KR20090026670A - Authentication method for mobile terminal - Google Patents

Abstract

An authentication method of a mobile communication terminal is provided to reduce a load of a mobile communication system by reducing a reattempt number of a call in a mobile communication terminal. A base station control device(130) transmits an authentication parameter about a mobile communication terminal(110) and RAND value to a base station(120)(S102, S114). The base station transmits a response about the authentication parameter and the RAND value to the base station control device(S104). The base station control device confirms the response(ACK)(S106, S116), and requests to transmit the authentication parameter and the RAND value to the terminal(S108). The authentication parameter and the RAND value are transmitted to the terminal according to the request of the base station(S110, S120). The authentication parameter is set in the terminal(S130). The terminal generates a RANDC value with a received RAND value(S132), and transmits a generated RANDC value and a set authentication parameter to the base station control device through the base station(S136). The base station control device requests an authentication about the terminal to an authentication center(180)(S144). The authentication center performs an authentication about the terminal(S146).

Description

Authentication Method for Mobile Terminal {Authentication Method for Mobile Terminal}

The present invention relates to a method for authenticating a mobile communication terminal, and in particular, in a mobile communication system, a base station receives an acknowledgment (ACK) for a random value (Random Number: RAND) received from a base station controller or a switch at a base station during authentication of the mobile communication terminal. The present invention relates to an authentication method of a mobile communication terminal that can increase the authentication success rate of a mobile communication terminal by transmitting to a controller or an exchange to prevent inconsistency of an authentication type in advance.

The mobile communication system has passed through the first generation of analog AMPS (Advanced Mobile Phone System) and the second generation of Cellular / Personal Communication Service (PCS). (International Mobile Telecommunication-2000) is used. As a representative example of such a third generation mobile communication system, a synchronous Code Division Multiple Access 2000 (CDMA2000) mainly used in Korea, the United States, Japan, etc., and a wideband Code Division Multiple Access (WCDMA) which is mainly used in Europe, etc. Can be distinguished.

CDMA2000 uses GPS (Global Positioning System) for synchronization between terminal and base station, and provides much faster wireless Internet service than IS-95A / B network by using IS-95C network that has evolved from existing IS-95A / B network. It is possible. WCDMA does not need to use GPS to synchronize the entire base station. In addition, the WCDMA method uses a CDMA method for a wireless access method for communication between a terminal and a base station, but a mobile communication network related technology is based on a network operation technology of GSM (Global System for Mobile Communication).

A typical synchronous mobile communication system includes a mobile communication terminal (MS), a base station (BTS), a base station controller (BSC) and a mobile switching center (MSC). Visitor Location Register (VLR) that registers and updates the location of the mobile communication visitor according to the location registration request of MS), and is connected to the MSC, the current location information of the terminal, and the status information of the mobile communication subscriber. Includes a Home Location Register (HLR) for storing and managing mobile communication-related information such as statistics related to mobile communication and various service-related information, and an Authentication Center (AC) for authenticating a terminal. do. The exchanger (MSC) and the visitor location register (VLR) may be configured separately, but the visitor location register (VLR) is provided in the exchanger (MSC) to be integrated (this is referred to as the exchange / visitor location register (MSC / VLR) for convenience). Can be implemented as:

In the case of performing the authentication of the mobile communication terminal in such a synchronous mobile communication system, a base station controller (BSC) generates and stores a random size (hereinafter referred to as RAND value) of a certain size periodically and authenticates the mobile communication terminal. The parameter and the RAND value are transmitted to a base station (BTS). The base station (BTS) transmits the authentication parameter and the RAND value to the mobile communication terminal. An authentication parameter is set in the mobile communication terminal, and randomized using the received RAND value and predetermined information, for example, information such as an electronic serial number (ESN) and shared secret data (SSD). A code (Random Code: hereinafter referred to as RANDC) is generated and transmitted to the base station controller (BSC) through the base station (BTS) to request authentication. The base station controller (BSC) compares the RANDC value transmitted from the base station (BTS) and the RANDC value stored therein in advance and determines whether the base station controller (BSC) matches. The authentication center (AC) performs authentication of the mobile communication terminal by requesting a registration update and requesting authentication from the authentication center (AC).

In addition, a general asynchronous mobile communication system includes a subscriber authentication module (Mobile Subscriber Authentication Module), a mobile communication terminal (ME), a Node B, a radio network controller (RNC), and performs a voice data service. Switch / Visitor Location Register (MSC / VLR) that stores and manages users' profiles, Gateway to Points connected to external wired networks, GMSC (Gateway MSC) in charge of circuit switching (CS), Packet data services Serving GPRS Supporting Node (SGSN) to provide, Gateway GPRS Supporting Node (GGSN) in charge of Packet Switching (PS) as a gateway to the external Internet network, Current location information of mobile communication terminal, Mobile communication Store and manage various information related to mobile communication such as subscriber status information, statistical data related to mobile communication and various service related information Comprises an authentication center (AC) for performing a home location register (HLR) and a mobile authentication of the communication terminal. The subscriber authentication module is a module for processing subscriber authentication in the third generation mobile communication system, such as the Universal Subscriber Identify Module (USIM) or the Removable User Identify Module (R-UIM), so that the authentication service is performed by being inserted into the mobile communication terminal. .

In the general asynchronous mobile communication system, when authenticating a subscriber of a specific mobile communication terminal, the authentication center (AC) generates a plurality of authentication vectors (AV) including a RAND value and an authentication token (AUTN) value. After transmitting to the exchange / visitor location register (MSC / VLR), the exchange / visitor location register (MSC / VLR) stores the authentication vector (AV) and then stores the RAND value and AUTN value included in the authentication vector (AV). Subscriber authentication is requested by transmitting to the mobile communication terminal through the Node B. The mobile communication terminal generates a subscriber response value (RES) through the subscriber authentication module 20 and transmits it to the exchange / visitor location register (MSC / VLR). The exchange / visitor location register (MSC / VLR) compares the subscriber response value (RES) with a previously stored subscriber expected response value (XRES: Expected Response), and performs a location registration update when it matches, and the home location register ( HLR) and the authentication center (AC) are notified and the authentication center (AC) performs authentication of the mobile communication terminal.

However, in the conventional synchronous mobile communication system, the base station controller (BSC) transmits the authentication parameters and the RAND value to the base station (BTS) in the subscriber authentication process of the mobile communication terminal, and in the asynchronous mobile communication system, the exchange / visitor location register ( When the MSC / VLR) transmits the RAND value and the AUTN value to the Node B, there is a case where the authentication parameter, the RAND value, and the AUTN value cannot be received due to a failure in the base station (BTS) or the Node B. It was. In this case, the base station (BTS) or Node B cannot transmit authentication parameters, RAND values, and AUTN values for authentication to the mobile communication terminal, so that the authentication of the terminal is no longer performed and the subscriber cannot receive the mobile communication service. There was a problem that the customer complaints occur.

In addition, in the related art, there is a case in which an authentication parameter, a RAND value, and an AUTN value cannot be received correctly (accurate data) due to a failure in a base station (BTS) or a node B. In some cases, data and other data may be transmitted to the mobile communication terminal. For example, a base station controller (BSC) has transmitted a RAND value including X and Y parameters to the base station (BTS), but the base station (BTS) may receive a RAND value including Y and Z parameters due to a failure or the like. Can be. In this case, the authentication parameter and RANDC value received from the base station controller (BSC) at the terminal, or the subscriber response value (RES) received from the exchange / visitor location register (MSC / VLR), respectively, are stored in advance. XRES) is different from each other, and thus, there is a problem in that the authentication type (TYPE) in the terminal to be authenticated and the mobile communication system are different from each other, so that the success rate of authentication of the corresponding mobile communication terminal is significantly reduced. Furthermore, due to the authentication failure of the mobile communication terminal, the number of retries of a call increases, resulting in a decrease in system quality, which leads to problems such as resource waste and load increase of the system.

As described above, in the authentication process of the conventional mobile communication terminal, the base station controller (BSC) or the exchange / visitor location register (MSC / VLR) transmits the authentication parameter, the RAND value, and the AUTN value to the base station (BTS) or the node B, respectively. Later, since the base station (BTS) or Node B does not check whether it has received or even received the correct data, the network operator will not be able to quickly detect the occurrence of a failure at the base station (BTS) or Node B, and later Only after receiving a complaint report from the customer was it possible to identify problems in the certification process, making it difficult to respond quickly to failures or errors in network operation.

Therefore, when the base station (BTS) or Node B fails to receive the authentication parameter, the RAND value, or the AUTN value due to a failure in the network operation level, or the correct data is not received even if it is received, the network operator quickly detects the failure and fails. It has been required to develop a technology that can improve the authentication success rate by reducing the authentication failure of the mobile communication terminal by detecting and taking a quick action.

According to the present invention, when an authentication parameter, a RAND value, or an AUTN value is transmitted from a base station controller or exchange to a base station during authentication of a mobile communication terminal, the base station controller or exchange sends an acknowledgment (ACK) to the reception of the values. The purpose of the present invention is to provide an authentication method of a mobile communication terminal that can detect the occurrence of a failure in the operation of the network in advance and take measures to increase the authentication success rate of the mobile communication terminal.

In addition, another object of the present invention is to prevent inconsistency between the authentication type (TYPE) in the mobile communication terminal and the mobile communication system by transmitting a response (ACK) of the values received from the base station controller or the exchange in the mobile communication system The present invention provides a method for authenticating a mobile communication terminal, which can increase the authentication success rate of the mobile communication terminal.

In order to achieve the above object, an authentication method for a mobile communication terminal according to an embodiment of the present invention includes a method for authenticating a mobile communication terminal in a mobile communication system.

Transmitting, by the base station controller, an authentication parameter and a RAND value for the mobile communication terminal to be authenticated to the base station; Transmitting, by the base station, an acknowledgment (ACK) in response to receiving the authentication parameter and the RAND value to the base station controller; A third step of checking, by the base station controller, the response (ACK) and requesting the base station to transmit the authentication parameter and the RAND value to the terminal; Transmitting, by the base station, the authentication parameter and the RAND value to the terminal according to the request; A fifth step of setting an authentication parameter in the terminal and generating a RANDC value using the received RAND value and then transmitting the generated RANDC value and the set authentication parameter to the base station controller through the base station; A sixth step in which the base station controller compares the received RANDC value with a previously stored RANDC value and requests authentication of the terminal from an authentication center when the base station controller compares the received RANDC value; And a seventh step of authenticating the terminal in the authentication center.

In one embodiment of the present invention, the first step preferably includes generating a RAND value according to a predetermined period in the base station controller.

In an embodiment of the present disclosure, after the first step, the method may further include changing a RAND value according to a preset period in the base station controller. In this case, the second step may further include transmitting, by the base station, a response (ACK) for receiving the changed RAND value to the base station controller.

In one embodiment of the present invention, the second step is preferably transmitted to the base station controller by including the received authentication parameter and the RAND value in the response (ACK) at the base station. In this case, the third step compares the authentication parameter and the RAND value transmitted by being included in the response (ACK) by the base station controller and the authentication parameter and the RAND value transmitted to the base station. It is preferable to request to transmit the authentication parameter and the RAND value to the terminal.

In addition, the authentication method of the mobile communication terminal according to another embodiment of the present invention for achieving the above object, in the authentication method of the mobile communication terminal in the mobile communication system,

A first receiving and storing a plurality of authentication vectors from an authentication center at an exchange, extracting the RAND value and the AUTN value included in the authentication vector, and including the extracted RAND value and the AUTN value in a subscriber authentication request message and transmitting the same to the base station; step; Transmitting, by the base station, an acknowledgment (ACK) in response to receiving the subscriber authentication request message to the exchange; A third step of checking, by the exchange, the response (ACK) and requesting the base station to transmit the transmitted subscriber authentication request message to the terminal; A fourth step of transmitting, by the base station, the subscriber authentication request message to the terminal according to the request; A fifth step of generating, at the terminal, a subscriber authentication value (RES) using the RAND value and the AUTN value included in the subscriber authentication request message and transmitting the generated subscriber authentication value (RES) to the exchange; A sixth step in which the exchange compares the transmitted subscriber authentication value RES with a previously stored subscriber expected response value XRES and requests authentication of the terminal to the authentication center if they match each other; And a seventh step of authenticating the terminal in the authentication center.

In one embodiment of the present invention, the first step includes: transmitting an acknowledgment (ACK) for receiving the authentication vector from the exchange to the authentication center; Checking the response (ACK) in the authentication center and requesting the exchange to transmit the RAND value and the AUTN value included in the transmitted authentication vector to the base station; And extracting, by the exchange, a RAND value and an AUTN value included in the authentication vector in the subscriber authentication request message according to the request.

The transmitting of the response to the authentication vector reception may include transmitting the received authentication vector to the authentication center by including the received authentication vector in the response (ACK), and transmitting the response (ACK) to the authentication center. ), The authentication center may compare the authentication vector transmitted in the response (ACK) with the authentication vector transmitted to the exchange and check whether the authentication vector is identical.

In one embodiment of the present invention, the second step preferably includes the received subscriber authentication request message in the response (ACK) at the base station and transmits it to the exchange. In this case, the third step may include comparing the subscriber authentication request message transmitted by being included in the response (ACK) with the subscriber authentication request message transmitted to the base station and confirming whether the exchange is identical.

In one embodiment of the present invention, before the first step, requesting a subscriber identification value from the exchange to a subscriber authentication module mounted in the terminal; The subscriber authentication module may further include transmitting a pre-stored subscriber identification value to the exchange through the terminal.

According to the present invention, the authentication success rate of the mobile communication terminal is improved by improving the authentication procedure of the mobile communication terminal in the mobile communication system, and the number of retries of calls in the mobile communication terminal is reduced, thereby reducing the load on the mobile communication system. This can improve the overall quality of the mobile communication system.

Furthermore, when the authentication procedure of the mobile communication terminal is not performed due to a failure in the mobile communication system, the network operator can identify the failure in advance, thereby reducing the authentication failure rate of the terminal. Minimize customer complaints.

In the following, a detailed description of a preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, in the case where it is determined that detailed descriptions of related well-known functions or configurations may unnecessarily obscure the subject matter of the present invention, detailed descriptions thereof will be omitted so as not to obscure the subject matter of the present invention. will be.

1 is a schematic configuration diagram of a mobile communication system to which an authentication method of a mobile communication terminal according to an embodiment of the present invention is applied.

Referring to FIG. 1, a mobile communication system to which an authentication method of a mobile communication terminal according to an embodiment of the present invention is applied includes a mobile communication terminal (MS) (hereinafter referred to as a “terminal” for convenience) 110 and a base station (BTS). 120, a visitor location register (VLR) for registering and updating the location of the mobile subscribers according to the location registration request of the base station controller (BSC) 130, the switch (MSC) 140, and the mobile communication terminal 110; (150) connected to the exchange (MSC) 140 and the visitor location register (VLR) 150, the current location information of the terminal (MS) (110), status information of the mobile subscriber, statistical data related to mobile communication And an authentication center (AC) 180 that performs authentication for a home location register (HLR) 170 and a terminal (MS) 110 that store and manage various information related to mobile communication such as various service related information. It is configured to include. As described above, the visitor location register (VLR) 150 may be configured separately from the exchanger (MSC) 140, and the visitor location register (VLR) (in the exchanger (MSC) 140) as shown in FIG. 150 may be configured in one piece, which is referred to as an exchanger // visitor location register (MSC / VLR) 160 for convenience.

The terminal 110 stores an authentication key (A-Key) and performs an authentication algorithm to generate and store a unique authentication value (AHTHR), voice security (VP), and secret message for signal message encryption (SME). It is responsible for storing / update of call history count (COUNT) and storing and performing authentication algorithm.

The base station (BTS) 120 is responsible for the wireless section communication with the terminal 110, the base station controller (BSC) 130 performs the control of a plurality of base stations 120 and a plurality of base stations 120 and switch The MS (110) is in charge of accessing the network between the / Visitor Location Register (MSC / VLR) 160 using a wireless protocol.

The exchanger (MSC) 140 of the exchanger / visitor location register (MSC / VLR) 160 controls the wired / wireless link, is in charge of the connection between the terminal 110 and other communication networks, and is directly linked for authentication. Sends messages related to authentication to the center (AC) 180, the visitor location register (VLR) 150 performs the function of registering and updating the location of the mobile subscribers according to the location registration request of the terminal (110). .

The home location register (HLR) 170 registers the subscriber's personal information and delivers authentication data for the particular subscriber. That is, it receives the authentication-related message from the authentication center (AC) 180 and tracks the location to relay the visitor / visitor location register (MSC / VLR) 160.

The authentication center (AC) 180 manages the subscriber DB, stores the authentication key (A-Key), and performs the authentication algorithm, the secret for authentication value (AUTHR), voice security (VP), and signal message encryption (SME). Generate key and verify authentication value to determine authentication success / failure. In addition, it performs overall security management functions to determine and enforce in-network authentication policies and to monitor authentication-related data.

2 is a procedure showing an authentication method of a mobile communication terminal according to an embodiment of the present invention. 2 illustrates a method for authenticating a mobile communication terminal according to an embodiment of the present invention, and each component may perform other functions in addition to the authentication of the mobile communication terminal.

As shown in Figure 2, when performing the authentication for the terminal 110 in the mobile communication system, authentication type (TYPE) for the terminal (MS) 110 to be authenticated in the authentication center (AC) (180) The setup message is transmitted to the base station controller (BSC) 130 (S100), and the base station controller (BSC) 130 continuously checks the authentication-related data to determine the authentication parameter of the terminal 110 (BTS) 120 (S102).

The base station (BTS) 120 transmits an acknowledgment (ACK) to the reception of the authentication parameter to the base station controller (BSC) 130 (S104). Here, in one embodiment of the present invention, the response (ACK) may simply be an acknowledgment (ACK) in the form of a notification about the authentication parameter reception, and in another embodiment, a response (ACK) indicating that the authentication parameter is correctly received. ) In other words, in the former case, the base station (BTS) 120 simply responds to the case where the authentication parameter is not received at all due to a failure or the like. In the latter case, the base station (BTS) ( In case 120 receives an authentication parameter of data other than the authentication parameter transmitted by the base station controller (BSC) 130 due to the occurrence of a failure, it is notified that the correct data about the transmitted authentication parameter has been received. Is the answer. Thus, in the latter case, the base station (BTS) 120 includes the received authentication parameter in the response (ACK) and transmits it to the base station controller (BSC) 130.

Subsequently, the base station controller (BSC) 130 checks the response (ACK) received from the base station (BTS) 120 (S106) and transmits the authentication parameter transmitted to the base station (BTS) 120 to the terminal ( MS) 110 requests to transmit (S108). In this case, the acknowledgment (ACK) confirms whether the base station (BTS) 120 has received the authentication parameter or correct data. In the latter case, it is determined whether the authentication parameter transmitted by being included in the response (ACK) in the base station (BTS) 120 and the authentication parameter transmitted in step S102 match (S106). Request 120 to transmit the authentication parameter to the terminal (MS) 110 (S108), and the base station (BTS) 120 transmits the authentication parameter to the terminal 110 according to the request ( S110). As a result, the base station controller (BSC) 130 confirms that the authentication parameter is received by the base station (BTS) 120 by checking the response (ACK) transmitted from the base station (BTS) 120.

If the base station controller (BSC) 130 does not receive the response (ACK) from the base station (BTS) 120, it may transmit an authentication parameter again (not shown), and report this to the network operator. It may be (not shown). Through this process, the network operator can check whether the failure of the base station 120, the base station controller 130, or other nodes occurs in advance, thereby reducing the probability of authentication failure.

Subsequently, the base station controller (BSC) 130 generates a RAND value periodically (S112) and transmits the generated RAND value to the base station (BTS) 120 (S114). Then, after receiving the RAND value, the base station (BTS) 120 transmits an acknowledgment (ACK) to the reception of the RAND value to the base station controller (BSC) 130 (S116). In this case, the acknowledgment (ACK) may be a simple notification of the reception of the RAND value, or a notification indicating that the correct data on the RAND value has been received. In the latter case, the base station (BTS) 120 preferably transmits the received RAND value to the base station controller (BSC) 130 by including the received RAND value in the response (ACK), and the base station controller (BSC) 130. ) Checks the RNAD value included in the response (ACK) and the RAND value transmitted in step S114 (S118), and if the two values match, transmits the transmitted RAND value to the base station (BTS) 120. Request to transmit to the terminal (MS) (110) (S120), the base station (BTS) 120 in response to the request through the paging channel (paging CH) to the terminal (MS) (110) It transmits (S122). Thus, the base station controller (BSC) 130 has received the generated RAND value from the base station (BTS) 120 by receiving and confirming the response (ACK) transmitted from the base station (BTS) 120. As described above, the network operator can check in advance whether or not a failure occurs in the corresponding nodes.

On the other hand, since the RAND value periodically generated by the base station controller (BSC) 130 is used for authentication of the terminal 110, security is important. Accordingly, in order to prevent the RAND value from being exposed to the outside or being illegally copied, the base station controller (BSC) 130 may periodically change the generated RAND value (S124), and the changed RAND value may be changed. The base station (BTS) 120 may transmit to (S126). Even in this case, the base station (BTS) 120 transmits an acknowledgment (ACK) to the modified RAND value transmission to the base station controller (BSC) 130 (S128), and the base station controller (BSC) 130 By receiving and confirming the reception response (ACK) transmitted from the base station (BTS) 120, it may be confirmed that the base station (BTS) 120 has received the changed RAND value (not shown). Steps S124 to S128 indicated by "A" in the figure may be selectively determined as necessary.

 When an authentication parameter is set in the terminal (MS) 110 by the user (S130), the terminal (MS) 110 receives a RAND value and predetermined information received from the base station (BTS) 120, for example, electronic. The RANDC value is generated using information such as serial number (ESN) and shared secret data (SSD) (S132), and the authentication is requested by transmitting the generated RANDC value and the set authentication parameter to the base station 120 ( S134). The set authentication parameter includes a unique authentication value (AHTHR) obtained through an authentication algorithm, a call history count (COUNT), and a secret key for signal message encryption (SME). At this time, the terminal (MS) 110 generates a RANDC value using a predetermined authentication algorithm stored therein.

The format of the authentication parameter of the terminal 110 may be displayed, for example, as shown in Table 1 below.

TABLE 1

Authentication parameter ID Authentication parameter length Authentication type Authentication data length Authentication data value

In Table 1, the authentication parameter ID is a unique identifier of the authentication parameter set in the specific terminal, and the authentication parameter length is the total length of the authentication parameter. In addition, the authentication type (TYPE) may be a value indicating the authentication process for a specific terminal. The authentication data length and the authentication data value indicate the length of authentication data determined according to the authentication type and the value of the corresponding data, for example, shared secret data (SSD), a call history count (COUNT) changed when the terminal attempts to call. . Here, by using the authentication type (TYPE), it is possible to determine whether the terminal that is the target of the authentication process in the mobile communication system and the terminal that performs the operation corresponding to the authentication process are matched. If there is no match, the authentication type (TYPE) in the mobile communication system and the authentication type (TYPE) of the corresponding terminal do not match. In this case, the authentication for the corresponding terminal fails.

2, the base station (BTS) 120 receiving the RANDC value and the authentication parameter from the terminal (MS) 110 transmits it to a base station controller (BSC) 130 (S136). . The base station controller (BSC) 130 compares the RANDC value transmitted from the base station (BTS) 120 and a pre-stored RANDC value to determine whether two RANDC values match (S138), and if there is a match, the exchange The visitor location register (MSC / VLR) 160 requests a location registration update (S140). Subsequently, the exchange / visitor location register (MSC / VLR) 160 transmits an authentication request message (AUTH REQ) to the home location register (HLR) 170 (S142), and the home location register (HLR) 170. In step S144, the authentication request message (AUTH REQ) is transmitted to the authentication center (AC) 180 to transmit the authentication request message (AUTH REQ). The authentication center (AC) 180 verifies the authentication value (AUTHR), the force count (COUNT) to perform authentication for the terminal (MS) 110 (S146), and then the home location register (HLR) Send a reply message (auth req) for the authentication request to the (170) (S148), the home location register (HLR) 170 is authenticated by the exchange / visitor location register (MSC / VLR) 160 Reply to the request (S150). Subsequently, the exchange / visitor location register (MSC / VLR) 160 returns a location registration update acceptance or rejection to the base station controller (BSC) 130 (S154).

3 is a schematic configuration diagram of a mobile communication system to which an authentication method of a mobile communication terminal according to another embodiment of the present invention is applied.

3, a mobile communication system to which an authentication method of a mobile communication terminal according to another embodiment of the present invention is applied includes a subscriber authentication module 200 for processing subscriber authentication, for example, USIM or R-UIM, A mobile communication terminal (ME) (hereinafter, referred to as a terminal (ME) 210) using a data or packet data service, and a plurality of mobile stations serving as a base station for wireless section communication with the terminal (ME) 210 Node B (Node B) 220, the Radio Network Controller (Radio Network Controller (RNC) 230) for controlling the Node B 220, the wireless network controller (RNC) 230 is connected to the terminal 210 Mobile Switching Center (MSC) / Visitor Location Register (VLR) 240, which performs circuit switching (CS) to provide voice call service and stores visited user profiles, and external wired network As a gateway to a branch office that connects to a circuit switched (CS) A gateway MSC (GMSC) 250, which is in charge of switching, is connected to the radio network controller 230 to perform a packet exchange (PS) for providing a packet data service, and maintain and access a location track of the terminal 210. Serving GPRS Supporting Node (SGSN) 260 that performs control and security functions, Gateway GPRS Supporting Node (GGSN) 270 that is responsible for switching for packet switching (PS) as a gateway at the point of connection to the Internet network, Connected to the exchange / visitor location register (MSC / VLR) 240 and the SSGN 260, the current location information of the terminal (ME) 210, status information of the mobile subscriber, statistics related to the mobile communication and various services And a home location register (HLR) 280 that stores and manages various information related to mobile communication such as information, and an authentication center (AC) 290 that performs authentication of the terminal (MS) 210.

The terminal (ME) 210 is a wireless terminal used for wireless communication to identify a subscriber, perform an authentication algorithm, and store authentication and encryption keys and some subscription information required by the terminal (ME) 210.

The Node B 220 plays a role as a base station that participates in radio resource management and performs radio section communication with the terminal 210, and the RNC 230 is in charge of controlling the Node B 220. As a service access point at all services (e.g., connection management to the terminal (ME) 210) connected to and provided to the Node B 220, the switch (MSC / VLR) 240 and the SSGN 260. Own and control radio resources.

The switch / visitor location register (MSC / VLR) 240 is a switch (MSC) and a database (VLR) that provide circuit switched (CS) services to the terminal (ME) 210 at its current location. The function of the switch MSC as the switch performs a switching task for the circuit switched CS, and the function of the visitor location register VLR as the database is not only the profile of the visited user, but also the terminal in the support system. A copy of the more accurate information on the location of the ME 210 is kept.

The HLR 280 is a database (DB) located in the user home system that stores the master copy of the user service profile. For example, a service profile consists of supplementary service information such as allowed service information, prohibited roaming, number of call transfers and call transfer status. The HLR 280 receives the authentication-related message from the authentication center (AC) 290 and tracks the location to relay to the corresponding exchange (MSC / VLR) 240 or SSGN 260.

The authentication center (AC) 290 is a secret for the authentication value (AUTHR), voice security (VP), signal message encryption (SME) through the management of subscriber DB, storage of the authentication key (A-Key), authentication algorithm Generate key and verify authentication value to determine authentication success / failure. In addition, it performs overall security management functions to determine and enforce in-network authentication policies and to monitor authentication-related data.

4 is a flowchart illustrating an authentication method of a mobile communication terminal according to another embodiment of the present invention. 4 illustrates a method for authenticating a mobile communication terminal according to another embodiment of the present invention, and each component may perform other functions in addition to the authentication of the mobile communication terminal.

As shown in FIG. 4, when performing subscriber authentication of a terminal (ME) 210 in a mobile communication system, an exchange / visitor location register (MSC / VLR) 240 is connected to the terminal (ME) via the node B 220. Request a subscriber identification value to the (210) (S200), the terminal (ME) (210) requests a subscriber identification value to the subscriber authentication module 200 (S202). The subscriber authentication module 200 transmits a subscriber identification value which is stored in advance to the terminal (ME) 210 (S204), and then the terminal (ME) 210 transmits the exchange / The visitor location register (MSC / VLR) 240 transmits the data (S206).

The exchange / visitor location register (MSC / VLR) 240 transmits an authentication data request message for subscriber authentication of the terminal (ME) 210 to an authentication center (AC) 290 (S208). The authentication center (AC) 290 generates a predetermined authentication vector (AV) including a RAND value and authentication token (AUTN) information by using the subscriber information stored in the home location register (HLR) 280. And (S210), and transmits the generated authentication vector (AV) to the exchange / visitor location register (MSC / VLR) (240) (S212). Then, the exchange / visitor location register (MSC / VLR) 240 transmits an acknowledgment (ACK) to the authentication center (AC) 290 in response to the receipt of the authentication vector (AV) (S214). Even in this case, as described with reference to FIG. 2, the response ACK may be a simple notification of receipt of the authentication vector AV or a notification indicating that correct data of the authentication vector AV has been received. have. In the latter case, the exchange / visitor location register (MSC / VLR) 240 preferably includes the received authentication vector (AV) in the response (ACK) and transmits it to the authentication center (AC) 290. The authentication center (AC) 290 checks the authentication vector (AC) included in the response (ACK) and the authentication vector (AV) transmitted in step S212 (S216), and when the two values coincide. Using the authentication vector (AV) transmitted to the exchange / visitor location register (MSC / VLR) 240, the node B 220 instructs the subscriber authentication request (S218). In this way, the authentication center (AC) 290 checks the response (ACK) transmitted from the exchange / visitor location register (MSC / VLR) 240 and at the exchange / visitor location register (MSC / VLR) 240. It is confirmed that the authentication parameter has been received.

If the authentication center (AC) 290 does not receive the response (ACK) from the exchange / visitor location register (MSC / VLR) 240, the authentication parameter may be transmitted again (not shown). It may be reported to the network operator (not shown). Through this process, the network operator can reduce the probability of authentication failure by allowing the authentication center 290, the exchanger / visitor location register (MSC / VLR) 240, or other nodes to confirm in advance whether or not a failure occurs.

The exchange / visitor location register (MSC / VLR) 240 stores the received plurality of authentication vectors (S220), selects one of the plurality of authentication vectors, and authenticates the subscriber including the RAND value and AUTN included therein. The request message is transmitted to the Node B 220 through the radio network controller (RNC) 230 (S222). Then, the Node B 220 transmits the subscriber authentication request message, that is, a response (ACK) to receiving the RAND value and the AUTN value, to the exchange / visitor location register (MSC / VLR) 240 (S220). Even in this case, as described above, the response ACK may be a simple notification of receiving the RAND value and the AUTN value, or may be a notification indicating that the correct data on the RAND value and the AUTN value has been received. In the latter case, the Node B 220 preferably includes the received RAND value and the AUTN value in a response (ACK) and transmits the same to the exchange / visitor location register (MSC / VLR) 240. The visitor location register (MSC / VLR) 240 checks the RAND value and AUTN value included in the response (ACK) and the RAND value and AUTN value transmitted in step S222 (S226). Instructing the B 220 to perform a subscriber authentication request to the terminal (ME) 210 using the RAND value and the AUTN value (S228). As described above, the exchange / visitor location register (MSC / VLR) 240 receives the RAND value and the AUTN value at the node B 220 by checking the response (ACK) transmitted from the node B 220. You will be confirmed.

Subsequently, the node B 220 transmits the subscriber authentication request message to the terminal 210 (S230). The terminal (ME) 210 generates a subscriber authentication command according to the subscriber authentication request (S232), transmits to the subscriber authentication module 200 (S234), and the subscriber authentication module 200 performs the subscriber authentication. Using the RAND value and the AUTN value included in the request message, the network is authenticated through the same authentication algorithm as that of the authentication center (AC) 290, and a subscriber authentication value RES is generated (S236). In addition, encryption, decryption keys, and integrity keys can also be generated. Subsequently, the subscriber authentication module 200 transmits the subscriber response value (RES) to the terminal (ME) 210 (S238), and the terminal (ME) 210 transmits the subscriber response value (RES). The node B 220 and the radio network controller (RNC) 230 are transmitted to the exchange / visitor location register (MSC / VLR) 240 again (S240). The exchange / visitor location register (MSC / VLR) 240 then compares the transmitted subscriber response value RES with the previously stored subscriber expected response value XRES (S242), and if they match, the exchange / visitor. The location register (MSC / VLR) 240 updates the location registration of the terminal (ME) 210 (S244), and requests an authentication for the terminal (ME) 210 to the home location register (HLR) 280. The message is transmitted (S246). The home location register (HLR) 280 transmits an authentication request message back to the authentication center (AC) 290 (S248), and the authentication center (AC) 290 is connected with the subscriber response value (RES). The subscriber is authenticated by comparing the stored subscriber expected authentication value (XRES) (S250), the authentication result is returned to the home location register (HLR) 280 (S252), and the home location register (HLR) 280 is The authentication result is returned to the exchange / visitor location register (MSC / VLR) 240 (S254). Subsequently, the switch / visitor location register (MSC / VLR) 240 returns a location registration update acceptance or rejection to the radio network controller (RNC) 230 (S256).

Meanwhile, in another embodiment of the present invention, the SGSN 260 may perform a function of an exchange / visitor location register (MSC / VLR) 240 for subscriber authentication of the terminal (ME) 210. In other words, the authentication data request message is transmitted to the authentication center (AC) 29, the authentication vector (AV) including the RAND value is received and stored from the authentication center (AC) 290, and the node B 220 is stored. Transmits a user authentication request message by transmitting a RAND value to the terminal (ME) 210 through a), and receives a subscriber response (RES) from the terminal (ME) through the node B (220). (RES) compares and requests the exchange / visitor location register (MSC / VLR) 240 to update the location registration and authenticates the home location register (HLR) 280 and the authentication center (A) 290. The SGSN 260 may perform a function for requesting the request. The performance of the authentication function in the exchange / visitor location register (MSC / VLR) 240 and the SGSN 260 may be set by the operator.

As described above, in one embodiment of the present invention, in the synchronous mobile communication system, the mobile communication terminal is generated in the base station controller (BSC) before the authentication center (AC) authenticates the subscriber of the mobile communication terminal (MS). When the RANDC value and the RANDC value previously stored in the mobile communication system are compared and matched, the authentication center (AC) is requested to authenticate the mobile communication terminal to perform authentication.

Further, in another embodiment of the present invention, in the case of the asynchronous mobile communication system, before the authentication center (AC) authenticates the subscriber of the mobile communication terminal (ME), the exchange / visitor location register (MSC / VLR), Specifically, the subscriber authentication module compares the generated subscriber authentication value (RES) and the expected subscriber authentication value (XRES) previously stored in the mobile communication system in advance, and matches the corresponding mobile communication terminal to the authentication center (AC). Request authentication to perform authentication.

The synchronous mobile communication system according to the present invention includes, for example, CDMA2000, CDMA2000 1X, CDMA2000 1X Evolution-Data Only (EV-DO) and the like, and the asynchronous mobile communication system may include, for example, WCDMA, GSM, MBS, and the like. . In addition, the terminal 110, 210 according to an embodiment of the present invention is a PDA (Personal Digital Assistant), cellular (Cellular) phone, PCS (Personal Communication Service) phone, CDMA-2000 (Code Division Multiple Access) according to the mobile communication system applied 2000) Phone, GSM Phone, WCDMA Phone, Evolution-Data Only (EV-DO) Phone, Evolution-Data and Voice (EV-DV) Phone, Mobile Broadband System (MBS) Phone, Hand-Held PC It may include at least one or more wireless communication terminals selected from among.

As described above, in the embodiments of the present invention, when the mobile communication terminal performs authentication of the mobile communication terminal in a wireless communication system to which the mobile communication terminal is wirelessly connected, before the authentication center performs authentication of the corresponding terminal, The intermediate node (for example, base station controller (BSC) or exchange (MSC)) compares the information required for authentication from the mobile communication terminal with the information previously stored in the mobile communication system and compares each other, and if the match is to the terminal to the authentication center. Request for authentication and the authentication center to perform the authentication of the terminal. Through this process, it is possible to check in advance the authentication type mismatch in the mobile communication system and the terminal in advance so that the network operator can quickly take action when an authentication type mismatch occurs.

In addition, in another embodiment of the present invention, by checking the signal transmission between the nodes of the mobile communication system when performing the authentication of the mobile communication terminal, the failure of the terminal is eliminated in advance by quickly confirming and correcting the failure of the node. Help reduce customer complaints caused by failures.

The detailed description of the present invention and the accompanying drawings describe a method of authenticating a mobile communication terminal in a mobile communication system according to the present invention. In particular, whether the base station or node B transmits a RAND value to the base station or the node B, whether it is one-way authentication from the mobile communication system to the terminal or two-way authentication between the terminal and the mobile communication system, The technical features for preventing the authentication failure of the terminal due to the transmission error of the RAND value between the terminal-base international controller / switch-authentication center are transmitted in advance by transmitting the ACK to the base station controller or the exchange. . However, in the authentication method of the mobile communication terminal of the present invention, each component may also perform other functions. Therefore, the present invention omits detailed description of known functions or configurations not related to the technical spirit of the present invention.

5 is a view for explaining a process of generating a RANDC value using the RAND value according to an embodiment of the present invention.

Referring to FIG. 5, the base station controller (BSC) 130 of the mobile communication system according to an embodiment of the present invention continuously checks authentication related data and generates a 32-bit RAND value to generate a base station (BTS). It transmits to the terminal (MS) 110 through 120. The terminal 110 generates an 8-bit RANDC value through an authentication algorithm previously stored using the received RAND value and predetermined data, for example, predetermined data including an ESN and an SSD. In addition, the exchange / visitor location register (MSC / VLR) 240 receives and stores an 8-bit RANDC value from the authentication center 290.

Meanwhile, the terminal 110 transmits the RANDC value and the authentication parameter generated as described above to the base station (BTS) 120 to request authentication. At this time, in another embodiment of the present invention, the base station (BTS) 120 transmits the RANDC value and authentication parameter to the exchange / visitor location register (MSC / VLR) 160 without passing through the base station controller (BSC) 130. Can also be sent directly. In this case, the exchange / visitor location register (MSC / VLR) 160 may generate and store its own RANDC value according to the setting of the operator, and the two RANDC at the exchange / visitor location register (MSC / VLR) 130. When the values are matched and matched, the authentication center (AC) 190 may be requested to the corresponding terminal through the HLR 180.

In addition, the terminal may transmit an authentication request message to the base station according to the user's request. In this case, the terminal may transmit the authentication request message at a predetermined time interval, for example, 45 seconds, 1 minute interval. The RANDC value may be included in the authentication request message, and the RANDC value may be 8 bits.

The drawings and detailed description of the invention are merely exemplary of the invention, which are used for the purpose of illustrating the invention only and are not intended to limit the scope of the invention as defined in the appended claims or claims. As such, those skilled in the art will appreciate that various modifications and equivalent other embodiments are possible therefrom. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

In order to receive various services provided by a mobile communication system using a mobile communication terminal, an authentication process for confirming whether a mobile communication terminal has a right is required. If an error occurs in the authentication process of the mobile communication terminal or the authentication time is long, it may not satisfy the demand of the customer who wants a quick service for the recent mobile communication service, and the overall quality of the mobile communication service quality (QoS) assessment of services will be lowered.

In this respect, the present invention, which can improve the authentication success rate of the mobile communication terminal in the mobile communication system, can be practically applied to the mobile communication system. In addition, due to the improvement in the authentication success rate of the mobile communication terminal, the number of call retries can be reduced, thereby reducing the load on the mobile communication system, thereby enabling efficient management of the mobile communication system.

1 is a schematic configuration diagram of a mobile communication system to which an authentication method of a mobile communication terminal according to an embodiment of the present invention is applied.

2 is a procedure showing an authentication method of a mobile communication terminal according to an embodiment of the present invention.

3 is a schematic configuration diagram of a mobile communication system to which an authentication method of a mobile communication terminal according to another embodiment of the present invention is applied.

4 is a flowchart illustrating an authentication method of a mobile communication terminal according to another embodiment of the present invention.

5 is a view for explaining a process of generating a RANDC value using the RAND value according to an embodiment of the present invention.

 Explanation of symbols on the main parts of the drawings

110,210: mobile communication terminal (MS / ME) 120: base station (BTS)

130: base station controller (BSC) 160,260: exchange / visitor location register (MSC / VLR)

170,280: Home Location Register (HLR) 180,290: Certification Center (AC)

200: subscriber authentication module 210: node B

230: Radio Network Controller (RNC) 250: GMSC

260: SSGN 270: GGSN

Claims (13)

In the authentication method of a mobile communication terminal in a mobile communication system, Transmitting, by the base station controller, an authentication parameter and a RAND value for the mobile communication terminal to be authenticated to the base station; Transmitting, by the base station, an acknowledgment (ACK) in response to receiving the authentication parameter and the RAND value to the base station controller; A third step of checking, by the base station controller, the response (ACK) and requesting the base station to transmit the authentication parameter and the RAND value to the terminal; A fourth step of transmitting, at the base station, the authentication parameter and the RAND value to the terminal according to the request; A fifth step of setting an authentication parameter in the terminal and generating a RANDC value using the received RAND value and then transmitting the generated RANDC value and the set authentication parameter to the base station controller through the base station; A sixth step in which the base station controller compares the received RANDC value with a previously stored RANDC value and requests authentication of the terminal from an authentication center when the base station controller compares the received RANDC value; And A seventh step of performing authentication on the terminal in the authentication center; Authentication method of a mobile communication terminal comprising a. The method of claim 1, The method of claim 1, wherein the first step, And generating a RAND value according to a preset period in the base station controller. The method of claim 1 or 2, wherein after the first step, And changing the RAND value according to a preset period in the base station controller. The method of claim 3, wherein the second step, And transmitting, by the base station, an acknowledgment (ACK) of receiving the changed RAND value to the base station controller. The method of claim 1, wherein the second step, And the base station includes the received authentication parameter and the RAND value in the response and transmits the received authentication parameter and the RAND value to the base station controller. The method of claim 5, wherein the third step, The authentication parameter and the RAND value included in the response (ACK) in the base station controller are compared with the authentication parameter and the RAND value transmitted to the base station. Authentication method for a mobile communication terminal, characterized in that requesting to transmit to the terminal. In the authentication method of a mobile communication terminal in a mobile communication system, A first receiving and storing a plurality of authentication vectors from the authentication center at the exchange, extracting the RAND value and the AUTN value included in the authentication vector, and including the extracted RAND value and the AUTN value in a subscriber authentication request message and transmitting the same to the base station; step; Transmitting, by the base station, an acknowledgment (ACK) in response to receiving the subscriber authentication request message to the exchange; A third step of checking, by the exchange, the response (ACK) and requesting the base station to transmit the transmitted subscriber authentication request message to the terminal; A fourth step of transmitting, by the base station, the subscriber authentication request message to the terminal according to the request; A fifth step of generating, at the terminal, a subscriber authentication value (RES) using the RAND value and the AUTN value included in the subscriber authentication request message and transmitting the generated subscriber authentication value (RES) to the exchange; A sixth step in which the exchange compares the transmitted subscriber authentication value RES with a previously stored subscriber expected response value XRES and requests authentication of the terminal to the authentication center if they match each other; And A seventh step of performing authentication on the terminal in the authentication center; Authentication method of a mobile communication terminal comprising a. The method of claim 7, wherein the first step, Transmitting an acknowledgment (ACK) in response to receiving the authentication vector from the exchange to the authentication center; Checking the response (ACK) in the authentication center and requesting the exchange to transmit the RAND value and the AUTN value included in the transmitted authentication vector to the base station; And Extracting, by the exchange, a RAND value and an AUTN value included in the authentication vector in the subscriber authentication request message according to the request; Authentication method of a mobile communication terminal comprising a. The method of claim 8, wherein the transmitting of the response to the authentication vector reception comprises: And the exchange base station transmits the received authentication vector to the authentication center by including the received authentication vector in the response (ACK). The method of claim 9, wherein the acknowledgment (ACK) at the authentication center comprises: The authentication method of the mobile communication terminal, characterized in that the authentication center compares the authentication vector transmitted in the response (ACK) and the authentication vector transmitted to the exchange to confirm whether. The method of claim 7, wherein the second step, And the base station includes the received subscriber authentication request message in the response and transmits the received subscriber authentication request message to the exchange. The method of claim 11, wherein the third step, And comparing, by the exchange, a subscriber authentication request message included in the response (ACK) and a subscriber authentication request message transmitted to the base station and confirming whether they match with each other. The method of claim 7, wherein before the first step, Requesting a subscriber identification value from the exchange to a subscriber authentication module mounted in the terminal; And The subscriber authentication module transmitting previously stored subscriber identification values to the exchange through the terminal; Authentication method of a mobile communication terminal, further comprising.

Images