KR20060039126A - Amethod for terminal authenticating in portable internet system - Google Patents

Abstract

The present invention relates to a terminal authentication method of a portable internet system.

In the portable Internet system, user authentication based on the Extensible Authentication Protocol (EAP) framework is defined as a default in order to support interworking between different provider networks in the future. Therefore, according to the terminal authentication method of the portable Internet system of the present invention, an authentication request message for the terminal at the time of user authentication based on an Extensible Authentication Protocol (EAP) framework in an AAA (Authentication, Authorization and Accounting) server The message includes the terminal MAC (Medium Access Control) address and the user ID (identity)-after acquiring the user ID and the MAC address of the terminal requested authentication, the MAC of the terminal corresponding to the user ID Performs terminal authentication by searching for an address.

Mobile Internet System, AAA, Authentication, EAP, Diameter, RADIUS, AVP

Description

Terminal authentication method in portable Internet system {AMETHOD FOR TERMINAL AUTHENTICATING IN PORTABLE INTERNET SYSTEM}

1 is a view showing the structure of a portable Internet system according to an embodiment of the present invention.

2A to 2C are diagrams illustrating a message structure used to transmit an AT MAC address between an AT and an AP, an AP and a PAR, and a PAR and an AAA server, respectively.

FIG. 3 is a diagram illustrating an AT MAC database structure managed by the AAA server shown in FIG. 1.

4 is a diagram illustrating a terminal authentication process when a user authenticates a portable Internet system according to an exemplary embodiment of the present invention.

5 is a diagram illustrating a terminal and a user authentication operation of an AAA server in a portable Internet system according to an embodiment of the present invention.

The present invention relates to a portable internet system, and more particularly, to a terminal authentication method of a portable internet system that performs terminal authentication at the time of user authentication based on the EAP framework.

Recently, the domestic high-speed Internet service and mobile communication service market is gradually entering a saturation state, and the global mobile communication market is continuing to slump due to delayed commercialization of 3G mobile service. In this stagnant telecommunications market environment, wireless Internet services that provide high-speed Internet access to mobile subscribers at low rates are considered a breakthrough in creating new markets.

In general, the wireless Internet technology may be classified into commercial wireless LAN, cellular based mobile communication such as cdma 2000 1xEV-DO, and portable Internet to be commercialized in the future.

Wireless LAN is capable of Internet service at high transmission speed but limited in mobility and service area. Cellular-based mobile communication supports broadband service area and high speed mobility but is limited in transmission speed and usage fee. Therefore, existing wireless LAN and cellular based mobile communication systems cannot provide high-speed data services at low rates to mobile subscribers.

On the other hand, the mobile Internet is located in the middle of the wireless LAN and the mobile communication-based wireless Internet, and is a service that combines the advantages of both services. Various wireless data services including video and high speed packet data may be provided. As such, the portable Internet is in the spotlight as a next generation communication method because it supports a wide range of service areas, high transmission speeds, and mobility. Currently, various standards have been proposed for the portable Internet, and international standardization of the portable internet is currently underway based on IEEE 802.16.

In general, in order to provide reliable wireless Internet service, terminal authentication is required to prevent illegal terminal use of the service. As a related technology, there is a method for preventing illegal terminal use in a mobile communication network (Korean Patent Publication No. 2002-69142). According to this technology, a home location register (HLR) manages information on illegal terminals, restricts services through the illegal terminals, and transmits information on the illegal terminals to a customer center so that appropriate measures can be made.

Meanwhile, IEEE 802.16 supports terminal authentication based on a digital certificate having a medium access control (MAC) address as an identity. At this time, it is not easy to duplicate the MAC address of the terminal because it is digital certificate-based, but it is necessary to define a message for transmitting the digital certificate between the terminal, the base station and the authentication server.

Since IEEE 802.16 is a MAC standard, only a message for transmitting a digital certificate is defined between a terminal and a base station, but a message definition for transmitting a digital certificate between a base station and an authentication server is considered to be above a specification. Therefore, a new message definition is required for digital certificate transmission between the base station and the authentication server.

On the other hand, in the portable Internet system, user authentication based on the Extensible Authentication Protocol (hereinafter, referred to as 'EAP') framework is defined as a default in order to support interworking between different provider networks in the future. However, RADIUS and Diameter protocols, which are widely used as authentication protocols, do not define attributes or attribute-value pairs (AVPs) that can transmit digital certificates for terminal authentication. not. Therefore, there is a need for a new method for terminal authentication using existing authentication protocols.

An object of the present invention is to provide a method for performing terminal authentication at the time of user authentication in a portable Internet system.

According to an aspect of the present invention, a method for authenticating a terminal wirelessly connected to an eNB by an authentication, authorization and accounting (AAA) server performing authentication in a portable Internet system is provided. The method comprises: a) an authentication request message for the terminal upon user authentication based on the EAP (Extensible Authentication Protocol) framework; the authentication request message includes a terminal medium access control (MAC) address and a user identity. Receiving a message; b) obtaining a user ID of the terminal requested for authentication and a MAC address of the terminal from the terminal authentication request message; And c) performing terminal authentication by searching for the MAC address of the terminal corresponding to the user ID. In this case, the authentication request message may include an EAP payload on which an EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) based certificate is loaded.

In the authentication request message, the MAC address of the terminal is replaced with Calling-Station-Id Attribute-Value Pair (AVP), the EAP payload is replaced with EAP-Payload AVP, and the user ID is User-ID AVP. It may be a diameter EAP message replaced with, and the authentication request message may be transmitted through at least one of the RADIUS protocol or the DIAMETER protocol.

And d) performing user authentication according to the EAP-Payload AVP upon successful terminal authentication in step c). When the terminal authentication fails, the result is transmitted to the terminal, and subsequent user authentication may not be performed.

According to another feature of the present invention, an authentication, authorization and accounting (AAA) server in which a packet access router (PAR) performing a packet router function in a portable Internet system performs authentication request for authentication of a terminal wirelessly connected to a base station. A method is provided. The method comprises: a) the base station upon user authentication based on an Extensible Authentication Protocol (EAP) framework, wherein the base station receives the medium access control (MAC) address of the terminal upon initial wireless link connection with the terminal. Receiving an authentication request message of the terminal through receiving and managing; b) requesting and receiving a user ID of the terminal for which authentication is requested and authentication-related data of the terminal for which authentication is requested from the terminal through the base station; And c) requesting authentication of the terminal by transmitting the MAC address, the user ID and the authentication related data of the terminal to the AAA server through an authentication protocol. At this time, in step c), the MAC address of the terminal is replaced with Calling-Station-Id AVP, the authentication-related data is replaced with EAP-Payload AVP, and the user ID is replaced with User-ID AVP. Is sent.

The wireless link initial access may be performed through a MAC message between the terminal and the base station, and the terminal may carry the terminal MAC address in a message for requesting ranging to the base station.

In addition, the base station and the PAR may communicate with each other through an authentication message for EAP-based terminal authentication, and the base station transmits the MAC address of the terminal in the first authentication message transmitted to the PAR. At this time, when requesting a user ID from the PAR, the user ID may be carried in the EAP payload of the authentication message.

In addition, the base station negotiates a basic capability for setting an authentication mode when the wireless link is initially connected, and the authentication-related data of the set authentication mode may be included in the EAP payload of the authentication message.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

Now, a terminal authentication method of a portable Internet system according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings.

First, the portable Internet system to which the present invention is applied will be described in detail with reference to FIG. 1.

1 is a view showing the structure of a portable Internet system according to an embodiment of the present invention.

As shown in FIG. 1, the portable Internet system 100 according to an embodiment of the present invention includes an access terminal (hereinafter referred to as an 'AT') 110 and an access point (hereinafter referred to as an 'AP') ( 120), a packet access router (hereinafter referred to as a 'PAR') 130, an AAA (Authentication, Authorization and Accounting; hereinafter referred to as 'AAA') server 140, and a Home Agent (hereinafter referred to as `` AAA '') HA ') 150.

The AT 110 is a portable Internet terminal, which performs wireless channel transmission / reception and MAC protocol processing functions according to the wireless access standard of the portable Internet system at a frequency of 2.3 GHz and accesses the AP 120 to transmit and receive high-speed packet data. .

The AP 120 performs initial access, intersectoral handover control, and quality of service (QoS) control between the ATs 110. In addition, the AP 120 receives a radio signal from the AT 110 and transmits it to the PAR 130 or, conversely, converts various types of information received from the PAR 130 into a radio signal and transmits it to the AT 110. .

PAR 130 is connected to a plurality of AP (120) by IP-based wired access to the IP-based core network constituting the Internet network, authentication, MIP (Mobile IP), handover between AP and handover control function between PAR and It performs the QoS control function. In addition, between the PAR 130 and the AP 120 uses an internal protocol ANAP (Access Network Application Protocol).

The AAA server 140 is connected to the PAR 130 and the Internet network to perform the MAC authentication and authentication of the user, service authority verification, authentication key generation and billing of the AT (110) and at (110). In addition, the AAA server 140 uses a diameter protocol that is being standardized by the Internet Engineer Task Force (IETF). Diameter protocol enables authentication, authorization and billing information transfer by inter-server interworking. The AAA server 140 includes an AT MAC database 142 and manages a user ID and an AT MAC address for terminal authentication.

The HA 150 is connected to the PAR 130 through the Internet network to perform a MIP service function.

The conventional wireless LAN method such as IEEE 802.11 provides a data communication method capable of wireless communication within a short distance centering on a fixed AP, but this does not provide mobility of the AT and performs short-range data communication by wireless rather than wired. There was a limit to support.

Meanwhile, the portable Internet system 100 shown in FIG. 1 being promoted by IEEE 802.16 may interwork with other Internet networks through the AAA server 140, and may configure one or more PARs 130 on the same network. . In addition, one or more APs 120 may be configured under one PAR 130, and a plurality of ATs 110 may be connected to one AP 120 to receive a service. In addition, even when the AT 110 moves from a cell that manages the AP 120 to a new cell, the AT 110 may receive a service provided by the existing cell.

As described above, in the portable Internet system 100, user authentication based on the EAP framework is defined as a default in order to support interworking between different provider networks in the future. Therefore, according to an embodiment of the present invention, the terminal authentication is performed at the same time as the user authentication.

The EAP framework handles communication between EAP protocol messages, AT 110, AP 120, PAR 130, and AAA server 140. A new type of authentication, EAP, is an Internet Engineering Task Force (IETF) RFC standard that involves the ability to deliver various authentication schemes over any point-to-point protocol (PPP) connection.

Next, a message structure for transmitting the AT MAC address between the AT and the AP, the AP and the PAR, and the PAR and the AAA server will be described in detail with reference to FIGS. 2A to 2C.

2A to 2C are diagrams illustrating a message structure used to transmit an AT MAC address between an AT and an AP, an AP and a PAR, and a PAR and an AAA server, respectively.

As shown in FIG. 2A, a MAC message (hereinafter, referred to as an 'RNG-REQ message') transmitted in a wireless section between the AT 110 and the AP 120 includes a MAC header, a management message type, a MAC address, and a CRC (cyclic). redundancy check) parameter, and according to an embodiment of the present invention, in the portable Internet system 100, the AT MAC address is loaded on the MAC address parameter when the wireless link is initially connected between the AT 110 and the AP 120. 120).

Next, as shown in FIG. 2B, a message (hereinafter, referred to as an 'ADTcmd message') transmitted between the AP 120 and the PAR 130 includes a message ID, an AT MAC address, and an EAP payload parameter. According to an embodiment of the present invention, at the start of authentication, the AP 120 transmits the AT MAC address to the AT MAC address parameter of the first ADTcmd message and transmits it to the PAR 130. Here, the ADTcmd message is one of ANAP (Access Network Application Protocol) protocol messages which are internal protocols defined by the portable Internet system 100 for transmitting an authentication message between the AP 120 and the PAR 130.

As shown in FIG. 2C, a message transmitted between the PAR 130 and the AAA server 140 (hereinafter, referred to as a `` diameter-eap-request message '') includes a diameter header, a Calling-Station-Id AVP. (Attribute / Value Pair) and EAP Payload AVP parameters are included, and the AT MAC address is loaded on the Calling-Station-Id AVP and transmitted to the AAA server 140.

FIG. 3 is a diagram illustrating an AT MAC database structure managed by the AAA server shown in FIG. 1.

As shown in FIG. 3, the AT MAC database 142 includes a User ID 142-1 and an AT MAC address 142-2. A user may use a plurality of terminals, and the user ID and the AT MAC address are mapped in a 1-N relationship. The user ID has a NAI (Network Access Identifier) format.

Next, a terminal authentication method of the portable Internet system according to an exemplary embodiment of the present invention will be described in detail with reference to FIG. 4.

4 is a diagram illustrating a terminal authentication process when a user authenticates a portable Internet system according to an exemplary embodiment of the present invention.

As shown in FIG. 4, first, a wireless link connection process is performed between the AT 110 and the AP 120 according to the MAC standard of the portable Internet system 100 (S400). In more detail, when the AT 100 enters the AP 120, the base station first sets downlink synchronization with the AT 110. As such, when downlink synchronization is set in the AP 120, the AT 110 acquires an uplink parameter. Thereafter, the AT 110 transmits a ranging-request (RNG-REQ) MAC message to the AP 120 to perform a ranging procedure with the AP 120 (S402). Herein, the ranging is performed by correcting and matching timing, power, and frequency information between the AT 110 and the AP 120. Initial ranging is performed first, and then periodic ranging is performed. Will be performed. At this time, as described above, the AT 110 transmits to the AP 120 including the AT MAC address in the MAC address parameter of the RNG-REQ message. Then, the AP 120 receives the AP and stores the AT MAC address in the AT MAC database 142 for terminal authentication (S404).

When the ranging procedure is completed, the AT 110 sends a message to the terminal 110 to establish a connection between the AT 110 and the AP 120. The subscriber station basic capability request (hereinafter, referred to as 'SBC REQ') Request a negotiation about the UE basic function, and receives a UE basic function response (SBC-Response, hereinafter, 'SBC RSP') message from the AP 120 to negotiate the UE basic function ( S406). At this time, the negotiation information is exchanged and negotiated between the authentication mechanism and the encryption algorithm between the AT 110 and the AP 120. According to an embodiment of the present invention, the user authentication is performed based on the EAP framework in order to prevent the illegal terminal from using the wireless Internet service, and the terminal authentication is performed while performing the user authentication. It blocks mobile Internet service without At this time, user authentication is performed through an EAP-TLS (Extensible Authentication Protocol-Transport Layer Security) based certificate.

As such, when the radio link connection is successfully performed, the AT 110 transmits the EAP start payload to the AP 120 in the EAP-Transfer-Request MAC message to inform the PAR 130 of the start of authentication (S408). The AP 120 loads the AT MAC address and the EAP start payload in an ADTcmd message and transmits it to the PAR 130 through the ANAP protocol (S410).

The PAR 130 manages the AT MAC address (S412) and transmits the EAP Request / Identity to the AP 120 to the AP 120 in order to obtain an identifier (identity, 'ID') of the AT user (S414). . Then, the AP 120 again transmits the EAP payload including the EAP Request / Identity in the EAP-Transfer-Reply message to the AT 110 to perform a response to the authentication start (S416).

The AT 110 transmits the EAP Response / Identity including the AT user ID to the AP 120 in response to the AT user ID request in the EAP-Transfer-Request message (S418), and the AP 120 again transmits the EAP Response / Identity. The EAP payload including the identity is carried in the ADTcmd message and transmitted to the PAR 130 (S420). That is, the ADTcmd message including the EAP-Response / Identity message, which is a response to the ADTcmd message including the first EAP-Request / Identity message, transmits the user's ID.

On the other hand, EAP-TLS-based user authentication-related data is transmitted and received between the AT 110 and the PAR 130 in addition to the above-described step (S418-S420).

PAR 130 replaces AT MAC address with Calling-Station-Id AVP, EAP payload including EAP Response / Identity, EAP-Payload AVP, user ID with User-Name AVP A request (Diameter-EAP-Request, hereinafter 'DER') message is made and transmitted to the AAA server 140 (S422).

The AAA server 140 searches for a user ID and an AT MAC address that can be used by the user in the AT MAC database 142 managed for terminal authentication (S424). At this time, if there is no AT MAC address corresponding to the user ID in the AT MAC database 142, the terminal authentication is considered to be failed (S426). If the terminal authentication fails, subsequent user authentication processing is not performed.

In addition, when the terminal authentication fails, the AAA server 140 loads the terminal authentication result in a diameter response (Diameter-EAP-Answer, hereinafter referred to as 'DEA') message to the PAR 130 (S428), and the PAR 130. ) Transmits the terminal authentication result in the ADTcmd message to the AP 120 (S430). The AP 120 loads the terminal authentication result in the EAP-Transfer-Reply message and transmits the result to the AT 110 (S432). Specifically, the AAA server 140 may transmit to the PAR 130 as DIAMETER_AUTHENTICATION_REJECTED in the Result-Code AVP of the DEA message (S428), and the PAR 130 may send FAIL and AUTHENTICATION_REJECTED to the resultcode parameter and reasoncode parameter of the ADTcmd message, respectively. A value may be set and transmitted to the AP 120 (S430). In addition, the AP 120 may set a FAIL value in the EAP Result Code of the EAP-Transfer-Reply message and transmit the same to the AT 110 (S432).

On the other hand, if there is an AT MAC address corresponding to the user ID in the AT MAC address database 142, the terminal authentication is considered to be successful (S426). If the terminal authentication is successful, the AAA server 140 for the user authentication EAP EAP authentication is performed according to Payload AVP (S434). According to an embodiment of the present invention, user authentication is performed by using an EAP-TLS (Extensible Authentication Protocol-Transport Level Security) protocol among various protocols that can be used in the EAP framework. In the authentication system using EAP-TLS, user authentication is performed using a Certificate Authority (CA) certificate that issued the user's certificate. At this time, a plurality of EAP-Transfer-Request / Reply MAC messages, ADTcmd messages, and DER / DEA messages are exchanged for user authentication between the AT 110, the AP 120, the PAR 130, and the AAA server 140. . In the present invention, since user authentication using the EAP-TLS protocol is well known, a detailed description thereof will be omitted.

Next, a terminal and user authentication process performed by the AAA server of the portable Internet system will be described in detail with reference to FIG. 5.

5 is a diagram illustrating a terminal and a user authentication operation of an AAA server in a portable Internet system according to an embodiment of the present invention. In the following description, it is assumed that the user ID and the MAC address are registered in the AT MAC database 142 managed by the AAA server 140.

As shown in FIG. 5, when the AAA server 140 receives the DER message from the PAR 130 (S500), the AAA server 140 analyzes whether the content in the EAP-Payload AVP of the DER message is an EAP Response / Identity message (S510). . In this case, in the case of the EAP Response / Identity message, the user ID and the AT MAC address are obtained from the User-Name AVP and the Calling-Station-Id AVP in the DER message (S520). Thereafter, the AAA server 140 searches whether the AT MAC address corresponding to the user ID exists in the AT MAC database 140 (S530). At this time, if the AT MAC address exists in the AT MAC database, the terminal authentication is successful, and then user authentication is performed (S540). On the other hand, if the AT MAC address does not exist in the AT MAC database, the terminal authentication has failed and generates and transmits a DEA message to notify the PAR 130 that it is an illegal terminal (S550).

On the other hand, if the contents of the EAP-Payload AVP of the DER message is not an EAP Response / Identity message, the user authentication is performed because the terminal authentication is successful and the EAP-TLS message for user authentication (S540).

The above embodiments are intended to illustrate the present invention, the scope of the present invention is not limited to the embodiments, it can be modified or modified by those skilled in the art within the scope of the invention defined by the appended claims.

According to the present invention, by authenticating a terminal upon user authentication based on an EAP framework in a portable Internet system, an attribute or AVP is applied to existing authentication protocols, such as RADIUS and Diameter. There is no need to add an Attribute-Value Pair). In addition, user and terminal authentication is performed based on the EAP framework to facilitate interworking between different service provider networks.

In addition, since the user authentication is performed after first confirming whether the terminal is a legitimate terminal, authentication processing time due to an illegal terminal can be reduced.

Claims (15)

A method for authenticating a terminal wirelessly connected to a base station by an authentication, authorization and accounting (AAA) server performing authentication in a portable internet system, a) an authentication request message for the terminal upon user authentication based on the Extensible Authentication Protocol (EAP) framework, where the authentication request message includes the terminal MAC (Medium Access Control) address and user identity; Receiving; b) obtaining a user ID of the terminal requested for authentication and a MAC address of the terminal from the terminal authentication request message; And c) performing terminal authentication by searching for the MAC address of the terminal corresponding to the user ID; Terminal authentication method in a portable Internet system comprising a. The method of claim 1, The authentication request message is a terminal authentication method in a mobile Internet system including an EAP payload in which a certificate based on EAP-TLS (Extensible Authentication Protocol-Transport Layer Security). The method of claim 2, The authentication request message, Diameter EAP message in which the MAC address of the terminal is replaced by Calling-Station-Id Attribute-Value Pair (AVP), the EAP payload is replaced by EAP-Payload AVP, and the user ID is replaced by User-ID AVP. Terminal authentication method in a portable Internet system. The method of claim 3, d) performing user authentication according to the EAP-Payload AVP upon terminal authentication success in step c); Terminal authentication method in a portable Internet system further comprising. The method according to any one of claims 1 to 4, The terminal authentication method in a portable Internet system that transmits the result to the terminal when the terminal authentication fails, and does not perform subsequent user authentication. The method of claim 5, The authentication request message is a terminal authentication method in a portable internet system transmitted through at least one of the RADIUS protocol or the DIAMETER protocol. Claims [1] A method for requesting authentication of a terminal wirelessly connected to a base station by an authentication, authorization and accounting (AAA) server in which a packet access router (PAR) performing a packet router function in a portable internet system performs authentication. a) the base station at the time of user authentication based on the Extensible Authentication Protocol (EAP) framework, wherein the base station receives and manages a medium access control (MAC) address of the terminal upon initial access of the radio link with the terminal; Receiving an authentication request message of the terminal via Yes; b) requesting and receiving a user ID of the terminal for which authentication is requested and authentication-related data of the terminal for which authentication is requested from the terminal through the base station; And c) requesting authentication of the terminal by transmitting the terminal's MAC address, user ID, and authentication related data to the AAA server through an authentication protocol; Terminal authentication method in a portable Internet system comprising a. The method of claim 7, wherein In step c), The terminal authentication method in the mobile Internet system in which the MAC address of the terminal is replaced with Calling-Station-Id AVP, the authentication related data is replaced with EAP-Payload AVP, and the user ID is replaced with User-ID AVP. . The method of claim 8, The EAP-Payload AVP terminal authentication method in a portable Internet system that includes EAP-TLS-based user authentication-related data. The method of claim 9, The authentication protocol is at least one of a RADIUS protocol or a DIAMETER protocol. The method according to any one of claims 7 to 10, Terminal authentication in a mobile Internet system performing initial access of the radio link through a MAC message between the terminal and the base station and transmitting the terminal MAC address in a message requesting ranging by the terminal to the base station. Way. The method of claim 11, Communicating through the authentication message for the EAP-based terminal authentication between the base station and the PAR, The terminal authentication method in a portable Internet system for transmitting the MAC address of the terminal in the first authentication message transmitted by the base station to the PAR. The method of claim 12, The terminal authentication method in a portable Internet system for transmitting the user ID in the EAP payload of the authentication message when the user ID request from the PAR. The method of claim 12, Negotiate basic capabilities for setting an authentication mode upon initial access of the wireless link, Terminal authentication method in a portable Internet system that includes the authentication-related data of the authentication mode set in the EAP payload of the authentication message. The method of claim 14, The authentication-related data is a terminal authentication method in a portable Internet system is a certificate based on EAP-TLS (Extensible Authentication Protocol-Transport Layer Security).

Images