticating the device using the CA-Certificate parameter 401 and the SS-Certificate parameter 402, the authentication server receives the EAP Payload received from the terminal 101 via the packet access router 103. By transmitting to the 104, the authentication server requests to perform user authentication using the received EAP-TLS or EAP-TTLS authentication data. In particular, the first EAP-Transfer Request message must include all such parameters. Otherwise, the base station treats the authentication failure before performing device authentication.

4B is a diagram illustrating various parameters included in an EAP-Transfer Reply message transmitted from a base station to a terminal during a device authentication and user authentication procedure.

Referring to FIG. 4B, the base station 102 uses the EAP Result Code 411 to notify the UE of the success or failure of the authentication, and the Error Code 412 field exists only when the EAP Result Code value fails. Explain the reason for the failure. The Temporary Key Sequence Number 413 is a serial number temporarily designated by the authentication server for the corresponding authentication key. The key sequence number 414 is a serial number generated by the base station corresponding to the authentication key of the terminal granted from the authentication server, and the key lifetime 415 means the valid time corresponding to the authentication key. The SA Descriptor 416 includes a negotiation result of the Security-Capabilities field of the EAP-Transfer Request message. The EAP Payload 417 is authentication data related to user authentication transmitted from the authentication server to the base station through the packet access router, and is transmitted to the terminal without interpretation by the base station. In the authentication process, the last EAP-Transfer Reply message must include all these fields, and in particular, the authentication key of the terminal is encrypted in the EAP Payload.

According to an embodiment of the present invention, the base station can perform device authentication and request user authentication to the authentication server in the portable Internet system through two MAC messages shown in FIGS. 4A and 4B.

5 is a structure diagram of an authentication information space for a subscriber authenticated at a base station of a portable Internet system network according to an embodiment of the present invention.

If the access step (S300) of the terminal shown in FIG. 3 succeeds, the base station allocates the user context ID 501 of the terminal, and assigns the user context ID 501 and the AT MAC address 502 to the authentication information space. Save it. After the terminal 101 is finished until the authentication step, the base station also authenticates the values of the Key Sequence Number (503), Key Lifetime (504), and Authorization Key (505) of the terminal before transmitting the last EAP-Transfer Reply message to the terminal. Store in the information space. In particular, when storing the authentication key is encrypted and stored. At this time, the number of terminals that can be stored in the authentication information space in one base station is m, and up to n authentication keys and corresponding authentication information in one terminal can be stored in the authentication information space. Prior to performing device authentication of the base station shown in FIG. 3, it may be checked whether a device of a corresponding terminal is authenticated with reference to this authentication information space. If the device is authenticated, the base station requests user authentication to the authentication server without performing device authentication for the terminal.

According to the embodiment of the present invention described above, there are the following effects.

First, by performing both device authentication and user authentication for the subscriber of the portable Internet system, it is possible to maintain higher non-authentication and security.

Secondly, since the base station of the portable Internet system does not re-authenticate the already authenticated device by using the concept of authentication information space, the authentication procedure can be performed more efficiently.

Third, the base station performs a hierarchical and systematic authentication procedure for the terminal by requesting the authentication server to perform user authentication only when the device authentication for the terminal is successful.

Fourth, the user authentication is performed in the EAP-TLS or EAP-TTLS layer of the authentication server, not the MAC layer of the base station, and the base station simply acts as a relay function for transferring authentication data to the terminal and the authentication server, thereby causing the base station to load the user authentication. Reduce the burden

Fifth, when all the authentication step for the terminal is successfully completed by storing the information related to the authentication in the authentication information space in the base station can be more efficient control and management associated with all authentication.

Sixth, by encrypting when storing the authentication key in the authentication information space, it is possible to further enhance the security of the authentication key between the terminal and the base station in the base station.

Although the embodiments of the present invention have been described in detail above, the present invention is not limited to the above-described embodiments, and various other modifications and changes are possible.

As described above, according to the present invention, the portable Internet system simultaneously performs device and user authentication, thereby maintaining more stable and stronger security. In addition, according to the present invention, when the device authentication and user authentication for the subscriber is successfully performed, the base station distributes various authentication information related to the device and the user to the subscribers in real time and stably stores in the base station. Authentication can be performed efficiently.

1 is a block diagram of a portable Internet system network according to an embodiment of the present invention.

2 is a diagram illustrating a protocol for device authentication and user authentication in a portable Internet system network according to an embodiment of the present invention.

3 is a flowchart illustrating device authentication and user authentication in a mobile Internet system network according to an embodiment of the present invention.

4A and 4B are diagrams illustrating components of a MAC message for device authentication and user authentication in a portable Internet system network according to an embodiment of the present invention.

5 is a structure diagram of storing authentication information about a subscriber authenticated at a base station of a portable Internet system network according to an embodiment of the present invention.

Claims (21)

In the portable Internet system including a base station (AP), a packet access router (PAR) and an authentication (AAA) server, the authentication method of the portable Internet system for authenticating a user terminal (AT) wirelessly connected to the base station, (a) performing device authentication on a user terminal connected to the base station; (b) if the device authentication is successful, requesting a user authentication from the base station to the authentication server through the packet access router; And (c) the base station receiving user authentication related information from the authentication server, and transmitting the received information to the user terminal. The method of claim 1, wherein step (a) Confirming, by the base station, whether the connected user terminal is a device authenticated terminal by referring to an authentication information space; Determining that the device authentication is successful without performing device authentication when the terminal is already a device authenticated as a result of the checking; And And if the device is not already a device authenticated terminal, performing the device authentication on the connected user terminal. The process according to claim 1 or 2, wherein in step (a) And the base station performs device authentication on the connected user terminal using a certificate of a terminal manufacturer and a certificate of the terminal. The process according to claim 1 or 2, wherein in step (a) And when the device authentication of the user terminal fails, the base station notifies the user terminal of the device authentication failure and the reason thereof. The method of claim 1, wherein step (b) If the device authentication is successful, the base station transmits the standardized authentication protocol data of the upper layer transmitted from the user terminal to the authentication server through the packet router to request user authentication. Way. The method of claim 5, An authentication method of a portable Internet system that accommodates Extensible Authentication Protocol-Transport Layer Security (EAP-TLS) or EAP-Tunneled TLS (EAP-TTLS) as the standardized authentication protocol of the upper layer. The method of claim 6, wherein step (b) Transmitting, by the base station, the EAP-TLS data or the EAP-TTLS data to the packet access router using a message of an internal protocol between the base station and the packet access router; And And transmitting, by the packet access router, the received EAP-TLS data or the EAP-TTLS data to the authentication server using a diameter protocol. 8. A process as claimed in claim 6 or 7, wherein in step (b) And the base station transmits the EAP-TLS data or the EAP-TTLS data transmitted from the user terminal to the authentication server through the packet access router without transmitting the EAP-TLS data or the EAP-TTLS data. The method of claim 1, wherein step (c) Wherein the base station receives the user authentication related information transmitted by the authentication server through the packet access router using standardized authentication protocol data of a higher layer, and transmits the user authentication related information to a user terminal. Authentication method of portable internet system. The method of claim 9, And the standardized authentication protocol of the upper layer is EAP-TLS or EAP-TTLS. The method of claim 10, wherein in step (c), And the base station transmits the EAP-TLS data or the EAP-TTLS data to the user terminal through a PKM-RSP message of a MAC protocol. The method of claim 10, wherein step (c) Sending, by the authentication server, the EAP-TLS data or the EAP-TTLS data to the packet access router using a diameter protocol; Transmitting, by the packet access router, to the base station using the received EAP-TLS data or an internal protocol message between the EAP-TTLS data base station and the packet access router; And And transmitting, by the base station, the EAP-TLS data or the EAP-TTLS data to the user terminal through an EAP-Transfer Reply message, which is an internal message of a PKM-RSP MAC message. The process according to claim 11 or 12, wherein in step (c) And the base station transmits the EAP-TLS data or the EAP-TTLS data transmitted from the authentication server to the user terminal without interpreting the EAP-TLS data or the EAP-TTLS data. The method of claim 1, wherein step (c) If the user authentication result in the authentication server is successful, the base station receives the authentication information including the authentication key from the authentication server, and transmits the received authentication key to the user terminal authentication of the portable Internet system Way. The method of claim 14, And the authentication key is encrypted in EAP-TLS data or EAP-TTLS data and transmitted from the authentication server. The method according to claim 14 or 15, Step (c) is Receiving, by the base station, authentication information including an authentication key for the user terminal from the authentication server; Storing authentication information including the authentication key, an effective time of the corresponding authentication key, and a serial number in an authentication information space; And And transmitting, by the base station, an authentication key and additional authentication information received from the authentication server to the user terminal. The method of claim 16, And the base station transmits the additional authentication information to the user terminal through an EAP-Transfer Reply message. In the portable Internet system for performing the device authentication and user authentication for the user terminal, An authentication server for performing user authentication on the user terminal and generating an authentication key for the authenticated user; Perform a control function related to access and service of the user terminal, perform device authentication on the connected user terminal, and request user authentication of the device authenticated user terminal to the authentication server, thereby relating to user authentication. A base station receiving information and transmitting the information to the user terminal; And And a packet access router connected to the base station and the authentication server through a network and performing a packet access routing function and an external agent function of a mobile internet protocol. The method of claim 18, And the base station has an authentication information space storing ID, MAC address, and user authentication related information of a corresponding terminal. The method of claim 19, The base station checks whether the connected user terminal is a device authenticated terminal with reference to the authentication information space, and if the device is a device authenticated terminal, the user authentication for the terminal is performed through the packet access router without performing device authentication. A portable Internet system, characterized by requesting an authentication server. The method according to any one of claims 18 to 20, The base station transmits EAP-TLS data or EAP-TTLS data to the authentication server through the packet router to request user authentication.