KR20070003306A - Authentication failure management method in positioning system - Google Patents

Abstract

An authentication failure handling method in a position tracking system is provided to be capable of notifying the other party of an authentication failure when authentication between a terminal and a server fails during position tracking, thus a position tracking procedure is carried out through a safer authentication mechanism. An SUPL(Secure User Plane Location) agent(100) transmits an MLP SLIR(Mobile Location Protocol Standard Location Immediate Request) message to an SLP(SUPL Location Platform)(200)(S100). The SLP(200) verifies whether a target SET(SUPL Enabled Terminal)(300) supports an SUPL protocol(S110), and transmits an SUPL initialization message to the target SET(300)(S120). The target SET(300) conducts notification by using a 'Notification' field of the SUPL initiation message(S130). When authentication fails(S150), the SLP(200) transmits an SUPL end message to the target SET(300), and sends an MLP SLIA message which includes information on positioning failure to the agent(100)(S160).

Description

How to handle authentication failures in location tracking systems {AUTHENTICATION FAILURE MANAGEMENT METHOD IN POSITIONING SYSTEM}

1 is a view showing a first embodiment of an authentication failure processing method in a location tracking system according to the present invention;

2 is a view showing a second embodiment of an authentication failure processing method in a location tracking system according to the present invention;

3 is a diagram illustrating an embodiment of an initialization message transmitted from a server to a specific terminal when the network of the present invention starts.

4 illustrates an embodiment of a location tracking initialization message according to the present invention.

5A is a diagram illustrating an embodiment of a termination message according to the present invention;

5B is a diagram for explaining the type of status code of an end message according to the present invention;

* Explanation of symbols for main parts of the drawings

10, 100: SUPL Agent 20, 200: SLP

21, 210: SLC 22, 220: SPC

30, 300: Purpose SET

The present invention relates to a location tracking system of mobile communication, and more particularly, a specific terminal for providing location information in a location information system to which a user-based protocol is applied, and a server which is a network element for location tracking of the specific terminal is used for authentication. The present invention relates to a method for handling authentication failure in a location tracking system, which is a procedure to be performed in case of failure.

The mobile communication system provides a location based service (LSB) that locates and uses a terminal based on a mobile communication network. For example, a service for tracking the location of a person or thing such as a friend finder, vehicle navigation, and emergency rescue are typical examples of the location information service.

Currently, the mobile communication system provides the above location information service through a control plane of a network. However, services provided through such a control plane (Signal) for positioning (Signaling) and positioning according to the network structure, such as 3GPP (3rd Generation Partnership Project), 3GPP2 (3GPP2) The structure of the location tracking system will be different.

Therefore, in order to update a service or introduce a new location tracking method into the network, network elements that must be changed according to the change of the control plane, such as signaling and protocol of the control plane, can be changed. There was a problem of updating all or introducing new ones.

In order to solve the above problem, a user-based protocol for providing a location information service in a user plane has been defined.

Since the user-based protocol transmits information necessary for positioning using a user plane, the user-based protocol is independent of the network structure and configures a location tracking system even if a service is updated or a new location tracking method is introduced. The advantage is that all network elements do not have to be updated.

However, when authentication fails in the location tracking system to which the user-based protocol is applied, a preferable method for dealing with this is not suggested, which is a problem in performing the location tracking procedure.

The present invention has been made to solve the above problems, and an object of the present invention is to provide an authentication failure processing method and a more efficient location tracking system in a location tracking system.

In order to achieve the above object, the present invention provides a method for processing an authentication failure of a specific terminal receiving location tracking, the method comprising: receiving an initialization message for a location tracking service, performing authentication of the initialization message, and performing the authentication; As a result of the execution, when the authentication fails, providing an authentication failure processing method in a location tracking system comprising the step of transmitting an authentication failure message.

In addition, the present invention provides a method for processing an authentication failure in a server for location tracking of a specific terminal, the method comprising: transmitting an initialization message for a location tracking service; receiving an authentication success message from the specific terminal; And a step of performing an authentication of the message, and transmitting an authentication failure message when the authentication fails as a result of the authentication.

The present invention also provides a first terminal for requesting location tracking, a server for transmitting the initialization message to the second terminal receiving the location tracking request, and performing authentication of the initialization message, thereby failing authentication. In this case, it provides a location tracking system comprising a second terminal for transmitting an authentication failure message.

Therefore, according to the present invention, it is possible to stop the location tracking procedure when authentication fails while performing the location tracking procedure by providing a more secure authentication mechanism when performing location tracking in the location tracking system.

Hereinafter, with reference to the accompanying drawings, preferred embodiments of the present invention that can be specifically realized for the above purpose.

In addition, the terms used in the present invention was selected as a general term widely used as possible now, but in some cases, the term is arbitrarily selected by the applicant, in which case the meaning is described in detail in the description of the invention, It is to be understood that the present invention should be understood as the meaning of terms rather than the names of terms.

In this regard, in the present invention, "protocol" means a communication protocol, and "user-based protocol" means a protocol for providing location information service in a user plane.

In the present invention, as a user-based protocol, SUPL (Secure User Plane Location: hereinafter called 'SUPL') protocol is described as an example, but the technical concept of the present invention is not limited to the SUPL protocol.

In this regard, in the present invention, the term "terminal" means a point indicating a point at which information is inputted or outputted in a communication network, or means a device for making or viewing data in a digital data transmission system or a device for transmitting or receiving data. do.

Hereinafter, the present invention will be described by using a SET (SUPL Enabled Terminal: hereinafter referred to as 'SET') as a terminal for convenience of description, and defines a terminal requesting location tracking as a SUPL agent, and becomes a location tracking target. The terminal is defined as an objective SET (Target SEPL Enabled Terminal: hereinafter referred to as 'target SET'), but the technical concept of the present invention is obviously applicable to other terminals as well.

For example, a terminal requesting location tracking may be defined as a first terminal, and a terminal receiving location tracking as a location tracking target may be defined as a second terminal.

In relation to the present invention, the term "server" refers to an apparatus or program for operating a management software for controlling access to all or part of a communication network and access to resources of the communication network to another terminal or the like on a communication network. do.

In addition, the server (Server) is configured to include a "location calculation unit" for calculating the position of a specific terminal and a "server manager" for overall protocol management in the server.

In particular, SLP (SUPL Location Platform: SLP) as an embodiment of the server in relation to the present invention, SPC (SUPL Position Center: SPC) as the embodiment of the position calculation unit, As an example of the server management unit, an SLC (SUPL Location Center: hereinafter referred to as 'SLC') will be described as an example, but it is obvious that the present invention can be equally applicable to other servers.

In this context, in the present invention, "message" means a unit configured according to a strict rule as one transmission unit and transmitted according to a protocol that is a constant rule between a transmitting device and a receiving device.

In the present invention, "initialization message" refers to a message that is first transmitted from the server to the terminal when the network starts, "location tracking initialization message" refers to a message to be sent to start the location tracking, "location tracking message" The message includes information for location tracking, and the "end message" refers to a message indicating the completion of a specific process.

In addition, in the present invention, the "authentication failure message" is a message including authentication failure information when authentication fails as a result of performing authentication, and "authentication success message" is a successful authentication when authentication is successful as a result of authentication. Refers to a message containing information.

In particular, in the context of the present invention, a SUPL INIT message as the initialization message, a SUPL POS INIT message as the location tracking initialization message, a SUPL POS message as the location tracking message, and a SUPL END message as the end message. It is apparent that the present invention is not limited to the above embodiments but can be applied to other messages having the same technical spirit.

1 is a view showing a first embodiment of an authentication failure processing method in a location tracking system according to the present invention, in particular, authentication of a SUPL INIT message that is an initialization message in a target SET (Target SET) which is a terminal for providing location information. FIG. 1 illustrates an example of an authentication failure.

Referring to FIG. 1, the location tracking system may include a target SET 30, an SLP 20, and a SUPL agent 10.

The objective SET 30 is a terminal capable of communicating with the SUPL network using the SUPL protocol, and means the terminal receiving the location tracking in the present invention. For example, a user terminal (UMTS) of a Universal Mobile Telecommunication System (UMTS), a Global System for Mobile Communication (GSM) and a Mobile Station (MS) of an IS-95, or a notebook and a personal digital assistant supporting the SUPL protocol. ), Etc.

In addition, when the target SET 30 has received a confirmation request for location tracking, but the SET user cannot directly allow or deny the target SET 30, the target SET 30 requests confirmation on behalf of the SET user. You can also perform a response to.

In addition, in the present invention, the objective SET 30 may perform a function of transmitting an authentication failure message, which is a message including failure information, to the SLP 20 by performing authentication on location tracking.

The SLP 20 is a server that is a network element that accesses and uses a network resource for location tracking of the target SET 30. The SLP 20 represents a service access point (SUPL SAP) of a network part and is a specific terminal. It is preferable to include the SPC 22 which is an entity which calculates the position information of the objective SET 30, and the SLC 21 which is an entity which manages the overall SUPL protocol.

In relation to this, the destination SET 30 may calculate location information by communicating with the SPC 22 through the SLC 21, which is called a proxy mode, and the destination SET 30 is referred to as a proxy mode. The case where) calculates location information by directly communicating with the SPC 22 is referred to as non-proxy mode.

In the present invention, the case where the SLC 21 is in the proxy mode will be described as an example, but it is obvious that the SLC 21 can be applied even when the non-proxy mode is in the non-proxy mode. .

In addition, in the present invention, the SLP 20 performs the authentication when the destination SET 30 transmits an authentication success message, which is a message including information indicating that authentication is successful by performing authentication. When the SLP 20 fails to authenticate, the SLP 20 performs authentication to transmit an authentication failure message, which is a message including the failed information, to the destination SET 30 in detail with reference to FIG. 2. Explain.

The SUPL Agent 10 requests the SLP 20 for a location tracking service of the target SET 30, which is a specific terminal, and provides a logical Service Access Point (SAP) using the location information transmitted from the SLP 20. It means to indicate.

In this case, the SUPL Agent 10 is a terminal capable of communicating with the SUPL network using the SUPL protocol, such as the destination SET 30. For example, the SUPL Agent 10 may include a user terminal (UE) of a Universal Mobile Telecommunication System (UMTS), Obviously, it could be Global System for Mobile Communication (GSM) and Mobile Station (MS) in IS-95, or notebooks and Personal Digital Assistants (PDAs) that support the SUPL protocol.

Hereinafter, an authentication failure processing method will be described in a location tracking system according to the present invention.

First, the SUPL Agent 10 is a MLP SLIR (Mobile Location Protocol Standard Location Immediate Request), which is a message for requesting location tracking to the SLP 20 to request location information of the target SET 30 that wants to know location information. 'MLP SLIR') is transmitted (S10).

The SLP 20 receiving the MLP SLIR message checks the roaming state of the destination SET 30 and whether the destination SET 30 supports the SUPL protocol (S20).

In this regard, it is a matter of course that the present invention is applicable to a case where a SET, which is a terminal, is initialized regardless of roaming. That is, the present invention is applicable regardless of whether the terminal is in a roaming state or not in a roaming state. However, in the roaming state, it is preferable to further include the step of checking roaming.

The SLP 20 transmits a SUPL INIT message, which is an initialization message, to the destination SET 30 to start the location SET service with the destination SET 30 (S30). The SUPL INIT message is preferably configured to include a "Message Authentication Code (MCA)" field and a "Key Identity" field, which are fields that allow the destination SET 30 to authenticate the SUPL INIT message.

A detailed description of the SUPL INIT message will be described later with reference to FIG. 3.

In addition, the target SET 30 receiving the SUPL INIT message establishes a connection to the SLP 20 and the mobile communication network to enable data communication in order to start a session of the SUPL protocol (S40).

Then, the objective SET 30 performs authentication of the SUPL INIT message using the "Message Authentication Code (MCA)" field and the "Key Identity" field of the received SUPL INIT message. 30) The authentication of the SUPL INIT message fails (S50).

In this regard, the present invention transmits an authentication failure message when authentication fails. In this embodiment, although the SUPL END message is used as the authentication failure message, it is natural that another message may be used as the authentication failure message.

If the authentication succeeds without failing to authenticate the SUPL INIT message in step S50, the SLP 20 also undergoes a procedure for performing authentication in the SLP 20, which is a server described with reference to FIG. In the case of authentication, the objective SET 30 transmits an authentication success message. In this embodiment, a SUPL POS INIT message or a SUPL END message is used as the authentication success message. However, another message may be used as an authentication success message. Of course.

Since authentication has failed in step S50, the objective SET 30 transmits a SUPL END message including a "Status Code" field indicating a status code as an authentication failure message to the SLP 20, and then the SLP. Release the connection with the (20), and releases all network resources associated with the SLP (20) session (S60).

In this regard, the SLP 20 receiving the SUPL END message from the destination SET 30 indicating that authentication has failed, sends the SUPL INIT message back to the destination SET 30 to restart the location service, or the SUPL Agent ( 10) may send an MLP SLIR message containing information that the location tracking failed.

The SUPL END message which is the end message will be described later with reference to FIGS. 5A and 5B.

2 is a view showing a second embodiment of the authentication failure processing method in the location tracking system according to the present invention, in particular, the authentication of the SUPL INIT message in the target SET (Target SET) which is a specific terminal for providing location information In this case, the SLP serving as the server fails to authenticate the SUPL INIT message.

The location tracking system of FIG. 2 may be configured to include an objective SET 300, an SLP 200, and a SUPL Agent 100, as shown in FIG. 1, wherein the SLP 200 includes an SLC 210 and an SPC 220. It is configured to include).

A detailed description thereof has been described with reference to FIG. 1, which is omitted herein.

The invention described in FIG. 2 succeeds in authenticating the SUPL INIT message received by the destination SET 300 from the SLP 200 when the SLP 200 operates in the proxy mode assumed in the present invention. In this case, the destination SET 300 transmits a SUPL POS INIT message including a "Ver" field, which is a hash value of a SUPL INIT message, to the SLP 200 and receives the SPL 200 message. ) Shows the case where authentication of SUPL INIT message fails. Hereinafter, each step will be examined.

First, the SUPL Agent 100 transmits an MLP SLIR message to the SLP 200 to request the location information of the destination SET 300 that wants to know the location information (S100).

The SLP 200 receiving the MLP SLIR message checks the roaming state of the destination SET 300 and whether the destination SET 30 supports the SUPL protocol (S110).

In this regard, it is a matter of course that the present invention is applicable to a case where a SET, which is a terminal, is initialized regardless of roaming. That is, the present invention is applicable regardless of whether the terminal is in a roaming state or not in a roaming state.

Upon receiving the MLP SLIR message, the SLP 200 transmits a SUPL INIT message, which is an initialization message, to the destination SET 300 to start location tracking service with the destination SET 300 (S120).

The SUPL INIT message is preferably configured to include a "Message Authentication Code (MCA)" field and a "Key Identity" field, which are fields that allow the destination SET 300 to authenticate the SUPL INIT message.

A detailed description of the SUPL INIT message will be described later with reference to FIG. 3.

Receiving the SUPL INIT message sent by the SLP 200, the destination SET 300 establishes a connection with the SLP 200 to the mobile communication network to enable data communication to start a session of the SUPL protocol.

In addition, the destination SET 300 receiving the SUPL INIT message performs authentication using the "MAC" field and the "Key Identity" field of the SUPL INIT message.

As a result of performing the authentication, the target SET 300 which successfully authenticates the SUPL INIT message uses the "SLP Mode" field of the SUPL INIT message, so that the SLP 200 may be configured in a proxy mode and a non-proxy mode ( Non-Proxy mode) is determined in which mode, and using the "Notification" field of the SUPL INIT message (Notification) is performed (S130).

In the present invention, since the SLP 200 operates in the proxy mode, the example is described. Therefore, when the SLP 200 operates in the proxy mode, the target SET 300 tracks the location. In order to start the SUPL POS INIT message is a location initialization initialization message to the SLP (200).

The SUPL POS INIT message is a field including information on a hash value of the SUPL INIT message so that the SLP 200 can authenticate whether the SUPL INIT message has been correctly received by the destination SET 300 for which position tracking is desired. It is preferable to include the "Ver" field. The SUPL POS INIT message will be described later in detail with reference to FIG. 4.

The SLP 200 receives a SUPL POS INIT message including a “Ver” field, which is a field including information on a hash value of a SUPL INIT message, from the destination SET 300, and receives a message about the SUPL INIT message. By performing authentication, the authentication for the SUPL INIT message fails (S150).

On the contrary, if the SLP 200 succeeds in authenticating the SUPL INIT message, the SLP 200 performs a location tracking procedure with the destination SET 300. In this case, it is preferable to perform a location tracking procedure by transmitting and receiving a location tracking message SUPL POS message, the end message SUPL END message.

Since the authentication failed in step S150, the SLP 200 displays a SUPL END message including a "Status Code" field indicating a status code having a "initAuthFailure" field, which is a field including information on authentication failure. The target SET 300 is transmitted, and the MLP SLIA message including the information on the location tracking failure is transmitted to the SUPL Agent 100 (S160).

Upon receiving the SUPL END message including the acknowledgment failure information, the destination SET 300 disconnects from the SLP 200 and releases resources such as all networks related to the SUPL session.

According to the present invention through the above method in the case where the authentication procedure between the target SET 300 and the SLP 200 in the SUPL-based location information system has failed, inform the other party about the authentication failure, It suggests ways in which processing can be performed.

Hereinafter, embodiments of the SUPL INIT message as the initialization message, the SUPL POS INIT message as the location tracking initialization message, and the SUPL END message as the end message will be described with reference to FIGS. 3 to 5B.

3 is a diagram illustrating an embodiment of an initialization message transmitted from a server to a specific terminal when the network of the present invention is started, and in particular, illustrates an embodiment of a SUPL INIT message, which is a message transmitted from an SLP to a target SET. to be.

The SUPL INIT message includes a "Positioning Method" field indicating supported positioning technologies, a "Notification" field providing the SET with information regarding LCS notification and privacy, and an SLP. An "SLP Address" field containing an Address, a "QoP" field indicating the Quality of Position, and an SLP mode in Proxy Mode or Non-Proxy Mode. "MAC" including an "SLP Mode" field indicating whether or not a mode, and a message authentication code (MAC), which is used for integrity protection of SUPL INIT messages. Field and a " Key Identity " field indicating identity information for a key used to identify the MAC.

In this regard, the "Notification" field indicates a notification and verification mechanism, where the "Notification type" includes a "No notification and no verification" type that does not require notification and verification. "Notification only" type that requires only notification without SET confirmation, "Notification and Verification" type that requires both notification and confirmation, and "Privacy", which ignores both notification and confirmation in an emergency and starts location tracking. override "type.

4 is a view showing an embodiment of a location initialization initialization message according to the present invention, in particular a view showing an embodiment of a SUPL POS INIT message.

In this case, the SUPL POS INIT message is used as an example of an authentication success message transmitted to an SLP which is a server when an object SET which is a specific terminal succeeds in authentication.

The SUPL POS INIT message includes a "SET Capabilities" field containing information indicating the capabilities of the SET and a "Requested Assistance Data" field containing information indicating the required global positioning system assistance data. And a "Location ID" field containing information indicating the cell information of the SET, a "Position" field containing information indicating the position of the SET, and a positioning protocol payload. ) And a "Ver" field containing information indicating a hash value of the SUPL INIT message.

FIG. 5A is a diagram illustrating an embodiment of an end message according to the present invention. In particular, FIG.

At this time, the SUPL END message is a message indicating the end of the SUPL process normally or abnormally.

The SUPL END message includes a "Position" field including information indicating a position result of a SET, and information indicating a status of the message as an error indication or information indication. It is preferably configured to include a "Status Code" field.

In this regard, error indications have values between 0 and 99, and information indications have values between 100 and 199.

FIG. 5B is a diagram illustrating a type of a status code of an end message according to an embodiment of the present invention. In particular, an embodiment of a type of "Status Code" in a SUPL END message is described in detail.

In particular, in the context of the present invention, a status code type "Status Code" may include "initAuthFailure" including information indicating authentication failure when authentication fails in a SET or SLP.

Hereinafter, the type of "Status Code" will be described in detail. The "Error Code" is divided into "Error Indicators" for displaying errors and "Information Indicators" for displaying information.

The "Error Indicator" indicates "unspecified" representing unknown errors, "systemFailure" representing system failure, "protocolError" representing protocol parsing error, and a case in which required data values are missed. Described by "dataMissing", "unexpectedDataValue" to indicate that a data value is not required, "posMethodFailure" to indicate that the underlying location method failed and returned, and required QoP and SET Capabilities and SLP. "PosMethodMismatch", which indicates a case in which no matching Positioning method can be found, and a Positioning protocol available for SET and SLP cannot be found. "PosProtocolMismatch" to indicate "set", "targetSETnotReachable" to indicate when the SET is not responding, and invalid ULP (User "VersionNotSupported" to indicate the Plane Location Protocol version, "resourceShortage" to indicate that there are not enough resources available to serve the SET, and "invalidSessionId" to indicate the Invalid session identity. It is preferably configured to include.

The " Information Indicator " means " consentDeniedByUser " where the user refuses to approve a location determination session, " consentGrantedByUser " which allows the user to approve a location determination session, and SET. "NonProxyModeNotSupported" to indicate no support for non-proxy mode operation, "proxyModeNotSupported" to indicate that the SET does not support proxy mode operation, and a case where authentication fails on the SET or SLP. It is preferably configured to include "initAuthFailure".

In this regard, "initAuthFailure" indicating an authentication failure in the SET or SLP may be divided into "initAuthFailureatSET" indicating an authentication failure in the SET and "initAuthFailureatSLP" indicating an authentication failure in the SLP.

As described above, in the present invention, when authentication between the terminal SET and the server SLP fails when the location tracking using the SUPL protocol, which is a user-based protocol, fails, a method for notifying the other party of the authentication failure, and authentication failure It provides a more secure authentication mechanism by providing a method of handling when a message indicating a message is received.

The present invention is not limited to the above-described embodiments, and as can be seen in the appended claims, modifications can be made by those skilled in the art to which the invention pertains, and such modifications are within the scope of the present invention.

The effect of the authentication failure processing method in the location tracking system according to the present invention described above is to provide a more secure authentication mechanism when performing location tracking in the location tracking system to perform the location tracking procedure.

Claims (13)

In the authentication failure processing method of a specific terminal receiving the location tracking, Receiving an initialization message for the location service; Performing authentication of the initialization message; And transmitting an authentication failure message when the authentication fails as a result of performing the authentication. The method of claim 1, And re-receiving an initialization message for restarting the location service. In the authentication failure processing method in the server for location tracking of a specific terminal, Transmitting an initialization message for location services; Receiving an authentication success message from the specific terminal; Performing authentication of the initialization message; And transmitting an authentication failure message when the authentication fails as a result of performing the authentication. The method of claim 3, wherein The method for processing authentication failure in a location tracking system, characterized in that further comprising the step of confirming whether or not the user-based protocol support of the specific terminal. The method of claim 3, wherein The authentication success message authentication failure processing method in the location tracking system, characterized in that it comprises information about the authentication success in a specific terminal. The method of claim 3, wherein And transmitting a message including location tracking failure information to a predetermined terminal requesting location tracking when authentication fails. The method according to claim 1 or 3, And the initialization message comprises a field including information for authentication of the message. The method of claim 3, wherein The authentication success message authentication failure processing method in the location tracking system, characterized in that having a hash (Hash) value information of the initialization message. A first terminal for requesting location tracking; A server for receiving the location tracking request and sending an initialization message to a second terminal to be tracked; And a second terminal configured to perform authentication of the initialization message and to transmit an authentication failure message when authentication fails. The method of claim 9, And when the server receives the authentication success message from the second terminal, performs an authentication of the initialization message, and transmits an authentication failure message when authentication of the initialization message fails. The method of claim 9, The first terminal and the second terminal is a location tracking system, characterized in that the communication with the network using a user-based protocol. The method of claim 11, The user-based protocol is a location tracking system, characterized in that the SUPL (Secure User Plane Location) protocol. The method of claim 9, The server comprises a location calculation unit for calculating the location information and a server management unit for managing the protocol comprising a.

Images