KR20110108680A - Authentication method and apparatus - Google Patents

Abstract

An authentication method and apparatus are disclosed. In the method of authenticating the user terminal in the exchange, if the authentication mode is set, and if the authentication mode is active, the authentication vector most recently used among the stored authentication vectors is extracted, and then the extracted authentication vector is transmitted to the user terminal for authentication. Request to obtain an authentication value, and may authenticate the user terminal according to whether the obtained authentication value and the authentication result value included in the extracted authentication vector are identical.

Description

Authentication method and apparatus

The present invention relates to a mobile communication system, and more particularly, to a method and a system capable of performing authentication on a terminal without going through an authentication center.

The authentication procedure in the mobile communication system is a procedure for determining whether the subscriber information stored in the authentication center of the mobile communication network matches the predetermined information stored in the mobile communication terminal. At this time, the authentication key is necessarily used in the authentication procedure, the symmetric key method for authenticating the authentication apparatus and the user terminal using the same authentication key is mainly used. This authentication procedure may be performed for each location registration, every signal or incoming call of the subscriber, or may be selectively performed.

If a problem occurs in this authentication procedure, the exchange cannot request an authentication vector to the authentication center for the authentication procedure of the user terminal, and as a result, the location registration for the user terminal cannot be completed normally.

If the location registration fails, the user terminal requests the location registration to the mobile communication system again to receive the communication service provided by the mobile communication system, and this process is continuously repeated, resulting in an overload of the authentication center. Done.

The present invention provides an authentication method and apparatus capable of performing authentication on a user terminal without going through an authentication center when the authentication center is overloaded.

For this reason, the present invention is to provide an authentication method and apparatus capable of stabilizing the entire mobile communication network without changing the network system.

According to an aspect of the present invention, there is provided an apparatus capable of authenticating a user terminal without interworking with an authentication center when the authentication center is overloaded.

According to an embodiment of the present invention, a storage unit for storing one or more authentication vectors; Setting unit for setting an authentication mode, wherein the authentication mode is set to active or inactive; And a control unit for performing authentication on a user terminal using the most recently used authentication vector among the stored authentication vectors when the authentication mode is active.

According to another aspect of the present invention, a method for authenticating a user terminal without interworking with an authentication center when an authentication center is overloaded is provided.

According to an embodiment of the present invention, there is provided a method of authenticating a user terminal at an exchange, comprising: (a) setting an authentication mode, wherein the authentication mode is active or inactive; (b) if the authentication mode is active, extracting a most recently used authentication vector among previously stored authentication vectors; (c) requesting authentication by transmitting the extracted authentication vector to a user terminal to obtain an authentication value; And (d) authenticating the user terminal according to whether the obtained authentication value is identical to the authentication result value included in the extracted authentication vector.

By providing an authentication method and apparatus according to an embodiment of the present invention, it is possible to perform authentication on a user terminal without going through an authentication center when the authentication center is overloaded.

Therefore, the present invention can stabilize the entire mobile communication network without changing the network system.

1 is a block diagram schematically illustrating a configuration of a mobile communication system for performing authentication for a user terminal.
2 is a flowchart illustrating a method for authenticating a subscriber of a user terminal in a mobile communication system.
3 is a block diagram schematically illustrating an internal configuration of an exchange that authenticates a user terminal without interworking with the home location register of FIG.
4 is a flow chart illustrating a method in which an exchange authenticates a user terminal without interworking with a home location register.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

The terms first, second, etc. may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

[Description of Fig. 1]

1 is a block diagram schematically illustrating a configuration of a mobile communication system that performs authentication for a user terminal.

Referring to FIG. 1, a mobile communication system includes a user terminal 110, a base station 120, an exchange 130, and a home location register 140.

The user terminal 110 is an apparatus for receiving various communication services provided by a mobile communication system through a communication network. For example, the type of the user terminal 110 may be a personal computer (PC), a personal digital assistant (PDA), a cellular phone, a personal communication service (PCS) phone, a hand-held PC, or a GSM (Global). System for Mobile (Phone), WCDMA phones, CDMA-2000 phones, MBS (Mobile Broad and System) phones and the like can be included.

That is, the user terminal 110 may be equally applicable to any device capable of receiving a mobile communication service through a communication network.

The base station 120 receives location information of the user terminal 110, registrant information, and a communication call of the user terminal 110. For example, the base station 120 may include a base station transmitter (BTS), a base station controller (BSC) and a repeater (not shown). have.

The base station transmitter is arranged in units of cells and performs a function of transmitting a communication call of the communication terminal 110 to the exchange 130 via the base station controller. In addition, the base station transmitter performs location registration by identifying the position of the user terminal 110 existing in the cell area under the control of the base station transmitter.

The base station transmitter receives location information of the base station transmitter from a global positioning system (GPS). The base station transmitter transmits the location information to the user terminal 110 using the system parameter message of the forward link call channel. The user terminal 110 may register new location information by calculating the location of the user terminal 110 using the location information of the base station transmitter of the cell to which the user terminal 110 belongs. Location registration is a process of informing the exchange 130 of the location, status, identifier, slot period, and other characteristics of the user terminal 110 through the base station transmitter, where the base station transmitter is to establish an incoming call to the user terminal 110. When the user terminal 110 can be called effectively. Such location registration is performed when the power of the user terminal 110 is turned on or off, the user terminal 110 moves the exchange period, or the parameter of the user terminal 110 is changed.

The base station controller performs various functions required for radio call processing such as handoff while controlling and managing a plurality of base stations. The base station controller also transmits subscriber information of the location registered terminal to the exchange.

The base station controller performs a function of transferring a communication call transmitted from the user terminal 110 through the base station transmitter to the exchange 130.

The exchange 130 has a control function and an interworking function with a public telephone network and another network switch so that the wireless base stations can be efficiently operated. For example, when the exchange 130 receives an outgoing call, the exchange 130 checks the home location register 140 of the GT (Global Title) through translation of the incoming prefix number. The exchange 130 inquires the location information of the called terminal in the identified home location register 140 and routes it to another exchange in which the called terminal is located according to the result.

In addition, the exchange 130 is provided with a visitor location register (not shown) inside or directly connected to the visitor location register outside, the authentication received from the home location register 140 in response to the location registration request of the user terminal 110 Store the vector in the visitor location register. Accordingly, the exchange 130 may obtain the authentication vector from the home location register 140 when the authentication vector is not stored in the visitor location register when the user registers the location registration request of the user terminal 110 and stores the authentication vector in the visitor location register. have.

In addition, the exchange 130 may perform the authentication procedure for the user terminal 110 without obtaining the authentication vector through the home location register 140, depending on whether the authentication mode is set. Here, the authentication mode may be active or inactive. A method of performing an authentication procedure for the user terminal 110 according to whether the authentication mode is set in the exchange 130 will be described in more detail with reference to the accompanying drawings below.

The home location register 140 provides routing information to the exchange 130. In addition, the database stores a service profile regarding subscriber information of a user of the user terminal 110. The home location register 140 has information on a subscriber's phone number of the user terminal 110, a mobile identification number (MIN), an electronic serial number (ESN), and a service type. That is, the home location register 140 stores all the subscriber information including the information of the base station 120 and the exchange 130 where the user terminal 110 is located. In addition, the home location register 140 may generate an authentication vector according to the authentication vector request of the exchange 130 and transmit the generated authentication vector to the exchange 130.

[Description of Fig. 2]

2 is a flowchart illustrating a method for authenticating a subscriber of a user terminal in a mobile communication system.

In operation 210, the exchange 130 requests authentication data from the home location register 140.

More specifically, the exchange 130 obtains international mobile subscriber identity (IMSI) through the user terminal 110 when an authentication vector is required for subscriber authentication for the user terminal 110. Subsequently, the exchange 130 may check the home location register in charge of the authentication of the user terminal 110 using the obtained subscriber identification information and request transmission of authentication data to the corresponding home location register.

Accordingly, at step 215, the home location register 140 generates authentication vectors and transmits an authentication data response including the generated authentication vectors to the exchange 130.

In step 220, the exchange 130 requests the terminal authentication after storing the authentication vectors.

Here, the exchange 130 may receive a plurality of authentication vectors from the home location register 140, and authenticate each user terminal by selectively using the received authentication vectors one by one without duplication. That is, in the normal case, when the exchange 130 uses all of the received plurality of authentication vectors, the switch 130 requests the authentication vectors from the home location register 140 and uses any one of the obtained authentication vectors without duplication. Through the user terminal 110 can be authenticated. However, if the plurality of authentication vectors cannot be obtained in association with the home location register 140, the user terminal may be authenticated by the method described with reference to FIG. 4.

The authentication vector includes a cipher key (CK), an integrity key (IK), an authentication result value (XRES), a random identification variable value (RAND, random challenge), and an authentication field (AUTN). The exchange 130 stores the encryption key CK, the integrity key IK, and the authentication result value among the authentication vectors received from the home location register 140, and generates a random identification variable value RAND and an authentication field AUTN. Transmits the request to the user terminal 110 to request authentication for the user terminal 110.

In operation 225, the user terminal 110 calculates an authentication value by performing a calculation according to a predetermined algorithm using the random identification variable value RAND and the authentication field AUTN received from the exchange 130.

In more detail, the user terminal 110 uses the random identification variable value RAND and the authentication field AUTN received from the exchange 130 to determine the serial number SQN, the message authentication code MAC, and the authentication management field value. Restore (AMF) Here, the method of restoring the serial number (SQN), the message authentication code (MAC), and the authentication management field value (AMF) using the random identification variable value (RAND) and the authentication field (AUTN) is obvious to those skilled in the art. A separate description thereof will be omitted.

Subsequently, the user terminal 110 generates a temporary message authentication code using a secret key K shared with the home location register 140 and determines whether the generated temporary message authentication code and the restored message authentication code are the same. By comparison, you can authenticate against the network.

If the generated message authentication code and the restored message authentication code are the same, the user terminal 110 compares the serial number SQN stored in the user terminal 110 with the serial number SQN included in the authentication field AUTN. To determine the validity of the serial number.

If the serial number (SQN) stored in the user terminal 110 and the serial number included in the authentication field (AUTN) is valid, the user terminal 110 is restored message authentication code (MAC), secret key (K) and random The authentication value RES is calculated using the identification variable value RAND.

In operation 230, the user terminal 110 transmits the calculated authentication value RES to the exchange 130.

In operation 235, the exchange 130 performs authentication on the user terminal 110 by comparing the temporary authentication result value XRES stored in the exchange 130 with the authentication value RES received from the user terminal 110. .

If the temporary authentication result value (XRES) and the received authentication value (RES) are the same, the exchange 130 sends a security mode agreement message (SMC) including a new encryption key (CK) and an integrity key (IK). ) To perform the secure mode agreement process.

The above-described authentication method for the user terminal is an essential process. When the authentication for the user terminal is not performed, the user terminal 110 may not receive various communication services provided by the mobile communication system.

[Description of Fig. 3]

3 is a block diagram schematically illustrating an internal configuration of an exchange that authenticates a user terminal without interworking with a home location register.

Referring to FIG. 3, the exchange 130 includes a communication unit 310, a setting unit 320, a storage unit 330, and a control unit 340.

The communication unit 310 performs a function of transmitting and receiving data with other devices (eg, the user terminal 110) through a communication network.

For example, the communication unit 310 may transmit a subscriber authentication request to the user terminal 110. Here, the subscriber authentication request may include a random identification variable value RAND and an authentication field AUTN among the authentication vectors selected by the controller 340.

In addition, the communication unit 310 may receive a response to the subscriber authentication request (ie, subscriber authentication response) from the user terminal 110. Here, the subscriber authentication response may include an authentication value.

The setting unit 320 performs a function of setting the authentication mode. Here, the authentication mode may be set to active or inactive.

For example, the setting unit 320 may receive the authentication mode by the administrator of the mobile communication system and set the authentication mode to be active or inactive. In addition, the setting unit 320 may set the authentication mode to be active or inactive according to the control message from the home location register 140.

In the present embodiment, the authentication mode is a mode in which the exchange 130 specifies whether to interwork with the home location register 140 for authentication of the user terminal 110. For example, when the authentication mode is set to active, the exchange 130 is not associated with the home location register 140 and is used most recently among the authentication vectors previously received and stored from the home location register 140. The user terminal 110 is authenticated using the authenticated authentication vector.

On the other hand, when the authentication mode is set to inactive, the exchange 130 is interlocked with the home location register 140, receives the authentication vectors from the home location register 140, and selectively receives the received authentication vectors without duplication. Authentication may be performed for the user terminal 110 by using the.

The storage unit 330 may include an algorithm required for operating the exchange 130, an authentication algorithm required for authentication, one or more secret keys shared with the user terminal 110, and one or more authentication vectors received from the home location register 140. For example, the authentication result corresponding to each authentication vector is stored.

The controller 340 controls the internal components of the switch 130 (eg, the communication unit 310, the setting unit 0, and the storage unit 330).

In addition, when the authentication mode is set to active through the setting unit 320, the controller 340 extracts the authentication vector most recently used in the storage unit 330, and uses the extracted authentication vector to transmit the user terminal 110. ) Can be authenticated.

For example, if the authentication mode is active, the controller 340 extracts the last stored authentication vector, and transmits the random identification variable value RAND and the authentication field AUTN of the extracted authentication vector to the user terminal 110. Send request for subscriber authentication.

Accordingly, when the corresponding authentication value is received from the user terminal 110, the user terminal 110 may be authenticated by comparing the authentication result value of the extracted authentication vector with the received authentication value. This will be described in more detail with reference to the accompanying drawings below.

[Description of Fig. 4]

4 is a flowchart illustrating a method in which an exchange authenticates a user terminal without interworking with a home location register.

In operation 410, the exchange 130 determines whether an authentication mode is set to active when an authentication vector is required for authentication of the user terminal 110.

If the authentication mode is set to inactive, the user terminal 110 is authenticated in the manner described with reference to FIG. 2. Since this is the same as described with reference to FIG. 2, redundant descriptions will be omitted.

However, if the authentication mode is active, then at step 415 exchange 130 extracts the most recently used authentication vector.

Subsequently, in step 420, the exchange 130 transmits a user authentication request including the random identification variable value RAND and the authentication field AUTN of the extracted authentication vector to the user terminal 110.

In operation 425, the user terminal 110 uses the random identification variable value RAND and the authentication field AUTN received from the exchange 130 to display a serial number SQN, a message authentication code MAC, and an authentication management field AMF. Restore).

In operation 430, the user terminal 110 determines whether the serial number SQN previously stored in the user terminal 110 is equal to or larger than the restored serial number SQN.

If the previously stored serial number SQN is equal to or larger than the restored serial number SQN, the user terminal 110 calculates an authentication value using the random identification variable value RAND in step 435.

That is, if the previously stored serial number SQN is equal to or greater than the restored serial number SQN, the user terminal 110 may recognize that the authentication is successful for the network and perform an authentication procedure.

However, if the previously stored serial number (SQN) is less than the restored serial number (SQN), the user terminal recognizes that the authentication for the network has failed in step 440 and does not perform the subsequent authentication procedure.

In operation 445, the user terminal 110 transmits the calculated authentication value to the exchange 130.

In operation 450, the exchange 130 may perform authentication on the user terminal 110 by determining whether the received authentication value is identical to the authentication result value included in the extracted authentication vector.

For example, when the received authentication value and the authentication result value included in the extracted authentication vector are the same, the exchange 130 recognizes that the authentication is successful for the user terminal 110.

However, if the received authentication value and the authentication result value included in the extracted authentication vector are different, the exchange 130 recognizes that the authentication for the user terminal 110 has failed.

On the other hand, a method for performing authentication on a user terminal without interworking with a home location register according to an embodiment of the present invention is implemented in the form of program instructions that can be performed through various electronic means for processing information and recorded in a storage medium. Can be. The storage medium may include program instructions, data files, data structures, etc. alone or in combination.

The program instructions recorded in the storage medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in the software art. Examples of storage media include magnetic media such as hard disks, floppy disks and magnetic tape, optical media such as CD-ROMs, DVDs, and magnetic-optical media such as floppy disks. hardware devices specifically configured to store and execute program instructions such as magneto-optical media and ROM, RAM, flash memory, and the like. In addition, the above-described medium may be a transmission medium such as an optical or metal wire, a waveguide, or the like including a carrier wave for transmitting a signal specifying a program command, a data structure, and the like. Examples of program instructions include not only machine code generated by a compiler, but also devices that process information electronically using an interpreter, for example, high-level language code that can be executed by a computer.

The hardware device described above may be configured to operate as one or more software modules to perform the operations of the present invention, and vice versa.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art to which the present invention pertains without departing from the spirit and scope of the present invention as set forth in the claims below It will be appreciated that modifications and variations can be made.

310: communication unit
320: setting unit
330: storage unit
340: control unit

Claims (10)

A storage unit for storing one or more authentication vectors;
Setting unit for setting an authentication mode, wherein the authentication mode is set to active or inactive; And
And a control unit configured to perform authentication on a user terminal by using the most recently used authentication vector among the stored authentication vectors when the authentication mode is active.
The method according to claim 1,
If the authentication mode is active, the control unit,
The most recently used authentication vector is extracted from the stored authentication vectors, and a user authentication request including a random identification variable value (RAND) and an authentication field (AUTN) of the extracted authentication vector is transmitted to the user terminal. And acquiring a certificate, and authenticating the user according to whether the obtained authentication value and the authentication result value included in the authentication vector are identical.
The method of claim 2,
The user terminal,
If the serial number SQN previously stored in the user terminal is equal to or greater than the serial number SQN included in the authentication field AUTN, a secret key K, the random identification variable value RAND, and the authentication field AUTN. Switch characterized in that for calculating and transmitting the authentication value.
The method according to claim 1,
And if the authentication mode is active, the control unit does not request an authentication vector to a home location register.
The method according to claim 1,
And the control unit selects the stored authentication vectors one by one without duplication and performs authentication on the user terminal using the selected authentication vector.
The method of claim 5,
And the controller performs authentication on the user terminal by using the most recently used authentication vector when all of the stored authentication vectors are selected without duplication.
In the method for authenticating a user terminal at an exchange,
(a) setting an authentication mode, wherein the authentication mode is active or inactive;
(b) if the authentication mode is active, extracting a most recently used authentication vector among previously stored authentication vectors;
(c) requesting authentication by transmitting the extracted authentication vector to a user terminal to obtain an authentication value; And
(d) authenticating the user terminal according to whether the obtained authentication value and the authentication result value included in the extracted authentication vector are identical.
The method of claim 7, wherein
In step (b),
And when the previously stored authentication vectors are selectively used without duplication, extracting the most recently used authentication vector.
The method of claim 7, wherein
In step (c),
Transmitting a user authentication request including a random identification value (RAND) and an authentication field (AUTN) of the extracted authentication vectors to the user terminal; And
And receiving a user authentication response including the authentication value from the user terminal.
10. The method of claim 9,
The user terminal,
If the serial number SQN previously stored in the user terminal is equal to or greater than the serial number SQN included in the authentication field according to the user authentication request, the secret key K, the random identification variable RAND, and the Calculating an authentication value using an authentication field (AUTN); And
And transmitting the calculated authentication value to the exchange.

Images