KR20050121607A - Authentication method of handover in a wireless communication system - Google Patents

Abstract

The present invention relates to an authentication method during handover in a wireless communication system. The present invention provides a method for performing authentication at the time of handover in a wireless communication system, reducing data interruption time, and increasing efficiency of a wireless channel.

The method according to the present invention is an authentication method for handover in a wireless communication system including a wireless terminal, a serving base station providing a service to the wireless terminal, and a target base station adjacent to the serving base station. Maintaining a source tunnel between the serving base stations and transmitting a pre-handover notification message to adjacent base stations when a handover request message is received from a wireless terminal of the serving base station; and the target base stations receive a pre-handover notification message. Transmitting a pre-handover notification response message including a token through the source tunnel, and the serving base station transmits a pre-handover message to the handover request wireless terminal and receives a target base station determination signal from the wireless terminal. And the serving base station Transmitting token information about the target base station to the wireless terminal upon receiving a target determination signal; and performing a channel setup procedure with the target base station after the handover request wireless terminal transmits a handover completion message to the serving base station; It includes the process of doing.

Description

Authentication method for handover in wireless communication system {AUTHENTICATION METHOD OF HANDOVER IN A WIRELESS COMMUNICATION SYSTEM}

The present invention relates to a handover method in a wireless communication system, and more particularly, to an authentication method during handover in a wireless communication system.

In general, a representative system of a wireless communication system is a mobile communication system. Such mobile communication systems are gradually being developed to provide wireless packet data services based on voice services. As a system capable of providing wireless packet data services, a third generation (hereinafter, referred to as "3G") mobile communication system has been developed to provide various multimedia services at high speed. However, in the third generation mobile communication system, users are classified using a code division multiple access method. In the code division multiple access scheme, data can be transmitted by allocating different codes having orthogonality to users or to data transmitted to the users.

However, in the 3G system, there is a problem that high speed data cannot be provided at high quality due to lack of code. That is, because the code that can be used is limited, the problem is that the rate is limited. Therefore, in order to solve this problem, researches and developers of mobile communication systems are considering a 4th Generation (hereinafter referred to as "4G") wireless communication system called a next generation communication system. In such a 4G system, a user or transmitted data may be classified and transmitted using an orthogonal frequency division multiple access (OFDMA) scheme. As such, the 4G system has an advantage of increasing the transmission rate to about 100Mbps. Accordingly, services having a variety of quality of service (hereinafter referred to as 'QoS') may be provided than services provided by the 3G system.

Research on these 4G systems is currently under way with broadband wireless access (BWA) systems, such as wireless local area network ("LAN") systems and wireless urban area network ("MAN") systems. It is evolving into a form of broadband wireless access communication system. In addition, while providing mobility (characteristics) of the wireless communication system, it is evolving in the form of guaranteeing Quality of Service (QoS). Such representative communication systems include the Institute of Electrical and Electronics Engineers (IEEE) 802.16a communication system and the IEEE 802.16e communication system. The IEEE 802.16a communication system and the IEEE 802.16e communication system are communication systems applying the OFDM / OFDMA scheme to support a broadband transmission network in a physical channel of the wireless MAN system.

The IEEE 802.16a communication system is a system currently considering only a single cell structure and a state in which a subscriber station (SS) (hereinafter referred to as "SS") is fixed, that is, the SS mobility is not considered at all. On the contrary, the IEEE 802.16e communication system is a system considering mobility in the SS mentioned in the IEEE 802.16a communication system. Therefore, the IEEE 802.16e communication system has an SS having the mobility, which is called a mobile subscriber station (MSS).

Next, the structure of the IEEE 802.16e communication system will be described with reference to FIG. 1. 1 is a diagram schematically illustrating a structure of a general IEEE 802.16e communication system.

Referring to FIG. 1, the IEEE 802.16e communication system has base stations 110 and 140 having different cells, and each of the base stations 110 and 140 is capable of communicating with itself. ) As such, the areas 100 and 150 that can communicate with the base stations 110 and 140 are referred to as cells. In FIG. 1, the MSSs 111, 113, and 130 included in the region 100 of the first base station 110 are included, and the MSSs 151 and 153 included in the region 150 of the second base station 140. , 130). As described above, each of the base stations 110 and 140 communicates with each of the terminals 111, 113, 130, 151, and 153 using an OFDM / OFDMA scheme.

However, the MSS 130 included in the areas of the first base station 110 and the second base station 140 among the MSSs 111, 113, 130, 151, and 153 is present in the handover area. can do. That is, when the MSS 130 moves toward the cell 150 managed by the base station 140 while transmitting and receiving a signal with the base station 110, the serving BS moves from the base station 110 to the serving base station 110. May be changed to the base station 140. Such handover has not been well used in the OFDMA scheme, but has been developed to support handover due to problems such as frequency reuse coefficient.

Next, a process of handover under the structure of the general IEEE 802.16e communication system as shown in FIG. 1 will be described with reference to FIG. 2. 2 is a signal flow diagram illustrating a handover procedure that is supported by the IEEE P802.16e / D5-2004 standard.

In FIG. 2, it is assumed that MSS 201 to perform handover first, serving base station 203 currently providing a service, and base stations 205 and 207 to which MSS 201 is able to handover exist. This will be explained in.

In the above state, the MSS 201 generates a handover request message (MSSHO-REQ with possible Target BS) when the handover is required in step 211, that is, in the case of the MSS 130 of FIG. ). The MSSHO-REQ message scans neighboring base stations that can be accessed when the link status with the serving base station becomes worse than a predetermined range in the MSS 201. Then, the MSS 201 selects base stations to transmit a handover request based on the search result, and then transmits an MSSHO-REQ message including the selected base stations and the search result to the serving base station 203.

In step 213, the serving base station 203 searches for a list of possible base stations as a base station to be handed over using a list that stores information about neighboring base stations. After searching for the target base station as described above, the serving base station 203 uses the first target base station (hereinafter referred to as “HO-pre-notification”) message to the target base stations as in steps 215 and 219. 205 and the second target base station 207. Here, the HO-pre-notification message includes required bandwidth and required service quality information of the MSS 201.

In step 217 and step 221, the first target base station 205 and the second target base station 207 communicate with the MSS 201 through a handover pre-notification response message (hereinafter referred to as “HO-pre-notification-response”). Transfer to the serving base station 203. Accordingly, the serving base station 203 collects HO-pre-notification-response messages received from the first target base station 205 and the second target base station 207. Thereafter, the serving base station 203 determines the base stations to which the MSS 201 can handover and delivers through a handover response (hereinafter referred to as "MOB_HO-RSP") message. In FIG. 2, it is assumed that only the second target base station 207 is configured as a target base station capable of performing handover. In practice, however, one or more base stations may be included in the MOB_HO_RSP message. In addition, although not shown in FIG. 2, a handover confirmation (hereinafter referred to as "HO-confirm") message is transmitted to base stations included in the MOB_HO_RSP message to prepare for handover of the MSS 201.

As such, when the MOB_HO_RSP message is received from the serving base station, the MSS 201 finally determines a target base station to perform handover among the base stations included in the MSS_HO-RSP message in step 225. The MSS 201 notifies the serving base station 203 through the finally determined handover indication message (hereinafter referred to as "HO-IND").

The serving base station 203 receiving the HO-IND message from the MSS through the above process releases the radio access channel with the MSS 201. Then, the MSS 201 performs a network re-entry with the second target base station 207 included in the HO-IND message to establish a new radio access channel with the target base station 2 207. do. In this case, the network-re-entry with the second target base station 207 is similar to the network-entry procedure with the serving base station 203 and the configuration thereof may be summarized as follows.

(1) downlink / uplink parameter acquisition process

(2) ranging process

(3) basic capability re-negotiation process

(4) PKM authorization process

(6) EAP User Authentication Process

(7) PKM Key Exchange Process

(8) re-register process

(9) It consists of re-establish IP connectivity process.

The process of steps 227 to 239 in FIG. 2 briefly illustrates the above processes, and exchanges messages between the MSS 201 and the second target base station 207. Through these processes, the MSS 201 that establishes a new radio access channel with the second target base station 207 may continue to transmit data.

As described above, in the process of releasing the radio access channel of the existing serving base station 203 and setting the radio access channel with the new target base station, the serving base station deletes the service context of the MSS 201. The time point at which the HO-IND message is received from the MSS 201 or from the second target base station 207 after setting of a radio access channel between the MSS 201 and the second target base station 207 is completed. It is time to receive a handover complete message. However, the current IEEE P802.16e / D1-2004 standard does not define a specific message.

Accordingly, the current IEEE P802.16e / D5-2004 standard based on a method in which the MSS 201 releases a radio access channel with a serving base station 203 and sets a new radio access channel with a target base station during handover. For example, frequent handover may occur when the MSS 201 moves between two base stations in a cell boundary region. In this case, the system and the MSS must perform authentication of the terminal, authentication of the user, and encryption key delivery whenever frequent handover occurs. Therefore, the MSS requiring the handover has a problem of incurring a significant delay in transmitting / receiving data through a new channel. In addition, there is a problem that the adverse effect that the transmission / reception stop time of the data is increased during the handover. In addition, there is a problem in that the transmission efficiency of the wireless channel is reduced because an encryption key or the like must be frequently transmitted through the wireless channel during authentication according to handover.

Accordingly, an object of the present invention is to provide a method for quickly performing authentication during handover in a wireless communication system.

Another object of the present invention is to provide a method for reducing data interruption time during handover in an IEEE 802.16e system.

Another object of the present invention is to provide a method for increasing the efficiency of a radio channel during handover in an IEEE 802.16e system.

The method of the present invention for achieving the above object, as a authentication method during handover in a wireless communication system including a wireless base station and a serving base station providing a service to the wireless terminal and the target base station adjacent to the serving base station, the serving method; Maintaining a source tunnel between a target base station adjacent to a base station and the serving base station, transmitting a pre-handover notification message to adjacent base stations when a handover request message is received from a wireless terminal of the serving base station; And transmitting a pre-handover notification response message including a token through the source tunnel when the pre-handover notification message is received, and the serving base station transmits a pre-handover message to the handover request wireless terminal. Receiving a target base station determination signal from And, when the serving base station receives a target determination signal, transferring the token information about the target base station to the wireless terminal; And performing a channel setting procedure.

Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, when it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

First, the present invention proposes a method for fast authentication during handover in IEEE P802.16e / D3-2004, which is a Mobile Broadband Wireless Access System (MBWA) standard. That is, in order to improve the handover performance, IEEE P802.16e / D3-2004 proposes a method for optimizing terminal authentication, user authentication, and encryption / authentication key transmission during the handover procedure. Define procedures and messages.

Next, a method for optimizing a network reentry procedure according to the present invention will be described. Here, the neighboring base stations belonging to the target BS list are set as the first target base station 305 and the second target base station 307 for ease of explanation.

3 is a signal flowchart illustrating an authentication process during handover in a mobile broadband wireless access system according to the present invention. Hereinafter, an authentication process during handover in a mobile broadband wireless access system according to the present invention will be described in detail with reference to FIG. 3.

First, the serving base station 303 and the neighboring base stations 305 and 307 of the MSS 301 perform an Internet key exchange (IKE) to form an IPsec tunnel. This process is performed in steps 311 and 313 between the serving base station 303 and the first target base station 305, and is performed in steps 315 and 317 between the serving base station 303 and the second target base station 307. . Therefore, a secure tunnel is generated between the serving base station 303, the first target base station 305, and the second target base station 307 of the MSS 301 through the above processes.

Thereafter, in step 319, the MSS 301 scans neighboring base stations that can be accessed when the link state with the serving base station becomes worse than a predetermined range. Then, the MSS 301 selects base stations to transmit a handover request based on the search result, and then transmits an MSSHO-REQ message including the selected base stations and the search result to the serving base station 203. This process is the same as the process described in the prior art. The serving base station 303 then checks the list of possible target base stations from the list for adjacent base stations in step 321. Thereafter, the serving base station 303 transmits a HO-pre-notification message to the target base stations transmitted in step 319 using the network backbone. At this time, the target base stations that are available for service, that is, the base stations transmitting the acknowledgment (ACK) to the HO-pre-notification response, transmit an authentication token (Token_) to the serving base station 303 in the HO-RSP message. An authentication token received from a target base station is stored, where a token refers to a token mentioned in cryptography, which means an authentication result, that is, a random value.

This will be described again with reference to FIG. 3. The serving base station 303 transmits a HO-pre-notification message to the first target base station 305 and the second target base station 307 in steps 323 and 331. Then, the first target base station 305 and the second target base station 307 generates and transmits a HO-pre-notification response message including the token according to the present invention as a response signal in steps 325 and 333, respectively. Then, the serving base station 303 of the MSS 301 transmits security context information of the MSS 301 to the target base stations 305 and 307 which transmitted the token in steps 327 and 335. At this time, the security environment information includes MSS orignal SBC profile, All CIDs, SFIDs, All Key Materials information. Then, the target base stations 305 and 307 generate and transmit a secure environment information response (MSS-context-transfer Ack) message to the serving base station 303 of the MSS 301.

Accordingly, the serving base station of the MSS 301 receives token information from target base stations. Accordingly, the serving base station 303 transmits a HO-RSP message including a list of target base stations that transmit a token to the MSS 301 including a list of target base stations which transmit each token information in step 339. The MSS 301 that receives the token information list from the serving base station 303 determines a target base station to perform handoff among the base stations included in the list. In step 341, the MSS 301 provides a previous Private Key Management Authentication (PKM-Pre-Auth) request (Req) message indicating a target base station to perform the handoff. Send to 303.

Here, the PKM-Pre-Auth message may be configured as shown in Table 1 below.

Attribute Contents Target BSID Target Base Station MAC address HMAC Tuple Message Digest calulated using HMAC_KEY_U

In Table 1, HMAC means Hash Message Authentication Code. As described above, the serving base station 303 receiving the PKM-Pre-Auth Req message transmitted by the MSS 301 in step 341 finds the token of the target base station requested by the MSS 301 in step 343 and authenticates the previous private key management. The message is sent to the MSS 301 in a response message (PKM-Pre-Auth-Reply).

Here, if the PKM-Pre-Auth-Reply message is shown in a table, it may be shown as in <Table 2>.

Attribute Contents Target BSID Target Base Station MAC address Token 128 bits Token generated by Target BS HMAC Tuple Message Digest calulated using HMAC_KEY_U

In addition, if the PKM message code modified according to the present invention is shown in a table, it may be shown as in Table 3 below.

Code PKM message type MAC Management Message name 14 PKM-Pre-Auth-Req PKM-REQ 15 PKM-Pre-Auth-Rsp PKM-RSP

Due to the exchange of such messages with each other, the MSS 301 transmits the HO-IND message to the serving base station 303 in step 345. At this time, the radio channel between the MSS 301 and the serving base station 303 is released. Thereafter, the second target base station 307, which is the target base station shown in FIG. 3, generates a fast ranging message and transmits it to the MSS 301 in step 347. In step 349, the MSS 301 generates a ranging request (RNG-REQ) message and transmits the ranging request (RNG-REQ) message to the second target base station 307. Accordingly, the second target base station 307 completes the handover process by transmitting an RNG-RSP message to the MSS 301 in step 351. The step 347 step 351 described above may be referred to as a channel setting process.

In the above-described process, the procedure for authentication between the MSS 301 receiving the token generated by the target base station and the target base station receiving the authentication encryption information of the terminal from the serving base station 303 is rearranged as follows. This is done by generating and sharing encryption keys with each other.

The authentication / encryption information includes the following.

1) Token: Pseudo Random number of minimum 128 bits

2) KGF: Key Generation Function

3) Serving Key Materials: AK (Authorization Key) of the UE defined in PKMv1 and all related Key Materials; All keys associated with HMAC_KEY_D / U, KEK (Key Encryption Key), and PAK (Pre-Authorization Key) defined in PKMv2.

The authentication / encryption information is shared by the terminal and the target base station as authentication cipher information trusted by the terminal and the target base station by the PKMv2 key generation algorithm defined in the IEEE P802.16e / D3-2004 standard using Token as a factor. Examples of such algorithms are as follows.

[1] Target PAK = KGF (Token || MSID || Serving PAK)

[2] Target TEK = KGF (Token || MSID || Serving TEK)

[3] Target KEK = KGF (Token || MSID || Serving KEK)

[4] Target HMAC_KEY_D / U = KGF (Token || MSID || Serving HMAC_KEY_D / U)

As described above, there is an advantage in that authentication can be performed quickly at the time of handover in a wireless communication system. In addition, it is possible to reduce data downtime during handover and to increase the efficiency of a wireless channel.

1 is a view schematically showing the structure of a general IEEE 802.16e communication system;

2 is a signal flow diagram illustrating a handover procedure that is supported by the IEEE P802.16e / D5-2004 standard;

3 is a signal flow diagram illustrating an authentication process during handover in a mobile broadband wireless access system according to the present invention.

Claims (1)

An authentication method for handover in a wireless communication system including a wireless base station, a serving base station providing a service to the wireless terminal, and a target base station adjacent to the serving base station. Maintaining a source tunnel between the target base station adjacent to the serving base station and the serving base station, and transmitting a pre-handover notification message to adjacent base stations when a handover request message is received from a wireless terminal of the serving base station; Transmitting, by the target base stations, a pre-handover notification response message including a token through the source tunnel upon receiving the pre-handover notification message; The serving base station transmitting a pre-handover message to the handover request wireless terminal and receiving a target base station determination signal from the wireless terminal; When the serving base station receives a target determination signal, transferring token information about the target base station to the wireless terminal; And performing a channel establishment procedure with the target base station after transmitting the handover complete message to the serving base station.