KR100497290B1 - Authentication Method for fast handoff in mobile-based radius network - Google Patents

Abstract

The present invention relates to an authentication method for fast handoff in a mobile environment-based Radius network to provide stability according to the movement of an authenticated user when a fast handoff occurs due to a user's movement in a wireless environment. In order to provide authentication according to user's movement in case of high speed handoff based on wireless mobile environment, we apply IETF standard protocol and related technology based on it, and apply authentication technology of Radius which is IETF standard standard when authenticating according to user's movement. Also, in case of high speed handoff due to user's movement, additional operation of access network server and Radius server maintains user's authentication status and maintains service.

Description

Authentication Method for Fast Handoff in Mobile-based Radius Networks

The present invention relates to authentication for fast handoff in a Mobile IPv6 Remote Authentication Dial In User Service (RADIUS) network. In particular, a fast handoff occurs due to a user's movement in a wireless environment. The present invention relates to an authentication method for fast handoff in a mobile environment-based Radius network to provide stability according to the movement of an authenticated user.

In general, a wireless LAN is a technology for extending a LAN in an environment in which an existing wired network is difficult to install using a wireless transmission technology. Instead, a wireless LAN uses a method of transmitting and receiving data through a 2.4GHz band instead of a 10Mbps or 100Mbps based wired cable.

Wireless LANs have raised considerable expectations for their use due to various advantages. First, departments and mobile companies require a lot of relocation costs and consumables when using existing wired networks. Except in the case of network expansion, there is an efficiency that does not require additional costs.

Therefore, even in a work environment requiring maintenance, relocation, mobility, etc., or where a relatively large sales organization is required (e.g., insurance companies, car offices, etc.), even if a wired network environment is established, it is not enough to supplement dynamic business activities. It is the best solution available for distributors, local sales offices, logistics companies, manufacturers, schools and warehouses.

The WLAN is a device for WLAN, a service registration method, and a method used according to the number of mobile communication terminals to be connected, the size of an area requiring a service, the type of service provided for each ISP, and the involvement of a WLAN service provider. If you look at the configuration and services of the basic WLAN briefly as follows.

First, an ISP equipped with a backbone network directly installs an AP device and provides a WLAN service by renting a registered PC card or a mobile communication terminal to a user who applied for WLAN service. With the terminal information, the service user does not need to perform a separate procedure for roaming between service areas of the access point device. For example, an institution having a backbone network provides a wireless LAN service to a person related to an institution so that a business can be processed regardless of movement within a certain region.

Second, an ISP equipped with a backbone network and an AP device may provide a wireless LAN service for the general public using each individual mobile communication terminal. In this case, a service user usually uses the ISP's site on the wired Internet. Access to the wireless LAN service, and receives the communication program and identification information for using the wireless LAN to use the service.

Third, when the wireless LAN service provider provides the wireless LAN service by installing an AP device and connecting the ISP and the service user, the service user applies for the service to the wireless LAN service provider and uses his own unregistered mobile communication terminal. The use of the WLAN service is fragmented and more complicated communication is made between the mobile communication terminal, the AP device, the WLAN service provider, and the ISP than the case described above.

Fourth, the ISP may provide a wireless LAN service for a wireless LAN service provider and individual users in a wider region than the aforementioned cases by implementing the inter-regional network configuration as a wireless LAN equipment.

In order to use the various WLANs, the user authentication is basically performed, and the access authority is granted to the authenticated user so that the system can be used stably.

Currently, Radius (RADIUS) is used for user authentication in Mobile IPv6-based system. Radius is used for the purpose of granting authentication and access rights of a user connected via a dial-up modem in a wired or wireless environment. Through such an authentication procedure, it is possible to ensure the stable service use of the authenticated user and to use it as a base technology of the charging system.

1 is a diagram illustrating a general mobile environment-based Radius network.

Here, reference numeral 10 denotes a mobile node, reference numerals 21 and 22 denote access points AP1 and AP2, reference numerals 31 and 32 denote hubs, and reference numerals 41 and 42 denote reference numerals. A network access server (NAS: Network Access Server) is connected to the hubs 31 and 32, respectively, and operates as a Radius client. Reference numeral 50 is connected to the network access servers 41 and 42 to authenticate a user. Represents a Radius server responsible for overall control over access authorization, billing, and so on.

In the general mobile environment-based Radius network configured as described above, the user terminal 10 is connected in the current access point area AP1 to perform authentication through the general authentication process as shown in FIG.

That is, as shown in Figure 2, the user terminal 10 transmits the user authentication information (User Authentication Information) to the network access server 41, which is a Radius client connected to the current access point 21 in step S11 In step S12, the network access server 41 encrypts the received user information and then makes a RADIUS Access Request to the Radius server 50 in step S12.

The Radius server 50 receiving the request determines whether the user is a normal user through a user authentication process in step S13. If it is determined that the user is a normal user, in step S14, the network access server 41 transmits a message (Access-Challenge) to request accessor identification, and the network access server 41 receives the user terminal (step S15). 10) send the Access-Challenge message.

The user terminal 10 receiving the Access-Challenge message transmits user authentication information to the network access server 41 again in step S16. The network access server 41 receives the received user access information. After encrypting one user information, a message (RADIUS Access Request) requesting a Radius connection is transmitted to the Radius server 50 in step S17.

Upon receiving the message requesting the Radius connection, the Radius server 50 performs a user authentication process in step S18. When the user authentication is performed, the message allowing the connection to the network access server 41 in step S19 ( Access Accept) is transmitted, and the network access server 41 receiving the message transmits a message (Authentication Success Information) indicating that authentication is successful to the user terminal 10 in step S20.

On the other hand, when the user terminal 10 moves to the AP2 area in the situation that the service is received through the network access server 41 after authentication for the connection through the flow as shown in Figure 2 of the current user by fast handoff The network environment will change.

However, in the conventional Radius method as described above, when the network environment changes due to user movement, an additional authentication procedure is not performed, the user terminal moving to AP2 may maintain the service by filtering the network access server 42. There was a problem that no.

In other words, the existing Radius does not provide a function for moving a user based on a mobile environment, and thus, a service desired by a user may be maintained due to a failure of authentication due to a user's movement when interworking with a high speed handoff technology. There was no problem.

Accordingly, the present invention is to provide an authentication procedure according to the movement of the user in conjunction with the fast handoff of the mobile environment,

An object of the present invention is to provide an authentication method for fast handoff in a mobile environment-based Radius network to provide stability according to the movement of an authenticated user when a fast handoff occurs due to a user's movement in a wireless environment. .

The present invention for achieving the above object,

In case of high speed handoff based on wireless mobile environment, IETF standard protocol and related technology based on this are applied to provide authentication according to user's movement. That is, it applies the IP layer control function and operation in the network access server.

Authentication based on user's movement applies the authentication technology of Radius, IETF standard. This technology provides the user's authentication process and the ability to grant access.

In addition, in case of high speed handoff due to user's movement, additional access network server and Radius server operate to maintain user's authentication status and maintain service.

Hereinafter, described in detail with reference to the accompanying drawings, preferred embodiments of the present invention according to the technical spirit as described above.

3 is a flowchart illustrating an authentication method for fast handoff in a mobile environment-based Radius network according to the present invention.

Here, reference numeral 10 denotes a user terminal (MN), reference numeral 41 denotes a network access server currently serving the user terminal 10, reference numeral 50 denotes a radius server, and reference numeral 42 denotes the user terminal. When the 10 moves, the network access server for maintaining the service of the user terminal 10 through the fast handoff.

As shown in the figure, when the user terminal 10 moves to the AP2 area during data communication between the user terminal 10 and the network access server 41 after performing authentication through a normal user authentication process, the user terminal (10) transmits a fast handoff request message (RtSolPr Msg.) To the network access server 41 (S101 to S102), and receives the fast handoff request message from the network access server 41. Transmitting a handoff information (Handoff Information Msg.) Of the user terminal to the network access server 42 (S103), and the user terminal 10 from the network access server 41 to the radius server 50; (S104) requesting an authentication procedure according to the handoff of the network and performing a user authentication on the Radius server 50, and as a result, the network access server to be handed off if the user is a normal user. Searching for (S105), requesting synchronization of the authentication information (Fast Accept Request) from the Radius server 50 to the handoff target network access server 42 (S106), and the network access server 42 In step (S107) to update the filtering information, and update the user list information to perform authentication synchronization, and after the synchronization is performed, the network access server 41 to the user terminal 10 for the binding information update request Transmitting a confirmation message (Fast Binding Ack. Msg.) And deleting filtering information about the user (S108 to S109), and filtering information about the user from the access network server 41 to the Radius server 50; The step (S110) of transmitting the message (Disconnect Request) that has been deleted, and updating the information on the access point (AP) in the Radius server 50 (S111).

The authentication method for the fast handoff in the mobile environment-based Radius network according to the present invention will be described in more detail as follows.

First, after performing authentication through a normal user authentication process as in step S101, and when the user terminal 10 moves to the AP2 area during data communication between the user terminal 10 and the network access server 41, in step S102 The user terminal 10 transmits a fast handoff request message (RtSolPr Msg.) To the network access server 41.

Upon receiving the fast handoff request message, the network access server 41 transmits a handoff information (Handoff Information Msg.) Of the user terminal to the network access server 42, which is a handoff target access router, in step S103. do.

In addition, the network access server 41 is triggered immediately after transmitting the information about the handoff to the network access server 42, the user identification number (ID), its own IP, etc. using the MAC address of the user terminal in step S104 After creating a message (Fast Access Request) requesting the authentication procedure including the information of the information, and transmits it to the Radius server 50 to request the authentication procedure for the handoff of the user terminal.

The Radius server 50 searches whether the user is a normal authenticated user by using the user ID in the message requesting the authentication procedure received in step S105, and as a result, in the case of an unauthenticated user, the received message is ignored. In contrast, if the user is an authenticated user, the network access server 42 to be newly accessed is searched by using a care of addr. To be used by the new access router (handoff target network access server 42). Thereafter, in step S106, a message (Fast Accept Request) is transmitted to the handoff target network access server 42 to request authentication information synchronization.

The network access server 42 which has received the message for requesting synchronization of the authentication information (Fast Accept Request) updates the filtering information (the packet of the authenticated user is not filtered) using the user authentication information synchronized in step S107. In addition, the user list information is updated for the next handoff of the user.

After this process, the previous network access server 41 transmits a confirmation message (Fast Binding Ack. Msg.) For binding information update request to the user terminal 10 as in step S108. When the user terminal 10 receives the confirmation message, the user terminal 10 moves the physical link to the new network access server 42.

In addition, the previous network access server 41 deletes the filtering information for the user it has in step S109, and the message that the filtering information for the user has been deleted to the Radius server 50 in step S110 (Disconnect Request) Will be sent.

Upon receiving this, the Radius server 50 determines that the user has completed the handoff, and updates the information on the access point AP from the network access server 41 to the network access server 42 in step S111.

According to the present invention described above, since the additional authentication and access control according to the movement of the user node in the wireless mobile environment is possible, there is an effect to stabilize the billing processing and service support.

In addition, PTF, PAP, CHAP, and other standards of the IETF also have the effect of promoting mobility and safety.

1 is a diagram showing the configuration of a general mobile environment-based Radius network,

2 is a flow chart illustrating a Radius process based on a conventional mobile environment.

3 is a flowchart illustrating an authentication method for fast handoff in a mobile environment-based Radius network according to the present invention.

<Explanation of symbols for the main parts of the drawings>

10 ..... User terminal (MN)

41 ..... Network Access Server (NAS1)

42 ..... Network Access Server (NAS2)

50 ..... Radius Server

Claims (2)

When the user terminal (MN) 10, the network access server 41 currently serving the user terminal 10, the radius server 50, and the user terminal 10 have moved, the user terminal through fast handoff. In the authentication method for fast handoff in a mobile environment-based Radius network consisting of a network access server 42 for maintaining the service of (10), When the user terminal 10 moves to the AP2 area during data communication between the user terminal 10 and the network access server 41 after performing authentication through a normal user authentication process, When the user terminal 10 transmits a fast handoff request message (RtSolPr Msg.) From the network access server 41, the network access server 41 receives the network access server 42 of the user terminal. Transmitting a handoff information (Handoff Information Msg.) And triggering to a Radius client for a fast Radius authentication procedure request; Requesting an authentication procedure according to the handoff of the user terminal 10 from the network access server 41 to the radius server 50; Performing user authentication in the Radius server 50 and searching for a network access server to be handed off if the user is a normal user, and then requesting a fast accept request from the network access server 42 to which the handoff target is to be handed off. Wow; Updating filtering information at the network access server (42) and updating user list information to perform authentication synchronization; Transmitting the confirmation message (Fast Binding Ack. Msg.) For the binding information update request from the network access server 41 to the user terminal 10 after the synchronization is performed, and deleting the filtering information for the user; ; Transmitting a message (Disconnect Request) indicating that the filtering information about the user has been deleted from the access network server (41) to the Radius server (50); And updating the information on the access point (AP) in the Radius server (50). The method of claim 1, wherein the updating of the information about the access point in the Radius server 50, Upon receiving the message that the filtering information for the user has been deleted, the information on the access point is updated to the network access server 42 handed off from the previous network access server 41. Authentication method for handoff.