Certificate based authentication authorization accounting scheme for loose coupling interworking

The present invention relates to networking, and more particularly to certificate-based authentication, authorization and accounting (AAA) schemes for loose coupling interworking between two different access networks.

Authentication, authorization and accounting (AAA) are typically required to access and utilize networks such as cellular networks and wireless local area networks (WLANs). However, the realization of AAA only requires additional software and / or hardware in the case of interworking between two different radio access networks that do not belong to the same management domain and do not share the same AAA scheme. It is difficult without.

There are two main types of interworking between cellular networks and WLANs: tight coupling and loose coupling. In the loose coupling scenario, the WLAN and cellular network are independent data paths, but for WLAN users AAA relies on the AAA capabilities of the cellular network. However, the cellular network AAA protocol (MAP / SS7) is incompatible with the Internet Protocol (IP) based protocol used by WLAN users. Two approaches have been proposed. In the first approach, the AAA interface is located in the home location register (HLR) of the cellular network. This requires either replicating the HLR data or providing a protocol converter between the Radius / Diameter and the MAP. In the second approach, the mobile terminal (MT) is the SIM (Subscriber Identity). When using a Module) card-based authentication mechanism (for example, NOKIA's wireless operator LAN), AAA follows a cellular procedure. AAA Interworking Functions (IWF) need to interface with HLR and MT. In terms of functionality, it is similar to the Serving GPRS (General Packet Radio Service) Support Node (SGSN) or Mobile Switching Center (MSC), with traffic being carried through IP in terms of AAA, excluding AAA.

<p> Both approaches require a special interworking function or gateway to be deployed by the cellular operator. According to the second approach, users are required to have a SIM card for WLAN access, but most WLAN users have a SIM available on their laptop or personal digital assistant (PDA). I don't have a card.</p><p> Therefore, in the case of interworking between two different networks that do not belong to the same management domain and do not share the same AAA scheme, a special interworking feature deployment is required to bridge between the two types of networks. It is desired to have a certification, authorization and accounting (AAA) scheme that does not, and having such a scheme is very advantageous.</p>

<p> The above issues are solved by certificate-based authentication, authorization and accounting (AAA) schemes for interworking between different access networks according to the present invention, as well as other related issues in the past.</p><p> Advantageously, the invention can operate without interaction with the cellular core network during authentication. Compared to existing schemes, the proposed scheme does not require a cellular operator to tune the user's home location register (HLR) interface to provide authentication for the WLAN user through the Internet Protocol.</p><p> According to aspects of the invention, methods for authentication, authorization and accounting (AAA) in interworking between at least two networks are provided. At least two networks include a first network and a second network. Users on the first network are verified by the second network on the basis of a certificate. When the user is confirmed, the session key is sent from the second network to the user's mobile device. The session key is used to encrypt the communication between the mobile device and the second network.</p><p> These aspects, features and advantages of the present invention, as well as other aspects, features and advantages, will become apparent from the following detailed description of preferred embodiments, which preferred embodiments are described with the accompanying drawings. ..</p>

The present invention is directed to certificate-based certification, authorization and accounting (AAA) for loose-coupling interworking. It is understood that the present invention is applicable to any combination of access networks (eg, interworking between a community access television (CATV) network and a wireless local area network (WLAN)). Should be. However, the present invention is particularly applicable to cellular networks and WLAN networks in loose network configurations.

It is understood that the present invention may be realized in various forms such as, for example, hardware, software, firmware, a special-purpose processor, or a combination thereof in a mobile terminal, an access point, or a cellular network. I want to. Preferably, the present invention is realized as a combination of hardware and software. Further, software is preferably realized as an application program actually realized by the program recording device. The application program may be uploaded to a machine with the appropriate architecture and executed by that machine. Preferably, the machine is implemented on a computer platform with hardware such as one or more central processing units (CPUs), random access memory (RAM), and input / output (I / O) interfaces. The computer platform also includes an operating system and microinstruction code. The various processes and functions described in this embodiment may be either a part of the microinstruction code or a part of the application program (or a combination thereof), and the processes and functions may be a part thereof. Runs through the operating system. In addition, various other peripherals may be connected to computer platforms such as additional data storage and printing devices.

Since some of the configuration system components and method steps described in the accompanying drawings are implemented in software, the actual connection between the system components (or processing steps) depends on the method in which the present invention is programmed. Please understand that it may be different. Given the teachings of this embodiment, one of ordinary skill in the art would be able to devise these realizations and configurations of the present invention, similar realizations and configurations.

FIG. 1 is a block diagram illustrating a computer system 100 to which the present invention may be applied according to an exemplary embodiment of the present invention. The computer processing system 100 may be implemented in a mobile device used to access a cellular network or WLAN. The computer processing system 100 includes at least one processor (CPU) 102 that is operationally connected to other components via the system bus 104. Read-only memory (ROM) 106, random access memory (RAM) 108, display adapter 110, I / O adapter 112, user interface adapter 114, sound adapter 199, and network adapter 198 are operationally connected to system bus 104. ing.

The display device 116 is operatively connected to the system bus 104 by a display adapter 110. The disk storage device (eg, magnetic or optical disk storage device) 118 is operatively connected to the system bus 104 by an I / O adapter 112. The mouse 120 and keyboard 122 are operably connected to the system bus 104 by a user interface adapter 114. The mouse 120 and keyboard 122 are used to input information to and output information from system 100.

At least one speaker (hereinafter referred to as "speaker") 197 is operatively connected to the system bus 104 by a sound adapter 199. The (digital and / or analog) modem 196 is operationally connected to the system bus 104 by a network adapter 198.

FIG. 2 is a block diagram illustrating a combination of access networks to which the present invention may be applied according to an exemplary embodiment of the present invention. In the exemplary embodiment of FIG. 2, the access network combination includes a cellular network 210 and three wireless local area networks (WLANs) 220a, 220b, 220c. The mobile terminal 200, cellular network 210 and WLAN 220 may communicate with each other as shown. The present invention provides a certificate-based scheme for providing AAA services to WLAN users. As mentioned earlier, the present invention may apply to any combination of networks, including different numbers and different types of networks.

FIG. 3 illustrates a certificate-based method for authentication, authorization and accounting (AAA) of mobile users in interworking by loose coupling between access networks, according to an exemplary embodiment of the invention. It is a flowchart. Access networks include cellular networks and wireless local area networks (WLANs), such as the network shown in Figure 2. Cellular networks are at least associated with mobile users. The exemplary embodiment of FIG. 3 (similar to the exemplary embodiment of FIG. 4 below) will be described for cellular networks and WLANs, but like the networks described above and of different numbers of networks. It should be understood that any combination of networks, including other types of networks, may be readily utilized in accordance with the present invention while preserving the spirit and scope of the present invention.

First, the public key K related to the cellular network_{PUB_CN}Is sent from the cellular network to the WLAN (step 310), which has an interworking contract with the cellular network. If the cellular network has an interworking contract with more than one WLAN, the cellular network will have the public key K of the cellular network on all the contracted WLANs._{PUB_CN}Is sent. Not compulsory, but K_{PUB_CN}The public key K of the cellular network so that the receiving WLAN can verify that is a valid public key associated with the cellular network._{PUB_CN}Is preferably distributed through a secure channel.

The certificate is then sent from the cellular network to the mobile user (step 315). The certificate includes, but is not limited to,: Public key K associated with mobile user_{PUB_U}Cellular network ID; for example, the mobile user's subscription level as to whether the mobile user has subscribed to the WLAN service for authentication / verification; certificate expiration date; and mobile user's ID. The certificate is the private key K of the cellular network_{PRI_CN}Signed with. Although not compulsory, it is preferred that the certificate be sent to the mobile user when the mobile user signs the cellular setwork for the WLAN interworking service.

Various keys and certificates are used as follows. When the mobile user moves to the area covered by the WLAN, the certificate is sent from the mobile user to the WLAN (step 320). The WLAN then checks the ID of the cellular network contained in the certificate (step 325), checks the identity of the mobile user contained in the certificate (for example, for authentication / verification purposes) (step 327), and the cellular network. Network public key K_{PUB_CN}Verify the authenticity of the certificate using (step 330) and, upon confirmation, the mobile user's public key K contained in the certificate_{PUB_U}Calculates the session key of the mobile user encrypted in (step 335) and sends the session key to the mobile user (step 340). The session key is not limited, but may be a WEP (Wired Equivalent Privacy) key per user.

Upon receiving the session key, the mobile user can use his / her private key K_{PRI_U}Use the session key to decrypt (step 345) and use the session key to communicate with the WLAN (ie, all subsequent communication between the mobile device and the WLAN is encrypted using the session key. (Step 350). Thus, a mobile user has a private key K that only that particular mobile user needs to decrypt the session key._{PRI_U}Because it has, it is authenticated by WLAN.

FIG. 4 is a flow chart illustrating a certificate-based method for authentication, authorization and accounting of mobile users in interworking by loose coupling between access networks, according to another exemplary embodiment of the invention. Is. Access networks include cellular networks and wireless local area networks (WLANs). The cellular network is associated with at least one mobile user. The method in Figure 4 allows the mobile user to ensure that he / she is communicating with a legitimate WLAN (for example, to prevent the message from being sneaked). Allows mutual authentication between the and WLAN.

Cellular network public key K_{PUB_CN}Is sent from the cellular network to the WLAN (step 310), which has an interworking contract with the cellular network. If the cellular network has an interworking contract with more than one WLAN, the cellular network is the public key K of the cellular network._{PUB_CN}To all these WLANs. Not compulsory, but K_{PUB_CN}The public key K so that the WLAN can verify that is indeed the public key of the cellular network_{PUB_CN}Is preferably distributed through a secure channel.

Also, the public key K of the cellular network_{PUB_CN}Is sent from the cellular network to the mobile user (step 412). The first certificate is sent from the cellular network to the mobile user (step 315). The first certificate includes, but is not limited to,: Mobile user public key K_{PUB_U}Cellular network ID; Mobile user subscription level (as to whether the mobile user subscribes to the WLAN service); First certificate expiration date; and mobile user ID. The first certificate is the cellular network private key K_{PRI_CN}Signed with. Although not mandatory, it is preferred that the first certificate be sent to the mobile user when the mobile user signs the WLAN interworking service on the cellular network. In addition, the second certificate is sent from the cellular network to each WLAN (having a contract agreed with the cellular network). The second certificate, but not limited to, the WLAN public key K_{PUB_W}Includes. The second certificate is the cellular network private key K_{PRI_CN}Signed with.

The first certificate is sent from the mobile user to the WLAN (eg, an access point (AP)), for example, when the mobile user moves to an area covered by the WLAN (step 320). In response, the WLAN checks the cellular network ID contained in the primary certificate (step 325) and (for authentication / verification purposes) the mobile user ID contained in the primary certificate. (Step 327), Public Key K for Cellular Network_{PUB_CN}Use to verify the authenticity of the first certificate (step 330). Upon confirmation, the WLAN will be the mobile user's public key K (included in the primary certificate)._{PUB_U}Encrypted with WLAN private key K_{PRI_W}Calculate the session key for the mobile user signed in (step 435) and send the session key and second certificate to the mobile user (step 440). The session key is not limited, but may be a WEP (Wired Equivalent Privacy) key per user.

Cellular network public key K, depending on receipt of session key and second certificate_{PUB_CN}The mobile user verifies that the second certificate is valid using (step 441). If valid, the WLAN public key K from the second certificate_{PUB_W}Is extracted (step 442). Then, to confirm the signature of the session key, the WLAN public key K_{PUB_W}By using, the mobile user verifies that the session key actually arrived from the WLAN (step 443). If it is confirmed that the encrypted session key arrived from the WLAN, then his / her private key K_{PRI_U}The mobile user decrypts the session key (step 345) and uses the session key to communicate with the WLAN. All subsequent communication between the mobile device and the WLAN is encrypted at the start of the session key, using the session key to communicate with the WLAN (step 350).

Thus, a major advantage of the present invention over prior art is that the present invention does not require any physical interworking function for the WLAN to interact with the cellular network for user authentication. That is. In fact, by using a certificate, the WLAN grants user access and therefore does not require any interaction with the cellular network when the mobile device needs access to the network. Since the certificate contains the identity of the mobile user, this information, including the user identity, can be used to easily perform accounting functions.

Although exemplary embodiments have been described herein with reference to the accompanying drawings, the present invention is not limited to those exact embodiments, and various other modifications and modifications may be made. It will be appreciated by those skilled in the art without departing from the scope or spirit of the invention. All such modifications and modifications are intended to be included within the scope of the invention, as defined by the appended claims.

<figref num="1">FIG. 5 is a block diagram illustrating a computer system 100 to which the present invention may be applied, according to an exemplary embodiment of the invention.</figref><figref num="2">It is a block explaining the combination of access networks to which this invention may be applied which concerns on an exemplary embodiment of this invention.</figref><figref num="3">It is a flowchart illustrating a certificate-based method for authentication, authorization and accounting (AAA) of a mobile user in interworking by loose coupling between access networks according to an exemplary embodiment of the invention.</figref><figref num="4">It is a flowchart illustrating a certificate-based method for authentication, authorization and accounting (AAA) of mobile users in interworking by loose coupling between access networks, according to another exemplary embodiment of the invention. ..</figref>