KR20070014350A - Authentification method in the push proxy gateway and the contents provider server - Google Patents

Abstract

An authentication method in a push proxy gateway and a content provider server is provided to enable a receiver to have a reliable push service by performing authentication between the push proxy gateway and the content provider server. An authentication method in a push proxy gateway and a content provider server includes the steps of: at the content provider server, checking an IP address of the content provider server with an extracted IP address by extracting the IP address mounted on an agent if the agent receives a performance request signal(S30); performing on the content provider server if the extracted IP address is the same with the IP address of the content provider IP address by the agent(S50); at the push proxy gateway, checking whether the IP address of the content provider server is registered previously or not if a connection request is received from the content provider server(S80); transmitting a connection response to the content provider server if the IP address of the content provider is registered previously(S110); decoding a coded ID/authentication key which is inserted into a push message if a push message transmission request is received from the content provider server according to a transmission result of the connection response, and checking registration of the decoded ID/authentication key(S160); and processing the push message transmission request from the content provider server if the decoded ID/authentication key is registered(S180).

Description

Authentication method in the Push Proxy Gateway and the Contents Provider Server}

1 is a configuration diagram of an embodiment of a mobile communication network to which the present invention is applied.

2 is a flow chart of an embodiment of an authentication method in a push proxy gateway and a content providing server according to the present invention.

* Description of symbols on the main parts of the drawings *

40: Short Message Service Center (SMSC)

60: Push Proxy Gateway (PPG)

70: content server (CP server)

The present invention relates to an authentication method in a push proxy gateway and a content providing server. More specifically, the content providing server matches an IP address mounted in an agent when the agent is provided from a push proxy gateway and a content providing server IP address. When the connection request is received from the content providing server, the push proxy gateway checks whether the content providing server IP address is a registered IP address to authenticate the valid content providing server, and pushes it. The proxy gateway relates to a method of authenticating whether the ID / authentication key in the push message received from the content providing server is a valid content providing server by checking whether the ID / authentication key is a registered ID / authentication key.

In general, a push proxy gateway (PPG) is a content provider server without a user's request, unlike a full service (WAP) of wireless application protocol (WAP) performed by an existing terminal user request. It provides a variety of information received from the server) to the mobile communication terminal in a push method.

The push proxy gateway is a gateway that transmits a push message received from a content providing server through a wired network to a mobile communication terminal through a wireless network, and performs message processing tasks such as protocol conversion, content encoding, and push message delivery.

For example, a content providing server providing stock information, weather information, news, and the like among real-time data services generates various types of information in a push message and transmits the information to a push proxy gateway. Accordingly, the push proxy gateway converts the push message received from the content providing server into a message (eg, short message, callback URL short message, etc.) suitable for the mobile communication network and transmits the message to the mobile communication terminal.

The push proxy gateway and the content providing server access / push each other using protocols such as Push Access Protocol (PAP), Simple Push Access Protocol (SPAP), Simple Generalized Interface Protocol (SGIP), and Generalized Interface Protocol v.2 (GIP2). Send and receive messages. Hereinafter, the protocol will be described using SGIP as an example.

SGIP, mentioned above, is a protocol that transforms GIP (Generalized Interface Protocol), which was provided for short message service, into a simple text-based standard. Through the SGIP, a short message can be serviced by simply and easily interworking with a short message service server (SMSS). The SGIP only needs to describe the defined header and paste the content with the separator.

However, in the related art, when the content providing server transmits a push message in accordance with the SGIP standard and the push proxy gateway as described above, when the message is transmitted from the content providing server to the mobile communication terminal, the push proxy gateway receives the push message received from the content providing server. Process all and deliver to the mobile communication terminal.

In other words, authentication protocols are not defined in the above protocols such as PAP, SPAP, SGIP, GIP2, and so on. If the message specification and the communication protocol match only without the authentication procedure between the push proxy gateway and the content providing server, the push message is processed. Done. As a result, the push proxy gateway may cause a system overload due to the processing of push messages received from an illegal content providing server, and in particular, the mobile terminal receives all push messages from the negative content providing server so that the recipient does not want the message or spam. You will receive an email.

The spam or message described above not only inconveniences the user to check and delete unsolicited messages, but also allows the user to access a URL via short message when a spam or message in the form of a callback URL service is received. There is this. Therefore, the user may have an unreasonable fee due to unwanted internet access, or if the user is a minor, the user may easily access contents requiring adult authentication.

The present invention has been proposed to solve the above problems and to meet the above requirements, and the content providing server matches the IP address mounted on the agent and the content providing server IP address when executing the agent provided from the push proxy gateway. When the connection request is received from the content providing server, the push proxy gateway checks whether the content providing server IP address is a registered IP address to authenticate the valid content providing server, and pushes it. The proxy gateway has a purpose of providing a method of authenticating whether the ID / authentication key in the push message received from the content providing server is a valid content providing server by checking whether the ID / authentication key is a registered ID / authentication key.

The present invention for achieving the above object, between the content providing server for providing a push message to the mobile communication terminal and the push proxy gateway through mutual authentication / access / push message transmission and reception through an agent installed in the content providing server, the content provided In the server, when the agent receives the execution request signal, the first step of extracting the IP address pre-loaded on the agent and checks whether it matches the content providing server IP address; And a second step of executing, by the agent, on the content providing server when the IP address extracted from the inspection result and the content providing server IP address match. In the push proxy gateway, content is provided when the access request is received from the content providing server. A first step of checking whether a server IP address is already registered; A second step of transmitting a connection response to the content providing server if a content providing server IP address is already registered as a result of the IP address checking; Receiving a push message transmission request from a content providing server as a result of the connection response, decrypting an encrypted ID / authentication key inserted into the push message and checking whether the decrypted ID / authentication key is already registered; step; And a fourth step of processing a push message transmission request from the content providing server when the ID / authentication key decrypted as a result of the ID / authentication key check is pre-registered.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted if it is determined that the detailed description of the present invention may unnecessarily obscure the subject matter of the present invention. Terms to be described later are terms defined in consideration of functions in the present invention, and may be changed according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the specification.

1 is a configuration diagram of an embodiment of a mobile communication network to which the present invention is applied.

As shown in FIG. 1, the mobile communication network includes a mobile station (MS) 10, a base station / base station controller (BS / BSC) 20, and a mobile switching center (MSC). (30), Short Message Service Center (SMSC) 40, Packet Data Serving Node (PDSN) 50, Push Proxy Gateway (PPG) 60, A content provider server (CP) 70 is included.

The push proxy gateway 60 receives a stock information service, a weather information service, data about news, and the like from the content providing server 70 in a push message through the Internet. The push message may include an SGIP message, a PAP message, a GIP message, and the like. Hereinafter, the present invention will be described using an SGIP message as an example.

When the push proxy gateway 60 receives the SGIP message from the content providing server 70, the push proxy gateway 60 converts the SGIP message into a short message suitable for a mobile communication network using a well-known message conversion rule, and then through the short message service center 40. Transmit to mobile communication terminal 10.

The proxy gateway 60 is composed of a push management server (PMS) that handles push service requests and a push data server (PDS) that manages push data information. Detailed description of the gateway will be omitted.

The content providing server 70 may be a sole proprietor, or may be a company or an organization. Real-time news or events and weather forecasts, such as SGIP messages are made and sent to the push proxy gateway 60.

In the present invention, in order to send a push message to the push proxy gateway 60, the content providing server 70 must have a business agreement regarding a push message service with the push proxy gateway 60. This business agreement is made by a content providing server representative receiving a request for using a push proxy gateway from a push proxy gateway representative by e-mail, fax, or in person.

In particular, in the present invention, the content providing server 70 uses an agent program distributed from the push proxy gateway 60 to send a push message to the push proxy gateway 60. This agent program is used when authenticating the content providing server 70, the content providing server 70 connects to the push proxy gateway 60, and transmits the SGIP message. The agent is an application used when the content providing server 70 sends an SGIP message to the push proxy gateway 60.

The agent is equipped with an ID / authentication key given from a push proxy gateway manager, and in particular, a hash value for a content providing server IP address is mounted. Here, the ID / authentication key and the hash value for the content providing server IP address are parameters used to authenticate whether the content providing server is a legitimate push message service user in the content providing server 70 and the push proxy gateway.

These agents are generated by the service representatives at the push proxy gateway 60 and distributed to the content providing server 70. The agents are provided with a hash value for the content providing server IP address (at least one IP address list) mounted on the agent. Depending on whether the person in charge makes it, it consists of two tasks: This will be described in detail as follows.

First, the push proxy gateway manager who receives the content providing server IP address and the use request from the content providing server manager creates a hash value by inputting the content providing server IP address as an input value using the script program IP_check.sh. Then, the push proxy gateway manager creates an agent when a hash value is generated, and mounts the hash value on the agent. In addition, the push proxy gateway manager assigns an ID / authentication key to the content providing server and mounts the ID / authentication key on the agent. In addition, the ID / authentication key may be notified to the contents providing server manager without being mounted on the agent, and the contents providing server representative may later input the ID / authentication key to the agent.

Then, the push proxy gateway agent sends the ID, the authentication key, and the agent to the content providing server manager through mail and distributes the agent. The agent creation operation provides the IP address to the Push Proxy Gateway representative by the Content Provision Server Representative, and the Content Provision Server IP address received from the Content Provision Server Representative with the ID / authentication key as a hash value. Make it and mount it on the agent.

Secondly, the content provision server representative only accepts a usage request without providing the content provision server IP address to receive the push service. Therefore, the push proxy gateway manager sends the IP_check.sh program that can create a hash value for the IP address to the content providing server manager through mail, and sends the hash value by making the content providing server IP address a hash value. Require. Accordingly, the content providing server manager uses the IP_check.sh program to generate a hash value by inputting the content providing server IP address as an input value. Then, the content providing server representative sends this hash value to the push proxy gateway representative via mail or the like.

The push proxy gateway manager then mounts this hash value to the agent to create an agent for distribution to the content provision server manager. Meanwhile, the person in charge of the push proxy gateway assigns an ID / authentication key for the content providing server, and distributes the agent and the ID / authentication key to the content providing server representative through e-mail. The agent creation task is to push a hash value from the content providing server manager and mount it on the agent without directly creating a hash value for the content providing server IP address.

The agent provided to the content providing server by the above operation is given a hash value for the IP address, an ID / authentication key, and the content providing server manager installs the agent on the content providing server. In addition, the IP address, ID / authentication key, etc. assigned to the content providing server is registered in the database of the push proxy gateway.

Hereinafter, an authentication method in a push proxy gateway and a content providing server will be described in detail with reference to FIG. 2.

2 is a flowchart illustrating an authentication method in a push proxy gateway and a content providing server according to the present invention.

When the agent distributed from the push proxy gateway 60 is installed in the content providing server 70 by the agent creation / distribution operation described above, the agent in charge of the content providing server 70 sends an agent on the content providing server for SGIP message transmission. Request execution (S10).

Accordingly, in response to the execution request of the person in charge of the content providing server, the agent of the content providing server 70 extracts (decodes) the IP address encrypted with the hash value using the hash algorithm (S20).

Then, the agent of the content providing server 70 checks whether the extracted IP address and the content providing server IP address match each other (S30).

If the IP address check result (S30), the extracted IP address and the content providing server IP address does not match each other, the agent of the content providing server refuses to execute (S40). On the other hand, if the IP address check result (S30), the extracted IP address and the content providing server IP address match each other, the agent of the content providing server accepts the agent execution (S50). When the agent is executed on the content providing server 70 as described above, the agent of the content providing server 70 transmits a connection request to the push proxy gateway 60 through an HTTP socket method by a push proxy gateway access command of a content providing server manager. (S60).

Accordingly, when the push proxy gateway 60 receives the access request signal from the content providing server 70, the push proxy gateway 60 extracts the content providing server IP address from the access request signal (S70).

Then, the push proxy gateway 60 checks whether the extracted content providing server IP address is a previously registered IP address (S80). At this time, the push proxy gateway 60 extracts the content providing server IP address from the header of the packet data received from the content providing server 70 and checks whether it is registered in the database.

If the IP address check result (S80), the content providing server IP address is not registered in the database, the push proxy gateway 60 rejects the access of the content providing server 70 (S90). On the other hand, if the IP address check result (S80), the content providing server IP address is registered in the database, the push proxy gateway 60 accepts the content providing server connection (S100).

Then, the push proxy gateway 60 transmits the content providing server IP address authentication success and access response signal to the content providing server 70 when the content providing server IP address authentication succeeds (S110). Accordingly, the content providing server 70 recognizes that the access proxy is normally connected to the push proxy gateway 60 in response to receiving the access response signal, thereby generating and transmitting an SGIP message.

That is, the agent of the content providing server 70 encrypts the ID / authentication key using a token (a unit that can be distinguished from a string of characters) (S120). Then, the agent of the content providing server 70 generates the SGIP message by inserting the encrypted ID / authentication key into the SGIP message header for the security, weather information, etc. to provide to the mobile communication terminal (S130). For example, the SGIP message generated in step S130 is shown in Table 1 below.

TABLE 1

TLAA5owbM8aDIVGjuUnwNw // ID / Authentication Key ... partnersvc-id = O000620001 // Partner Service ID teleservice-id = 65491 // Teleservice ID vaild-period = 120 // Service Valid Time ... noti-url = http: //203.236.40.234:9001/cgi=bin/noti.cgi // urladdress source-ip = 203.236.40.239 ported-out = no // Source IP ... Have a nice weekend !! // message content (content)

In [Table 1], "TLAA5owbM8aDIVGjuUnwNw" is an encrypted string of the ID ("O00062irfCatg4tCfvF3xvAxbi") / authentication key ("3s02khW992s"), which is obtained from the Push Proxy Gateway using a token.

Then, the agent of the content providing server transmits the generated SGIP message to the push proxy gateway 60 (S140).

Therefore, when receiving the SGIP message from the content providing server 70, the push proxy gateway 60 decrypts the encrypted ID / authentication key in the SGIP message header using a token (S150). Here, the decrypted ID / authentication key is "O00062irfCatg4tCfvF3xvAxbi" / "3s02khW992s", and the algorithm used to decrypt the ID / authentication key in the push proxy gateway 60 encrypts the Adi / authentication key in the content providing server 70. It will be readily apparent to those skilled in the art that the same security algorithm as the algorithm used (in the present invention, a security algorithm using a token) is applied.

Then, the push proxy gateway 60 checks whether the decrypted ID / authentication key is a registered content providing server ID / authentication key (S160).

If the ID / authentication key check result (S160), the decrypted ID / authentication key is not a pre-registered content providing server ID / authentication key, the push proxy gateway 60 transmits a message (preferably message processing, eg; message conversion). , Short message transmission, etc.) (S170). Meanwhile, if the ID / authentication key check result (S160) and the decrypted ID / authentication key are the registered content providing server ID / authentication key, the push proxy gateway 60 accepts the message transmission (S180).

Then, the push proxy gateway 60 converts the SGIP message using the message conversion rule as well as the successful notification of the content providing server, and transmits it to the short message service center 40 (S190). The short message service center 40 transmits the received message to the mobile communication terminal 10. Then, the short message service center 40 transmits a message transmission response to the push proxy gateway 60 (S200).

Accordingly, when the push proxy gateway 60 receives a response from the short message center 40, the push proxy gateway 60 responds that the message is normally transmitted to the content providing server 70 (S210).

In the present embodiment, for convenience of description, the content providing server is limited to one, but this number may be adaptively changed according to the number of serviced servers of the content providing server, and this fact is common in the art. Those who have knowledge will easily know.

Although the contents of the present invention have been described with reference to the embodiments, the embodiments of the present invention are merely illustrative of the present invention and should not be construed as limiting the scope of the present invention. Those skilled in the art to which the present invention pertains may modify or alter the present invention in various forms within the spirit and scope described in the claims herein.

As described above, the present invention can properly authenticate a content providing server in a push proxy gateway, block access / message transmission and reception from an illegal content providing server, and provide only a message received from a legitimate content providing server to a mobile communication terminal. It can work.

In addition, the present invention has the effect that the agent distributed to the content providing server is executed only in the legitimate content providing server can prevent the unauthorized content providing server using the push proxy gateway using the agent. Thus, authentication can be performed between the push proxy gateway and the content providing server to provide a reliable push service to the receiver.

Claims (4)

Between the content providing server that provides the push message to the mobile terminal and the push proxy gateway, mutual authentication / access / push message transmission and reception are performed through an agent installed in the content providing server. In the content providing server, A first step of extracting an IP address preloaded on the agent and checking whether it matches the content providing server IP address when the agent receives the execution request signal; And And a second step of the agent executing on the content providing server when the IP address extracted as the check result and the content providing server IP address match. In the push proxy gateway, A first step of checking whether a content providing server IP address is already registered when receiving a connection request from the content providing server; A second step of transmitting a connection response to the content providing server if a content providing server IP address is already registered as a result of the IP address checking; Receiving a push message transmission request from a content providing server as a result of the connection response, decrypting an encrypted ID / authentication key inserted into the push message and checking whether the decrypted ID / authentication key is already registered; step; And And a fourth step of processing a push message transmission request from the content providing server when the ID / authentication key decrypted as a result of the ID / authentication key check is pre-registered. . The method of claim 1, In the content providing server, When the agent receives the push message generation request signal while the agent is running on the content providing server, the push proxy gateway and the content providing server may encrypt and insert an ID / authentication key given from the push proxy gateway into a push message. Authentication method in. The method according to claim 1 or 2, The agent is generated on the push proxy gateway side and distributed to the content providing server side, the agent itself is a push proxy gateway and the authentication method in the content providing server, characterized in that the content providing server IP address list encrypted with a security value. In a content providing server connected to a wired or wireless network, An agent for mutual authentication / access / push message transmission and reception with a push proxy gateway on a content providing server to provide a push message to a mobile communication terminal. Extracting a pre-loaded IP address when receiving an execution request signal from a user and checking whether the content is identical with the content providing server IP address; Executing on the content providing server if the IP address extracted as a result of the inspection and the content providing server IP address match; And A computer-readable recording medium having recorded thereon a program for realizing a step of encrypting and inserting an ID / authentication key given from a push proxy gateway into a push message when a push message generation request signal is received from a user.

Images