KR20050064105A - Authentication server system and authentication server management method using ipc - Google Patents

Abstract

An authentication server system and an authentication server management method using IPC are disclosed. In the authentication server system using the diameter protocol, when the SNMP agent receives a predetermined request message for resource management of the authentication server system through the SNMP protocol, the SNMP agent converts the request message into an IPC message. The Java management server generates an IPC message including the changed table information when a table in the server DB that stores authentication related information is changed. The authentication server unit receives the IPC message from the SNMP agent unit and the Java management server unit, performs a predetermined operation according to the contents of the IPC message, and returns the result via the IPC message. This simplifies the interface and facilitates program maintenance by unifying the interface between the authentication server and other processes into one.

Description

Authentication server system and authentication server management method using IPC}

The present invention relates to an authentication server system and an authentication server management method, and more particularly, to an authentication server system and an authentication server management method that can be efficiently managed by an external management system.

Conventionally, a remote access dial in user service (RADIUS) server has been used as a server for authentication or billing. However, a Radius server has a limitation on the number of attributes and the length of a message. Difficulty in supporting interworking. Overcoming the limitations of this Radius server, a diameter authentication server has emerged that uses the high-performance and scalable Diameter protocol.

Diameter is a new AAA standard protocol being formulated by the IETF to solve the limitations and problems of the conventional Radius protocol. Compared with the conventional Radius, security is further enhanced by employing the Stream Control Trams-mission Protocol (SCTP) and the Transport Layer Security (TLS) at the transport layer. In addition, the Diameter is a flexible protocol structure that can provide access network and security application service, and authenticates, authorizes, and charges the wired / wireless access subscriber and roaming subscriber to multiple networks.

The technical problem to be achieved by the present invention is that an administrator efficiently manages a Management Information Base (MIB) such as authentication related statistics of an authentication server system using a management system, and manages information stored in a DB of the authentication server system. The present invention provides an authentication server system and an authentication server management method capable of providing the authentication server system with the update fact every time it is updated.

In order to achieve the above technical problem, an embodiment of the authentication server system according to the present invention, in the authentication server system using the diameter protocol, a predetermined request for resource management of the authentication server system through the SNMP protocol An SNMP agent converting the request message into an IPC message upon receiving the message; A Java management server unit generating an IPC message including information of the changed table when a table of the server DB storing information related to the authentication is changed; And an authentication server unit which receives an IPC message from the SNMP agent unit and the Java management server unit, performs a predetermined operation according to the contents of the IPC message, and returns an execution result through an IPC message.

One embodiment of the management method of the authentication server system according to the present invention for achieving the above technical problem, in the management method of the authentication server system using the diameter protocol, the resource of the authentication server system through the SNMP protocol Converting a predetermined request message for management into an IPC message; Generating an IPC message including information of the changed table when the table of the server DB storing the information related to the authentication is changed; And receiving the IPC messages, performing a predetermined operation according to the IPC message, and returning an execution result through the IPC message.

This simplifies the interface and facilitates program maintenance by unifying the interface between the authentication server and other processes into one.

Hereinafter, with reference to the accompanying drawings will be described in detail with respect to the authentication server system and the management method of the authentication server system according to the present invention.

1 is a diagram illustrating an authentication server system and a management system for managing the same according to the present invention.

Referring to FIG. 1, the authentication server system 120 according to the present invention includes an SNMP agent 130, a Java management server unit 150, and an authentication server unit 140. The authentication server unit 140 includes a plurality of threads for authentication, and the main threads thereof include the meta agent 142, the application 144, and the base engine 146. The management system 100 for managing the authentication server system 120 according to the present invention is composed of an SNMP management program 102 and a server DB management program 104.

The SNMP management program 102 of the management system 100 is a program that manages each resource of the authentication server system through the Simple Network Management Protocol (SNMP) 110. SNMP manages a Management Information Base (MIB) for each resource management of the authentication server system.

The MIB is a formal description of a set of network objects that can be managed using SNMP, defined as a draft of the IETF, the Internet standards body. Here, the MIB is used to manage statistics, status, setting information, etc. related to the authentication server system according to the present invention.

The SNMP agent 130 of the authentication server system 120 exchanges information with the SNMP management program 102 of the management system via the SNMP 110 protocol. The SNMP agent 130 implemented as a separate process from the authentication server unit 140 of the authentication server system 120 uses IPC (Inter Process Communication) to exchange information with the authentication server unit 140. An interface method between the authentication server unit 140 and the SNMP agent 130 according to the present invention will be described in detail with reference to FIG. 2.

The server DB management program 104 of the management system 100 manages subscribers, peers, realms and sessions of the authentication server system 120 according to the present invention. The server DB management program 104 implemented in Java exchanges DB related information with the Java management server unit 150 of the server system 120 through a remote procedure call (RPC) 112. The server DB management program 104 may be implemented in a language other than Java, and may communicate with the Java management server using a communication method suitable for the implemented language.

The Java management server unit 150 of the authentication server system 120 exchanges information with the server DB management program 104 of the management system 100 and receives subscribers, peers, areas, and the like received from the server DB management program 104. Information such as a session is stored in the server DB 160. Since the authentication server unit must grasp the change of peer and realm information for message routing in real time, when the Java management server unit 150 stores the changed data in the server DB 160, it notifies the authentication server unit 140 of the fact. do.

The Java management server unit 150 implemented as a separate process from the authentication server unit 140 communicates with the authentication server unit 140 through an IPC message. An interface between the Java management server unit 150 and the authentication server unit 140 will be described in detail with reference to FIG. 3.

The authentication server unit 140 decrypts predetermined information received from the SNMP agent 130 and the Java management server unit 150 to perform a necessary operation. The authentication server unit 140 includes a thread such as a meta agent 142 for communicating with the SNMP agent 130 and the Java management server unit 150, an application 144 that performs authentication, and the like. The authentication server unit 140 may perform a role of a conventional Radius authentication server or a role of a diameter authentication server.

In particular, the authentication server 140 may provide the access point with IP address information and key related information necessary for secure handoff of the WLAN terminal when the WLAN terminal roams between the access points. It can serve as an authentication server that uses a diameter protocol that allows it.

In order to perform a role as an authentication server for the access point, when the server authentication unit 140 receives a predetermined request message through a diameter protocol, the server authentication unit 140 parses the request message and then multiplies the access point according to the contents of the request message. A response message including a group key for casting or a pair key for roaming the WLAN terminal is generated. The generation and management of the group key and the pair key may be performed by the key management daemon unit, which is a separate thread.

If the access point serves as a Radius client, the message transmitted from the access point is converted into a diameter protocol message, and the message transmitted from the authentication server system according to the present invention to the access point is converted into a Radius protocol message. This can be done by including a conversion agent to send.

2 is a diagram illustrating an interface between an SNMP agent and an authentication server unit of the authentication server system according to the present invention.

2, the SNMP agent 230 of the authentication server system 220 exchanges information with the SNMP management program 200 of the external management system through the SNMP protocol, and the IPC message with the meta agent 242 of the authentication server unit. Exchange information through.

The SNMP management program 200 is a program for managing the MIB of the authentication server unit 240. Generally, the SNMP management program 200 exists in a system separate from the authentication server system 220 according to the present invention and is required for the administrator to manage the authentication server. Provides statistics and configuration information.

The SNMP agent 230 of the authentication server system 220 communicates with the SNMP management program 200 using the SNMP protocol. Also, the SNMP agent 230 uses an IPC message to exchange information with the meta agent 242 of the authentication server unit 240.

IPC is an interprocess communication mechanism, and typical examples include message queue, shared memory, and semaphore methods. Message queuing methods include message queuing, process synchronization based on message state, and useful features such as message priority. The shared memory method allows multiple processes to share user space to read or write data. In the shared memory method, only the control information is stored in kernel space, and the rest is in user space, so each process can exchange data with each other by writing or writing data to its own variables. The semaphore method supports mutual exclusion, allowing synchronization between multiple processes when accessing a single data at the same time.

The authentication server system 220 according to the present invention generally uses Message Queuing IPC between the SNMP agent 230 and the meta agent 242. If there are other efficient mechanisms for interprocess communication, you can use them.

By using the Message Queuing IPC, each of the separate processes, the authentication server 240 and the SNMP agent 230, can inform the other party that there is new data, and the processes (authentication server, SNMP agent) simultaneously It can solve the critical area problem, the problem of accessing data.

When the SNMP manager 200 sends an SNMP variable request (GetRequest or GetNext) 202 or an SNMP variable set (SetRequest) 204 to the authentication server system 220, the commands are transmitted to the SNMP agent 230 through the SNMP protocol. Is delivered to. The SNMP agent 230 parses the forwarded SNMP commands and generates an SNMP request 210 suitable for the message queue IPC based on the parsed SNMP commands. In addition, the SNMP agent 230 transmits an SNMP request 210 suitable for the message queue IPC to the meta agent 242 of the authentication server unit.

The meta agent 242 exists as a thread belonging to the authentication server unit 240 and executes the SNMP request 210 command through an operation of reading or setting a global variable value and outputting the result through the SNMP response 212. Reply At this time, different types of message queues are used for the SNMP request 210 and the SNMP response 212 so that the meta agent 230 does not read itself the SNMP response 212 sent to the message queue. For example, the message queue type for the SNMP request 210 is set to 10 and the message queue type for the SNMP response 212 is set to 100.

The SNMP agent 230 receives the SNMP response 212 and makes it an SNMP variable response 206 using the SNMP protocol and sends it to the SNMP management program 200.

Data in the form of a data structure, such as a message queue structure, cannot be transferred immediately. Therefore, it is necessary to properly define the data structure, convert it to a string form, and interpret the string form as a defined data structure.

3 is a diagram illustrating a data structure of a string transferred between an SNMP agent and a meta agent in the authentication server system according to the present invention.

Referring to FIG. 3, the SNMP request message 300 transmitted from the SNMP agent 230 to the meta agent 242 includes an SNMP variable request message 310 and an SNMP variable setting message 320, and the meta agent 242. In the message transmitted to the SNMP agent 230 is an SNMP response message (350).

The SNMP variable request message 310 includes a management variable name 311, an index 1 312, an index 2 313, an index 3 314, and a flag 315. The management variable name field 311 stores the name of the request target variable, and the index 1 to index 3 fields 312 to 314 are used to support up to three indexes of the MIB table. The flag field 315 is a field for distinguishing whether the SNMP request message 300 is an SNMP variable request message 310 or an SNMP variable setting message 320.

The SNMP variable setting message 320 includes a management variable name 321, index 1 322, index 2 323, index 3 324, flag 325, data length 326, and data 327. do. The variable name to be set is stored in the managed variable name field 321, and the index 1 to index 3 fields 322 to 324 are used to support up to three indexes of the MIB table. The flag field 325 is used to identify the SNMP variable setting message 320. The data length field 326 indicates the length of the data 327 included in the SNMP variable setting message 320, and data to set the setting target variable is recorded in the data field 327.

The SNMP response message 350 includes an SNMP response message 360 for an SNMP variable request and an SNMP response message 370 for an SNMP variable setting. The response messages 360 and 370 for the SNMP variable request and the SNMP variable setting commonly include index 1 361 and 371, index 2 362 and 372, index 3 363 and 373, and result fields 364 and 374.

In the case of the SNMP response message 360 for the SNMP variable request, the variable value and the length requested by the SNMP agent 130 are recorded in the data field 365 and the data length field 366, respectively. In the result field 364, success or failure, which is a result of the SNMP variable request, is recorded. In the case of the SNMP response message 370 for the SNMP variable setting, the index fields 371 to 373 record success or failure in the index value and the result field 374.

The meta agent 142 converts the SNMP response message 350 into a string and sends it to the SNMP agent 130, and the SNMP agent 130 analyzes the received string to grasp the SNMP response message data structure 350. The SNMP agent 130 converts the SNMP response message 350 into a form suitable for SNMP and transfers the SNMP response message 350 to the SNMP management program 102 through SNMP.

4 is a diagram illustrating an interface between a Java management server unit and an authentication server unit of the authentication server system according to the present invention.

Referring to FIG. 4, the Java management server unit 430 of the authentication server system 420 exchanges information with the server DB management program 400 of the external management system, and the metaagent 442 of the authentication server unit 440. Exchange information through IPC.

 The server DB management program 400 is a program for managing the server DB 160 used by the authentication server unit 440. The server DB management program 400 exchanges DB related information with the Java management server 430 using a remote procedure call.

When the Java management unit server unit 430 changes the information of the server DB 160 according to the predetermined information transmitted from the server DB management program 400, the Java management unit server unit 430 generates an event to generate an authentication server unit ( 440) notifies the server DB information change. In particular, since the change of the peer information and the realm information managed by the authentication server unit 440 is data directly affecting the message routing between the authentication server system and the peer connetcion, the change is authenticated. Must be delivered to the server unit 440 in real time.

The Java management server unit 430 notifies in real time that the information of the server DB 160 has changed through the message queue IPC with the meta agent 442 of the authentication server unit 440. As shown in Fig. 2, the meta agent 442 also receives a predetermined command with the SNMP agent 230 through IPC. That is, the SNMP agent 230 and the Java management server unit 430 implemented as a separate process from the authentication server unit 440 transmit and receive information through the meta agent 442 of the authentication server unit 440. Use Message Queuing IPC. The authentication server unit 440 unifies the interface with the external process by the meta agent 442, thereby simplifying the interface and facilitating program maintenance of the authentication server unit 440.

Specifically, when a change 402 of peer and area information occurs in the server DB management program 400, the changed information is transmitted to the Java management server 430 through a Java remote procedure call. The Java management server unit 430 reflects the transferred change information to the server DB 160 and generates a table change transfer message 410 for notifying the authentication server unit 440 of the change. The Java management server unit 430 transmits the table change transfer message 410 to the authentication server unit 440 through the message queue IPC.

The meta agent 442 parses the received table change delivery message 410, obtains the changed table name, the changed peer or realm name from the server DB 160, and delivers the changed table name to another thread of the authentication server unit 440. . The meta agent 42 generates the result message 412 and transmits the result message 412 to the Java management server 430 through the message queue IPC. The Java management server unit 430 transmits the received result message to the server DB management program 400.

Through the above-described process, the server DB management program 400 may perform a task related to the server DB and exchange information with the authentication server unit 440.

5 is a diagram illustrating a data structure of a string transmitted between a Java management server unit and a meta agent in the authentication server system according to the present invention.

Referring to FIG. 5, the table change transfer message 500 includes a peer table change message 510 and an area table change message 520. The result message for the table change forwarding is a message queue change confirmation message 500.

The peer table change message 510 includes a table identification value 511, a peer name length 512, a peer name 513, an application ID 514, and a change type 515. The area table change message 520 includes a table identification value 521, an area name length 522, an area name 523, and a change type 525. In the table identification value fields 511 and 521, a value for identifying whether the table change delivery message 500 is a peer table change message 510 or an area table change message 520 is recorded. The length of the peer name is recorded in the peer name length field 512, and the length of the area name is recorded in the area name length field 522. In the change type fields 515 and 525 (eg, insertion: 1, deletion: 2, modification: 3), values distinguishing whether peer information and area information have been inserted, deleted, or modified are recorded. The application ID 514 is a value for distinguishing an application to which the peer table change information is to be transmitted among several applications of the authentication server unit. In the case of zone table change message 520, the application ID field 524 is filled with zeros and is not used.

The change confirmation message 550 sent from the meta agent 442 to the Java management server unit 430 includes a result field 550 indicating whether success or failure has occurred. As such, the server DB management program 400 performs a normal management function by notifying the authentication server unit 440 of a necessary event after performing a task related to the server DB 160 through the transmission and reception of a predetermined message through the message queue. .

6 is a flowchart illustrating a method for managing an authentication server according to the present invention.

Referring to FIG. 6, the SNMP agent 130 of the authentication server system 120 using the diameter protocol receives a request message for resource management of the authentication server system 120 from an external management system 100 (S600). ). The request message includes a variable request message and a variable setting message. The SNMP agent 130 of the external management system 100 and the authentication server system 120 transmits and receives a request message and a response message to the request message through SNMP.

Upon receiving the request message, the authentication server system 120 converts the request message into an IPC message for interprocess communication (S600). Then, the converted IPC message is transmitted to the authentication server unit 140 to perform the request message (S600).

When the information stored in the table of the server DB 160 of the authentication server system 120 is changed, deleted, or generated by the external management system 100, the Java management server unit 150 of the authentication server system 120 is connected to the server DB ( 160 generates and transmits an IPC message for notifying the authentication server 140 of the change of the table (S610).

The authentication server unit 140 receives the IPC message from the SNMP agent 130 through the message queue IPC, performs an operation according to a variable setting or a variable request, and returns the result (S620). In addition, when the authentication server unit 140 receives an IPC message including the server DB 160 table change fact from the Java management server unit 150, the change server transmits the change fact to another thread for processing and returns a result ( S620). The authentication server unit 140, the SNMP agent 130, and the Java management server unit 150 exchange messages through a message queue IPC, which is an interprocess communication method.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the scope will be construed as being included in the present invention.

According to the present invention, the administrator can manage the authentication server system efficiently and conveniently by using the SNMP management program and the server DB management program, and the interface is simplified by unifying the interface between the authentication server and other processes into one. Maintenance is easy.

By using Message Queuing IPC between the authentication server unit and other processes, the time required for information exchange between the authentication server unit and other management programs can be minimized, and performance degradation of the authentication server system due to the execution of management functions can be prevented. In addition, response delays in management programs can be minimized.

In addition, by implementing the authentication server portion of the authentication server system according to the present invention using a diameter protocol to provide a more efficient and stable system to the service provider when using as an authentication server of the wireless LAN environment, even for users of the wireless LAN service It can provide convenient and stable service.

1 is a diagram illustrating an authentication server system and a management system for managing the same according to the present invention;

2 is a diagram illustrating an interface between an SNMP agent and an authentication server unit in the authentication server system according to the present invention;

3 is a diagram illustrating a data structure of a string transmitted between an SNMP agent and an authentication server unit in an authentication server system according to the present invention;

4 is a diagram illustrating an interface between a Java management server unit and an authentication server unit in the authentication server system according to the present invention;

5 is a diagram illustrating a data structure of a string transmitted between a Java management server unit and an authentication server unit in the authentication server system according to the present invention;

6 is a flowchart illustrating a method for managing an authentication server according to the present invention.

Claims (9)

In the authentication server system using the diameter protocol, An SNMP agent converting the request message into an IPC message upon receiving a predetermined request message for resource management of the authentication server system through an SNMP protocol; A Java management server unit generating an IPC message including information of the changed table when a table of the server DB storing information related to the authentication is changed; And And an authentication server unit which performs a predetermined operation according to the contents of the IPC message received from the SNMP agent unit and the Java management server unit, and returns an execution result through the IPC message. The method of claim 1, And the SNMP agent unit, the Java management server unit, and the authentication server unit are each implemented in separate processes. The method of claim 1, And the SNMP agent unit, the authentication server unit, the Java server manager, and the authentication server unit exchange the IPC message through IPC using a message queue. The method of claim 1, The SNMP agent unit, the Java server manager and the authentication server unit define a predetermined data structure for data exchange between each other, and then convert the IPC message having the data structure into a string form through a message queue IPC. Authentication server system. The method of claim 1, The SNMP agent exchanges an IPC message by separating a message queue type for transmitting an IPC message to the authentication server unit and a message queue type for receiving an IPC message from the authentication server unit. The method of claim 1, The Java server management unit exchanges an IPC message by separating a message queue type for transmitting an IPC message to the authentication server unit and a message queue type for receiving an IPC message from the authentication server unit, respectively. . In the management method of the authentication server system using the diameter protocol, Receiving and transmitting a predetermined request message for resource management of the authentication server system through an SNMP protocol, converting it into an IPC message; Generating and transmitting an IPC message including information of the changed table when the table of the server DB storing the information related to the authentication is changed; And Receiving the IPC messages, performing a predetermined operation according to the IPC messages, and returning an execution result through an IPC message. The method of claim 7, wherein And the IPC message is transmitted and received via a message queue IPC. The method of claim 7, wherein The IPC message is defined in a predetermined data structure and then converted into a string form through the message queue IPC is transmitted and received, characterized in that for transmitting and receiving.