1301027 有了這些安全關聯之後，行動終端10便可以提出註冊請 ，(步」驟S40a)給外地代理器210，然後由外地代理器21〇轉送 f冊請求(步驟S41a)給本地代理器ι10，由本地代理器11〇負 貝對，動終端10進行認證以及註冊的動作(步驟S5〇及S55) 並將註冊回應傳回給外地代理器21〇(步驟S42a)，最後再由外 地代理益210轉送註冊回應給行動終端1〇(步驟S43a)，使行 動，端10完成註冊(步驟S57)，相關的先前技術包括：美國專 利第6760444號，其主要的内容在於解決如何認證合法行 端10的相關技術。 、1301027 After having these security associations, the mobile terminal 10 can make a registration request, (step S40a) to the foreign agent 210, and then the foreign agent 21 transfers the f-book request (step S41a) to the local agent ι10, The home agent 11 performs a pairing operation, and the mobile terminal 10 performs an authentication and registration operation (steps S5 and S55) and transmits the registration response back to the foreign agent 21 (step S42a), and finally the foreign agent benefits 210. Transferring the registration response to the mobile terminal 1 (step S43a), causing the action, the terminal 10 completes the registration (step S57), and the related prior art includes: US Pat. No. 6,760,444, the main content of which is to solve the problem of how to authenticate the legitimate terminal 10 Related technology. ,
然而此種習知行動網址的認證方法上，其所需要建立的安 全，聯在可變動性(Scalability)上是相當缺乏的，另外由於必須 在母個外地代理器210與行動終端1〇以及本地代理器之 巧都要建立各自的安全關聯，因此對於這些安全關聯的管理也 t成項龐大的負擔。為了解決這些問題，同時因應行動網址 的不同，展需求，如：認證(Authentication)、授權(Authorization) 計量計費(Accounting)，出現了 一種如「第2A圖」以及 :第2B圖」所示之具有aaa行動通訊網路架構的行動網址 認證方法，此種方法主要係分別在本地網丨⑻以及外地網2〇〇 中透過本地認證授權伺服器12〇以及外地認證授權伺服器22〇 ^進行認證程序的步驟，如此一來所有屬於同一認證伺服器所 官轄之代理器均可以透過所對應之認證伺服器來進行認證程 序的步驟’因此可以降低本地代理器11()以及外地代理器21〇 之間的認證負擔，可以提升整體的可變性。 此種AAA行動通訊網路架構下的行動網址認證方法，省 去了原先建立在行動終端10、本地代理器11〇與外地代理器 =0之間的安全關聯，取而代之的是在行動終端1〇與本地認 證授權伺服器120之間的第一安全關聯2〇(步驟S30)、外地代 理器210與外地認證授權伺服器220之間的第二安全關聯 21(步驟S31)、本地認證授權伺服器12〇與外地認證授權伺服 7 ⑧ 1301027 命dr 門的苐—女全關聯步驟S32)，以及本地代理哭110 ^ 120 23；；^ 糾1〇由本地網刚漫遊至外地網之後， 驟的動作，此時行動終端10將提出註冊請求(步 写22〇ai’^i=ff外地代理器210與外地認證授權飼服 ί二ί?^、1月求(步驟S41a、41b)，由外地認證授權伺 粗了 pi j 1進订綱丁動終端1〇的認證(步驟S50)產生認證資 二B、 一組金鑰組(步驟S56)，並將本地代理器11〇所However, in the authentication method of such a conventional action website, the security that needs to be established is quite lacking in the Scalability, and also because the parent foreign agent 210 and the mobile terminal must be local and local. Agents have to establish their own security associations, so the management of these security associations is also a huge burden. In order to solve these problems, and in response to the different action URLs, such as: Authentication, Authorization, and Accounting, there is a kind of "Figure 2A" and: Figure 2B. The mobile website authentication method with the aaa mobile communication network architecture mainly performs authentication in the local network (8) and the foreign network 2 through the local authentication and authorization server 12 and the foreign authentication and authorization server 22 The steps of the program, so that all the agents belonging to the same authentication server can perform the steps of the authentication process through the corresponding authentication server. Therefore, the local agent 11 () and the foreign agent 21 can be lowered. The burden of certification between them can improve overall variability. The mobile website authentication method under the AAA mobile communication network architecture eliminates the security association originally established between the mobile terminal 10, the local agent 11 and the foreign agent=0, and is replaced by the mobile terminal. The first security association 2 between the local authentication authorization server 120 (step S30), the second security association 21 between the foreign agent 210 and the foreign authentication authorization server 220 (step S31), and the local authentication authorization server 12 〇 外 外 外 外 8 8 7 7 7 7 7 7 7 7 7 7 7 7 7 dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr dr ^ ^ ^ ^ ^ ^ At this time, the mobile terminal 10 will make a registration request (step write 22〇ai'^i=ff foreign agent 210 and foreign authentication authorization service ί ί 、, January request (steps S41a, 41b), authorized by the foreign certification Serving the authentication of the pi j 1 into the ordering terminal 1 (step S50), generating the authentication element B, a group of key groups (step S56), and the local agent 11
品之、’鑰、、且連同a忍證資料及註冊請求轉送給本地代理器 (步驟S41c)，由本地代理器110進行註冊(步，驟S55)並傳回 註冊回給本地認證授權錬器啊步驟Μ%)，再透過外地 認證授權飼服器220以及外地代理器21〇將註冊回應轉送給行 動終端10(步驟S43a、S43b及S43c)，使行動終端10完成註 冊(步驟S57)。其中本地代理器11〇、外地代理器別以及行 動終端ίο會將所需的金鑰組給保留下來(步驟S44a、S44b及 S44c)。相關的先前技術可以參考包括：Efficient Authemicati()n and Key Distribution in Wireless IP Network 以及 Identity-base Cryptosystems and Signature Schemes 等論文，其主要係同樣係 提出如何解決合法行動終端1〇認證的相關技術。 雖然在AAA行動通訊網路架構下的行動網址認證方法可 以進一步提升整體的可變性以及安全性，但是伴隨著認證過程 中所大篁增加的認證程序(Authentication Procedure)的步驟及 認證週期時間(Round Trip Time)，使得整體認證的效率不彰。 因此，要如何保有原來在AAA行動通訊網路架構下之行 動網址認證方法的可變性以及安全性，在不改變AAA行動通 訊網路架構的前提下，能夠更進一步提升整體的認證效率，隨 時隨地都能夠確保行動終端10在任何網路中都能夠即時獲得 到最安全的保障，是目前行動通訊網路發展的主軸所在。 【發明内容】 ⑤ 8 1301027 *有鑑於此，本發明提出一種在行動網址認證、授權、計費 機:制上之金鑰快取認證方法，藉由一次將行動終端執行認證時 所需的認證資料以及多組金鑰組利用金鑰快取方式分別暫存 在也代理器與外地認證授權伺服器中，來達到減少行動終端 在1^ g時所需I費之認證步驟次數及認證週期時間，更可減少 認證步驟中所產生的訊息數量。 在行動網址認證、授權、計費機制上之金鑰快取認證方法 上，t括下列步驟··在行動終端與本地認證授權伺服器、外地 $减外地認證授權舰!!、外地認證授翻㈣與本地認 ^授，魏II、及本地認證授權舰器與本地代理^之間分別 「安全關聯、第二安全_、第三安全關聯、及第四安 由該本地認證授翻服器透過外地代㈣及外地認證 服H的觀，對行祕端所提出之註冊請求進行認證並 產生遇證倾，同時產生肋進行多次認證所需之—组以上金 各金鑰財將本地代理輯需之第—組金鑰組連同 求轉送至本地代理11;本地代理11註冊行動 二=、η拉子/i妾收之賴資料及第一組金鎗組於所屬之快取 產生註冊回應傳回給本地認證授權伺服11 ;本地認 收註冊回應，並連同認證資料及外地認證授權 之4—組金输組傳送給外地認證授翻服器；外地 J證5她_存所接收之認證資料及第一組金鑰㈣ 外地代理器暫存所接收 訊及萌回應轉送給行動終 攄切欲=二/接收之第—組金鑰組於所屬之快取空間，並根 據丘貝吼及注冊回應完成註冊。 要更進—步提出#行動終端所儲存之金鑰組逾時需 要更換金餘、、且以及同時需要進行本地代理器更換金瑜組時，透The product, the 'key, and the a forcible information and the registration request are forwarded to the local agent (step S41c), the local agent 110 registers (step S55) and returns the registration back to the local authentication authority. The step Μ%), and then the registration certificate is transferred to the mobile terminal 10 via the foreign certificate authority server 220 and the foreign agent 21 (steps S43a, S43b, and S43c), and the mobile terminal 10 completes the registration (step S57). The local agent 11〇, the foreign agent and the mobile terminal ίο will retain the required key group (steps S44a, S44b and S44c). Related prior art can refer to papers such as Efficient Authemicati () n and Key Distribution in Wireless IP Network and Identity-base Cryptosystems and Signature Schemes, which are mainly related to how to solve the legal mobile terminal authentication. Although the mobile URL authentication method under the AAA mobile communication network architecture can further improve the overall variability and security, it is accompanied by the steps of the authentication procedure and the certification cycle time (Round Trip). Time) makes the overall certification inefficient. Therefore, how to maintain the variability and security of the original mobile website authentication method under the AAA mobile communication network architecture can further improve the overall authentication efficiency without changing the AAA mobile communication network architecture, and can be used anytime, anywhere. Ensuring that the mobile terminal 10 can obtain the most secure protection in any network is the main axis of the current development of the mobile communication network. SUMMARY OF THE INVENTION 5 8 1301027 * In view of this, the present invention proposes a method for authentication, authorization, and accounting of a mobile website: a key authentication method for performing authentication on a mobile terminal by performing authentication at one time The data and the multiple key groups are temporarily stored in the proxy and the foreign authentication and authorization server by using the key cache method respectively, so as to achieve the number of authentication steps and the authentication cycle time for reducing the I fee required for the mobile terminal at 1^g. It also reduces the number of messages generated during the authentication step. In the key authentication method for the authentication, authorization, and charging mechanism of the mobile website, the following steps are included: · In the mobile terminal and the local authentication and authorization server, the foreign domain minus the foreign certification authorized ship!!, the foreign certification (4) with the local recognition, Wei II, and the local certification authorized ship and the local agent ^ respectively, "security association, second security _, third security association, and fourth security by the local authentication The concept of foreign generation (4) and foreign certification service H, the registration request made by the secret end of the line is authenticated and the witness is issued, and at the same time, the ribs are required for multiple certifications. The required first-group key group is forwarded to the local agent 11 together; the local agent 11 registration action 2 =, η 拉子/i妾 之 资料 及 and the first group of guns are generated in the cache Return to the local authentication and authorization servo 11; local acknowledgment registration response, and send it to the foreign certification transfer server together with the certification data and the foreign certification authorized 4 - group gold transfer group; the foreign J certificate 5 her _ deposit receipt authentication information And the first set of keys (four) The foreign agent temporarily stores the received message and the message is sent to the end of the action = 2 / the received group - the group key group is in the cache space, and the registration is completed according to Qiubei and the registration response. - Step by step # The key group stored in the mobile terminal needs to be replaced when the time is over, and at the same time, the local agent is required to replace the Jinyu group.