KR20030093603A - METHOD FOR AUTHENTICATION in wireless communication system for high rate packet data - Google Patents

Abstract

PURPOSE: A method of authenticating a terminal in a mobile communication system for high speed data communication is provided to obtain an ID of the terminal through information exchanges between an ANC(Access Network Controller) and a DLR(Data Location Register), and to perform an authentication process between an AT(Access Terminal) and an AN AAA(Access Network Authentication Accounting Authentication) unit, thereby quickly transmitting data. CONSTITUTION: An AT transmits a connection request message to an ANC(2a). The ANC transmits a 'SessionRetrieveReq' message including a UATI(Unicast Access Terminal Identifier) to a DLR(2b). The DLR transmits an MN ID and session information to the ANC(2c). The ANC performs a normal connection setup procedure(2d). The AT carries out a connection authentication procedure(2f,2g,2h). The ANC transmits a 'GeneralUpdateReq' message to the DLR, and requests the DLR to store the MN ID of the AT(2i). The DLR stores the MN ID(2j).

Description

Authentication method of a terminal in a mobile communication system for high-speed data communication {METHOD FOR AUTHENTICATION in wireless communication system for high rate packet data}

The present invention relates to a mobile communication system, and more particularly, to a method and apparatus for authenticating a terminal in a mobile communication system such as CDMA2000 1x EV-DO (HRPD).

A representative third generation digital communication system is a code division multiple access (CDMA) mobile communication system. For example, there are synchronous and asynchronous International Mobile Telecommunication 2000 (IMT-2000) systems. The synchronous IMT-2000 system is called a CDMA2000 or IS-2000 system, and the asynchronous IMT-2000 system is called a UMTS (Universal Mobile Telecommunication Service) or W (Wideband) -CDMA system. The CDMA mobile communication system integrates circuit data such as voice service and packet data of low speed (for example, 144 kbps or less).

On the other hand, as the demand for services requiring packet data transmission, such as the Internet, increases along with user demands, mobile communication systems are developing in the form of supporting high-speed packet data services. Mobile communication systems such as CDMA2000 1x EV-DO (EV-lution Data Only) or HRPD (High Rate Packet Data) are systems developed and commercialized to support only high-speed (eg 2Mbps or more) packet data services without voice services. .

In the conventional mobile communication system, the components necessary for authentication of the terminal are an authentication center (AUC), a home location register (HLR) for managing the location information of the mobile terminal, a visitor location register (VLR), and the like. There is a problem that can not be applied to the HRPD system configured system for the purpose of high-speed data transmission.

An object of the present invention to solve the above problems is to provide an authentication method of a terminal in a mobile communication system, in particular HRPD system. Another object of the present invention is to store information necessary for authentication of the terminal in the HRPD system in a Data Location Register (hereinafter referred to as "DLR") to perform the authentication quickly even if the terminal moves to another subnet, The present invention provides a method for transmitting data. According to the present invention for achieving the above object, the authentication procedure process by taking a method of obtaining the ID of the terminal through the information exchange between the access network controller (hereinafter referred to as "ANC") and the DLR during the authentication process of the terminal A new message is provided, and after authentication of the terminal, the base station system requests the DLR to update and store the identifier information of the terminal, and the DLR updates and stores the identifier information of the terminal in response to the storage request.

The foregoing has outlined rather broadly the features and technical advantages of the present invention in order that those skilled in the art may better understand the detailed description of the invention that follows.

Additional features and advantages of the invention will be described hereinafter which form the subject of the claims of the invention. Those skilled in the art should recognize that the disclosed concepts and specific embodiments of the invention may be readily used as a basis for modifying or designing other structures for achieving the same purposes of the present invention. Those skilled in the art should also recognize that structures equivalent to the invention do not depart from the spirit and scope of the broadest form of the invention.

1 is a block diagram of a CDMA2000 1x EV-DO (HRPD) system, which is a technical field of the present invention;

2 is a flow chart of a signal in the case of normally performing an authentication process according to an embodiment of the present invention;

3 is a flowchart illustrating a procedure of performing an authentication process when a base station system does not receive information required for authentication from a DLR according to an embodiment of the present invention;

4 is a flowchart illustrating a process of releasing a connection during an authentication process according to an embodiment of the present invention.

DETAILED DESCRIPTION A detailed description of preferred embodiments of the present invention will now be described with reference to the accompanying drawings. It should be noted that reference numerals and like elements among the drawings are denoted by the same reference numerals and symbols as much as possible even though they are shown in different drawings. In the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted.

In the following, a feature of distinguishing a CDMA2000 1x EV-DO or HRPD, which is a mobile communication system to which the present invention is applied, from a CDMA 1x system will be described. Next, the configuration of the 1x EV-DO system to which the present invention is applied will be described. Next, an operation of updating location information of an access terminal (AT) according to embodiments of the present invention will be described.

A feature that distinguishes the 1x EV-DO system from the 1x system is that the terminal uses a temporary identifier rather than a fixed identifier. The temporary identifier called 'Unicast Access Terminal Identifier (UATI)' is an identifier temporarily assigned to a terminal regardless of the subnet configuration. Another feature is that in the 1x EV-DO system, since the transmission bandwidth of the forward link is wide, unlike the 1x system, the transmission is performed with all the power to one subscriber every moment on the forward link. Thus, 1x EV-D0 The system does not need to allocate resources considering multiple subscribers as in the 1x system. Therefore, as much information as possible is transmitted and received as soon as possible so that resource allocation can be quick, and changes of such information must be updated quickly. Accordingly, the present invention provides a data location register (hereinafter referred to as "data location register") as a logical system for managing information such as location, status, and identifier of a terminal in a 1x EV-DO system developed to support only high-speed packet data services. DLR "), and the DLR manages the terminal information. The present invention also provides a signaling procedure and a message for updating the information of the terminal between an access network controller (ANC) and a DLR in order to enable a quick service based on accurate location information when receiving a service to the terminal. Define.

1 is a diagram illustrating the configuration of a CDMA2000 1x EV-DO (or HRPD) system, which is a mobile communication system to which the present invention is applied.

Referring to FIG. 1, the 1x EV-DO system includes a general ATM switch network (GAN) 100, which is an exchange, and an access network transceiver system, which is a base station transceiver serving as a base transceiver system (BTS) defined in a CDMA 1x system. 120), an access network controller (ANC) 110, which is a base station controller serving as a base station controller (BSC) 110, a base station manager (BSM) 140, which is a base station manager, and a terminal authentication process. AN-AAA (Access Network-Authentication, Authorization and Accounting) 150, Data Location Register (DLR) 160, Packet Data Serving Node (PDSN) 170, Home Agent (HA) 180 , AAA (Authentication, Accounting, Authorization) 190. As described above, the 1x EV-DO system to which the present invention is applied is connected to the GAN 100, the ANC 110, the plurality of ANTSs 120 connected by wire to the ANC 110, and the AT 130 wirelessly connected to the ANTS 120 to communicate. It includes. The ANC 110 and ANTS 120 constitute a base station system. In the following, ANC 110 and ANTS 120 will be collectively referred to as ANC.

Network components added to existing CDMA2000 1x systems for 1x EV-DO systems are the DLR160 and AN-AAA150. The DLR 160 stores session information related to a terminal, such as a mapping between IMSI (International Mobile Subscriber Identity, hereinafter referred to as "IMSI"), IMSI and UATI (Unicast Access Terminal Identifier, referred to as "UATI"), and the like. . In addition, the DLR 160 controls the UATI allocation for the terminal, instructs the ANC 110 to paging to the terminal, and stores the positions of the ANTS and the ANC where the terminal is currently located. The DLR 160 is logically located in a packet control function (PCF).

In this case, the term session refers to 1x EV-DO (HRPD) session and refers to status information shared between the AT 130 and the ANC 110. This shared state information stores information about the protocol and its protocol configuration between AT 130 and ANC 110 and is used for communication between AT 130 and ANC 110. Without opening this session, communication between AT 130 and ANC 110 cannot be established.

The AN AAA is an access network authentication unit. The AN AAA performs an access authentication for an access network and an access authentication process of a specific terminal.

In addition, the AN AAA operates as a Remote Authentication Dial-In User Service (RADIUS) server during authentication.

2 is a flowchart of a signal when a normal authentication process is performed.

Referring to FIG. 2, the AT sends a connection request message to the ANC in step 2a when it needs to perform an authentication procedure or when data to be transmitted arrives. Upon receiving the connection request message, the ANC sends a SessionRetrieveReq message including the UATI of the UE to the DLR in order to obtain MN_ID and Session information in step 2b. At this time, SessionRetrieveReq message can be configured as shown in <Table 1>.

Information Element Type Message Type M Message Length M TID M UATI M Location Registration M Authentication Parameter O

Looking at the components of the SessionRetrieveReq message in Table 1, the TID (Transaction IDentifier) for distinguishing the UDP response of the UDP layer of the RADIUS protocol reference model, UATI is defined as a temporary identifier in the HRPD system.

When the DLR receives the SessionRetrieveReq message, the DLR sends the MN ID and Session information to the ANC through a SessionRetrieveRsp message in step 2c. At this time, the SessionRetrieveRsp message may be configured as shown in Table 2 below.

Information Element Type Message Type M Message Length M TID M RET M MN ID O Paging Parameter O QoS Parameter O Session Configuration Records O MS InfoRecord O HW ID O

Referring to the main information in Table 2, the TID receives the received TID in the session retrieve request message, and delivers the result of the session retrieve request message to the RET. Other MN ID, Paging Parameter, QoS Parameter, Session Configuration Records fields and HW ID are transmitted only when information exists. Table 3 is a table showing the MN ID field in the message format described in Table 2 above.

The MN ID field is the same as the IMSI described above as the terminal unique number information. The MS InfoRecord field is a parameter used only when the subscriber is an intelligent network service and is transmitted only when MS InfoRecord information exists.

When the DLR sends the MN ID and Session information to the ANC, the ANC performs a normal connection establishment procedure with the AT in step 2d.

When the AT establishes a connection with the ANC, the AT performs the access authentication procedure in steps 2f, 2g, and 2h.

3 is a flowchart illustrating a procedure of performing an authentication process in an ANC when the DLR does not send MN ID and Session information in steps 2c to 2e of FIG. 2. In step 2c of FIG. 2, the ANC that receives the SessionRetieveRsp from the DLR determines whether there is Session information in the information sent by the DLR (4a), and when receiving the Session information, determines whether there is MN ID information (4b). . First, if the session information is not sent from the DLR, the session configuration token is sent from the AT, the necessary protocols are set up, and the session negotiation process is performed (4c). If there is no MN ID information, the ANC sends a DataReady message of a packet application (access) to the AT to inform that there is a packet to be transmitted (5d). The ANC determines whether an XonRequest message is received (4e), and if the XonRequest message is received, transmits an XonResponse message to the AT (4f). The subsequent process performs a normal authentication process (5e).

When the AT needs to perform a connection authentication process or when it receives the DataReady message from the ANC, it actually sends the packet to the ANC in step 2f so that the ANC prepares a resource such as a radio link protocol. Send an XonRequest message. When the ANC receives the XonRequest message from the AT, it sends an XonResponse message to the AT in step 2g, and then performs an access authentication procedure with the AT in step 2h. In performing the access authentication procedure, the AT and the ANC establish a Point to Point Protocol (hereinafter referred to as "PPP"), and the Challenge Authentication Protocol (hereinafter referred to as "CHAP") on the PPP. Based authentication. CHAP refers to a method of authenticating a user by sending a validity message to a connection requestor after establishing a link and checking a response. After the CHAP having the function described above is completed, the ANC or the DLR performs the AN-AAA and the Radius (RemoteAuthentication Dial-In User Service (hereinafter referred to as "RADIUS")) from the AN-AAA. Perform user authentication. The AN-AAA then notifies the ANC of the authentication result, together with the MN ID for the AT. The RADIUS authenticates the users that the remote access server has accessed through the Dial-Up modem, It allows the user to communicate with a central server to grant access to the server.

After access authentication is completed in step 2h, in step 2i, the ANC sends a general update request (GeneralUpdateReq) message to the DLR to request to store the MN ID for the AT obtained in step 2h.

By performing the above-described process, it is possible to achieve the object of the present invention to provide authentication of the terminal even in a mobile communication system for high-speed data communication.

The GeneralUpdateReq message may be configured as shown in Table 4 below.

Information Element Type Message Type M Message Length M TID M REG_TYPE M UATI M MN ID O PDSN IP Address O Access Network Identifier O Authentication Keys O Paging Parameter O QoS Parameter O Session Configuration Records O Location Registration O CLIM Indicator O MS InfoRecord O

Looking at the components of the GeneralUpdateReq message of <Table 5>, TID (Transaction IDentifier), REG_TYPE, UATI, etc., which classify a registration case, are required. If the IMSI information is included, the MN ID field is updated to update the DLR. Is passed. In addition, PDSN IP Address, Access Network Identifier, Authentication Keys, Paging Parameter, QoS Parameter, Session Configuration Records and Location Registration fields are optional and are delivered only when information is included. The CLIM (Credit Limit Management) Indicator field is included only in the case of a PPS subscriber. The MS InfoRecord field is used to update the DLR in case of an intelligent network service subscriber.

Upon receiving the GeneralUpdateReq message, the DLR stores the received MN ID, session information, location registration, etc. in the database when the information corresponding to the received UATI exists in the internal database.

Table 4 is a table showing the REG_TYPE field in the message format described in Table 5 above. This field is used to identify the registration case. For example, location information transfer when registering location based on distance, location information transfer when general call is released, session information and location information transfer when call is released after session negotiation, IMSI delivery when IMSI is acquired from AN AAA, and QoS parameter delivery. Indicates.

Upon receiving the GeneralUpdateReq message, the DLR forwards the GeneralUpdate Response (GeneralUpdateRsp) message as a response message to the ANC in step 2j. The GenenralUpdateRsp message may be configured as shown in Table 6 below.

Information Element Type Message Type M Message Length M TID M RET M MN ID O

In Table 6, the TID field delivers the TID value received in the GeneralUpdateReq message, and delivers the processing result of the GeneralUpdateReq message to the RET. For example, when an MN ID is passed, if the information with the same MN ID exists separately by comparing the passed MN ID with the information in the database, the duplicated previous information is deleted from the database, and the RET is DUPLICATED_UATI. To pass. Otherwise, pass GeneralUpdateRsp with RET as SUCCESS. In the abnormal case, if there is no information corresponding to the received UATI, GeneralUpdateRsp is delivered by setting RET to UNKNOWN_UATI. For other failures, set the cause of the failure to RET and pass GeneralUpdateRsp. The MN ID serves to deliver the subscriber's MN ID value from the DLR to the ANC during the 1x-1x EV-DO Dormant Handoff.

4 is a flowchart illustrating a process of releasing a connection during an authentication process according to an embodiment of the present invention. The AT sends a ConnectionRequest message to the ANC in step 6a when it needs to perform an authentication procedure or when data to be sent arrives. When the ANC receives the ConnectionRequest message, the ANC sends a SessionRetrieveReq message including the UATI of the UE to the DLR to obtain the MN ID and Session information in step 6b. When the DLR receives the SessionRetrieveReq message, it sends the MN ID and Session information to the ANC through the SessionRetrieveRsp message in step 6c. When the DLR sends MN ID and Session information, the ANC performs a normal connection establishment procedure with the AT in step 6d. The AT sends an XonRequest message to the ANC in step 6f when it needs to perform a connection authentication procedure or when it receives a DataReady message from the ANC. When the ANC receives the XonRequest message from the AT, the ANC sends an XonResponse message to the AT in step 6g, and then performs the terminal authentication process as in the normal authentication procedure. If the connection is lost during the access authentication process, the PPP packet is generated again in the AT. Therefore, in step 6h, the AT sends a ConnectionRequest message to the ANC. The subsequent process is the same as the normal authentication procedure.

Meanwhile, in the detailed description of the present invention, specific embodiments have been described, but various modifications are possible without departing from the scope of the present invention. Therefore, the scope of the present invention should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

As described above, the present invention obtains the ID of the terminal through information exchange between the ANC and the DLR during the authentication procedure of the terminal in a mobile communication system, in particular, a CDMA2000 1x Code Division Multiple Access 2000 1x Evolution Data Only (EV-DO) system. By performing a connection authentication procedure between the AT and AN AAA, a new message provided during the authentication procedure is newly defined, and the resultant value is stored in the DLR to enable high-speed data transmission.

Claims (8)

And a base station, a terminal wirelessly connected to the base station for communication, a data location register (DLR) connected to the base station and storing authentication information of the terminal, and at least an access network authentication unit configured to perform user authentication. In the mobile communication system, a method for providing authentication of the terminal, Transmitting, by the terminal, a first message to prepare information necessary for authentication including session information to the base station; Sending, by the base station, a second message to the data location register to obtain information necessary for authentication in response to receiving the first message; Transmitting, by the data location register, a third message including information necessary for authentication to the base station in response to receiving the second message; Establishing, by the base station, a connection with the terminal using a predetermined protocol; And performing the authentication by the base station using the access network authentication unit and a predetermined algorithm. 2. The method of claim 1, wherein the predetermined protocol is an authentication challenge protocol (CHAP). The method of claim 1, wherein the predetermined algorithm is RADIUS. The method of claim 1, further comprising: transmitting a connection request message back to the base station when the connection is released during the connection authentication process. The method of claim 1, further comprising: transmitting, by the base station, identifier information of the terminal to the base station after performing authentication of the terminal; Transmitting, by the base station, a message requesting an update of identifier information for the terminal to the data location register; And updating and storing the stored identifier information with the received new identifier information. The method of claim 1, wherein the third message comprises session information and identifier information (MN ID) of the terminal. The method of claim 6, wherein if there is no session information in the third message, session negotiation is performed using a predetermined value sent by the terminal. The method of claim 6, wherein the base station sends a fourth message to the terminal when the third message does not have identifier information of the terminal.