WO2008110099A1

WO2008110099A1 - Method, system and associated device for authenticating apparatus access to a communication network

Info

Publication number: WO2008110099A1
Application number: PCT/CN2008/070435
Authority: WO
Inventors: Ling Zhang; Zhihui Gu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-03-14
Filing date: 2008-03-07
Publication date: 2008-09-18
Also published as: CN101267365B; CN101267365A

Abstract

A method and system for authenticating apparatus access to a communication network are provided. According to the method and system, an authentication management node receives an authentication request from a request node, then the authentication management node sends the authentication request to an authentication node acting as client of an authentication server; after initiating the authentication process, an authentication message communication between the authentication node and the request node is performed through the authentication management node. Additionally, a communication device for managing an authentication process of all nodes in a radio access network is also provided.

Description

Authentication method, system and device for device accessing communication network

Technical field

The present invention relates to the field of communications, and in particular, to an authentication technology for a device to access a communication network.

Background technique

WPAN (Wi re les s per sona l area ne twork , wireless personal area network) is a concept compared to wireless networks such as wireless wide area network (WWAN), wireless metropolitan area network (WMAN), and wireless local area network (WLAN). Refers to a network of devices in close range, with a typical communication distance of 10 meters. Devices within the WP AN can communicate using technologies such as Bluetooth (Blue tooth), Ultra Wide Band (and B) or Z i gBee.

The network structure of WP AN is relatively complex, including various network structures such as star, tree and mesh. Multi-hop and self-organization are the main features of WPAN. There are three types of devices in a WPAN: a coordinator, a routing node, and an end node. Among them, the coordinator is the central manager in the WP AN, and its functions include the establishment of WPAN, inter-device communication and security management, with strong storage capacity and information processing capability; the functions of the routing node include establishing routing and forwarding data; The end node is typically a user equipment and is the destination for the arrival of information and services.

The WPAN includes the parent node and the child node: When the device joins the WPAN, the first node that establishes a connection with the device is the parent node of the device, and the device is the corresponding child node; the parent node assigns a network address to the child node, The node saves the network address of the parent node; a parent node in the WPAN can have multiple child nodes, but a child node can only have one parent node. Both the parent node and the child node are relative concepts. The same device can be the parent node of one device and the child node of another device.

In the convergence of a wireless access network such as WPAN and WLAN (Wireless Local Area Network) and a mobile communication network, a basic service is authentication, that is, when a user accesses a mobile communication network through these wireless access networks, the identity of the mobile communication network to the user The process of verifying legality. After the authentication is completed, the mobile communication network can authorize the user to access the network resources and perform billing management. The authentication system mainly consists of three functional entities: an authentication server, usually an AAA server (authentication, authorization, and accounting server) for performing authentication functions, generally located in a mobile communication network; an authenticator (Authent icator) for transmitting authentication requests And the authentication message is a client of the authentication server, generally a gateway or a network access point; and a requester (Suppl icant), that is, a device requesting access to the mobile communication network. The authentication process of the authentication system is usually: a) the requester issues an authentication request, the authentication process begins; b) the authenticator forwards the authentication request to the authentication server; c) the authenticator passes the authentication message from the authentication server to the requester, such as an identity Request information; d) the requester issues corresponding response information; e) the authenticator passes the response information from the requester to the authentication server; f) the authentication server verifies the identity of the requester based on the response information; g) the authentication server issues the authentication result; h) The authenticator forwards the authentication result to the requester. In the above process, the c to f steps generally involve the interaction of multiple authentication messages.

In the authentication framework, the authentication framework combined with Diameter or RADIUS (remote user dial-in authentication service) and EAP (extensible authentication protocol) is used. Diameter and RADIUS are the core protocols of the authentication system, defining the basic The message format provides a mechanism for reliable transmission; EAP provides a standard mechanism to support multiple authentication methods, which can enhance the security of the authentication system through its application extension on Diameter or RADIUS protocol; EAP only represents a protocol The framework itself does not define any authentication method. In practice, some EAP-based authentication algorithms such as EAP-SIM and EAP-AKA are used to complete the authentication. The EAP-SIM is an authentication algorithm based on the GSM SIM (Subscr iber Ident I ty Module) card, and the ΕΑΡ-ΑΚΑ is an authentication algorithm based on 3G Authentic and Identifier (Key Agreement). .

In an authentication process, an authentication message interaction between the requester and the authenticator, and an authentication message interaction between the authenticator and the authentication server are included. Specifically, between the authentication server and the authenticator, the data packet is carried by the Diameter or RADIUS protocol; between the requester and the authenticator, the EAP data packet may be carried by a secure transmission protocol defined by the access network, such as EAP0L protocol used in WLAN. In terms of physical function requirements, the authentication server and the authenticator need to support the Diameter or RADIUS protocol, and the authentication server and the requester need to support the EAP algorithm. Take the authentication system of WLAN and 3G network interworking as an example, including the requester (ie, WLAN terminal), the authenticator 802. IX AP (ie, WLAN access point), and the authentication server. The EAP0L protocol based on the 802.IX framework is used between the WLAN terminal and the WLAN access point, and the RADIUS protocol is used between the WLAN access point and the authentication server, and the EAP data packet is carried by the two protocols.

The 802.IX framework is only applicable to point-to-point connections between terminal devices and access points. WLAN terminal devices to WLAN access points are usually star networks and therefore meet point-to-point connection requirements. However, WPAN often has multiple topologies. The terminal equipment and the access point are often multi-hop, so the above WLAN authentication system cannot be directly applied to WPAN.

There is a simple authentication mechanism inside the WPAN. For example, in the Entity Authentive Authentication mechanism of the Z i gbee network, two devices in the WPAN can mutually authenticate each other by using information such as an address and a key, but The mechanism can only be applied to point-to-point message authentication.

There is also an authentication method and system for accessing a mobile communication network in a multi-hop mode in the prior art. The authentication system includes a requester, an authenticator, a primary authenticator, and an authentication server. The authentication process is: the authenticator receives the requester's authentication request; the authenticator creates a state according to the authentication request (ie, saves the last hop address and records the authentication requester address); the authenticator forwards the authentication request to the primary authenticator, and the primary authenticator The authentication server forwards the authentication request; the authentication server generates the authentication information, and forwards the information to the authenticator through the primary authenticator; the authenticator performs authentication according to the authentication information. Further information relating to the above technical solutions can be found in the U.S. Patent Application Serial No. US20060236377, issued Oct. 19, 2006.

According to the above technical solution, the devices as the authenticators are all WLAN terminal devices, and the premise of being the authenticator or the primary authenticator is that the authentication of the authentication server has passed. In WPAN, devices other than the terminal device generally do not have an identity (such as the UMTS subscriber identity card US IM) that the mobile communication network can recognize, and thus cannot be authenticated by the mobile communication network. Therefore, in the process of integration of WPAN and mobile communication networks, a new set of authentication mechanisms needs to be established.

Summary of the invention

Embodiments of the present invention provide an authentication method, system, and device for accessing a communication network of a device, To solve the problem of authentication when the terminal device requesting authentication and the authenticator are multi-hop.

An embodiment of the present invention provides an authentication method for a device to access a communication network, including: an authentication management node receiving an authentication request; an authentication management node transmitting the authentication request to an authentication node; and performing an authentication management node between the authentication node and the requesting node The interaction of the authentication message.

An embodiment of the present invention further provides an authentication system for a device to access a communication network, including a requesting node, an authentication management node, and an authentication node, where the requesting node is configured to send an authentication request and an authentication message; and the authentication management node is configured to receive the authentication request. And transmitting the authentication request to the authentication node, and transmitting the authentication message during the interaction between the requesting node and the authentication node; the authentication node is configured to interact with the authentication server, and the authentication message is transmitted between the authentication management node and the authentication server.

The embodiment of the present invention further provides a communication device, configured to manage an authentication process of a node in a radio access network, including: a receiving unit, configured to receive an authentication message; and an encapsulating unit, configured to encapsulate an authentication message from the authentication node; The decapsulation unit is configured to decapsulate the authentication message from the requesting node, and the sending unit is configured to send the encapsulated authentication message to the requesting node, and send the decapsulated authentication message to the authentication node.

According to the embodiment of the present invention, the requesting node performs message interaction between the authentication management node and the authentication node, so that the authentication management node can uniformly process the authentication of each node, which is beneficial to the management of the authentication process, and solves the request node and the authentication management. Authentication problems between nodes when multi-hopping. Moreover, the architecture of the authentication management node, the authentication node, and the authentication server in the embodiment of the present invention is consistent with the traditional authentication architecture, and can fully support the existing mature authentication mechanism.

DRAWINGS

1 is a simplified diagram of an authentication system in accordance with one embodiment of the present invention;

2 is a schematic diagram of an authentication process of the authentication system shown in FIG. 1;

3 is a schematic diagram of the requesting node transmitting an authentication request to the authentication management node in FIG. 2;

4 is a schematic diagram of an authentication message interaction process between a requesting node and an authentication server; FIG. 5 is a simplified diagram of a structure of a communication device according to an embodiment of the present invention.

detailed description In order to solve the problem of the multi-hop authentication between the terminal device and the authenticator, the embodiment of the present invention provides an authentication system for the device to access the communication network, including the requesting node, the authentication management node, and the authentication node.

The requesting node is configured to send an authentication request and an authentication message;

The authentication management node is configured to receive the authentication request and deliver the authentication request to the authentication node, and deliver the authentication message during the interaction between the requesting node and the authentication message of the authentication node;

The authentication node is configured to interact with an authentication server to transmit an authentication message between the authentication management node and the authentication server.

In order to make the objects, technical solutions and advantages of the present invention more clear, the present invention will be further described in detail below with reference to the WPAN network.

1 is a simplified diagram of an authentication system including a requesting node, a relay node 1, a relay node 2, an authentication management node, an authentication node, and an authentication server, in accordance with an embodiment of the present invention.

The requesting node is the initiator of the authentication request, and is generally a terminal device that the mobile communication network can recognize, such as a UE (User Equipment), and the requesting node supports related authentication protocols, such as EAP-S IM, EAP-AKA. The authentication management node is responsible for encapsulating or decapsulating the authentication message, transmitting the processed authentication message, and formulating and managing the security policy of the authentication channel, and also recording the authentication result of all the requesting nodes in the WP AN, so as to facilitate the wireless Each node in the access network performs centralized monitoring. Considering the powerful processing power of the coordinator within the WPAN and its status as a central manager, the coordinator is preferred as the authentication management node.

There may be one or more relay nodes between the requesting node and the authentication management node, which are determined by the specific network topology. The relay node is usually a routing node within the WPAN and is used to forward the authentication message. The authentication message is transparent to the relay node, so the relay node only needs to pass the intra-network authentication of the WP AN to ensure security. The relay node supports the existing point-to-point authentication mechanism in the WPAN, such as the entity authentication mechanism.

The authentication node acts as a client of the authentication server and processes and forwards the authentication message. The authentication node supports the authentication protocol used by the authentication server, such as the Diame ter protocol or the RADIUS protocol, and also supports The authentication protocol used by the authentication management node, and supports the conversion of the two protocols. The authentication node can be the gateway of the WPAN.

The authentication server is located in the mobile communication network and is used to perform the authentication algorithm and verify the identity of the requesting node. The authentication server can be a Dameter server or a RADIUS server.

The relationship between the authentication management node, the authentication node, and the authentication server conforms to the authentication framework consisting of the requester, the authenticator, and the authentication server in the existing authentication system. That is to say, the authentication node is equivalent to the authenticator, and from the perspective of the authentication node, the authentication request is sent from the authentication management node, and the authentication management node is equivalent to the requester in the existing authentication system.

The embodiment of the invention further provides an authentication method for a device to access a communication network, comprising: the authentication management node receiving an authentication request;

The authentication management node transmits the authentication request to the authentication node;

The authentication node interacts with the requesting node through the authentication management node.

The WP AN network is taken as an example to describe the embodiment of the present invention in further detail with reference to the accompanying drawings. FIG. 2 is a schematic diagram of an authentication process of the authentication system shown in FIG. 1, specifically:

201. The requesting node sends an authentication request to the authentication management node along the preset authentication channel.

202. The authentication management node sends the authentication request to the authentication node.

203. The authentication management node, the authentication node, and the authentication server perform an interaction of the authentication message according to a certain protocol, such as an EAP-S IM protocol or an EAP-AKA protocol. Meanwhile, the authentication management node and the requesting node are preset. Authentication channel for authentication message interaction, including authentication service

204. The authentication management node records the authentication result.

205. The authentication management node notifies the requesting node of the authentication result.

Step 201 further includes several steps as shown in FIG. 3:

301. The requesting node sends an authentication request to the relay node 1, where the authentication request is carried by the protocol packet defined by the WP AN, where the packet includes the authentication packet identifier (indicating that the packet is used for authentication), the requesting node address, and the representative address. Identification of the secondary certification process. 302. The relay node 1 identifies the authentication request, transfers to the authentication state, and records the addresses of the requesting node and the last hop node. This record can be achieved by establishing an authentication routing table. Since the requesting node and the previous hopping node are the same, in this step, only the requesting node address needs to be recorded. When the relay node in this embodiment is in the authentication state, it pauses processing other services, and receives and processes the authentication message related to the current authentication process.

303, the relay node 1 forwards the authentication request to the relay node 2; if the next hop node of the relay node 1 is the authentication management node, there is no relay node 2;

304. The relay node 2 identifies the authentication request, transfers to the authentication state, and records the addresses of the requesting node and the last hop node, for example, establishing an authentication routing table including the requesting node address and the relay node 1 address;

305. The relay node 2 forwards the authentication request to the authentication management node.

306. The authentication management node identifies the authentication request, records the address of the requesting node and the last hop node, for example, establishes an authentication routing table including the requesting node address and the address of the relay node 2, and creates an authentication information storage space for the requesting node, the storage space. Used to save the request node address, the authentication result (including authentication success or authentication failure), and authorization information;

307. The authentication management node formulates a security policy, such as a preset key algorithm.

It should be noted that, when the authentication channel is preset, it is preferable that the neighboring nodes have a parent-child relationship, that is, the direction from the requesting node to the authentication management node, and the next hop node is the parent node of the previous hop node. For example, the relay node 1 is the parent node of the request node, the relay node 2 is the parent node of the relay node 1, and the authentication management node is the parent node of the relay node 2. Since the child node stores the address of the parent node and the parent node is unique, when the child node delivers the message to the parent node, the process of establishing a route is not required, which is beneficial to the fast delivery of the message compared to other random authentication channels. , and good security and stability. When the neighboring nodes do not have a parent-child relationship, the requesting node needs to look up the routing table before issuing the authentication request. If the routing table entry of the authentication management node is not reached, the requesting node needs to establish a route to the authentication management node, and establish a route. During the process, each of the previous hop nodes needs to select the next hop node and record the address of the next hop node, so that the subsequent path can be followed when the authentication message interaction is performed. In addition, both the relay node 1 and the relay node 2 are nodes that have been authenticated by the authentication management node. The requesting node and the authentication management node may also have no relay node, and the requesting node directly sends an authentication request to the authentication management node, and steps 302, 303, 304, and 305 are not required.

The detailed steps of step 203 are as shown in FIG. 4:

In this embodiment, the EAP-AKA authentication protocol is used between the authentication management node, the authentication node, and the authentication server.

401. The authentication node sends an EAP request to the authentication management node, requesting to obtain an identity identifier.

402. The authentication management node encapsulates the EAP request packet into the WPAN authentication packet, and encrypts according to the security policy.

403. The authentication management node delivers the encapsulated WPAN authentication message to the requesting node through a preset authentication channel, and may have a relay node forwarding in the middle;

404. After receiving the WPAN authentication packet, the requesting node decrypts and decapsulates the packet, identifies the EAP request data packet, and encapsulates the EAP response data packet containing the identity identification information into the WPAN authentication packet according to the EAP request, and encrypts according to the security policy; , there may be forwarding of relay nodes in the middle;

406. The authentication management node decrypts and decapsulates the received WP AN authentication packet, and takes out the identity identification information.

407. The authentication management node transmits an EAP response (authentication information response) containing the identity information to the authentication node.

408. The authentication node forwards the EAP response to the authentication server.

409. The authentication server sends an EAP request (authentication information request) containing the AKA challenge information to the authentication node.

410. The authentication node forwards the EAP request to the authentication management entity.

411. The authentication management node encapsulates the EAP request packet into the WPAN authentication packet, and encrypts according to the security policy. 412. The authentication management node delivers the encapsulated WPAN authentication packet to the requesting node through a preset authentication channel, and may be forwarded by the relay node in the middle;

413. After receiving the WPAN authentication packet, the requesting node decrypts and decapsulates the packet, identifies the EAP request packet, and encapsulates the EAP response packet containing the AK A response message into the WP AN authentication packet according to the EAP request, according to the security. Policy encryption; point, there may be forwarding of relay nodes in the middle;

415. The authentication management node decrypts and decapsulates the received WP AN authentication, and extracts the AKA response information.

416. The authentication management node passes the EAP response including the AKA response information to the authentication node.

417. The authentication node forwards the EAP response to the authentication server.

418 and 419. The authentication server sends the authentication result. For example, when the authentication succeeds, the EAP success information is returned, and the EAP success information is transmitted to the authentication management node by the authentication node.

In steps 401 to 417, the information included in each authentication message that the authentication node passes to the authentication management node may be collectively referred to as request information, such as information in the EAP request, AKA challenge information, and each authentication message that the requesting node transmits to the authentication management node. The information contained may be collectively referred to as response information, such as identity information, AKA response information.

The embodiment of the invention further provides a communication device for managing the authentication process of each node in the radio access network, including encapsulating and decapsulating the authentication message, and transmitting the authentication message, and may also include formulating and managing the security policy of the authentication channel. As shown in FIG. 5, the communication device includes a transmitting unit 501, a packaging unit 502, a receiving unit 503, and a decapsulation unit 504.

In the authentication process, after the receiving unit 503 receives the authentication request from the requesting node, the sending unit 501 passes the authentication request to the authentication server through the authentication node. After receiving the authentication request, the authentication server generates an authentication message, where the authentication message includes the authentication message. The request information of the server is transmitted to the receiving unit 503 of the authentication management node through the authentication node. After receiving the authentication message, the encapsulating unit 502 encapsulates the authentication message, and then the sending unit 501 sends the request message to the requesting node. The message then returns an encapsulated authentication message to the communication device, the authentication message containing the response information of the requesting node, and the message is received by the receiving unit 503 of the communication device, and then decapsulated by the decapsulation unit. The communication device further includes an authentication result storage. The unit 505 stores the authentication result after the receiving unit 503 receives the authentication result sent by the authentication server through the authentication node.

In the embodiment of the present invention, a fixed node is selected as the communication device, and the authentication management node is selected as the communication device to centrally process and manage the authentication of all request nodes in the WP AN, which is beneficial to the management and monitoring of the authentication situation; Moreover, the authentication system structure formed by the authentication management node, the authentication node, and the authentication server is consistent with the traditional authentication architecture, and can fully support the existing mature authentication mechanism, and the changes to the mobile communication network are small, and the portability and scalability are relatively good. Strong. In addition, the authentication channel between the requesting node and the authentication management node simplifies the process of establishing a route between the requesting node and the authentication management node. The authentication channel formed by the node of the preferred parent-child relationship is more beneficial to ensure network security and stability.

The drawings and the related description are merely illustrative of the principles of the invention and are not intended to limit the scope of the invention. For example, the invention may also be applied to a wireless network having a similar topology to WPAN. Therefore, any modifications, equivalents, improvements, etc. made within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim

A method for authenticating a device to a communication network, characterized in that it comprises:

The authentication management node receives the authentication request;

The authentication method of the device accessing the communication network according to claim 1, wherein the authentication request is transmitted by the requesting node to the authentication management node through a preset authentication channel; The authentication message is transmitted between the requesting node and the authentication management node through the preset authentication channel.

The method for authenticating a device access communication network according to claim 2, wherein the authentication channel is a wireless link including a requesting node, a relay node, and an authentication management node.

The method for authenticating a device accessing a communication network according to claim 2, wherein in the authentication channel, the last hop node stores the address of the next hop node.

5. The method for authenticating a device access communication network according to claim 1, wherein the authentication management node is a coordinator within the wireless personal area network.

The method for authenticating a device accessing a communication network according to claim 2, wherein the authentication message includes encapsulated request information;

After receiving the encapsulated request information, the requesting node decapsulates the information, and encapsulates the response information and transmits the response information to the authentication management node along the authentication channel.

The method for authenticating a device access communication network according to any one of claims 1 to 6, wherein the interaction of the authentication message comprises: the authentication node transmitting an authentication result to the authentication management node, the authentication result Generated by the authentication server; the authentication method further includes:

The authentication management node records the authentication result and notifies the requesting node of the authentication result.

8. An authentication system for accessing a communication network of a device, comprising: a requesting node, an authentication management node, and an authentication node,

The requesting node is configured to send an authentication request and an authentication message; The authentication management node is configured to receive the authentication request and deliver the authentication request to the authentication node, and deliver the authentication message during the interaction between the requesting node and the authentication node of the authentication node;

The authentication node is configured to interact with an authentication server, and pass an authentication message between the authentication management node and the authentication server.

9. The authentication system for accessing a communication network of a device according to claim 8, further comprising a relay node, configured to pass an authentication request from the requesting node to the authentication management node, and to transmit the authentication management node and Request authentication messages between nodes.

The authentication system of the device accessing the communication network according to claim 8, wherein the requesting node and the authentication management node transmit the authentication request and the authentication message through a preset authentication channel.

The authentication system of the device accessing the communication network according to claim 8, wherein the authentication message includes an authentication result, and the authentication result is generated by an authentication server; the authentication management node is further configured to record the authentication. result.

12. A communication device, configured to manage an authentication process of a node in a wireless access network, the method comprising:

a receiving unit, configured to receive an authentication message;

a packaging unit, configured to encapsulate an authentication message from the authentication node;

a decapsulation unit, configured to decapsulate an authentication message from the requesting node;

And a sending unit, configured to send the encapsulated authentication message to the requesting node, and send the decapsulated authentication message to the authentication node.

The communication device according to claim 12, wherein the receiving unit is further configured to receive an authentication result from the authentication node, where the communications device further includes:

An authentication result storage unit, configured to store the authentication result.