KR20100021690A - Method and system for supporting authentication and security protected non-access stratum protocol in mobile telecommunication system - Google Patents

Abstract

PURPOSE: A management method and a system for supporting a NAS(Non- Access Stratum) protocol security are provided to efficiently operate the mobility of a terminal, a location management and a registration management by using a method for efficiently processing the secured NAS message. CONSTITUTION: The front part of a AKA(Authentication and Key Agreement) authentication procedure is operated(401). A MME(Mobility Management Entity) decides whether to transmit an authentication request message or a NAS security mode authentication to a terminal(403). An authentication response message is received from the terminal(423). The MME decides a response from a corresponding terminal by comparing an expected response with a response(425). A security mode command message is transmitted from the MME to the terminal(427). A security mode complete message is received from the terminal(429).

Description

{METHOD AND SYSTEM FOR SUPPORTING AUTHENTICATION AND SECURITY PROTECTED NON-ACCESS STRATUM PROTOCOL IN MOBILE TELECOMMUNICATION SYSTEM}

The present invention relates to a mobile communication system, and more particularly, to a method and system for efficiently supporting an authentication process of a terminal and a network and a NAS protocol security process between a terminal and a mobility manager (MME).

The 3rd Generation Partnership Project (3GPP), which is representative of general mobile communication systems, defines an Evolved Packet System (EPS) for next generation communication, and introduces an MME as a mobility management entity of a network.

In the mobile communication system as described above, an improvement method for providing a high speed communication service in the next generation mobile communication by improving the NAS protocol used in the 3GPP of the conventional mobile communication system, in particular 3GPP. Therefore, in addition to the authentication process and the security process performed in the wireless access layer, the security management method was strengthened by introducing the concept of a secured NAS protocol in the NAS layer.

However, the current NAS protocol definition and security definition of the NAS protocol are in an initial stage, and specific procedures and attributes for supporting the above functions are not defined. In addition, the presently defined procedures and defined messages may cause problems in that a large number of signals are generated for operation in an actual operation, and the time required for signaling processing is increased. Therefore, the NAS security mode command command, which is introduced to enhance the security of the NAS protocol, improves authentication and communication and security between the terminal and the mobility manager (MME). You need to specify how to support it.

According to the present invention, when the NAS protocol is supported in an evolved mobile communication system including 3GPP EPS, security is provided for authentication between a terminal and a network and secured NAS message between a terminal and a mobility manager (MME). It provides a method and system to safely and efficiently support authentication and security in a short time. In addition, the present invention specifies how the NAS security process operates using the NAS protocol, which is a protocol between the terminal and the mobility manager (MME), thereby moving not only within the 3GPP EPS but also to a wireless access technology other than 3GPP EPS, that is, to another access network. Even if it is provided to the terminal using the NAS provides a method for supporting authentication and security management between the terminal (entity), such as the role of the mobility manager (MME).

The present invention relates to a method and system for managing security between a terminal and a network using a non-access stratum (network layer: NAS) protocol in a mobile communication network, the NAS protocol according to the present invention. A method for managing security between a terminal and a network by using a message includes a terminal (hereinafter referred to as UE) and a mobility manager (hereinafter referred to as MME). The authentication is performed between the terminal and the network. The terminal performs authentication with the network by selectively enabling the NAS security mode command set for NAS protocol operation between the terminal and the mobility manager (MME) during the authentication process and the authentication process. And secure mode commands, or the terminal is secured in the middle of performing network and authentication. Performing de command to shorten the time required for security procedures, may perform the operations necessary for the security between the terminal and the mobile manager (MME). Therefore, the present invention has an advantage of reducing the time required for the authentication process and the security mode command. Meanwhile, the authentication process and the security mode command process can be performed independently according to the role to be performed, thereby raising the method of preparing for the case where the execution of the security mode command is arbitrarily necessary and needs to be performed. In addition, there is an advantage of efficiently managing security in communication between the terminal and the mobile manager, and shortening the time according to the security procedure.

According to an embodiment of the present invention, a method for managing security between a terminal and a network using a non-access stratum (non-access stratum, ie, network layer: NAS) protocol in a mobile communication network includes a terminal (hereinafter referred to as UE), A mobile manager (MME), which includes a mobility management entity (hereinafter referred to as MME) and an HSS, sends and receives an authentication request / response message between the terminal, the mobile manager and the HSS, and exchanges necessary information with the terminal. Enabling a user to selectively perform a NAS security mode command set for NAS protocol operation between the terminal and the mobility manager (MME) during an authentication process between the mobile managers and responding to the mobile manager from the terminal. It is characterized by the process of receiving a message.

In this case, the NAS related message further includes a NAS security mode active type information element, which is a message that enables selective execution. And it further includes a NAS security mode information element that informs the NAS security mode information to be included if possible to perform optional. In addition, the NAS security mode activation type information element further includes a NAS security mode activation type value. The NAS security mode activation type information element further includes a security flag.

In addition, a system for managing security between a terminal and a network using a non-access stratum (hereinafter referred to as NAS) protocol in a mobile communication network includes a terminal (hereinafter referred to as UE) and a mobile manager ( MME, mobility management entity (hereinafter referred to as MME), a mobility manager that includes an HSS, transmits an authentication request message or an authentication request message including NAS security mode, or a NAS security mode command message, and transmits information required for these messages; The mobile terminal transmits an authentication response message or NAS security mode completion message including a response message or NAS security mode, and transmits information necessary for these messages, and an HSS for generating and transmitting an authentication vector required for authentication.

In the present invention operating as described in detail above, the effects obtained by the representative ones of the disclosed inventions will be briefly described as follows.

The present invention manages the mobility and idle mode of a terminal using a non-access stratum (network layer: NAS) protocol in a mobile communication network (registration management: Attach, detach) Management), location management (location management: tracking area management) method and system, using the NAS protocol, that is, the message according to the present invention to manage the mobility of the terminal, idle mode (idle mode), registration management, location management The method includes a terminal (hereinafter referred to as UE) and a mobility manager (hereinafter referred to as MME), wherein the terminal is handed over in an active mode and an idle mode. (location management) in the (idle mode), when the terminal is registered in the network, mobility management in a network such as EPS (Evolved Packet System) of 3GPP When sending or receiving a message that plays the same role among the EMM (EPS Mobility Management) messages, if the received message is a secured NAS message, a method for efficiently handling the secured NAS message is presented. There is an advantage of efficient location management and registration management.

Hereinafter, with reference to the accompanying drawings will be described in detail the operating principle of the preferred embodiment of the present invention. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted if it is determined that they may unnecessarily obscure the subject matter of the present invention. In addition, terms to be described below are defined in consideration of functions in the present invention, which may vary according to intentions or customs of users and operators. Therefore, the definition should be made based on the contents throughout the specification.

SUMMARY OF THE INVENTION The present invention to be described below provides a method for managing and supporting authentication and security of a NAS, which is a protocol between a terminal and an MME, using a NAS protocol, which is a protocol between a terminal and an MME, for a mobile communication system. Hereinafter, in describing the present invention in detail, an EPS system based on 3GPP will be used, and the present invention may be used in other mobile systems using NAS.

Meanwhile, as shown in FIG. 1 of the present invention, the embodiment of FIG. 1 proposes a method for supporting security during authentication and communication between a terminal and a mobility manager (MME) using a NAS protocol, which is a basic object of the present invention. May be modified in some manner without departing from the scope of the present invention in other mobile communication systems having similar technical background and channel type, network architecture or similar protocol or protocols having different but similar operation. Applicable, this will be possible at the discretion of those skilled in the art.

1 is a block diagram illustrating an authentication and security environment in a mobile communication system according to an exemplary embodiment of the present invention. Here, the 3GPP EPS system structure is shown as an example.

Referring to FIG. 1, an Evolved Node Base Station (E Node B: hereinafter referred to as eNB) 112 is a UE (User Equipment: hereinafter referred to as UE or UE) located in a cell which is each service area 110. Set up a wireless connection with and perform communications. The UE 110 refers to a terminal that accesses a packet data network such as the Internet through a serving gateway (hereinafter, referred to as a Serving GW, or SGW) 116. In the present specification, as a main network entity of the packet data network, the packet data network gateway (hereinafter referred to as PDN GW) 118 serves as a home agent (hereinafter referred to as HA). On the other hand, there is a mobility management entity (hereinafter referred to as MME) 114 for mobility management of a terminal, location management of a terminal, and registration management. In addition, a Home Subscriber Server (hereinafter referred to as HSS) 121 is connected to the MME 114 with an interface in order to manage authentication information and service information for the user and the terminal.

An interface for managing the data path and mobility of the UE exists between the eNB 112 and the Serving GW 116, the MME 114, and the Serving GW 116. The UE 110 and the MME 114 in the present invention communicate with each other with a NAS protocol stack to perform mobility management, location management, registration management, and session management.

The present invention focuses on the NAS protocol, which is a protocol between the MME 114 and the terminal 110, which are entities introduced for mobility management, location management, and session management of the UE 110. That is, the NAS protocol introduced between the terminal 110 and the MME 114 for mobility management, location, and session management has been enhanced in the EPS system, which was also present in the conventional 3GPP system. That is, the NAS protocol procedure and the role of each entity have been supplemented in order to support integrity and encryption in the NAS protocol, but at present, the UE 110 and the MME 114 efficiently operate based on the NAS protocol. 2 to 5 will be described below with reference to the above network to operate.

2 is a message flow diagram illustrating a procedure of an authentication and NAS protocol security process according to an embodiment of the present invention. 2 is a NAS protocol security, i.e., the integrity and encryption process of the NAS protocol, and the difference with the conventional technology in this flow will refer to the message formats shown in Tables 1 to 4 below. Important entities in the authentication process and the NAS security process are the UE 110, the MME 114, and the HSS 121 as shown in FIG. 2. In step 201, the UE 110 sends a user identifier to the MME 114, the MME 114 and the HSS 121 request and receive an authentication vector, and the MME 114 selects an authentication vector. In step 203, the MME 114 sends an authentication request (AUTHENTICATION REQUEST) message to the UE 110 to display an authentication token (hereinafter referred to as AUTN) and a random number request (random challenge: referred to as RAND) which are part of the authentication vector. The UE 110 verifies the received AUTN. In step 205, the UE 110 sends an authentication response message to the MME 114, including a response parameter calculated by the UE 110 (hereinafter, referred to as RES) to the MME 114. Thereafter, in step 207, the MME 114 and the UE 110 perform the remainder of the authentication and key agreement protocol (hereinafter referred to as AKA). In other words, the UE 110 calculates an integrity key (indicated by IK hereinafter) and an encryption key (indicated by Ck below a cipher key), and in the MME 114, a response parameter RES and an expected response (Expected Response). (Hereinafter referred to as XRES) to verify whether the MME itself is an authentication response from the terminal that sent the authentication request. In step 209, the NAS security mode command message is sent from the MME 114 to the UE 110. The NAS security mode command informs the selected NAS security algorithm and NAS key set identifier (KSI), and in response to this, in step 211, the UE informs the MME of the NAS security mode complete message. send. Since the security mode command is used for NAS message security setting, it is also used when used with the authentication process as in the present invention. Therefore, in the present invention, a process in which a security mode command is issued after the authentication process can be selectively used in the authentication process has been described. Since, the NAS security mode of FIG. 3 and Tables 1 to 4 are described. Reference is made to related information elements (hereinafter referred to as IE). That is, for the operation as shown in FIG. 2, an authentication request (AUTHENTICAION REQUEST) message that does not include NAS security mode information should be transmitted from the MME to the UE. Such operation is referred to the following [Table 2] to [Table 4].

3 is a message flow diagram illustrating a procedure of an authentication and NAS protocol security process according to an embodiment of the present invention. In other words, FIG. 3 illustrates an embodiment in which the authentication process and the security mode command process as shown in FIG. 2 are performed together.

Referring to FIG. 3, in step 301, as in step 201, the UE 110, the MME 114, and the HSS 121 perform an operation in front of the AKA. Subsequently, in step 303, the AKA authentication request process and the NAS security mode command process are performed together. In the present invention, this is indicated as an AUTHENTICAION REQUEST with NAS SECURITY MODE message. This process depends on the message format of [Table 1] to [Table 4]. The NAS security mode including authentication request message is a request message sent from the MME 114 to the UE 110. In step 305, the UE 110 transmits an NAS security mode including authentication response (AUTHENTICATION RESPONSE with NAS SECURITY MODE) message to the MME 114. Thereafter, the MME compares the RES received from the UE with its own XRES to verify whether the message is from the UE.

4 is a flowchart illustrating a scheme for supporting an authentication and NAS protocol security process in an MME according to an embodiment of the present invention.

Referring to FIG. 4, in step 401, the first part of the AKA authentication process is performed. For a description of this process, refer to step 301 of FIG. 3 or step 201 of FIG. In step 403, the MME 114 determines whether to request the UE 110 only an authentication request message or transmit a NAS security mode authentication request message including a NAS security mode setting to the UE. In case of transmitting only the authentication request message, the mobile station proceeds to step 421 and sends an authentication request message that does not include the NAS security mode to the UE as in step 421. When receiving an authentication response message from the UE as in step 423, step 425. Compare the RES and XRES as in to determine whether the response from the terminal. If necessary, as in step 427, the security mode command (SECURITY MODE COMMAND) message is sent from the MME 114 to the UE 110 in response to the security mode completion message (SECURITY MODE COMPLETE) message from the terminal in step 429 Will receive. In this case, in step 421, in order to inform that the NAS security mode is not included, the message formats shown in Tables 2 to 4 may be used. Alternatively, the conventional message format may be used as it is.

Meanwhile, when the authentication request message including the NAS security mode is transmitted from the MME to the UE as in step 405, the authentication response message including the NAS security mode is received from the UE as in step 407, and thus, RES and XRES are received as in step 409. Compare and verify whether the response from the terminal. In this case, the NAS security mode including authentication request message and the NAS security mode including authentication response message transmitted in steps 405 to 407 may use the message formats shown in Tables 1 to 2 below.

5 is a flowchart illustrating a method for supporting an authentication and NAS protocol security process in a terminal according to an embodiment of the present invention.

Referring to FIG. 5, in step 501, an AKA authentication front part as in step 201 of FIG. 2 is performed. In operation 503, the UE may receive a message including only an authentication request message from the MME or an authentication request message including a NAS security mode. If only the authentication request message is received, the process proceeds to step 511 to verify the AUTN which is part of the AKA process and calculate the RES. The description thereof will be referred to the later description of step 203 of FIG. 2. Thereafter, in step 513, the UE sends an authentication response message to the MME. In operation 515, the integrity key IK and the encryption key CK are calculated.

On the other hand, when the UE 110 receives the NAS security authentication request message from the MME, the AUTN is verified and the RES is calculated in step 505. For a description thereof, refer to the later description of step 203 of FIG. Thereafter, in step 507, an authentication response message including a NAS security mode is transmitted to the MME. Then step 515 is the same as described above.

As described above with reference to FIGS. 2 to 5, in order for the UE and the MME to operate, the following messages of Tables 1 to 4 may need to be supported. This will be described below.

[Table 1] is a NAS security mode information element (indicated by IE hereinafter). In the case where the NAS security mode activation type IE (Information element) of [Table 2] indicates that the NAS security mode is activated and used, Information element that informs about the information to be included. Therefore, it is included in the authentication request (AUTHENTICATION REQUEST) message sent from the MME to the UE to include specific NAS security mode information. The NAS security mode information element identifier of 1 octet is assigned by the standard organization. The 2 octets contain a length field indicating the total length of the NAS security mode information elements, and the 3 octets contain information of the selected NAS security algorithm. The four octets contain a NAS key set identifier, which identifies a _keyset, such as NAS encryption key K _NASenc or integrity key K _NASint , used to secure NAS messages. Octet 5 describes the security algorithms supported by the UE, and octet 6 contains the international mobile equipment identity software version (hereafter referred to as IMEISV), indicating the mobile device and its software version of the subscriber. You will be informed. Such an IMEISV is a parameter that is generally included when the terminal requests the IMEISV to be included in the authentication or encryption response message.

Message 1: NAS Security Mode Information Element (IE)

[Table 2] below is a NAS security mode activation type IE (Information element) sent by including in an authentication request (AUTHENTICATION REQUEST) message sent from the MME to the UE. This is an information element (hereinafter referred to as IE) that is used to inform the UE whether to use the NAS security mode. Composed of 8 bits in total, bit 5678 will be a value assigned by 3GPP or a standard authority as an information element identifier. Meanwhile, bit 123 is used to inform the type of activating the NAS security mode. For one embodiment of the specific value, refer to [Table 3]. It is also used as a flag for deciding whether to use the NAS security mode and one embodiment of a specific example of the value will be referred to the embodiment of Table 4 below.

Message 2: NAS Security Mode Active Type Information Element (IE)

Table 3 below records an embodiment of assigning a value according to the NAS security mode active type. In the case of attach, handover, tracking area update, MME's request or reserved for future use, bit 123 is assigned as 000, 001, 010 as follows: Use to distinguish. On the other hand, if the NAS security mode is activated by MME request, 011 is used, and the other combination of bits is reserved for future use.

Message 3: NAS Security Mode Active Type Value

Table 4 below shows an embodiment of a table for a security flag used as a flag for determining whether to use a NAS security mode. When the value of 4 bit is set to 0, an authentication request message (authentication request) not including the NAS security mode is transmitted from the MME 114 to the UE 110. On the other hand, if set to 1, the authentication request message including the NAS security mode is transmitted.

Message 4: Security flag value of NAS security mode active type IE

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be defined not only by the scope of the following claims, but also by those equivalent to the scope of the claims.

1 is a block diagram illustrating an authentication and security environment in a mobile communication system according to an embodiment of the present invention;

2 is a message flow diagram illustrating a procedure of authentication and NAS protocol security process according to an embodiment of the present invention.

3 is a message flow diagram illustrating a procedure of an authentication and NAS protocol security process according to an embodiment of the present invention.

4 is a flowchart illustrating a method for supporting authentication and NAS protocol security processes in an MME according to an embodiment of the present invention.

5 is a flowchart illustrating a method for supporting an authentication and NAS protocol security process in a terminal according to an embodiment of the present invention.

Claims (2)

In the security management method between the terminal and the network using a connectionless protocol in a mobile communication network, Sending and receiving authentication request / response messages between the UE, the mobile manager and the HSS and exchanging necessary information; Enabling to selectively execute a NAS security mode command set for NAS protocol operation between the terminal and the mobility manager during the authentication process between the terminal and the mobile manager; Security management method comprising the step of receiving a response message from the terminal to the mobile manager. A system for managing security between a terminal and a network using a connectionless protocol in a mobile communication network, A mobility manager that sends an authentication request message or a NAS security mode command message, including the authentication request message or NAS security mode, and sends the necessary information to these messages; A mobile terminal that transmits an authentication response message or a NAS security mode completion message including an authentication response message or a NAS security mode, and transmits information necessary for these messages; Security management system, characterized in that consisting of the HSS to generate and transmit the authentication vector required for authentication.

Images