KR20050063188A - System for authenticating of 1x evolution-data only service subscriber station using cave algorithm in a code division multiple access mobile communication system and method thereof - Google Patents

Abstract

The present invention supports the services according to both the first scheme and the second scheme, and provides the first scheme service in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. A subscriber station authentication method being provided, comprising: a second random number generated with upper predetermined bits among first random numbers generated corresponding to the first scheme, and a third random value generated corresponding to the second scheme And generating a first authentication value by applying the subscriber terminal information to a preset function, and using a fourth random number value generated with predetermined upper bits among the first random numbers generated corresponding to the first scheme. Generating a second authentication value by applying the fifth random number value and the subscriber station information generated corresponding to the first scheme to the function; and wherein the first authentication value and the second authentication value If chihal characterized in that it comprises the step of determining by the successful authentication with the subscriber terminal.

Description

SYSTEM AND AUTHENTICATING OF 1x EVOLUTION-DATA ONLY SERVICE SUBSCRIBER STATION USING CAVE ALGORITHM IN A CODE DIVISION MULTIPLE ACCESS MOBILE COMMUNICATION OF SYSTEM }

The present invention relates to subscriber authentication in a code division multiple access (CDMA) mobile communication system. In particular, CAVE is a subscriber station authentication scheme in a CDMA2000 1x service network. The present invention relates to a system and method for authenticating a 1x EV-DO (EV-DO) service subscriber station (SS) using an encryption authentication algorithm.

The CDMA mobile communication system started service in the mid-1990s, and the international mobile telecommunication-2000 (IMT-2000), which is a 3rd generation (3G) mobile communication service method, is now commercially operated. The CDMA mobile communication system may be classified into a CDMA2000 1x service and a 1x EV-DO service, which are synchronous services. The CDMA2000 1x service uses the IS-95C network, which has evolved from the existing IS-95A and IS-95B networks. This is a possible service. Meanwhile, the 1x EV-DO service is a standard of wireless access technology proposed by Qualcomm and optimized for high-speed and high-capacity data transmission.It is an advanced technology from CDMA2000 1x, compared to the maximum transmission rate of 144Kbps of CDMA2000 1x forward channel. It has a maximum data transfer rate of 2.4Mbps which is about 16 times improved.

Such a mobile communication system provides a voice service, a multimedia service such as an image, data, etc. which are required in a highly information society. As a result, the mobile communication system requires many security features to protect sensitive information. Therefore, the mobile communication system requires an authentication procedure for each subscriber station. On the other hand, each subscriber station using the CDMA2000 1x and 1x EV-DO service has a different authentication scheme for using the service. The subscriber station using the CDMA2000 1x service performs a subscriber station authentication using a CAVE encryption authentication algorithm in a home location register (HLR). The 1x EV-DO service subscriber station is encrypted with MD5 (Message Digest 5, hereinafter referred to as 'MD5') in AN-AAA (Access Network-Authentication, Authorization, Accounting, hereinafter referred to as 'AN-AAA'). The authentication of the subscriber station is performed using an authentication algorithm. Here, the cave encryption authentication algorithm is a cryptographic algorithm implemented as a predetermined function. In addition, the MD5 encryption authentication algorithm is an algorithm created by abbreviating a 128-bit message from input data (one message of any length) and used to verify data integrity.

Here, the current CDMA mobile communication system provides both CDMA2000 1x service and 1x EV-DO service. That is, the CDMA mobile communication system first has a CDMA2000 1x service and then has an overlay network service type that provides the 1x EV-DO service. Accordingly, the subscriber station using the 1x EV-DO service is provided with a user identify module (hereinafter referred to as UIM) capable of using both the CDMA2000 1x service and the 1x EV-DO service. Doing. However, since the initial CDMA2000 1x service subscriber station has a UIM card receiving only the CDMA2000 1x service, the existing CDMA2000 1x service subscriber station uses an existing UIM card in order to receive the 1x EV-DO service in a CDMA system in which both services are provided. Must be replaced. That is, the CDMA2000 1x service subscriber station should have a new UIM card in which both a cave authentication algorithm for CDMA2000 1x authentication and an MD5 authentication algorithm for 1x EV-DO authentication are embedded. In this case, a communication service provider providing the two services together should replace the existing UIM card used by the CDMA2000 1x service subscriber. As a result, the communication service provider has a huge cost problem due to the UIM card replacement of the subscriber station.

An object of the present invention is to provide a system and method for authenticating a 1x EV-DO service subscriber station using a CDMA2000 1x service subscriber station authentication scheme in a code division multiple access mobile communication system.

Another object of the present invention is to provide a system and method for reducing the cost of replacing a UIM card of a CDMA2000 1x service subscriber station in a code division multiple access mobile communication system.

The system of the present invention for achieving the above objects; The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. In a subscriber station authentication system, a second random number generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, a third random value generated according to the second scheme, and the subscriber A subscriber station generating a first authentication value by applying the terminal information to a preset function, a fourth random number value generated with predetermined upper bits among the first random numbers generated corresponding to the first scheme, and When a fifth authentication value is generated according to the first scheme and the subscriber station information is applied to the function to generate a second authentication value, and the first authentication value and the second authentication value coincide. And a first type service authentication station which determines that the authentication of the subscriber station is successful.

A first method of the present invention for achieving the above object; The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. A subscriber station authentication method, comprising: a second random value generated with predetermined constant bits of a first random number generated corresponding to the first scheme, a third random value generated according to the second scheme, and the subscriber Generating a first authentication value by applying the terminal information to a preset function, a fourth random number value generated with predetermined upper bits among the first random numbers generated corresponding to the first method, and the fourth random number value; Generating a second authentication value by applying the fifth random number value and the subscriber station information generated corresponding to one scheme to the function; and when the first authentication value and the second authentication value coincide. And determining that the authentication of the subscriber station is successful.

A second method of the present invention for achieving the above objects; The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. An authentication method performed by a subscriber station, the method comprising: generating a second random number value having predetermined upper bits among first random numbers generated corresponding to the first method, the second random value, and the second method And generating a first authentication value by applying the third random number value and the subscriber station information corresponding to the predetermined function to a predetermined function, and then receiving the success message. do.

A third method of the present invention for achieving the above objects; In the code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different from each other, the first scheme service authentication station is a subscriber. A method for performing terminal authentication, the method comprising: receiving a first authentication value from the subscriber station, a fourth random number value generated with predetermined upper bits among first random numbers generated corresponding to the first scheme, Generating a second authentication value by applying the fifth random number value and the subscriber station information generated corresponding to the first scheme to the function; and when the first authentication value and the second authentication value coincide with each other, Characterized in that the authentication of the terminal is successful.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. It should be noted that in the following description, only parts necessary for understanding the operation according to the present invention will be described, and descriptions of other parts will be omitted so as not to distract from the gist of the present invention.

In the present invention, a 1x EV-DO (EV-DO) is performed by a CDMA2000 1x service subscriber station authentication scheme in a code division multiple access (CDMA) system. A method of authenticating a subscriber station (SS) is proposed. In particular, the 1x EV-DO service subscriber station is authenticated using a CAVE (CAVE: Cellular Authentication & Voice Encryption, hereinafter referred to as CAVE) encryption authentication algorithm.

Next, a method of authenticating 1x EV-DO service subscriber station using the CAVE algorithm will be described with reference to FIG. 1.

1 is a signal flow diagram illustrating a process of authenticating a 1x EV-DO service subscriber station with a CAVE algorithm according to an embodiment of the present invention.

Referring to FIG. 1, the mobile communication system includes a subscriber station (MS) 104 and a user identification module (UIM: User) mounted inside or outside the MS. Identify Module (hereinafter referred to as UIM) 102, AN / PCF (Access Network / Packet Control Function), which serves as a base transceiver station (BTS) and a base controller station (BSC) And an accounting and authentication station (AN-AAA: Access Network-Authentication, Authorization, Accounting, hereinafter referred to as 'AN-AAA'), and a 1x EV-DO service subscriber station. 108).

First, the AN / PCF 106 completes 110 a call setup procedure with the MS 104 for authentication. Next, the AN / PCF 106 sends a RAND ((RANDom value, hereinafter 'RAND') message to the MS 104 through a Challenge Handshake Authentication Protocol (CHAP) challenge message. RAND is a random number value, and the RAND value used in the MD5 (Message Digest 5, hereinafter referred to as 'MD5') algorithm can be set to 16 bytes or more. In addition, the CHAP message is a message defined by a standard required for encryption authentication, and the MS 104 having received the RAND value generates the RAND 'by taking the upper 4 bytes of the 16-byte RAND value to conform to the cave algorithm. 114 and send it to the UIM 102 card (116).

The UIM 102 receives the RAND 'value, and includes a UIM ID (ID), a 15-bit subscriber terminal identification number (IMSI: International Mobile Subscriber Identify (IMSI)), and a home location register. (Shared Secret Data (SSD) received from a Home Location Register (HLR: hereinafter referred to as 'HLR')) is inputted to the CAVE algorithm 118 to input AUTH1 ( AUTHentication1, hereinafter referred to as 'AUTH1'). In the above IMSI, 3 bits are allocated as a country code, 15 bits are assigned as a carrier code, and 10 bits are assigned as a mobile identification number (MIN).

In addition, the SSD is a code value promised to each other between the RANDSSD (RANDom Shared Secret Data, hereinafter referred to as 'RANDSSD') transmitted by the HLR performing CDMA2000 1x authentication, and between the MS 104 and the AN-AAA 108. (Hereinafter, referred to as 'A-key') and a uniquely assigned electrical unique number (ESN: Electronic Serial Number, hereinafter referred to as 'ESN'). The A-key is a code value uniquely assigned to each subscriber station, and the AN-AAA 108 has the A-key value list assigned to each terminal. In addition, the UIM ID is a serial number of the UIM card. In addition, the RANDSSD value is composed of 56 bits, and is periodically updated by the HLR and transmitted to the MS 104.

The UIM 102 generating the AUTH1 adds a network access interface (hereinafter referred to as "NAI") to the MS 104 and transmits it to the MS 104. In this case, the NAI means an entire bit value in which an operator URL (Uniform Resource Locator) address is added to the IMSI. For example, the NAI may be IMSI@KTF.com. The MS 104 adds the network access interface to the AUTH1 and NAI again and transmits 122 to the AN / PCF 106 via a CHAP response message. Upon receiving the CHAP response message, the AN / PCF 106 transmits the generated RAND value and the received NAI and AUTH1 to the AN-AAA 108 through a Radius Access Request message. 124).

The AN-AAA 108 generates an SSD by combining a pre-appointed and stored A-key value with ESN and RANDSSD. In addition, the AN-AAA 108 generates a RAND ′ value by taking the upper 4 bytes from the received RAND value. This is the same process as step 114 performed by the MS 104. In addition, although described in the order of steps 126 and 128 for the convenience of description, it should be noted that the invention is established even if the order is changed. Next, the AN-AAA 108 generates the AUTH2 by inputting the generated SSD value, the RAND 'value, the UIM ID, and the IMSI to the CAVE algorithm 130. The AN-AAA 108 compares the generated AUTH2 value with the AUTH1 value received from the MS 104 (132). If the values of AUTH1 and AUTH2 match according to the comparison result, the AN-AAA 108 transmits 134 a CHAP success message, that is, a subscriber authentication success message, to the MS 104. On the other hand, when the comparison result AUTH1 and AUTH2 value does not match, the AN-AAA 108 transmits (136) a CHAP failure message, that is, an authentication failure message to the MS (104).

Next, a procedure performed by the MS 104 of FIG. 1 will be described with reference to FIG. 2.

2 is a flowchart illustrating a process of performing an authentication procedure by a subscriber station (MS) according to an embodiment of the present invention.

Referring to FIG. 2, in step 202, the MS 104 completes a call setup procedure with a base station and proceeds to step 204. In step 204, the MS 104 receives the RAND value generated and transmitted by the AN / PCF 106 and proceeds to step 206. In step 206, the MS 104 generates the RAND 'value by taking the upper 4 bytes from the received 16 RAND values, and proceeds to step 208. In step 208, the MS 104 transmits the newly generated RAND 'value to the UIM 102, and proceeds to step 210. Meanwhile, the UIM 102 inputs the input values described with reference to FIG. 1 to the CAVE algorithm 118 to generate AUTH1, and adds the NAI to the MS 104. In step 210, the MS 104 receives the AUTH1 and the NAI transmitted from the UIM 102, and proceeds to step 212. In step 212, the MS 104 transmits NAI and AUTH1 to the AN / PCF 106, and proceeds to step 214. When the MS 104 receives the authentication success message from the AN-AAA 108 in step 214, the MS 104 proceeds to step 216. In step 216, the MS 104 recognizes that authentication is successful. On the other hand, the MS 104 receives the authentication failure message in step 214 proceeds to step 218. In step 218, the MS 104 recognizes that authentication has failed.

Next, a procedure of performing an authentication procedure in the AN-AAA of FIG. 1 will be described with reference to FIG. 3.

3 is a flowchart illustrating a process of performing an authentication procedure by an authentication authority (AN-AAA) according to an embodiment of the present invention.

Referring to FIG. 3, first, in step 302, the AN-AAA 108 receives NAI, AUTH1, and RAND values transmitted from the MS 104 from the AN / PCF 106, and proceeds to step 304. In step 304, the AN-AAA 108 generates an SSD value by combining the A-key value uniquely assigned to each subscriber station with the ESN and RANDSSD values, and proceeds to step 306. In step 306, the AN-AAA 108 generates the RAND 'value by taking the upper 4 bytes from the received RAND value and proceeds to step 308. For convenience of description, the steps are described in the order of steps 304 and 306, but it should be noted that the present invention is established even if the order is changed. In step 308, the AN-AAA 108 inputs the UIM ID, SSD, RAND 'and IMSI to the CAVE algorithm 130 to generate AUTH2, and proceeds to step 310. In step 310, the AN-AAA 108 compares the AUTH1 value and the AUTH2 value received from the MS 104, and proceeds to step 312. In step 312, the AN-AAA 108 transmits an authentication success message to the corresponding MS 104. However, if the two values do not match in step 310 proceeds to step 314. In step 314, the AN-AAA 108 transmits an authentication failure message to the corresponding MS 104.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

As described above, the code division multiple access communication system that provides the CDMA2000 1x service and the 1x EV-DO service together has different subscriber terminal authentication schemes between the services. Therefore, the CDMA2000 1x service subscriber station needs to replace a UIM card in order to receive the 1x EV-DO service. However, in the present invention, by enabling the 1x EV-DO service subscriber station authentication using the CDMA2000 1x service subscriber station authentication method, there is an effect of reducing the cost of replacing the UIM card.

1 is a signal flow diagram illustrating a process of authenticating a 1xEV-DO service subscriber station with a CAVE algorithm according to an embodiment of the present invention.

2 is a flowchart illustrating a process of performing an authentication procedure by a subscriber station (MS) according to an embodiment of the present invention.

3 is a flowchart illustrating a process of performing an authentication procedure by an authentication authority (AN-AAA) according to an embodiment of the present invention.

Claims (21)

The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. In the subscriber terminal authentication method, A second random number generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, a third random value generated according to the second scheme, and the subscriber station information; Generating a first authentication value by applying to a function; The fourth random number value generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, the fifth random value generated according to the first scheme, and the subscriber station information are applied to the function. Generating a second authentication value; And if the first authentication value and the second authentication value coincide with each other, determining that the authentication for the subscriber station is successful. The method of claim 1, Wherein the function is a CAVE function. The method of claim 1, The subscriber station information includes a subscriber identification number (IMSI: International Mobile Subscriber Identify) and a unique number of a user identification module (UIM). The method of claim 1, And determining that authentication fails for the subscriber station if the first authentication value and the second authentication value do not match. The method of claim 1, The third random value generated corresponding to the second scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. Wherein said method is determined by. The method of claim 1, The fifth random number value generated corresponding to the first scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. Wherein said method is determined by. The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. In the authentication method performed by the subscriber station, Generating a second random number value with predetermined bits of the first random number generated corresponding to the first scheme; Generating a first authentication value by applying the second random value, the third random value generated corresponding to the second method, and the subscriber terminal information to a predetermined function; And the subscriber station authentication includes receiving a success message. The method of claim 7, wherein Wherein the function is a CAVE function. The method of claim 7, wherein The subscriber station information includes a subscriber identification number (IMSI: International Mobile Subscriber Identify) and a unique number of a user identification module (UIM). The method of claim 7, wherein The third random value generated corresponding to the second scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. Wherein said method is determined by. In the code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different from each other, the first scheme service authentication station is a subscriber. In the method for performing terminal authentication, Receiving a first authentication value from the subscriber station; The fourth random number value generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, the fifth random value generated according to the first scheme, and the subscriber station information are applied to the function. Generating a second authentication value; And if the first authentication value and the second authentication value coincide with each other, determining that the authentication for the subscriber station is successful. The method of claim 11, Wherein the function is a CAVE function. The method of claim 11, The subscriber station information includes a subscriber identification number (IMSI: International Mobile Subscriber Identify) and a unique number of a user identification module (UIM). The method of claim 11, The fifth random number value generated corresponding to the first scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. Wherein said method is determined by. The method of claim 11, And determining that authentication fails for the subscriber station if the first authentication value and the second authentication value do not match. The first scheme and the second scheme are supported, and the first scheme is provided in a code division multiple access communication system in which the authentication scheme according to the first scheme and the authentication scheme according to the second scheme are different. In the subscriber terminal authentication system, A second random number generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, a third random value generated according to the second scheme, and the subscriber station information; A subscriber station generating a first authentication value by applying to a function; The fourth random number value generated with upper predetermined bits among the first random numbers generated corresponding to the first scheme, the fifth random value generated according to the first scheme, and the subscriber station information are applied to the function. Generating a second authentication value, and determining that the authentication of the subscriber station is successful when the first authentication value and the second authentication value coincide with each other. The method of claim 16, Wherein the function is a CAVE function. The method of claim 16, The subscriber station information includes a subscriber identification number (IMSI: International Mobile Subscriber Identify) and a unique number of a user identification module (UIM). The method of claim 16, And if the first authentication value and the second authentication value do not match, determining that authentication has failed for the subscriber station. The method of claim 16, The third random value generated corresponding to the second scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. The system of claim 1, wherein the system is determined. The method of claim 16, The fifth random number value generated corresponding to the first scheme is a combination of a code value preset for the subscriber station, an electrical unique number of the subscriber station, and a sixth random number value for updating the third random number value. The system of claim 1, wherein the system is determined.