UMTS-WLAN interworking system and authentication method therefor

PRIORITY

0001This application claims the benefit under 35 U.S.C. § 119(a) of an application entitled “UMTS-WLAN Interworking System and Authentication Method Therefor” filed in the Korean Intellectual Property Office on Dec. 14, 2004 and assigned Serial No. 2004-105862, the entire contents of which are hereby incorporated by reference.

BACKGROUND OF THE INVENTION

00021. Field of the Invention

0003The present invention relates generally to a Universal Mobile Telecommunications System (UMTS)-Wireless Local Area Network (WLAN) interworking system. More particularly, the present invention relates to a system and method for enabling fast authentication for handoff of a User Equipment (UE) in a UMTS-WLAN interworking network.

00042. Description of the Related Art

0005When a handoff is initiated as a UE moves from a UMTS network to a WLAN or vice versa in the UMTS-WLAN interworking network, the UE performs an authentication procedure again in the WLAN or UMTS. At the handoff, an authentication and key agreement with different network entities takes place for the UE.

0006With reference to <figref idref="DRAWINGS">FIG. 1</figref>, the following describes a typical UMTS-Authentication Key Agreement (AKA) procedure for authentication of a UE to a UMTS network.

0007<figref idref="DRAWINGS">FIG. 1</figref> is a diagram illustrating a signal flow for the UMTS-AKA procedure.

0008Referring to <figref idref="DRAWINGS">FIG. 1</figref>, a UE <b>101</b> sends an Attach Request message to a Serving GPRS Support Network (SGSN) <b>105</b> in step <b>110</b>. Upon receipt of the Attach Request message, the SGSN <b>105</b> sends an Authentication Data Req. message including the International Mobile Station Identifier (IMSI) of the UE <b>101</b> to a Home Location Register (HLR) <b>107</b> in step <b>112</b>.

0009In step <b>114</b>, the HLR <b>107</b> sends an Authentication Data Resp. message including Authentication-Vectors (AVs) to the SGSN <b>105</b>. Each of the AVs includes a random number RAND, an authentication token AUTN, a cipher key CK, an integrity key IK, and an expected response XRES.

0010The SGSN <b>105</b> sends the RAND and AUTN of a received AV to the UE <b>101</b> by a User Auth. Req. message in step <b>116</b> and the UE <b>101</b> sends a User Auth. Resp. message including a response RES for the User Auth. Req. message to the SGSN <b>105</b> in step <b>118</b>.

0011In step <b>120</b>, the SGSN <b>105</b> compares the RES with the XRES of the AV and if they match, authenticates the UE <b>101</b> by performing a Security Mode Setup procedure involving encryption key establishment and distribution.

0012With reference to <figref idref="DRAWINGS">FIGS. 2 and 3</figref>, a typical procedure for authenticating a UE to a WLAN, Enhanced Authentication Protocol (EAP)-AKA will be described below.

0013The EAP-AKA procedure is performed for access network authentication and Internet Key Exchange (IKE)-based Core Network (CN) authentication. In the former case, the key goal of the EAP-AKA is safe data exchange over the WLAN by mutual authentication between a UE <b>201</b> and a 3^rdGeneration Partnership Project (3GPP) Authentication, Authorization and Accounting (AAA) server <b>205</b> and sharing of a CK and an IK between the UE <b>201</b> and a WLAN Access Network (AN) <b>203</b>. In the latter case, the EAP-AKA is used to authenticate whether a UE <b>301</b> can access a CN via a 3GPP AAA server <b>305</b> using an IKE protocol and to exchange CKs and IKs to enable safe data exchange between the UE <b>301</b> and a Packet Data Gateway (PDG) <b>303</b>.

0014<figref idref="DRAWINGS">FIG. 2</figref> is a diagram illustrating a signal flow for the EAP-AKA procedure for access network authentication in a typical UMTS-WLAN interworking network.

0015Referring to <figref idref="DRAWINGS">FIG. 2</figref>, the UE <b>201</b> performs a WLAN Access Point (AP) Association with an AP of the WLAN AN <b>203</b> in step <b>210</b>. The WLAN AN <b>203</b> sends an EAP Request/Identity message to the UE <b>201</b>, requesting the identity of the UE <b>201</b> in, step <b>212</b>. The UE <b>201</b> replies with an EAP Response/Identity message including the Network Access Identifier (NAI) of the UE <b>201</b> in step <b>214</b>. The NAI is created with the International Mobile Subscriber Identity (IMSI) and domain information and has the form of “imsi@domain”, for example.

0016In step <b>216</b>, the WLAN AN <b>203</b> forwards the EAP Response/Identity message with the NAI to the 3GPP AAA server <b>205</b>. The 3GPP AAA server <b>205</b> and an HLR <b>207</b> obtain an AV based on the NAI in step <b>218</b>. The AV includes a RAND, an AUTN, a CK, an IK and a XRES.

0017The 3GPP AAA server <b>205</b> sends the RAND, AUTN, and reuse and reauthentication values to the UE <b>201</b> through the WLAN AN <b>203</b> by an EAP Request/AKA Challenge message in steps <b>220</b> and <b>222</b>. The UE <b>201</b> sends an EAP Response/AKA Challenge message with an RES to the WLAN AN <b>203</b> in step <b>224</b>.

0018In step <b>226</b>, the WLAN AN <b>203</b> sends the EAP Response/AKA Challenge message to the 3GPP AAA server <b>205</b>. If the EAP authentication is successful, the WLAN AN <b>203</b> receives an EAP Success message including a CK and an IK from the 3GPP AAA server <b>205</b> and stores the CK and IK in step <b>228</b>. The WLAN AN <b>203</b> then informs the UE <b>201</b> of the authentication success with the EAP Success message in step <b>230</b>.

0019<figref idref="DRAWINGS">FIG. 3</figref> is a diagram illustrating a signal flow for the EAP-AKA procedure for CN authentication and service. authentication in the typical UMTS-WLAN interworking network.

0020Referring to <figref idref="DRAWINGS">FIG. 3</figref>, the UE <b>301</b> and the PDG <b>303</b> exchange a pair of messages known as IKE_SA_INIT in step <b>310</b>. The UE <b>301</b> sends an IKE_AUTH_Request message to the PDG <b>303</b>, requesting an IKE authentication in step <b>312</b>. In step <b>314</b>, the PDG <b>303</b> sends an EAP Request/Identity message requesting EAP and the identity of the UE <b>301</b> to the UE <b>301</b>. The UE <b>301</b> replies with an EAP Response/Identity message in step <b>316</b> and the PDG <b>303</b> forwards the EAP Response/Identity message to the 3GPP AAA server <b>305</b> in step <b>318</b>.

0021The 3GPP AAA server <b>305</b> sends an EAP Request/AKA Challenge message including PDG authentication information and keying material to the UE <b>301</b> through the PDG <b>303</b> in steps <b>320</b> and <b>322</b>. The UE <b>301</b> sends an EAP Response/AKA Challenge message with an RES for the requested PDG authentication and UE authentication information to the PDG <b>303</b> in step <b>324</b> and the PDG <b>303</b> sends the EAP Response/AKA Challenge message to the 3GPP AAA server <b>305</b> in step <b>326</b>.

0022If the authentication is successful, the 3GPP AAA server <b>305</b> sends an EAP Success message including reauthentication information to the UE <b>301</b> through the PDG <b>303</b> in steps <b>328</b> and <b>330</b>. Upon receipt of an EAP Response message from the UE <b>301</b> in step <b>332</b>, the PDG <b>303</b> replies with an IKE_AUTH_Response message in step <b>334</b>.

0023In the UMTS-WLAN interworking network, as described above, the UE performs mutual authentication and creates keys for data security by EAP-AKA in the WLAN, while it does so by UMTS-AKA in the UMTS network. Therefore, even when the valid duration of the authentication keys has not elapsed or the valid amount of data is not reached for the authentication keys, a reauthentication and security key reestablishment must be carried out depending on policies of the target network as the UE moves between the networks.

0024Accordingly, there is a need for an improved system and method for authenticating a UE in a UMTS-WLAN interworking system.

SUMMARY OF THE INVENTION

0025To substantially solve at least the above problems and/or disadvantages and to provide at least the advantages below, embodiments of the present invention provide a method of reducing overhead from reauthentication at handoff of a UE between a UMTS network and a WLAN in a UMTS-WLAN interworking network by transmission of authentication information and key information to be shared between the UMTS network and the WLAN.

0026The above object is achieved by providing a system and method for enabling fast authentication for a UE when a handoff occurs during a service in a UMTS-WLAN interworking network.

0027According to one aspect of the present invention, in a method of authenticating a UE connected to a WLAN via a 3GPP AAA server connected to the WLAN and to a mobile communication network including an SGSN in a mobile communication network-WLAN interworking network, an authentication procedure is performed between the WLAN and the UE via the 3GPP AAA server. The 3GPP AAA server sends a first message including authentication information resulting from the authentication procedure to the SGSN. The SGSN stores the authentication information.

0028According to another aspect of the present invention, in a method of authenticating a UE connected to a mobile communication network including an SGSN via a 3GPP AAA server connected to a WLAN and the mobile communication network in a mobile communication network-WLAN interworking network, an authentication procedure is performed between the mobile communication network and the UE. The SGSN sends a first message including authentication information resulting from the authentication procedure to the 3GPP AAA server. The 3GPP AAA server stores the authentication information by the 3GPP AAA server.

0029According to a further aspect of the present invention, in a wireless network interworking system, a UE is connected to a WLAN via a mobile communication network-WLAN interworking network. A 3GPP AAA server is connected to the mobile communication network and the WLAN, authenticates the UE, and stores authentication information resulting from the authentication. An SGSN receives the authentication information of the UE from the 3GPP AAA server and stores the received authentication information.

0030According to still another aspect of the present invention, in a wireless network interworking system, a UE is connected to a mobile communication network via a mobile communication network-WLAN interworking network. An SGSN performs an authentication procedure with the UE, storing authentication information resulting from the authentication procedure, and sends the authentication information to a 3GPP AAA server. The 3GPP AAA server is connected to the mobile communication network and the WLAN, authenticates the UE, and stores the authentication information of the UE received from the SGSN.

BRIEF DESCRIPTION OF THE DRAWINGS

0031The above and other objects, features and advantages of exemplary embodiments of the present invention will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings in which:

0032<figref idref="DRAWINGS">FIG. 1</figref> is a diagram illustrating a signal flow for a conventional UMTS-AKA procedure.

0033<figref idref="DRAWINGS">FIG. 2</figref> is a diagram illustrating a signal flow for an EAP-AKA procedure for access network authentication in a conventional UMTS-WLAN interworking network;

0034<figref idref="DRAWINGS">FIG. 3</figref> is a diagram illustrating a signal flow for an EAP-AKA procedure for CN authentication and service authentication in the conventional UMTS-WLAN interworking network;

0035<figref idref="DRAWINGS">FIG. 4</figref> schematically illustrates the configuration of the UMTS-WLAN interworking network according to an exemplary embodiment of the present invention;

0036<figref idref="DRAWINGS">FIG. 5</figref> is a diagram illustrating a signal flow for a handoff procedure from a WLAN to a UMTS network according to an exemplary embodiment of the present invention; and

0037<figref idref="DRAWINGS">FIG. 6</figref> is a diagram illustrating a signal flow for a handoff procedure from the UMTS network to the WLAN according to another exemplary embodiment of the present invention.

0038Throughout the drawings, like reference numbers will be understood to refer to like elements, features and structures.

DETAILED DESCRIPTION OF EXEMPLARY EMBODIMENTS

0039Exemplary embodiments of the present invention will be described herein below with reference to the accompanying drawings. In the specification, detailed descriptions of well-known functions or constructions are omitted for clarity and conciseness.

0040<figref idref="DRAWINGS">FIG. 4</figref> schematically illustrates the configuration of the UMTS-WLAN interworking network.

0041Referring to <figref idref="DRAWINGS">FIG. 4</figref>, a WLAN AN <b>410</b>, connected to an intranet/internet, includes an AP unit <b>412</b> and a WLAN agent <b>413</b> for managing the AP unit <b>412</b>. The WLAN AN <b>410</b> is connected to a 3GPP AAA server <b>436</b> via a Wr/Wb interface and to a PDG/Foreign Agent (FA) <b>438</b> via a Wp interface. The 3GPP AAA server <b>436</b> performs user authentication and service authentication for a UE <b>401</b> in the WLAN AN <b>410</b> or a UMTS Terrestrial Radio Access Network (UTRAN) <b>420</b> to which the UE <b>401</b> moves at a handoff. The 3GPP AAA server <b>436</b> is connected to a HLR <b>434</b> via a D′/Gr′ interface and the HLR <b>434</b> is connected to an SGSN <b>430</b>.

0042The WLAN AN <b>410</b> preferably performs an authentication and key agreement by EAP-AKA for access network authentication of the UE <b>401</b> and secure data exchange between the UE <b>401</b> and the WLAN AN <b>410</b>. The PDG/FA <b>438</b> preferably performs a CN authentication and key agreement with the UE <b>401</b> by EAP-AKA.

0043The UTRAN <b>420</b>, connected to the SGSN <b>430</b>, includes a Node B <b>422</b> and a Radio Network Controller (RNC) <b>424</b>.

0044The SGSN <b>430</b> preferably carriers out a mutual authentication with the UE <b>401</b> by UMTS-AKA. The UE <b>401</b> creates a CK and an IK based on authentication information received from the SGSN <b>430</b> during the mutual authentication. A CK and an IK established between the UE <b>401</b> and the SGSN <b>430</b> is provided to the RNC <b>424</b> for use as encryption keys for data transmission between the UE <b>401</b> and the RNC <b>424</b>. The SGSN <b>430</b> is connected to a Gateway GPRS Support Node (GGSN)/FA <b>432</b> via a Gn interface.

0045In the above described conventional UMTS-WLAN interworking environment, the UE <b>401</b>, when it is located in a WLAN service area, can access the WLAN AN <b>410</b> to receive data service. Thus, as the UE <b>401</b> moves from the WLAN to the UMTS network, it must perform a reauthentication procedure with the UMTS network, for seamless provisioning of the ongoing data service. In the opposite case, when the UE <b>401</b> moves to the WLAN service area during receiving a high-cost, low-rate data service from the, UTRAN <b>420</b>, it also must perform a reauthentication procedure with the WLAN at handoff, for seamless provisioning of the ongoing data service.

0046In accordance with an exemplary embodiment of the present invention, therefore, a network (that is the 3GPP AAA server or the SGSN) delivers authentication information and key information to be shared between the WLAN and the UMTS network in order to allow the UE <b>401</b> to reuse the authentication information of an old network in a new network when a handoff occurs during receiving a data service from the old network in the UMTS-WLAN interworking network. Two cases will be considered in the following description: handoff from the WLAN to the UMTS network and handoff from the UMTS network to the WLAN. In addition, a method of sending authentication information and key information used in the old network in advance before a handoff, and providing a service to the UE without UE authentication in the new network by requesting the authentication information and the key information after the handoff will be described in detail with reference to exemplary embodiments of the present invention.

Embodiment 1

0047This embodiment is a method of sending authentication information of the WLAN to the UMTS network beforehand when a handoff is triggered as the UE, which was authenticated to the WLAN, moves to the UMTS network.

0048<figref idref="DRAWINGS">FIG. 5</figref> is a diagram illustrating a signal flow for a procedure for sending authentication information to the UMTS network before handoff from the WLAN to the UMTS network according to an exemplary embodiment of the present invention.

0049Referring to <figref idref="DRAWINGS">FIG. 5</figref>, an EAP-AKA procedure is performed, which involves mutual authentication and creation of authentication keys between a UE <b>501</b> and a 3GPP AAA server <b>503</b>, and transmission of the authentication keys from the UE <b>501</b> to a WLAN AN <b>502</b> in step <b>510</b>.

0050In step <b>512</b>, the 3GPP AAA server <b>503</b> sends authentication information of the UE <b>501</b> to an SGSN <b>505</b> in the UMTS network by a Security INFO Forward message. The authentication information contains a NAI, a Re-Auth, ID for reauthentication, and unused AVs. The NAI is based on an IMSI or a pseudonym used in the WLAN. If key information is changed before the WLAN-UMTS handoff, the 3GPP AAA server <b>503</b> synchronizes the authentication information between the WLAN and the UMTS network each time the key information is changed.

0051When the handoff from the WLAN to the UMTS network takes place in step <b>513</b>, the UE <b>501</b> sends an L3 (Network Layer) Request message to the SGSN <b>505</b>, requesting access to the UMTS network in step <b>514</b>. The L3 Request message contains the IMSI and the Re-Auth. ID. It can be, for example, a GPRS Attach message in the UMTS network.

0052The SGSN <b>505</b> can use unused AVs already received from the WLAN based on the Re-Auth. ID. To be more specific, the SGSN <b>505</b> compares the Re-Auth. ID received from the UE <b>501</b> with that set in the Security INFOR Forward message. If they match, the SGSN <b>505</b> selects one of the unused AVs and performs mutual authentication with the UE <b>501</b> using the selected AV.

0053Thus, the SGSN <b>505</b> sends the RAND and AUTN of the selected AV to the UE <b>501</b> by a User Authentication Request message, for mutual authentication in step <b>516</b>. The UE <b>501</b> verifies that the AUTN is correct using a Master Key (MK) stored in a UMTS Subscriber Identity Module (USIM) and the RAND and hereby authenticates the SGSN <b>505</b>.

0054If the SGSN authentication is successful, the UE <b>501</b> sends an RES to the SGSN <b>505</b> by a User Authentication Response message in step <b>518</b>. The SGSN <b>505</b> generates an XRES using its own MK and compares the XRES with the RES. If they match, the SGSN <b>505</b> authenticates the UE <b>501</b>.

0055In step <b>520</b>, the SGSN <b>505</b> sends key information to be used for data encryption to a RAN and sends an L3 Response message to the UE <b>501</b>, thereby completing the authentication and access of the UE <b>501</b> to the UMTS network.

Embodiment 2

0056Another embodiment of the present invention is a method of sending authentication information to the WLAN beforehand when a handoff is triggered as the UE, which was authenticated to the UMTS network, moves to the WLAN.

0057<figref idref="DRAWINGS">FIG. 6</figref> is a diagram illustrating a signal flow for a procedure for sending authentication information of the UE to the WLAN before handoff from the UMTS network to the WLAN according to another exemplary embodiment of the present invention.

0058Referring to <figref idref="DRAWINGS">FIG. 6</figref>, a UE <b>601</b>, which is located in the UMTS network, performs mutual authentication and encryption key sharing with an SGSN <b>603</b> and an HLR <b>605</b> by the UMTS-AKA procedure specified in <figref idref="DRAWINGS">FIG. 1</figref> in step <b>610</b>.

0059After the authentication, the SGSN <b>603</b> sends a Security INFO Forward message including authentication information to a 3GPP AAA server <b>607</b> of the WLAN in step <b>612</b>. The authentication information contains the IMSI of the UE <b>601</b>, Key Set Identifier (KSI) [i], IK[i], CK[i], and unused AVs [i+1, . . . , n]. In the same manner as in the first embodiment, each time the valid duration of the IK and CK expires, the authentication information can be updated. The update of the authentication information in the UMTS network leads to an automatic update of the authentication information in the WLAN by the Security INFO Forward message.

0060In step <b>614</b>, a handoff occurs as the UE <b>601</b> moves from the UMTS network to the WLAN. The UE <b>601</b> is associated with a WLAN AN <b>609</b> and thus establishes a wireless connection to the WLAN in step <b>616</b>. In step <b>618</b>, the WLAN AN <b>609</b> sends an EAP Request/Identity message to the UE <b>601</b>, requesting the identity of the UE <b>601</b> (that is, an IMSI and a Packet-Temporary Mobile Station Identifier (P-TMSI)). The UE <b>601</b> sends an EAP Response/Identity message including a NAI based on the IMSI and KSI[i] used in the UMTS network to a 3GPP AAA server <b>607</b> through the WLAN AN <b>609</b> in steps <b>620</b> and <b>622</b>.

0061The 3GPP AAA server <b>607</b> determines the IMSI from the NAI and compares the authentication information of the UE <b>601</b> corresponding to the IMSI with KSI[i]. If they match, the 3GPP AAA server <b>607</b> creates a Next Re-Auth. ID for the next reauthentication of the UE <b>601</b> to the WLAN and sends the Next Re-Auth. ID together with CK[i] and IK[i] to the WLAN AN <b>609</b> by an EAP Success message in step <b>624</b>. Upon receipt of the EAP Success message, the WLAN AN <b>609</b> stores CK[i] and IK[i], reconstructs the EAP Success message to include only the Next Re-Auth. ID, and sends the EAP Success message to the UE <b>601</b> in step <b>626</b>.

0062While not shown, at the handoff from the UMTS network to the WLAN, the UE <b>601</b> further sends the KSI to the WLAN AN <b>609</b>, for the EAP-AKA procedure based on the IKE protocol. Thus the WLAN AN <b>609</b> acquires the authentication and key information and sends the Next Re-Auth. ID to the UE. Therefore, the UE can receive a seamless service by reusing the authentication information of the UMTS network without reauthentication and key reestablishment in the WLAN.

0063As described above, embodiments of the present invention advantageously reduce the overhead of reauthentication at handoff of a UE between a UMTS network and a WLAN in a UMTS-WLAN interworking network. Furthermore, since an unnecessary reauthentication delay does not occur despite the handoff, handoff delay and packet loss are reduced and seamless service is provided to a user.

0064While the invention has been shown and described with reference to certain exemplary embodiments thereof, it will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.