WO2017007122A1

WO2017007122A1 - Method and system for providing private network service

Info

Publication number: WO2017007122A1
Application number: PCT/KR2016/005172
Authority: WO
Inventors: 김세훈; 김달우; 류구현; 박병창; 우상우; 이일영; 진성일
Original assignee: 주식회사 케이티
Priority date: 2015-07-03
Filing date: 2016-05-16
Publication date: 2017-01-12
Also published as: KR101629006B1; KR101796297B1; KR20170004835A

Abstract

The present application relates to a private network service system and method. A method for providing a private network service according to an embodiment of the present invention may comprise: a reception step for receiving, by a private gateway, an access request from a mobile communication terminal; an authentication step for authenticating, by the private gateway, whether the mobile communication terminal satisfies a predetermined condition for granting access to a private network; and a connection step for establishing, by the private gateway, a communication session between the mobile communication terminal which has been successfully authenticated and the private network.

Description

Method and system for providing private network service

This application is subject to Korean Patent Application No. 10-2015-0095294, filed on July 03, 2015, Korean Patent Application No. 10-2015-0095998, filed on July 06, 2015, and September 18, 2015. It is accompanied by a priority claim based on Korean Patent Application No. 10-2015-0132088 filed in, all the contents disclosed in the specification and drawings of the patent application is incorporated in this application.

The present application relates to a method and a system for providing a private network, and more particularly, to a method and a system for providing a private network that can block access to a private network in an unauthorized terminal and an unauthorized region.

Due to the development of mobile communication systems, communication services based on the LTE (Long Term Evolution) communication system, which is a next generation mobile communication technology, are being developed. The LTE communication system includes an Evolved Packet Core (EPC) network including a mobility management entity (MME), a serving gateway (SGW), and a packet data network gateway (PGW), and provides services to users using the EPC. Providing. Korean Patent Publication No. 10-1216542 discloses PDN-GW of an EPC network.

As the broadband mobile communication market is activated and smart phones and the like are spreading, demand for utilizing broadband mobile communication and smartphones for corporate services is increasing.

The present application is to provide a method and system for providing a private network service that can block access to private networks in unauthorized terminals and unauthorized regions.

According to an aspect of the present invention, there is provided a method for providing a private network service, comprising: a receiving step of receiving, by a private gateway, a connection request of a mobile communication terminal; An authentication step of authenticating, by the private gateway, whether the mobile communication terminal satisfies a preset private network access permission condition; And connecting, by the private gateway, a communication session with the private network to the mobile communication terminal in which the authentication is successful.

In the receiving step, as the APN (Access Point Name) associated with the private network service is selected in the mobile communication terminal, the private gateway may receive the access request from the mobile communication terminal.

The authentication step may include: a location authentication step of performing, by the private gateway, the location authentication by comparing the location information of the mobile communication terminal received from the mobile communication terminal with a preset private network service area list; And a subscription authentication step in which the private gateway inquires whether the mobile communication terminal is a terminal subscribed to the private network service using a preset authentication device, and performs the subscription authentication.

The authentication step may further include an access time authentication step of performing a connection time authentication for the mobile communication terminal by comparing the time at which the private gateway receives the connection request with a connection allowable time preset in the mobile communication terminal. It may include.

In the location authentication step, the location authentication may be performed by using a private network service area list in which private network service areas allowed for each mobile communication terminal are set differently.

In the location authentication step, the private gateway may receive a Target Area Identifier (TAI) or an E-UTRAN Cell Global Identifier (ECGI) as the location information of the mobile communication terminal.

Here, in the subscription authentication step, the private gateway may transmit a RADIUS (Remote Authentication Dial-In User Service) message including user information of the mobile communication terminal to the authentication device.

Here, in the subscription authentication step, when the authentication device determines that the user information is included in a preset subscriber list, the private gateway may receive an authentication success message from the authentication device.

Here, in the subscription authentication step, if the authentication device determines that the user information is not included in the preset subscriber list, the phone number information is extracted from the source IP of the packet transmitted for authentication and connected to the mobile communication terminal. You can send a text message to the sender to send a no-access message.

Here, in the subscription authentication step, the private gateway may transmit a mobile station international ISDN number (IMSIS) or an international mobile station identity (IMSI) of the mobile communication terminal to the user information.

Here, the private network service providing method according to an embodiment of the present invention, the private gateway, when the mobile communication terminal is separated from the private network service area, the departure block step of blocking the communication session between the mobile communication terminal and the private network. It may further include.

Here, in the detachment blocking step, when the location information of the mobile communication terminal is changed, the private gateway compares the changed location information with a preset private network service area list to determine whether the mobile communication terminal is out of the private network service area. have.

Here, in the departure blocking step, when it is determined that the mobile communication terminal has left the private network service area, the private gateway changes the destination IP of the user traffic transmitted by the mobile communication terminal to the IP of the authentication apparatus. The private network connection of the mobile communication terminal can be blocked.

Here, in the detachment blocking step, if the authentication apparatus determines that the changed location information is not included in the preset private network area list, the mobile communication terminal extracts telephone number information from a source IP of a packet transmitted for authentication. You can send a text message to the server to send a message that is not accessible.

Here, in the authentication step, the private gateway may query the authentication apparatus whether the mobile communication terminal is a terminal located in the private network service area and whether the mobile communication terminal is a terminal subscribed to the private network service.

Here, in the authentication step, the private gateway may further query the authentication apparatus whether the mobile communication terminal has made a connection request at a preset access allowance time.

Here, in the authentication step, the private gateway may transmit, to the authentication device, a RADIUS (Remote Authentication Dial-In User Service) message including user information and location information of the mobile communication terminal.

Here, in the authentication step, if the authentication device determines that the user information and the location information are included in a preset subscriber list and a private network service area list, the private gateway may receive an authentication success message from the authentication device.

Here, the authentication step, the private gateway includes the mobile station International ISDN Number (MSISDN) or International Mobile Station Identity (IMSI) of the mobile communication terminal in the user information, the location information TAI ( Target Area Identifier) or ECGI (E-UTRAN Cell Global Identifier) may be transmitted.

Here, in the private network service providing method according to an embodiment of the present invention, when the mobile communication terminal is separated from the private network service area, a detachment blocking step of blocking a communication session between the mobile communication terminal and the private network by the private gateway. It may further include.

Here, in the detachment blocking step, when receiving a TAU (Tracking Area Update) message corresponding to the movement of the location of the mobile communication terminal, the private gateway transmits the location information of the mobile communication terminal to the authentication device, and the mobile communication terminal. It may query whether the private network service area of the departure.

Here, in the departure blocking step, when the departure confirmation message corresponding to the departure from the private network service area of the mobile communication terminal is received from the authentication device, the private gateway may block the transmission of traffic between the mobile communication terminal and the private network.

Here, in the detachment blocking step, if the authentication apparatus determines that the changed location information is not included in the preset private network area list, the phone number information is extracted from the source IP of the packet transmitted for authentication, and the mobile communication terminal is extracted. You can send a text message transmission server to send a disconnect message.

The method of providing a private network service according to an embodiment of the present invention may be a method of providing a private network service in an LTE network according to TR23.829 of 3GPP Release 10, wherein the local gateway receives a private network connection request of a mobile communication terminal. Receiving step; An authentication step of authenticating, by the local gateway, whether the mobile communication terminal satisfies a preset private network access permission condition; And establishing, by the local gateway, a communication session with the private network with respect to the mobile communication terminal in which the authentication is successful.

In the receiving step, as the APN (Access Point Name) related to the private network service is selected in the mobile communication terminal, the local gateway may receive the access request from the mobile communication terminal.

The authentication step may include: a location authentication step of performing a location authentication by a local gateway by comparing the location information of the mobile communication terminal received from the mobile communication terminal with a preset private network service area list; And a registration authentication step of performing, by the local gateway, whether the mobile communication terminal is a terminal subscribed to the private network service to a preset authentication device, and performing the subscription authentication.

The authentication step may further include an access time authentication step of performing a connection time authentication for the mobile communication terminal by comparing a time at which the local gateway receives the connection request with a connection allowable time preset in the mobile communication terminal. It may include.

In the location authentication step, the local gateway may receive a Target Area Identifier (TAI) or an E-UTRAN Cell Global Identifier (ECGI) as the location information of the mobile communication terminal.

Here, in the subscription authentication step, the local gateway may transmit a RADIUS (Remote Authentication Dial-In User Service) message including user information of the mobile communication terminal to the authentication device.

Here, in the subscription authentication step, if the authentication device determines that the user information is included in a preset subscriber list, the local gateway may receive an authentication success message from the authentication device.

Here, in the subscription authentication step, the local gateway may transmit a mobile station international ISDN number (IMSIS) or an international mobile station identity (IMSI) of the mobile communication terminal to the user information.

Here, the private network service providing method according to an embodiment of the present invention, the local gateway, when the mobile communication terminal is separated from the private network service area, the exit block step of blocking the communication session between the mobile communication terminal and the private network. It may further include.

Here, in the detachment blocking step, when the location information of the mobile communication terminal is changed, it is possible to determine whether the mobile communication terminal is out of the private network service area by comparing the location information whose local gateway is changed with a preset private network service area list. have.

Here, in the departure blocking step, if it is determined that the mobile communication terminal has left the private network service area, the local gateway changes the destination IP of the user traffic transmitted by the mobile communication terminal to the IP of the authentication apparatus. The private network connection of the mobile communication terminal can be blocked.

The private network service system according to an embodiment of the present invention checks whether a connection request is made to a private network using an access point name (APN) transmitted by a mobile communication terminal, and if the connection request is made to the private network, it corresponds to the APN. A mobility management entity (MME) for transmitting a bearer setup message for transmitting user traffic to a private gateway; Upon receiving the bearer setup message, perform location authentication on whether the mobile communication terminal is located in a preset private network service area, and perform subscription authentication on whether the mobile communication terminal joins the private network service with a preset authentication device. A private gateway for requesting to establish a communication session between the mobile communication terminal and a private network in response to the bearer setup message if the subscription authentication and location authentication for the mobile communication terminal are successful; And upon request of the private gateway, determine whether the mobile communication terminal is included in a terminal list subscribed to a preset private network service, generate a subscription authentication result, and transmit the generated subscription authentication result to the private gateway. It may include a device.

The private network service system according to another embodiment of the present invention checks whether the access request is for a private network using an access point name (APN) transmitted by a mobile communication terminal, and if the access request is for the private network, the private network service system corresponds to the APN. A mobility management entity (MME) for transmitting a bearer setup message for transmitting user traffic to a private gateway; When receiving the bearer setup message, requesting the location authentication and subscriber authentication of the mobile communication terminal to a predetermined authentication device, and if the location authentication and subscriber authentication for the mobile communication terminal is successful, in response to the bearer setup message A private gateway forming a communication session between the mobile communication terminal and the private network; And whether the user information of the mobile communication terminal is included in a preset subscriber list and whether the location information of the mobile communication terminal is included in a preset private network service area list to correspond to the location authentication and subscriber authentication request. The server may include an authentication server for generating a response message and transmitting the response message to the private gateway.

The private network service system according to another embodiment of the present invention may be a private network service system according to TR23.829 of 3GPP Release 10, and is a request for access to a private network using an APN (Access Point Name) transmitted by a mobile communication terminal. A mobility management device (MME: Mobility Management Entity) for transmitting a bearer setup message for transmitting user traffic to a local gateway corresponding to the APN if the connection request is made to the private network; Upon receiving the bearer setup message, perform location authentication on whether the mobile communication terminal is located in a preset private network service area, and perform subscription authentication on whether the mobile communication terminal joins the private network service with a preset authentication device. A local gateway for requesting and establishing a communication session between the mobile communication terminal and a private network in response to the bearer setup message if the registration authentication and location authentication for the mobile communication terminal are successful; And determining whether the mobile communication terminal is included in a terminal list subscribed to a preset private network service according to a request of the local gateway, generating a subscription authentication result, and transmitting the generated subscription authentication result to the local gateway. It may include a device.

In addition, the solution of the said subject does not enumerate all the characteristics of this invention. Various features of the present invention and the advantages and effects thereof may be understood in more detail with reference to the following specific embodiments.

According to the method and system for providing a private network service according to an embodiment of the present invention, it is possible to block private network access in an unauthorized terminal and an unauthorized region. In particular, in connection with a separate authentication device, it is possible to block connection of unauthorized mobile communication terminals or attempts to connect to a private network in unauthorized regions.

According to the method and system for providing a private network service according to an embodiment of the present invention, it is also applicable to an intranet access method in an LTE network promoted by 3GPP Release 10. In other words, even when directly accessing a private network through the HeNB and the local gateway without going through the wireless core network of the mobile communication provider, the private network connection in an unauthorized mobile communication terminal or an unauthorized region is performed in conjunction with an authentication device or the like. You can block.

1 is a block diagram illustrating a private network service system according to an embodiment of the present invention.

2 and 6 are timing diagrams illustrating a private network connection blocking method for an unregistered mobile communication terminal in a private network service system according to an embodiment of the present invention.

3A, 3B, 7A, and 7B are timing diagrams illustrating a method for disconnecting a private network for a mobile communication terminal leaving a private network service area in a private network service system according to an embodiment of the present invention.

4 is a table showing session information according to an embodiment of the present invention.

5 is a timing diagram illustrating a method of changing a connection to a public network by a mobile communication terminal connected to a private network in a private network service system according to an embodiment of the present invention.

8 is a block diagram illustrating a private network service system according to another embodiment of the present invention.

9 is a timing diagram illustrating a private network access blocking method for an unregistered mobile communication terminal in a private network service system according to another embodiment of the present invention.

10A and 10B are timing diagrams illustrating a private network access blocking method for a mobile communication terminal leaving a private network service area in a private network service system according to another embodiment of the present invention.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. However, in describing the preferred embodiment of the present invention in detail, if it is determined that the detailed description of the related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. In addition, the same reference numerals are used throughout the drawings for parts having similar functions and functions.

In addition, throughout the specification, when a part is 'connected' to another part, it is not only 'directly connected' but also 'indirectly connected' with another element in between. Include. In addition, the term 'comprising' of an element means that the element may further include other elements, not to exclude other elements unless specifically stated otherwise. In addition, the terms "... unit", "module", etc. described in the specification mean a unit for processing at least one function or operation, which may be implemented in hardware or software or a combination of hardware and software. .

As shown in FIG. 1, a private network service system according to an embodiment of the present invention includes a mobile communication terminal 1, a mobility management entity (hereinafter referred to as an MME) 20, and a serving gateway ( Serving Gateway (hereinafter referred to as 'SGW') 30, Public Gateway (hereinafter referred to as 'public PGW') 40, Private Gateway (hereinafter referred to as 'private PGW') (50) And an authentication device 60.

Hereinafter, a private network service system according to an embodiment of the present invention will be described with reference to FIG. 1.

The mobile communication terminal 1 may be a communication device that provides or receives a voice call or data communication, and according to an embodiment, a user equipment (UE), a mobile station (MS), a user terminal (UT), and a subscriber station (SS) may be used. Or other terms). The mobile communication terminal 1 includes a conventional mobile phone such as a cellular phone, a PCS phone, a GSM phone, a CDMA-2000 phone, a WCDMA phone, a smart phone, a tablet PC, a mobile phone using a 4G network, and the like, which are actively used recently. Can be.

The mobile communication terminal 1 may transmit and receive data using the mobile communication access network 200. The mobile communication access network 200 may include an Evolved Universal Terrestrial Radio Access Network (E-UTRAN), a Universal Terrestrial Radio Access Network (UTRAN), a GSM EDGE Radio Access Network (GERAN), a WiFi network, and the like.

According to an embodiment, the APN list in which the access point name (APN) and the public APN are recorded may be stored in the mobile communication terminal 1, and the user of the mobile communication terminal 1 accesses any one APN. By attempting this, the communication service can be provided from a public network such as the Internet N1 or a private network such as an intranet N2.

The MME 20 is a control plane entity in the E-UTRAN 210, and may provide mobility management and session management functions for the mobile communication terminal 1 through non-access stratum (NAS) signaling. have. The mobile communication terminal 1 may transmit an Attach Request message to the MME 20 in order to access a public network or a private network, and the public communication terminal 1 is intended to connect to the access request message. APN corresponding to the network or private network may be included. That is, the mobile communication terminal 1 transmits a connection request message including a private network APN (for example, private.lte.com) to request the MME 20 to access a private network, or a public network APN (for example, For example, the connection request message including public.lte.com) may be transmitted to request the MME 20 to access the public network. In this case, the MME 20 may select the respective SGW 30, PGW (40, 50) for access to the public or private network requested by the mobile communication terminal 1, and move to the corresponding public or private network. A bearer establishment message (Create Session request) for transmitting user traffic of the communication terminal 1 may be transmitted.

The SGW 30 may manage mobility of the mobile communication terminal 1 between the eNB included in the E-UTRAN 210 and another base station, between the 3GPP network and the EUTRAN, and payload traffic according to the established session. It can perform session control function to process. That is, the SGW 30 may operate as an anchoring point during handover between base stations and handover between 3GPP systems.

The common PGW 40 may connect the mobile communication terminal 1 with a public network such as the Internet N1, provide IP routing and forwarding functions, and provide packet filtering. In addition, the common PGW 40 may assign an IP address of the mobile communication terminal 1, and when handover between the SGW 30 or between the LTE communication system and a non-3GPP network (for example, WiMax, etc.) It can operate as a mobility anchoring point.

The private PGW 50 may be a gateway for connecting the mobile communication terminal 1 to a private network such as an intranet N2. When the mobile communication terminal 1 connects using a private APN, the mobile communication terminal 1 A communication session can be established with 1) to allow access to the intranet (N2). Here, the private PGW 50 may authenticate whether or not the mobile communication terminal 1 satisfies a preset private network connection permission condition before establishing a communication session between the mobile communication terminal 1 and the intranet N2. Only when the authentication succeeds, a communication session can be established. Here, the authentication performed by the private PGW 50 may include subscription authentication, location authentication, access time authentication, and the like.

According to an embodiment, the private PGW 50 may store a preset private network service area list, and the private PGW 50 may include location information of the mobile communication terminal 1 provided by the mobile communication terminal 1. You can compare private network service area lists. Here, the private PGW 50 may perform location authentication on the mobile communication terminal 1 by checking whether the location information of the mobile communication terminal 1 is included in the private network service area. Specifically, the private PGW 50 may receive a Target Area Identifier (TAI) or an E-UTRAN Cell Global Identifier (ECGI) as the location information of the mobile communication terminal 1, and the stored private network service area list may also be TAI or It may be stored based on ECGI. Therefore, the private PGW 50 compares the received TAI or ECGI of the mobile communication terminal 1 with the private network service area list, and if the TAI or ECGI of the mobile communication terminal 1 is included in the private network service area list, It can be determined that the mobile communication terminal 1 is located in the private network service area. Here, the location information of the mobile communication terminal 1 may be included in a bearer setting message received from the MME 20. According to the embodiment, it is possible to set the private network service area differently for each mobile communication terminal. For example, when different mobile communication terminals exist in the same location, there may be an embodiment in which location authentication is successful for only some mobile communication terminals.

On the other hand, the private PGW 50 may also perform subscriber authentication for the mobile communication terminal 1 to access the private network. That is, since the private network service can be provided only to the mobile communication terminal 1 registered in advance to use the private network service, whether the mobile communication terminal 1 requesting access corresponds to the mobile communication terminal 1 subscribed to the private network service. It is necessary to check whether or not. Here, the private PGW 50 may query the authentication apparatus 60 to determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service, for the subscriber authentication of the mobile communication terminal 1. At this time, the private PGW 50 may provide the user information received from the mobile communication terminal 1 to the authentication device 60, and then the mobile communication terminal 1 according to the authentication result transmitted by the authentication device 60. ), It is possible to determine whether or not the authentication for the subscription is successful. Specifically, the private PGW 50 is a user information of the mobile communication terminal 1, the MSISDN (Mobile Station International ISDN Number) or IMSI (International Mobile Station Identity) of the mobile communication terminal 1, the authentication device ( 60). Subsequently, if it is determined that the user information of the mobile communication terminal 1 exists in the stored subscriber list, the authentication device 60 may transmit an authentication success message to the private PGW 50, and receive the authentication success message. The PGW 50 may determine that the subscriber authentication for the mobile communication terminal 1 is successful. Here, according to another embodiment, the private PGW 50 inquires both the subscription authentication and the location authentication to the authentication device 60, and the mobile communication terminal 1 according to the authentication result transmitted by the authentication device 60. It is also possible to determine the success of the subscription authentication and location authentication for.

In addition, according to the embodiment, the mobile PGW 60 compares the time when the connection request is received from the mobile communication terminal 1 with the connection allowance time preset in each mobile communication terminal 1, and performs the mobile communication. It is also possible to perform access time authentication for the terminal 1. That is, even if both the subscription authentication and the location authentication for the mobile communication terminal 1 succeed, the mobile communication terminal 1 may not allow the connection when the mobile communication terminal 1 attempts to access the private network at a time other than the preset access allowance time. have. Herein, it is described that the private time PGW 60 performs the connection time authentication, but according to the embodiment, the connection time authentication is queried to the authentication device 60, and authentication is successfully performed according to the authentication result transmitted by the authentication device 60. It is also possible to determine.

The private PGW 50 may establish a communication session with the mobile communication terminal 1 only if all of the subscriber authentication, location authentication, and access time authentication are successful, and the mobile communication terminal 1 is located in the private network service area. If the mobile communication terminal 1 is not located, or the mobile communication terminal 1 is not subscribed to the private network service or the connection communication time allowed for the mobile communication terminal 1 is not allowed, the formation of the communication session can be refused. When the communication session is established, the private PGW 50 may assign an IP address commonly used in the private network to the mobile communication terminal 1.

In addition, when the private PGW 50 establishes a session with the mobile communication terminal 1, the private PGW 50 may periodically check the position of the mobile communication terminal 1. Therefore, when it is determined that the mobile communication terminal 1 has left the private network service area, the private PGW 50 may release the session with the mobile communication terminal 1. On the other hand, according to an embodiment, when the mobile communication terminal 1 performs the location movement and the location information is changed, a bearer change message (Modify Bearer Request) may be received in the private PGW 50, the bearer change message The changed location information of the mobile communication terminal 1 may be stored in the terminal. Therefore, the private PGW 50 may compare the stored private network service area list with the changed location information. When the changed location information is not included in the private network service area list, the session between the mobile communication terminal 1 and the private network is performed. Can be released. According to the embodiment, the private PGW 50 changes the destination IP of the user traffic transmitted by the mobile communication terminal 1 to the IP of the authentication device 60 so as to transmit the user traffic to the authentication device 60. By doing so, it is possible to block the connection to the private network.

According to an embodiment, the private PGW 50 may include an access permission table, and according to the access permission table, each subscription authentication, location authentication, access time authentication, or the like may be performed. For example, as shown in Table 1 below, both mobile communication terminal A and mobile communication terminal B are private network subscribers, but mobile communication terminal B is not allowed to access a private network at the "la" position. In addition, in the case of the mobile communication terminal D, since the connection allowable time is 13:00 to 18:00, access to the private network may not be permitted even when the location is in the "e" position from 09:00 to 13:00. . That is, it is possible to set a connection permission condition for a private network according to various conditions set in the connection permission condition table.

이동통신단말Mobile communication terminal	가입자 구분Subscriber Category	사설망 서비스 지역Private network service area	접속허용시간Connection time
A (010-xxxx-xxxx)A (010-xxxx-xxxx)	사설editorial	가, 나, 다, 라Go, me, da, la	09:00~18:0009: 00 ~ 18: 00
B (010-xxxx-xxxx)B (010-xxxx-xxxx)	사설editorial	가, 나, 다ABC	09:00~18:0009: 00 ~ 18: 00
C (010-xxxx-xxxx)C (010-xxxx-xxxx)	사설editorial	마, 바Do, bar	09:00~18:0009: 00 ~ 18: 00
D (010-xxxx-xxxx)D (010-xxxx-xxxx)	사설editorial	마hemp	13:00~18:0013: 00 ~ 18: 00
E (010-xxxx-xxxx)E (010-xxxx-xxxx)	일반Normal	--	--

The authentication device 60 may perform subscription authentication, access time authentication, or location authentication for the mobile communication terminal 1 at the request of the private PGW 50. The authentication device 60 includes a subscriber list corresponding to user information of the mobile communication terminal 1 subscribing to the private network service, a private network service area list corresponding to the location information accessible to the private network, and a connection allowable time for the individual mobile communication terminal. The list may be stored, and by using the subscriber list, the access allowance time list, and the private network service area list, subscriber authentication, access allowance time authentication, or location authentication may be performed for the mobile communication terminal 1. In addition, when the mobile communication terminal 1 succeeds in accessing the private network, the authentication device 60 may transmit a notification message indicating the access to the private network to the mobile communication terminal 1, and the mobile communication terminal 1 moves to a position. When leaving the private network service area, the mobile communication terminal 1 may transmit a notification message indicating that the private network service area. Here, the notification message may be a Short Message Servcie (SMS) message, a Multimedia Messagae Service (MMS) message, or an instant message. The authentication device 60 may directly transmit the notification message or transmit the notification message by requesting the transmission of the notification message to a separate text message transmission server.

2 is a timing diagram illustrating a private network access blocking method for an unregistered mobile communication terminal in a private network service system according to an embodiment of the present invention.

Referring to FIG. 2, first, a private network service area list corresponding to location information accessible to a private network may be stored in the private PGW 50 (S201), and the authentication device 60 may include a mobile communication terminal subscribed to a private network service ( The subscriber list corresponding to the user information of 1) may be stored (S202).

Thereafter, the mobile communication terminal 1 may transmit a connection request message for setting up a private APN to the MME 20 through the eNB 211 included in the E-URAN 210 for accessing the private network N2 ( S203, S204). Here, the MME 20 may allow access to the private PGW 50 only when a private APN requested by the mobile communication terminal 1 is predefined, but according to an embodiment, the MME 20 may allow access to the private PGW 50. It may be to apply a "Wild Card APN" that allows all the APN delivered by the mobile communication terminal (1). In this case, even if the APN is not defined in advance in the MME 20, the use may be allowed, and a bearer may be set for transmitting user traffic to the SGW 30 and the private PGW 50 corresponding to the private APN. A message (Creat Session Request) may be transmitted (S205 and S206).

The private PGW 50 may check whether the location information of the mobile communication terminal 1 included in the received bearer establishment message is included in the previously stored private network service area list. In this case, when the location information is included in the private network service area list, the private PGW 50 may determine that the location authentication is successful and proceed to subscriber authentication. On the other hand, when the location information of the mobile communication terminal 1 is not included in the private network service area list, the private PGW 50 may refuse to establish a session.

In addition, in the present embodiment, it is described that the subscriber authentication is performed after determining that the location authentication is successful, but is not necessarily limited to this order, it is also possible to proceed with the location authentication after the subscriber authentication according to the embodiment. .

If the location authentication is successful, the private PGW 50 may request subscriber authentication to the authentication device 60, in which case the private PGW 50 sends the user information (eg, MSISDN, IMSI, etc.) to the authentication device 60. ) Can be transmitted (S207). Here, the private PGW 50 may request the authentication of the subscriber by using the RADIUS (Remote Authentication Dial-In User Service) message. For example, a RADIUS message may send user information including User-name = MSISDN, 3GPP-IMSI = IMSI.

The authentication apparatus 60 may determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service by comparing the received user information with a pre-stored subscriber list. If it is determined that the user information is not included in the subscriber list (S208), the authentication apparatus 60 may transmit an authentication failure message (Access-Reject) to the private PGW 50 (S209). That is, if any of the received MSISDS and IMSI do not match, it is determined that subscriber authentication has failed, and the authentication failure message can be transmitted.

Upon receiving the authentication failure message, the private PGW 50 may block a connection to the private network of the unregistered mobile communication terminal 1 by sending a bearer setup stop message (Create Seesion Response-User Authentication failed) to stop the setup of the bearer. (S210, S211, S212).

Thereafter, the authentication device 60 may transmit a notification message to the unregistered mobile communication terminal 1 indicating that the connection to the private network is not permitted because the private network service is not subscribed. In this case, the authentication device 60 may transmit the notification message by requesting the transmission of the notification message to the separate text message transmission server 61 (S213 and S214). That is, if it is determined that the user information is not included in the subscriber list, the authentication device 60 extracts telephone number information from the source IP of the packet transmitted for authentication, and sends a message indicating that the mobile communication terminal 1 cannot access. The text message transmission server 61 may be transmitted.

3A and 3B are timing diagrams illustrating a private network access blocking method for a mobile communication terminal leaving a private network service area in a private network service system according to an embodiment of the present invention.

Referring to FIG. 3A, first, a private network service area list may be stored in the private PGW 50 (S301), and a subscriber list may be stored in the authentication device 60 (S302).

Thereafter, the mobile communication terminal 1 may transmit an attach request message for setting a private APN to the MME 20 (S303 and S304). The MME 20 may transmit a bearer setup message for creating user traffic to the SGW 30 and the private PGW 50 corresponding to the private APN (S305 and S306).

The private PGW 50 checks whether the location information of the mobile communication terminal 1 included in the received bearer setting message is included in the previously stored private network service area list, and if so, determines that the location authentication is successful. Proceed with subscriber authentication.

If the location authentication is successful, the private PGW 50 may request (access-request) subscriber authentication to the authentication device 60. At this time, the private PGW 50 may transmit user information (for example, to the authentication device 60). For example, MSISDN, IMSI, etc.) may be transmitted (S307).

The authentication apparatus 60 may determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service by comparing the received user information with a pre-stored subscriber list. If it is determined that the user information is included in the subscriber list, the authentication device 60 may transmit an access success message (Access-Accept) to the private PGW 50 (S308).

Upon receiving the successful authentication message, the private PGW 50 may allocate an IP address of the mobile communication terminal 1 connected to the private network (S309), and the accounting apparatus including the assigned IP address to the authentication device 60. -Send a Reqeust (start) message (S310), the authentication device 60 generates and stores session information based on the received Accounting-Reqeust (start) message (S315), and stores the result in a private PGW (50). Can be transmitted to (S311). Thereafter, the mobile communication terminal 1 may be connected to a private network (S312, S313, S314). Here, the stored session information may be as shown in FIG.

In addition, the authentication device 60 may transmit a text message indicating the successful connection to the private network to the mobile communication terminal 1 through the text message transmission server 61 (S316, S317, S318). Thereafter, the mobile communication terminal 1 may be provided with a communication service by accessing a private network and transmitting user traffic normally.

On the other hand, as shown in Figure 3b, when the mobile communication terminal 1 performs the position movement (S320), the location information of the mobile communication terminal 1 can be changed, TAU (Tracking Area) for the changed position Update) request may be sent to the MME 20 (S321). Accordingly, the private PGW 50 may receive a modify bearer request through the MME 20 and the SGW 30 (S322 and S323) and by using the changed location information included in the bearer change message. In operation S327, the mobile communication terminal 1 may determine whether it leaves the preset private network service area.

Thereafter, if the changed location information of the mobile communication terminal 1 is not included in the private network service area list, the private PGW 50 determines that the private PGW is out of the private network service area and determines the destination IP of the user traffic of the authentication apparatus 60. Can be changed to the IP (S328). In this case, since user traffic of the mobile communication terminal 1 is not input to the private network, access to the private network of the mobile communication terminal 1 is blocked, and the authentication apparatus 60 stores the source IP extracted from the user traffic and the stored session. IP of the mobile communication terminal 1 included in the information can be compared. Subsequently, when both IPs match, the authentication device 60 may send the text message transmission server 61 a text message indicating that it has left the private network service area to the mobile communication terminal 1 (S329, S330). , S331).

Fig. 5 is a timing diagram showing how the mobile communication terminal 1 connecting to the private network changes the connection from the private network to the public network.

Referring to FIG. 5, the mobile communication terminal 1 may first transmit a Detach request including a common APN to the MME 20 (S501 and S502), and the MME 20 may request a connection termination request. In response, the Delete Session Request message may be transmitted to the private PGW 50 through the SGW 30 (S503 and S504). Thereafter, the private PGW 50 may transmit an Accounting-Request (stop) message to the authentication device 60 in response to the Delete Session Request (S506), and the authentication device 60 may delete a communication session for the stored private network. The session may be terminated (S507). When the session termination is completed, the authentication device 60 may transmit a response message to the private PGW 50 to notify that the session termination is completed (S508).

6 is a timing diagram illustrating a private network connection blocking method for an unregistered mobile communication terminal according to another embodiment of the present invention.

Referring to FIG. 6, the authentication apparatus 60 may store a private network service area list and a subscriber list (S601). The mobile communication terminal 1 may transmit a connection request message for setting up a private APN to the MME 20 through the eNB 211 for private network access (S603 and S604). The MME 20 may transmit a bearer establishment message (Creat Session Request) for transmitting user traffic to the SGW 30 and the private PGW 50 in response to the access request message (S605 and S606).

The private PGW 50 may transmit user information and location information included in the received bearer setting message to the authentication device 60 to request subscriber authentication and location authentication for the mobile communication terminal 1 (S607). Here, the private PGW 50 may request the authentication and location authentication from the authentication device 60 using a RADIUS (Remote Authentication Dial-In User Service) message. For example, the RADIUS message may transmit user information and location information in the form of User-name = MSISDN, 3GPP-IMSI = IMSI, 3GPP-User-Location-Info = ECGI and / or TAI.

The authentication device 60 may compare the received user information and the location information with the subscriber list and the private network service area list, respectively. That is, it is determined whether the location information and the user information of the mobile communication terminal 1 are included in each private network service area list and the subscriber list, and when all are included, it can be determined that the location authentication and the subscriber authentication are successful. have. On the other hand, if any of the location information or user information of the mobile communication terminal 1 is not included in the private network service area list or the subscriber list, either the location authentication or the subscriber authentication has failed, and thus refuses to establish a session. can do. For example, if it is determined that the user information is not included in the subscriber list (S608), the authentication device 60 may transmit an authentication failure message (Access-Reject) to the private PGW 50 (S609).

Upon receiving the authentication failure message, the private PGW 50 may block a connection to the private network of the unregistered mobile communication terminal 1 by sending a bearer setup stop message (Create Seesion Response-User Authentication failed) to stop the setup of the bearer. (S610, S611, S612).

Thereafter, the authentication device 60 may transmit a notification message to the unregistered mobile communication terminal 1, indicating that access to the private network is not allowed because the private network service is not subscribed to the unregistered mobile communication terminal 1. In this case, the authentication device 60 may transmit the notification message by requesting the transmission of the notification message to the separate text message transmission server 61 (S613 and S614). That is, if it is determined that the user information is not included in the subscriber list, the authentication device 60 extracts telephone number information from the source IP of the packet transmitted for authentication, and sends a message indicating that the mobile communication terminal 1 cannot access. The text message transmission server 61 may be transmitted.

7A and 7B are timing diagrams illustrating a method for disconnecting a private network for a mobile communication terminal leaving a private network service area according to another embodiment of the present invention.

Referring to FIG. 7A, first, a private network service area list and a subscriber list may be stored in the authentication device 60 (S701). Thereafter, the mobile communication terminal 1 may transmit an Attach Request message for setting the private APN to the MME 20 (S703 and S704). The MME 20 may send a bearer setup message for creating user traffic to the SGW 30 and the private PGW 50 corresponding to the private APN (S705 and S706).

The private PGW 50 may query the authentication apparatus 60 for location authentication and subscriber authentication for the mobile communication terminal 1 requesting access to the private network (S707). In this case, the private PGW 50 may transmit user information (eg, MSISDN, IMSI, etc.) and location information (eg, TAI, ECGI, etc.) to the authentication device 60.

The authentication device 60 compares the received user information and location information with a pre-stored subscriber list and a private network service area list to determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service and a preset private network service area. It can be determined whether or not located within. Here, if it is determined that the user information is included in the subscriber list and the location information is included in the private network service area list, the authentication device 60 may transmit the authentication success message to the private PGW 50 (S708).

Upon receiving the successful authentication message, the private PGW 50 may allocate an IP address of the mobile communication terminal 1 connected to the private network (S709) and transmit an Accounting-Reqeust (start) message to the authentication device 60. In operation S710, the authentication apparatus 60 may store the formed session information based on the received Accounting-Reqeust (start) message (S715), and transmit the result to the private PGW 50 (S711). Thereafter, the mobile communication terminal 1 may be connected to a private network (S712, S713, S714).

In addition, the authentication device 60 may transmit a text message indicating the successful connection to the private network to the mobile communication terminal 1 through the text message transmission server 61 (S716, S717, S718). Thereafter, the mobile communication terminal 1 may be provided with a communication service by accessing a private network and transmitting user traffic normally.

On the other hand, as shown in Figure 7b, when the mobile communication terminal 1 performs the position movement (S720), the location information of the mobile communication terminal 1 can be changed, TAU (Tracking Area) for the changed position Update) request may be sent to the MME 20 (S721). Accordingly, the private PGW 50 may receive a modify bearer request through the MME 20 and the SGW 30 (S722 and S723) and by using the changed location information included in the bearer change message. In operation S724, the authentication device 60 may query whether the mobile communication terminal 1 leaves the preset private network service area. At this time, the private PGW 50 may transmit an Accounting-Request (interim) message including 3GPP-User-Location-Info to the authentication device 60.

The authentication device 60 may compare the 3GPP-User-Location-Info included in the Accounting-Request (interim) message with a preset private network service area list. Here, if the changed location information of the mobile communication terminal 1 is not included in the private network service area list, the authentication device 60 may determine that the mobile communication terminal 1 is out of the private network service area. In this case, the authentication device 60 may transmit a disconnect-request message (Disconnect-Request) for disconnecting the private network connection to the mobile communication terminal 1 to the private PGW 50 (S732).

The private PGW 50 may return an ACK message in response to the access blocking message (S733), and in order to stop transmission of user traffic, a bearer deletion message to the SGW 30 and the MME 20 (Delete Bearer Request). It may transmit (S734, S735). After receiving the bearer deletion message, the MME 20 may transmit a detach request to the mobile communication terminal 1 to block access to the private network of the mobile communication terminal 1 (S736). Thereafter, when a Delete Bearer Response message is received (S739), the private PGW 60 may transmit an Accounting-Request to the authentication device 60 (S740), and the authentication device 60 may be connected to the mobile communication terminal 1 and the private network. It is possible to terminate the session between (S741).

On the other hand, the authentication device 60, when the mobile communication terminal 1 is out of the private network service area, a notification message for notifying that the connection to the private network due to the location of the mobile communication terminal 1, the mobile communication terminal (1) ) Can be sent. That is, the authentication device 60 may request the text message transmission server 61 to transmit the notification message (S729, S730, and S731).

8 is a block diagram showing a private network service system according to another embodiment of the present invention.

8 shows a private network connection structure being promoted in TR23.829 of 3GPP Release 10. That is, according to the private network service system of FIG. 8, the mobile communication terminal 1 can directly connect to the private network through the HeNB 212 and the local gateway 70 without having to go through a separate wireless core network. have. Here, the mobile communication terminal 1 may set an APN to access the private network, and the mobile communication terminal 1 may transmit an Attach Request including the set APN to the MME 20. In this case, the MME 20 may set the bearer by selecting the SGW 30, the local gateway 70, and the like for accessing the private network corresponding to the received APN, and may transmit user traffic. . Here, the local gateway 70 may perform authentication, such as subscription authentication, location authentication, access time authentication, etc. for the mobile communication terminal 1, similar to the private PGW 50 of FIG. Only when all succeed, the mobile communication terminal 1 can be connected to the private network. Since specific authentication methods and the like have been described above, a detailed description thereof will be omitted.

According to the embodiment, as shown in Fig. 9, the mobile communication terminal 1 sends an attach request message for establishing a private APN to the MME 20 through the HeNB 212 for the private network connection. It can transmit (S901, S902). The MME 20 may transmit a bearer setup message (Creat Session Request) for transmitting user traffic to the SGW 30 and the local gateway 70 corresponding to the private APN (S903 and S904).

On the other hand, although not shown, the local gateway 70 may store a private network service area list corresponding to location information accessible to the private network, and the user of the mobile communication terminals 1 subscribed to the private network service in the authentication device 60. The subscriber list corresponding to the information may be stored.

Thereafter, the local gateway 70 checks whether the location information of the mobile communication terminal 1 included in the received bearer setting message is included in the previously stored private network service area list. Judgment can proceed to subscriber authentication. On the other hand, if the location information of the mobile communication terminal 1 is not included in the private network service area list, the session establishment can be rejected.

If the location authentication is successful, the local gateway 70 may request subscriber authentication to the authentication device 60, in which case the local gateway 70 transmits user information (eg, MSISDN, IMSI, etc.) to the authentication device 60. ) Can be transmitted (S905).

The authentication apparatus 60 may compare the received user information with a pre-stored subscriber list, and determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service (S906). If it is determined that the user information is not included in the subscriber list, the authentication device 60 may transmit an authentication failure message (Access-Reject) to the local gateway 70 (S907). That is, if any of the received MSISDS and IMSI do not match, it is determined that subscriber authentication has failed, and the authentication failure message can be transmitted.

Upon receiving the authentication failure message, the local gateway 70 transmits a Create Seesion Response-User Authentication failed message to stop setting up the bearer, thereby blocking access to the private network of the unregistered mobile communication terminal 1. It may be (S908, S909, S910).

Meanwhile, as shown in FIGS. 10A and 10B, when the mobile communication terminal leaves the private network service area after accessing the private network, private network access to the mobile communication terminal may be blocked.

Referring to FIG. 10A, a local network service area list may be stored in the local gateway 70 (S1001), and a subscriber list may be stored in the authentication device 60.

Thereafter, the mobile communication terminal 1 may transmit an attach request message for setting a private APN to the MME 20 (S1002 and S1003). The MME 20 may transmit a bearer setup message for creating user traffic to the SGW 30 and the local gateway 70 corresponding to the private APN (S1004 and S1005).

The local gateway 70 checks whether the location information of the mobile communication terminal 1 included in the received bearer setting message is included in the previously stored private network service area list, and if it is included, determines that the location authentication is successful. Proceed with subscriber authentication.

If the location authentication is successful, the local gateway 70 may request subscriber authentication to the authentication device 60, in which case the local gateway 70 transmits user information (eg, MSISDN, IMSI, etc.) to the authentication device 60. ) Can be transmitted (S1006).

The authentication apparatus 60 may determine whether the mobile communication terminal 1 corresponds to a terminal subscribed to a private network service by comparing the received user information with a pre-stored subscriber list. Here, if it is determined that the user information is included in the subscriber list, the authentication device 60 may transmit an authentication success message to the local gateway 70 (S1007).

Upon receiving the authentication success message, the local gateway 70 may allocate an IP address of the mobile communication terminal 1 accessing the private network, and transmit an Accounting-Reqeust (start) message to the authentication device 60 ( S1008), the authentication apparatus 60 may store the formed session information based on the received Accounting-Reqeust (start) message (S1013), and transmit the result to the local gateway 70 (S1009). Thereafter, the mobile communication terminal 1 may be connected to a private network (S1010, S1011, S1012).

In addition, the authentication device 60 may transmit a text message informing the mobile communication terminal 1 of the successful connection to the private network (S1014). Thereafter, the mobile communication terminal 1 may be provided with a communication service by accessing a private network and transmitting user traffic normally.

On the other hand, if the mobile communication terminal 1 performs the position movement (S1015), the location information of the mobile communication terminal 1 can be changed, the TAU (Tracking Area Update) request for the changed position is MME (20) It may be transmitted to (S1016). Accordingly, the local gateway 70 may receive a modify bearer request through the MME 20 and the SGW 30 (S1017 and S1018) and by using the changed location information included in the bearer change message. In operation S1019, it may be determined whether the mobile communication terminal 1 leaves the preset private network service area.

Thereafter, if the changed location information of the mobile communication terminal 1 is not included in the private network service area list, the local gateway 70 determines that the private gateway is out of the private network service area, and determines the destination IP of the user traffic of the authentication device 60. Can be changed to IP (S1022). In this case, since user traffic of the mobile communication terminal 1 is not input to the private network, access to the private network of the mobile communication terminal 1 may be blocked (S1023). Thereafter, the mobile communication terminal 1 may transmit a text message indicating that it has left the private network service area (S1024).

The present invention is not limited by the above-described embodiment and the accompanying drawings. It will be apparent to those skilled in the art that the present invention may be substituted, modified, and changed in accordance with the present invention without departing from the spirit of the present invention.

Claims

As a method of providing a location-based private network service,

A receiving step of receiving, by the private gateway, a connection request of the mobile communication terminal;

An authentication step of authenticating, by the private gateway, whether the mobile communication terminal satisfies a preset private network access permission condition; And

And a connection step of the private gateway, establishing a communication session with the private network to the mobile communication terminal in which the authentication is successful.
The method of claim 1, wherein the receiving step

And an access point name (APN) related to the private network service is selected in the mobile communication terminal, and a private gateway receives the access request from the mobile communication terminal.
The method of claim 1 or 2, wherein the authentication step

A location authentication step of performing, by the private gateway, location authentication by comparing the location information of the mobile communication terminal received from the mobile communication terminal with a preset private network service area list; And

And a subscription authentication step in which the private gateway inquires whether the mobile communication terminal is a terminal subscribed to the private network service using a preset authentication device, and performs subscription authentication.
The method of claim 3, wherein the authentication step

The private gateway further comprises a connection time authentication step of performing a connection time authentication for the mobile communication terminal by comparing the time of receiving the connection request with a preset connection allowance time in the mobile communication terminal. .
The method of claim 3, wherein the location authentication step

The private network service providing method for performing the location authentication by using a private network service area list that is set differently to the private network service area allowed for each mobile communication terminal.
The method of claim 3, wherein the location authentication step

The private gateway, the private network service providing method for receiving a Target Area Identifier (TAI) or E-UTRAN Cell Global Identifier (ECGI) as the location information of the mobile communication terminal.
The method of claim 3, wherein the subscription authentication step

The private gateway, the private network service providing method for transmitting a RADIUS (Remote Authentication Dial-In User Service) message containing the user information of the mobile communication terminal to the authentication device.
The method of claim 7, wherein the authentication step

And if the authentication apparatus determines that the user information is included in a preset subscriber list, the private gateway receives a successful authentication message from the authentication apparatus.
The method of claim 7, wherein the authentication step

If the authentication apparatus determines that the user information is not included in the preset subscriber list, the phone number information is extracted from the source IP of the packet transmitted for authentication, and a text message is sent to the mobile communication terminal. Private network service providing method to the transmission server.
The method of claim 7, wherein the authentication step

The private gateway, the private network service providing method for transmitting a mobile station International ISDN Number (IMSIS) or International Mobile Station Identity (IMSI) of the mobile communication terminal included in the user information.
The method of claim 3,

And a departure blocking step of blocking a communication session between the mobile communication terminal and the private network by the private gateway when the mobile communication terminal leaves the private network service area.
The method of claim 11, wherein the separation blocking step

And when the location information of the mobile communication terminal is changed, the private gateway compares the changed location information with a preset private network service area list to determine whether the mobile communication terminal is out of the private network service area.
The method of claim 12, wherein the leaving blocking step

If it is determined that the mobile communication terminal has left the private network service area, the private gateway changes the destination IP of the user traffic transmitted by the mobile communication terminal to the IP of the authentication apparatus, and accesses the private network of the mobile communication terminal. Private network service providing method to block.
The method of claim 13, wherein the separation blocking step

If the authentication apparatus determines that the changed location information is not included in the preset private network region list, the phone number information is extracted from the source IP of the packet transmitted for authentication, and a text message is sent to the mobile communication terminal. A method of providing a private network service to a message transmission server.
The method of claim 1 or 2, wherein the authentication step

And a private gateway inquires whether the mobile communication terminal is a terminal located in the private network service area and whether the mobile communication terminal is a terminal subscribed to the private network service.
The method of claim 15, wherein the authentication step

And a private gateway further inquires of the authentication apparatus whether the mobile communication terminal has made an access request at a preset access allowance time.
The method of claim 15, wherein the authentication step

And a private gateway, to the authentication device, transmitting a RADIUS (Remote Authentication Dial-In User Service) message including user information and location information of the mobile communication terminal.
The method of claim 17, wherein the authentication step

And if the authentication apparatus determines that the user information and the location information are included in a preset subscriber list and a private network service area list, respectively, the private gateway receives the authentication success message from the authentication apparatus.
The method of claim 17, wherein the authentication step

The private gateway includes a mobile station international ISDN number (IMSI) or an international mobile station identity (IMSI) of the mobile communication terminal in the user information, and a target area identifier (TAI) or ECGI of the mobile communication terminal in the location information. A method for providing a private network including the E-UTRAN Cell Global Identifier.
The method of claim 15,

And a departure-blocking step of blocking a communication session between the mobile communication terminal and the private network by the private gateway when the mobile communication terminal leaves the private network service area.
The method of claim 20, wherein the leaving blocking step

Upon receiving a TAU (Tracking Area Update) message corresponding to the movement of the location of the mobile communication terminal, the private gateway transmits the location information of the mobile communication terminal to which the location is moved to the authentication device, and the private network service of the mobile communication terminal A method of providing a private network service that inquires whether or not to leave the area.
The method of claim 21, wherein the leaving blocking step

And a private gateway blocks the transmission of traffic between the mobile communication terminal and the private network when receiving the departure confirmation message corresponding to the departure of the private network service area of the mobile communication terminal from the authentication device.
The method of claim 22, wherein the separation blocking step

If the authentication apparatus determines that the changed location information is not included in the preset private network region list, the phone number information is extracted from the source IP of the packet transmitted for authentication, and a text message is sent to the mobile communication terminal. A method of providing a private network service to a message transmission server.
A method for providing a private network service in LTE network according to TR23.829 of 3GPP Release 10,

Receiving, by the local gateway, a private network connection request of the mobile communication terminal;

An authentication step of authenticating, by the local gateway, whether the mobile communication terminal satisfies a preset private network access permission condition; And

And a local gateway, establishing a communication session with the private network to the mobile communication terminal in which the authentication is successful.
The method of claim 24, wherein the receiving step

And an access point name (APN) associated with the private network service in the mobile communication terminal, so that a local gateway receives the access request from the mobile communication terminal.
The method of claim 24, wherein the authentication step

A location authentication step of performing, by a local gateway, location authentication by comparing location information of the mobile communication terminal received from the mobile communication terminal with a preset private network service area list; And

And a local authentication, a subscription authentication step of performing a subscription authentication by querying a preset authentication device whether the mobile communication terminal is a terminal subscribed to the private network service.
The method of claim 26, wherein the authentication step

The local gateway further comprises a connection time authentication step of performing a connection time authentication for the mobile communication terminal by comparing the time of receiving the connection request with the connection allowable time preset in the mobile communication terminal. .
The method of claim 26, wherein the location authentication step

The private network service providing method for performing the location authentication by using a private network service area list that is set differently to the private network service area allowed for each mobile communication terminal.
The method of claim 26, wherein the location authentication step

And a local gateway receiving a target area identifier (TAI) or an E-UTRAN cell global identifier (ECGI) as location information of the mobile communication terminal.
The method of claim 26, wherein the subscription authentication step

And a local gateway transmitting a remote authentication dial-in user service (RADIUS) message including user information of the mobile communication terminal to the authentication device.
The method of claim 30, wherein the subscription authentication step

And if the authentication apparatus determines that the user information is included in a preset subscriber list, the local gateway receives the authentication success message from the authentication apparatus.
The method of claim 30, wherein the subscription authentication step

And a local gateway transmitting a mobile station international ISDN number (IMSIS) or an international mobile station identity (IMSI) of the mobile communication terminal in the user information.
The method of claim 26,

And a departure-blocking step of blocking a communication session between the mobile communication terminal and the private network by the local gateway when the mobile communication terminal leaves the private network service area.
The method of claim 33, wherein the leaving blocking step

If the location information of the mobile communication terminal is changed, the private network service providing method for determining whether the departure of the private network service area of the mobile communication terminal by comparing the location information changed by the local gateway with a preset private network service area list.
35. The method of claim 34, wherein the leaving blocking step

If it is determined that the mobile communication terminal has left the private network service area, the local gateway changes the destination IP of the user traffic transmitted by the mobile communication terminal to the IP of the authentication apparatus, and accesses the private network of the mobile communication terminal. Private network service providing method to block.
A bearer setup message for checking whether the access request is to a private network using an access point name (APN) transmitted by a mobile communication terminal, and transmitting user traffic to a private gateway corresponding to the APN if the access request is to the private network. A mobility management entity (MME) for transmitting a message;

Upon receiving the bearer setup message, perform location authentication on whether the mobile communication terminal is located in a preset private network service area, and perform subscription authentication on whether the mobile communication terminal joins the private network service with a preset authentication device. A private gateway for requesting to establish a communication session between the mobile communication terminal and a private network in response to the bearer setup message if the subscription authentication and location authentication for the mobile communication terminal are successful; And

At the request of the private gateway, an authentication device for determining whether the mobile communication terminal is included in the subscriber list subscribed to a preset private network service, generating a subscription authentication result, and transmitting the generated subscription authentication result to the private gateway. Private network service system comprising a.
A bearer setup message for checking whether the access request is to a private network using an access point name (APN) transmitted by a mobile communication terminal, and transmitting user traffic to a private gateway corresponding to the APN if the access request is to the private network. A mobility management entity (MME) for transmitting a message;

When receiving the bearer setup message, requesting the location authentication and subscriber authentication of the mobile communication terminal to a predetermined authentication device, and if the location authentication and subscriber authentication for the mobile communication terminal is successful, in response to the bearer setup message A private gateway forming a communication session between the mobile communication terminal and the private network; And

A response corresponding to the location authentication and subscriber authentication request by checking whether the user information of the mobile communication terminal is included in a preset subscriber list and whether the location information of the mobile communication terminal is included in a preset private network service area list. And a server for generating a message and transmitting the response message to the private gateway.
A private network service system according to TR23.829 of 3GPP Release 10,

A bearer setup message for confirming whether the access request is to a private network using an access point name (APN) transmitted by a mobile communication terminal, and for transmitting user traffic to a local gateway corresponding to the APN if the access request is to the private network. A mobility management entity (MME) for transmitting a message;

Upon receiving the bearer setup message, perform location authentication on whether the mobile communication terminal is located in a preset private network service area, and perform subscription authentication on whether the mobile communication terminal joins the private network service with a preset authentication device. A local gateway for requesting and establishing a communication session between the mobile communication terminal and a private network in response to the bearer setup message if the registration authentication and location authentication for the mobile communication terminal are successful; And

The authentication device determines whether the mobile communication terminal is included in a subscriber list subscribed to a preset private network service according to a request of the local gateway, generates a subscription authentication result, and transmits the generated subscription authentication result to the local gateway. Private network service system comprising a.