CN1909561B - When the session is abnormally terminated, the method of deregistering the MS is implemented - Google Patents

Abstract

The present invention relates to a method for deregistering an MS when a session terminates abnormally, the core of which is: when a session terminates abnormally, an entity on the network side initiates a deregistration process to the connection service network and through information interaction with the connection service network Realize that MS will be deregistered. The invention solves the problem that in the CMIP mode, when the MS is abnormally disconnected from the network, the HA must wait until the MIP life cycle is reduced to 0, and the HA initiates the MIP de-registration process, thereby achieving more accurate billing.

Description

When the session is abnormally terminated, the method of deregistering the MS is realized

technical field

The invention relates to the communication field, in particular to a method for deregistering an MS when a session is terminated abnormally.

Background technique

Mobile IP (Mobile IP) is a solution for transmitting information to mobile terminals. It is an Internet protocol standard formulated by the Internet Engineering Group. Mobile IP has nothing to do with the physical medium used by MS (Mobile Station; mobile terminal) to communicate, and it allows MS to change the geographic location without interrupting the communication and restarting the application program. Mobile IP has scalability, reliability and security, and enables MS to maintain ongoing communication while switching links. Mobile IP provides an IP routing mechanism, so that MS can use a permanent IP address to connect to the communication link.

With the vigorous development of Internet services and the wide application of wireless networks, users have increasingly strong mobility requirements. In order to support mobile IP, when defining the broadband wireless access network architecture system and requirements, two different mobile IP implementation methods are proposed: CMIP (CMIP Client Mobile Internet Protocol; Client Mobile Internet Protocol) and PMIP (PMIP Proxy Mobile Internet Protocol; Proxy Mobile Internet Protocol).

The CMIP implementation method of Mobile IP is the same as that of traditional Mobile IP. All the functions of the mobile node are realized on the MS. The registration/de-registration process in the Mobile IP process is initiated by the MIP Client (Mobile IP Client) on the MS. For MS, when moving to a foreign link and receiving an agent broadcast message sent by a new foreign agent, it will initiate a MIP (Mobile Internet Protocol; Mobile Internet Protocol) registration process according to the address in the message. In this way, the mobile IP is not transparent to the terminal, and the terminal needs to realize all the functions of the mobile node in the mobile IP.

The PMIP implementation of mobile IP separates the MIP Client (mobile IP client) from the MS, and implements it on a PMN (Proxy Mobile Node; authentication mobile node) logical network element in the ASN. In this way, the registration/de-registration process of Mobile IP is transparent to MS. From the MS's point of view, it always works on its own home link, and connects to the communication link with a permanent IP address. When the mobile terminal moves to a new foreign link, the PMN logic network element in the ASN or BS where the foreign link is located replaces the MS to initiate the MIP registration process; when the MS leaves the link or goes offline abnormally, The PMN replaces the MS to initiate the normal MIP registration/de-registration process.

In the PMIP implementation of mobile IP, before performing the MIP registration/de-registration process, a Credential must first be established between the MIP Client and the HA (Home Agent; Home Agent). Then when MIP Client initiates MIP registration/de-registration, according to the credential, the message verification code (MAC) is calculated for the registration request message. certified. After passing the authentication, send a MIP registration response message, and use the credential with the MIP to calculate the message check code (MAC). After receiving the registration response message, the MIP Client also needs to authenticate the message according to the credentials it holds.

The technical solution of the prior art 1 related to the present invention describes that in the PMIP mode, after the MS completes the authentication through the Authenticator, the MIP Client and the HA establish a credential through the initial MIP registration process, which is based on the WiMAX network architecture System realization. Described WiMAX network framework system, as shown in Figure 1, comprises MS110, ASN120, CSN130, and wherein said ASN120 comprises ASN-GW121 and BS122 network element. And, set PMN logic network element 123, Authenticator logic in ASN Network element 124 and FA125 (because the trust certificate with HA needs to be saved in PMN, so it is generally considered to be implemented in the same physical entity as another logical network element Authenticator in ASN. Of course, PMN logical network element It can also be set in the BS.), the FA and the ASN-GW are set on one physical entity; the AAA Server logical network element 131 and HA132 are set in the CSN.

The functions of various network elements (including logical network elements) and interfaces are described below in conjunction with FIG. 1 .

1. BS: It implements the air interface defined by IEEE 802.16 together with MSS; it is connected with the back-end ASN-GW/FA and Authenticator/PMN to provide users with access network services.

2. Authenticator: It provides proxy (proxy) function for MSS authentication, authorization and accounting functions; it saves a root key information (MSK) for MSS authenticated by it.

3. PMN: In the PMIP mode, it acts as the Proxy of the mobile terminal and realizes the function of the MIP Client, and initiates the MIP registration/de-registration process instead of the MS.

4. ASN GW: As a main control unit and data plane unit in the ASN, it realizes the control of the handover process and provides a data channel to the CSN. Generally speaking, it is implemented in the same physical entity as the FA.

5. FA: It is a foreign agent in mobile IP. Generally speaking, it is implemented in the same physical entity as ASN GW.

6. AAA Server: It mainly completes the MSS authentication, authorization and accounting functions. And the information necessary to generate the key is exchanged through the key generation mechanism agreed with the MSS. Since the information is exchanged before the establishment of the secure channel, the key algorithm used between the Authentication server and the MSS must ensure that information leakage does not affect the security mechanism. The main functions include: a. Complete MSS authentication, authorization and billing functions; b. Generate and distribute root key information to Authenticator; c. When user information changes, timely notify Authenticator and other network element information changes as a result of.

7. HA: It realizes the home agent in mobile IP.

8. MSS: it is a mobile user equipment.

In the PMIP mode, assuming that the MIP Client is implemented on the PMN logical network element, after the MS completes the authentication through the Authenticator, the specific implementation process of establishing a credential between the MIP Client and the HA through the initial MIP registration process, as shown in Figure 2 As shown, including: Step 1, PMN derives PMN-AAA Key from the root key MSK;

Step 2. Use the PMN-AAA Key to calculate the MN-AAA authentication extension field for the registration request message;

Step 3. The PMN sends a registration request message to the FA to which the MSS belongs. The message contains an extension field named MN-HA Key Generation Nonce Request. In addition, the message also contains the PMIP indication extension field, indicating that the PMIP method is used;

Step 4, FA relays the registration request message to the HA specified in the message according to the extension domain of the MN-HA Key Generation NonceRequest in the registration request message;

Step 5. The HA sends a Radius AccRq message to the AAA Server. The KeyGenNonceRq attribute in the message is obtained according to the MN-AAA authentication extension domain described in step 2, and it is used to instruct the AAA Server to generate a random number for generating a key;

Step 6, AAA Server receives said Radius AccRq message, derives PMN-AAA Key from root key MSK;

Step 7, AAA Server uses described PMN-AAA Key to carry out authentication to described MN-AAA authentication extension domain in the registration message, thereby realizes the authentication to PMN;

Step 8, AAA Server generates a random number KeyGenNonce according to the KeyGenNonceRq attribute in the Radius AccRq message;

Step 9, AAA Server uses the KeyGenNonce random number and other parameters to derive PMN-HA Key according to RFC (Request For Comments) 3957;

Step 10, AAA server sends described PMN-HA Key and KeyGenNonce to HA through the secure link between it and HA;

Step 11, HA stores PMN-HA Key in its mobile security connection context;

Step 12, HA calculates the MN-HA authentication extension domain in the registration response message according to the PMN-HA Key preserved described in step 11;

Step 13. The HA sends a registration response message with the MN-HA authentication extension domain to the FA, and the message also includes the random number KeyGenNonce generated by the AAA Server for generating the PMN-HA Key. And instruct to establish a data forwarding channel between HA and MS;

Step 14. After successfully receiving the MIP response message, the FA starts to establish a data forwarding channel between the HA and the MS, and relays the registration response message to the PMN;

Step 15, the PMN obtains the KeyGenNonce from the registration response message, and derives the PMN-HA Key according to RFC3957;

Step 16, use the PMN-HA Key derived in step 15 to authenticate the registration response message;

Step 17, the PMN saves the Proxy MN-HA Key in its mobile security connection context.

So far, the process of establishing the credential between the PMN and the HA is completed, and the PMN establishes a secure connection for MIP registration/de-registration between each MS and the HA.

In the case of mobile IP, the MS may experience abnormal network disconnection during the communication process, such as power failure, sudden departure from the service area, etc., and the BS can quickly detect the abnormal network disconnection of the MS through the detection of air interface channel resources.

In the PMIP mode, when the MS is abnormally disconnected from the network and the BS detects this abnormality, the PMIP implementation of the mobile IP separates the MIP Client (mobile IP client) from the MS and places it in the ASN , the BS will notify the Authenticator (authenticator)/PMN through signaling, and the MIP Client on the Authenticator/PMN will initiate a normal registration/de-registration process, or when the MIPClient finds that the life cycle of the MIP is about to end, it can also initiate a registration/deregistration process. Go to the registration process. At this point, the PMN directly initiates a normal registration/de-registration request to the HA, and the FA relays the registration/de-registration message without passing through the AAA Server, as shown in Figure 3, specifically including:

Step 1. When the FA finds that the MS needs to initiate the registration/de-registration process, it triggers the PMN to initiate the registration/de-registration process through a message, or the MIP Client in the PMN directly triggers the registration/de-registration process;

Step 2. The PMN sends a MIP registration/de-registration request to the FA, which includes the MN-HA authentication extension domain calculated using the key PMN-HA Key generated during the initial MIP registration process;

Step 3, FA sends MIP registration/de-registration request to HA;

Step 4. The HA uses the key PMN-HA Key generated during the initial MIP registration process to authenticate the registration/de-registration request. After passing the authentication, it sends a registration/de-registration response message to the FA, which contains the key PMN-HA Key used. MN-HA authentication extension field calculated by HA Key;

Step 5, FA sends the registration/de-registration response message to PMN;

Step 6. The PMN uses the key PMN-HA Key to authenticate the registration/de-registration response message. If the authentication is passed, the registration/de-registration process is confirmed to be completed.

It can be seen from the above-mentioned technical solutions of the prior art that only the method for establishing a credential between the MIP Client and the HA in the PMIP mode is defined in the prior art through the initial MIP registration process, and the method between the MIP Client and the HA in the CMIP mode is not defined. The method of establishing a certificate of trust, and the solution of how to initiate a normal registration/de-registration process in the case of an abnormal MS disconnection.

For the CMIP mode of mobile IP, since the MIP Client is located in the MS, if the MS is abnormally disconnected from the network, the MIP de-registration process cannot be initiated immediately. The HA must wait until the life cycle of the MIP is reduced to 0, and then the HA will automatically initiate the de-registration process of the MIP. If the life cycle is longer, there will be a Session (session) that cannot be terminated for a long time after the MS goes offline abnormally, and billing may still continue at this time, which is unbearable for users and the network . Therefore, in the CMIP mode, when the MS is abnormally disconnected from the network, a certain network element in the ASN needs to initiate the deregistration process instead of the MS.

Contents of the invention

The purpose of the present invention is to provide a method for deregistering the MS when the session is abnormally terminated, which solves the problem that in the current CMIP mode, when the MS is abnormally disconnected from the network, it must wait until the life cycle of the MIP is reduced to 0. Issue with initiating the de-registration process of the MIP.

The purpose of the present invention is achieved through the following technical solutions:

The present invention provides a method for deregistering an MS when a session is abnormally terminated, including:

A. When the session is abnormally terminated, the entity on the network side initiates a de-registration process to the connection service network, and deregisters the MS through information interaction with the connection service network;

Wherein, the step A specifically includes:

A1. When the session is abnormally terminated, the Authenticator entity on the network side, which has saved the MIP key information of the mobile terminal MS, initiates a de-registration process to the connection service network, and deregisters the MS through information interaction with the connection service network. register;

or,

A2. When the session is abnormally terminated, the AAA server initiates a de-registration process to the connection service network, and deregisters the MS through information interaction with the connection service network.

Wherein, the step A1 specifically includes:

A11, through the interaction of MIP messages among the mobile terminal MS, Authenticator, AAA server, foreign agent FA and home agent HA in the connection service network, the MIP key information of the MS is generated and saved in the HA, and Save the MN-HA KeyGenNonce random number obtained from the MIP message in the initial registration process in the FA;

A12. When the BS on the network side detects that the MS is abnormally disconnected from the network, it notifies the FA, and the FA sends the stored random number to the Authenticator, and the Authenticator uses the random number to calculate the key K2 information and saves it;

A13. The HA authenticates the MIP message exchanged between the Authenticator and the HA according to the saved MIP key information and the Authenticator according to the saved key K2 information. When the authentication is confirmed to pass, the HA sends the Said MS to register;

or,

A14, through the interaction of MIP messages between the mobile terminal MS, Authenticator, AAA server and the home agent HA in the connection service network, the MIP key information of the MS is generated and saved in the Authenticator and HA;

A15. When the MS session terminates abnormally, the Authenticator and the HA authenticate the MIP message exchanged between the Authenticator and the HA according to the MIP key information saved respectively. When it is confirmed that the authentication is passed, the HA will the MS de-registers;

Wherein, the step A11 specifically includes:

A111, through information interaction between MS, HA and AAA server, generate the MIP key K1 and key K2 information of the MS in the AAA server, and verify the extended field in the message through the k1, after the verification is passed, Send the key K2 information and the random number MN-HA KeyGenNonce used to generate the key K2 to the HA through the MIP response message;

A112, the HA obtains the key K2 information from the response message, saves it, and then sends a MIP RRP message to the FA, the message includes the MN-HA-AE authentication extension field calculated using the K2, And the random number MN-HA KeyGenNonce used to generate the key K2;

A113. The FA obtains the random number MN-HAKeyGenNonce from the MIP RRP message, and stores it.

Wherein, said step A11 also includes:

A114. The FA sends the MIP RRP message to the MS, and the message includes the MN-HA-AE authentication extension field and the random number MN-HA KeyGenNonce;

A115. According to the random number MN-HAKeyGenNonce in the received MIP RRP message, the MS uses the random number to generate key K2 information, and uses the key K2 information to update the MN in the message -HA-AE authentication extension domain for verification;

A116. After passing the verification, the MS saves the key K2 information.

Wherein, the step A12 specifically includes:

A121. When the BS detects that the MS session is abnormally terminated, it notifies the FA to send the MN-HA KeyGenNonce Notify message to the Authenticator, and the message includes the random number MN-HA KeyGenNonce saved by the FA;

A122. The Authenticator obtains the random number MN-HA KeyGenNonce according to the received MN-HA KeyGenNonceNotify message, and uses the unused 160 bits in the root key MSK as the key K1 and according to the random number MN -HA KeyGenNonce generates key K2 and saves it.

Wherein, the step A13 specifically includes:

A131. The Authenticator sends a MIP de-registration request message to the FA, and the message includes the MN-HA authentication extension domain calculated using the key K2 information;

A132. The FA forwards the MIP de-registration request to the HA;

A133. The HA authenticates the MIP de-registration request message according to the key K2 information stored in it. After the authentication is passed, the HA sends a de-registration response message to the Authenticator through the FA. The MN-HA authentication extension field calculated by the key K2 information, and at the same time terminate the corresponding data forwarding channel;

A134. The Authenticator authenticates the MN-HA authentication extension field in the de-registration response message according to the key K2 information stored therein, and confirms that the de-registration is successful after the authentication is passed.

Wherein, the step A14 specifically includes:

A141. Through information interaction between the MS, HA and the AAA server, generate the MIP key K1 and key K2 information of the MS in the AAA server, and verify the extended field in the message through the K1. After the verification is passed , sending the key K2 information and the random number MN-HA KeyGenNonce used to generate the key K2 to the HA through the MIP response message;

A142. The HA obtains the key K2 information from the response message, saves it, and then sends a MIP RRP message to the FA, which contains the MN-HA-AE authentication extension domain calculated using K2, and generates The random number MN-HA KeyGenNonce used by key K2;

A143. The FA forwards the RRP message to the MS; at the same time, sends a MN-HA KeyGenNonce Notify message to the Authenticator, and the message includes the random number MN-HAKeyGenNonce;

A144. The MS obtains MN-HA-AE and MN-HA KeyGenNonce random numbers according to the received MIP RRP message, and calculates and generates a key K2 according to the obtained MN-HA KeyGenNonce random numbers, Then verify the MN-HA-AE through the K2, and save the K2 after the verification is passed;

At the same time, the Authenticator obtains the random number MN-HA KeyGenNonce according to the received MN-HA KeyGenNonceNotify message, and uses the unused 160 bits in the root key MSK as the key K1 and according to the random number MN -HA KeyGenNonce generates key K2 and saves it.

Wherein, the step A15 specifically includes:

A151. When the BS detects that the MS is abnormally disconnected from the network, the BS notifies the Authenticator to send a MIP de-registration request to the HA through the FA;

A152. The Authenticator sends a MIP de-registration request message to the HA through the FA, and the message includes the MN-HA-AE authentication extension field calculated according to the key K2 stored in it;

A153. The HA authenticates the MN-HA-AE authentication extension domain in the de-registration request message according to the key K2 stored in it. After the authentication is passed, the corresponding data forwarding channel is terminated, and the de-registration is sent through the FA at the same time A response message is sent to the Authenticator, and the message includes the MN-HA authentication extension domain calculated using the key K2;

A154. The Authenticator authenticates the MN-HA authentication extension field in the de-registration response message according to the key K2 stored in it. If the authentication is passed, it confirms that the de-registration process is completed, and sends a successful de-registration response The message notifies the BS that the registration process was successful.

Wherein, said step A111 or step A141 specifically includes:

A1111. The MS sends a MIP registration request message to the HA through the FA, and the message includes the message extension field MN-AAA-AE and the MN-HA KeyGenNonce Rq indication;

A1112. The HA receives the MIP registration request message, and sends the Radius AccRq message to the AAA Server, which includes the MN-AAA-AE and MN-HAKeyGenNonce Rq indications;

A1113. The AAA Server obtains the key K1 information according to the root key information, and verifies the received MN-AAA-AE of the Radius AccRq message according to the K1; when the verification is passed, the AAA Server generates a random number MN- HA KeyGenNonce, and generate key K2 information according to the random number, and then send a MIP RAA response message to the HA, the message includes the K2 and the random number MN-HA KeyGenNonce.

Wherein, the step A2 specifically includes:

A21. When the BS detects that the MS session is abnormally terminated, it uses a message/primitive to notify the Authenticator to send a Radius message to notify the AAA server to initiate a de-registration instruction to the HA in the corresponding connection service network;

A22. After receiving the message, the AAA Server sends a Radius message to the HA, notifying the HA to register the corresponding MS, and terminate the relevant data forwarding channel;

A23. After receiving the Radius message, the HA deregisters the corresponding MS according to the message instruction, and terminates the relevant data forwarding channel.

Wherein, the step A21 specifically includes:

A211. When the BS detects that the MS session is abnormally terminated, the BS releases the relevant resources of the MS locally, obtains relevant information of the MS, and notifies the Authenticator entity through a message;

A212. The Authenticator notifies the AAA server to initiate a de-registration instruction to the corresponding HA in the connection service network according to the message.

Wherein, said step A212 also includes:

A2121. The HA sends back a response message that the AAA Server has successfully registered;

A2122. The AAA Server returns a Radius response message to the Authenticator according to the received response message;

A2123. The Authenticator sends a response message/primitive to notify the BS that the corresponding MS de-registration process has been successfully completed;

A2124. The BS notifies the relevant network element to release the resources occupied by the corresponding MS.

It can be seen from the above-mentioned technical solution provided by the present invention that when the session is abnormally terminated, the entity on the network side initiates a de-registration process to the connection service network and realizes de-registration of the MS through information interaction with the connection service network, thus solving the problem of In the CMIP mode, when the MS is abnormally disconnected from the network, it must wait until the MIP life cycle is reduced to 0, and the HA initiates the MIP de-registration process, so that more accurate billing can be achieved.

Description of drawings

Figure 1 shows the WiMAX network architecture system in the PMIP mode;

Fig. 2 is the flowchart of the initial registration process under PMIP mode in the prior art;

Fig. 3 is the flow chart of normal registration under the PMIP mode in the prior art;

Fig. 4 is the flow chart of the MIP initial registration process under CMIP mode among the present invention;

Fig. 5 is a flow chart of the de-registration process when the MS goes offline abnormally in the third embodiment of the present invention.

Detailed ways

The present invention provides a method for deregistering an MS when a session is abnormally terminated. The core is: when a session is terminated abnormally, the entity on the network side initiates a deregistration process to the connection service network and passes the information exchange with the connection service network. The interactive implementation deregisters the MS.

The core of the first embodiment provided by the present invention is that during the MIP initial registration process in the CMIP mode, the FA saves the MN-HAKeyGenNonce random number obtained from the MIP RRP message in the initial registration process. When the BS detects that the MS is abnormally disconnected from the network, it notifies the FA, and the FA sends the MN-HA KeyGenNonce Notify message to the Authenticator. After receiving the message, the Authenticator uses the random number to calculate the key K2, and at the same time initiates a de-registration request to the HA.

Wherein the MIP initial registration process under the CMIP mode is carried out, as shown in Figure 4, including:

Step 1. The MIP Client in the MS uses the unused 160 bits of the root key MSK (obtained in the process of access authentication before the initial registration) as the key K1.

Step 2. The MIP Client uses K1 to calculate the MN-AAA-AE authentication extension field for the MIP RRQ message.

Step 3. The MIP Client sends a MIP RRQ (MIP Registration Request) message to the FA, which includes the MN-AAA-AE authentication extension field and the MN-HA KeyGenNonce Rq indication.

Step 4, FA sends the received MIP RRQ message to HA.

Step 5, the HA receives the MIP RRQ message, and sends the Radius AccRq message to the AAA Server, the message includes HA_ID, Auth_ID/MS_ID, MN-AAA-AE and MN-HA KeyGenNonce Rq indication.

Step 6. The AAA Server uses the unused 160 bits in the MSK as the key K1.

Step 7: The AAA Server verifies the MN-AAA-AE authentication extension domain of the Radius AccRq message according to the key K1. After the verification is passed, go to step 8.

Step 8, AAA Server internally generates a random number MN-HA KeyGenNonce according to the MN-HAKeyGenNonce Rq indication in the Radius AccRq message.

Step 9. The AAA Server derives the key K2=kdf(K1, KeyGenNonce, Auth_ID/MSS_ID) according to the generated random number.

Step 10, the AAA Server sends a RAA (Radius Access-Accept) response message to the HA, the response message includes the key information K2, and the generated random number MN-HAKeyGenNonce.

Step 11, HA stores K2 in its MN-HA security connection context.

Step 12, the HA uses the K2 to calculate the MN-HA-AE authentication extension field for the MIP RRP message.

Step 13. The HA sends a MIP RRP message to the FA, and the message includes the MN-HA-AE authentication extension field and the random number MN-HA KeyGenNonce calculated by using K2.

Step 14, FA obtains the random number MN-HAKeyGenNonce from the received MIP RRP message, and saves it, and then sends the MIP RRP message to the MIP Client of MS, which contains the MN-HA - AE authentication extension field and random number MN-HAKeyGenNonce.

Step 15, the MIP Client of the MS derives key information according to the random number MN-HA KeyGenNonce in the received MIP RRP message, such as: K2=kdf(K1, KeyGenNonce, Auth_ID/MSS_ID).

Step 16, the MIP Client of the MS uses the key information K2 to verify the MN-HA-AE authentication extension field in the message.

Step 17: After passing the verification, the MIP Client of the MS saves K2 in its MN-HA security connection context.

After the process from step 1 to step 17 above, the key information K2 of the MS is stored in both the MS and the HA, that is to say, through the above initial authentication process, the MS, the HA and the AAA server The authentication of the MIP message, the MS shares the same key with the HA. This sets the stage for the subsequent process.

When the BS detects that the MS is abnormally disconnected from the network, it executes the implementation process of steps 14' to 18'.

Step 14', when the BS detects that the MS is disconnected from the network, the FA is notified, and the FA sends the MN-HA KeyGenNonce Notify message to the Authenticator, which includes the MS_ID, HA_ID and the random number M N-HA KeyGenNonce saved by the FA.

Step 15', the Authenticator sends back the MN-HA KeyGenNonce ACK response message to the FA.

Step 16', the Authenticator uses the unused 160 bits in the MSK as the key K1.

Step 17', the Authenticator derives the key K2=kdf(K1, KeyGenNonce, Auth_ID/MS_ID) according to the key K1 and the MN-HA KeyGenNonce random number in the received MN-HAKeyGenNonce Notify message.

Step 18', the Authenticator uses the key information K2 to initiate a de-registration process to the HA.

The Authenticator uses the key information K2 to initiate a de-registration process to the HA, which specifically includes:

Step 101, the Authenticator sends a MIP de-registration request message to the HA.

Step 102, the HA authenticates the de-registration request message according to the key K2 information saved in the initial MIP registration process, and after passing the authentication, terminates the corresponding data forwarding channel, and simultaneously sends a de-registration response message to the FA, The message contains the MN-HA authentication extension field calculated using the key K2 information.

Step 103, the FA forwards the de-registration response message to the Authenticator.

Step 104, the Authenticator authenticates the de-registration response message according to the key K2 stored therein, and if the authentication passes, it confirms that the de-registration process is completed.

The core of the second embodiment provided by the present invention is that, during the initial MIP registration process under CMIP mode, FA sends MN-HA KeyGenNonce Notify message to Authenticator, and Authenticator calculates key K2 for corresponding MS after receiving this message and Save it, when the BS detects that the MS is abnormally disconnected from the network, the BS notifies the Authenticator to replace the MIP Client on the MS to initiate the registration process to the HA.

In the MIP initial registration process under the CMIP mode, the difference from the first embodiment is that after the steps 1 to 13 are executed, the steps 14 to 17 are executed, and at the same time, the steps 14' to 18 are executed 'The execution process. The specific implementation process includes:

Step 1. The MIP Client in the MS uses the unused 160 bits of the MSK root key (obtained in the process of access authentication before the initial registration) as the key K1.

Step 2. The MIP Client uses K1 to calculate the MN-AAA-AE authentication extension field for the MIP RRQ (Registration Request) message.

Step 3. The MIP Client sends a MIP RRQ (MIP Registration Request) message to the FA, which includes the MN-AAA-AE authentication extension field and the MN-HA KeyGenNonce Rq indication.

Step 4, FA sends the received MIP RRQ message to HA.

Step 5, the HA receives the MIP RRQ message, and sends the Radius AccRq message to the AAA Server, the message includes HA_ID, Auth_ID/MS_ID, MN-AAA-AE and MN-HA KeyGenNonce Rq indication.

Step 6. The AAA Server uses the unused 160 bits in the MSK as the key K1.

Step 7: The AAA Server verifies the MN-AAA-AE authentication extension domain of the Radius AccRq message according to the key K1. After the verification is passed, go to step 8.

Step 8, AAA Server internally generates a random number MN-HA KeyGenNonce.

Step 9. The AAA Server derives a key K2=kdf(K1, KeyGenNonce, Auth_ID/MS_ID) according to the key K1 and the generated random number.

Step 10, the AAA Server sends a RAA (Radius Access-Accept) message to the HA, the message includes the key information K2, and the random number MN-HA KeyGenNonce.

Step 11, HA stores K2 in its MN-HA security connection context.

Step 12, the HA uses the K2 to calculate the MN-HA-AE for the MIP RAA message.

Step 13. The HA obtains the MN-HA KeyGenNonce from the MIP RAA message, saves it, and then sends a MIP RRP (MIP Register Response; MIP Registration Response message) message to the FA, which contains the MN-HA KeyGenNonce calculated using K2. HA-AE authentication extension field and random number MN-HA KeyGenNonce.

Step 14, the FA sends the received MIP RRP message to the MIP Client of the MS, and the message includes the MN-HA-AE authentication extension field and the MN-HA KeyGenNonce random number.

At the same time, FA sends MN-HA KeyGenNonce Notify message to Authenticator, which contains MS_ID, HA_ID and MN-HA KeyGenNonce.

Step 15, the MIP Client of the MS obtains the MN-HA KeyGenNonce random number and the MN-HA-AE authentication extension field according to the received MIP RRP message, and according to the MN-HA KeyGenNonce random number, Deriving the key K2=kdf(K1, KeyGenNonce, AuthID/MSS_ID); and verifying the received MN-HA-AE authentication extension field according to the K2, and saving the key K2 in its MN- HA secure connection context.

While executing step 15, the Authenticator returns the MN-HAKeyGenNonce ACK response message to the FA, and uses the unused 160 bits in the MSK as the key K1, for the MN-HAKeyGenNonce ACK response message in the received MIP RRP message. The HA-AE authentication extension field is verified; according to the MN-HAKeyGenNonce random number in the received MN-HA KeyGenNonce Notify message, derive the key K2=kdf(K1, KeyGenNonce, Auth_ID/MS_ID), and save the The above key K2 information.

After the above steps, the key information of the MIP Client of the MS is stored in the MS, the HA and the Authenticator.

When the MS is abnormally disconnected from the network, the Authenticator initiates a de-registration process instead of the MS, and the specific implementation process includes:

Step 201. When the BS detects that the MS is abnormally disconnected from the network, the BS notifies the Authenticator to send a MIP de-registration request.

Step 202, the Authenticator sends a MIP de-registration request message to the FA, the message includes the MN-HA-AE authentication extension field calculated according to the key K2 saved in the initial MIP registration process.

Step 203, the FA forwards the MIP de-registration request to the HA.

Step 204, HA authenticates the de-registration request message according to the key K2 saved in the initial MIP registration process, after the authentication is passed, terminates the corresponding data forwarding channel, and sends a de-registration response message to the FA at the same time. The MN-HA authentication extension field calculated by the key K2.

Step 205, FA forwards the de-registration response message to the Authenticator on the PMN;

Step 206, the Authenticator authenticates the de-registration response message according to the key K2 stored therein, and if the authentication passes, it confirms that the de-registration process is completed.

Step 207: Notify the BS that the de-registration process is successful by sending a response message of de-registration success.

The technical solution of the third embodiment provided by the present invention utilizes the secure channel between the AAA Server, Authenticaor and HA to realize the MIP de-registration when the MS is abnormally disconnected from the network in the CMIP mode. Its core is: when the BS detects that the MS is abnormally disconnected from the network through the air interface, the BS notifies the Authenticator through a message, which contains the address information of the MS and the corresponding HA. After receiving the message, the Authenticator notifies the AAA Server to initiate a de-registration instruction to the corresponding HA, and the AAA Server instructs the HA to terminate the corresponding data forwarding channel after receiving the notification. In this way, MIP de-registration is realized when the MS is abnormally disconnected from the network.

Realized the MIP de-registration process when the MS is abnormally disconnected from the network, as shown in Figure 5, including:

Step 301. When the BS detects that the MS is abnormally disconnected from the network, the BS releases relevant resources of the MS locally and acquires relevant information of the MS at the same time. Then send an R3_Session_Release.Notify message/primitive to the Authenticator to which the MS belongs. The message/primitive contains information such as the ID of the MS, notifying that the MS has been disconnected from the network abnormally.

The relevant information of the MS includes information such as the ID of the MS.

Step 302: After receiving the message/primitive, the Authenticator sends a Radius message to the AAA Server, instructing the AAA Server to notify the corresponding HA to register the MS.

Step 303: After receiving the message, the AAA Server sends a Radius message to the HA, notifying the HA to deregister the corresponding MS, and terminate the relevant data forwarding channel.

Step 304: After receiving the Radius message, the HA deregisters the corresponding MS according to the message instruction, and terminates the relevant data forwarding channel.

Step 305, the HA sends back a Radius response message of successful registration of the AAA Server.

Step 306, the AAA Server returns a Radius response message to the Authenticator.

Step 307, the Authenticator confirms to the BS that the de-registration process of the corresponding MS has been successfully completed by sending an R3_Session_Release.ACK response message/primitive, and the message/primitive contains information such as the ID of the MS.

Step 308, the BS notifies the relevant network element (such as ASN-GW/FA) to release the resources occupied by the MS.

It can be seen from the above-mentioned technical solution provided by the present invention that when the session terminates abnormally, the present invention initiates a de-registration process to the connection service network through the AAA server or the Authenticator entity that has saved the MIP key information of the MS and passes The information interaction with the connection service network realizes the de-registration of the MS, so it solves the problem that in the CMIP mode, when the MS is abnormally disconnected from the network, it must wait until the life cycle of the MIP is reduced to 0, and the HA initiates the de-registration process of the MIP problems, and thus more accurate billing can be achieved.

The above is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any person skilled in the art within the technical scope disclosed in the present invention can easily think of changes or Replacement should be covered within the protection scope of the present invention. Therefore, the protection scope of the present invention should be determined by the protection scope of the claims.

Claims (12)

1. when session abnormal end, realize MS is gone process registration for one kind, it is characterized in that, comprising:

A, when session abnormal end, the entity of network side initiates to go registration process to connectivity serving network, and by and connectivity serving network between the mutual realization of information MS is gone registration;

Described steps A specifically comprises:

A1, when session abnormal end, the preservation of network side the authentication person Authenticator entity of MIP key information of mobile terminal MS initiate to go registration process to connectivity serving network, and by and connectivity serving network between the mutual realization of information MS is gone registration;

Or,

A2, when session abnormal end, aaa server initiates to go registration process to connectivity serving network, and by and connectivity serving network between the mutual realization of information MS is gone registration.

2. method according to claim 1 is characterized in that, described steps A 1 specifically comprises:

A11, mutual by the MIP message between the home agent HA in mobile terminal MS, Authenticator, aaa server, foreign agent FA and the connectivity serving network, in described HA, generate and preserved the MIP key information of described MS, and the MN-HA KeyGenNonce random number of in described FA, obtaining in the MIP message of preservation from initial registration procedure;

A12, fall net back notice FA unusually when network side BS detects MS, FA sends to Authenticator with the random number of described preservation, and described Authenticator utilizes described random number computation key K2 information, and preservation;

A13, described HA authenticate MIP message mutual between described Authenticator and described HA according to key K 2 information of preserving according to MIP key information of preserving and described Authenticator, when confirming that authentication is passed through, described HA goes described MS to registration;

Or,

A14, mutual by the MIP message between the home agent HA in mobile terminal MS, Authenticator, aaa server and the connectivity serving network generate and have preserved the MIP key information of described MS in described Authenticator and HA;

A15, when MS session abnormal end, described Authenticator and described HA authenticate MIP message mutual between described Authenticator and described HA according to the MIP key information of preserving separately, when confirming that authentication is passed through, described HA goes described MS to registration.

3. method according to claim 2 is characterized in that, described steps A 11 specifically comprises:

A111, the information interaction by MS, HA and aaa server, in aaa server, generate MIP key K 1 and key K 2 information of described MS, and the extension field in the message is verified by described K1, after checking is passed through, described key K 2 information are sent to HA with the random number MN-HA KeyGenNonce that generates key K 2 uses by the MIP response message;

A112, described HA obtain described key K 2 information from described response message, and preserve, send MIP RRP message to FA then, comprised the MN-HA-AE authentication extension territory of using described K2 to calculate in the message, and generate the random number MN-HA KeyGenNonce that key K 2 is used;

A113, described FA obtain described random number MN-HAKeyGen Nonce from described MIP RRP message, and it is preserved.

4. method according to claim 3 is characterized in that, described steps A 11 also comprises:

A114, described FA send to MS with described MIP RRP message, have comprised described MN-HA-AE authentication extension territory and random number M N-HA KeyGenNonce in the message;

A115, described MS are according to the described random number MN-HAKeyGenNonce in the described MIP RRP message that receives, use described random number to generate key K 2 information, and use described key K 2 information that the MN-HA-AE authentication extension territory in the described message is verified;

After A116, checking were passed through, described MS preserved described key K 2 information.

5. method according to claim 2 is characterized in that, described steps A 12 specifically comprises:

A121, detect MS session abnormal end constantly as BS, notice FA sends MN-HA KeyGenNonce Notify message to Authenticator, has comprised the random number MN-HA KeyGenNonce that described FA preserves in the message;

A122, described Authenticator are according to the described MN-HA KeyGenNonceNotify message that receives, obtain described random number MN-HA KeyGenNonce, and use among the root key MSK untapped 160 to generate key K 2 and it is preserved as key K 1 and according to described random number MN-HA KeyGenNonce.

6. method according to claim 2 is characterized in that, described steps A 13 specifically comprises:

A131, described Authenticator send MIP and go login request message to FA, have comprised the MN-HA authentication extension territory of using described key K 2 information calculations in the message;

A132, described FA go register requirement to be transmitted to HA described MIP;

A133, described HA go login request message to authenticate according to key K 2 information of preserving in it to described MIP, after authentication is passed through, go registration reply message to described Authenticator by the FA transmission, comprised the MN-HA authentication extension territory of using described key K 2 information calculations in the message, simultaneously corresponding data forwarding passage has been stopped;

A134, described Authenticator go to the MN-HA authentication extension territory in the registration reply message to authenticate according to key K 2 information of preserving in it to described, after authentication is passed through, then confirm to go to succeed in registration.

7. method according to claim 2 is characterized in that, described steps A 14 specifically comprises:

A141, mutual by information between MS, HA and aaa server, in aaa server, generate MIP key K 1 and key K 2 information of described MS, and the extension field in the message is verified by described K1, after checking is passed through, described key K 2 information are sent to HA with the random number MN-HA KeyGenNonce that generates key K 2 uses by the MIP response message;

A142, described HA obtain described key K 2 information from described response message, and preserve, send MIP RRP message to FA then, comprised the MN-HA-AE authentication extension territory of using K2 to calculate in the message, and generate the random number MN-HA KeyGenNonce that key K 2 is used;

A143, described FA transmit described RRP message to described MS; Send MN-HA KeyGenNonce Notify message to described Authenticator simultaneously, comprised described random number MN-HAKeyGenNonce in the message;

A144, described MS are according to the described MIP RRP message that receives, obtain MN-HA-AE and MN-HA KeyGenNonce random number, and according to the described MN-HA KeyGenNonce random number that gets access to, calculate and generate key K 2, by described K2 described MN-HA-AE is verified then, after checking is passed through, K2 is preserved;

Simultaneously, described Authenticator is according to the described MN-HA KeyGenNonce Notify message that receives, obtain described random number MN-HA KeyGenNonce, and use among the root key MSK untapped 160 to generate key K 2 and it is preserved as key K 1 and according to described random number MN-HA KeyGenNonce.

8. method according to claim 2 is characterized in that, described steps A 15 specifically comprises:

A151, when BS detects MS and falls to net unusually, BS notifies described Authenticator to send MIP to HA by FA and goes register requirement;

A152, described Authenticator send MIP by FA to HA and go login request message, have comprised the MN-HA-AE authentication extension territory of calculating according to the described key K 2 of preserving in it in this message;

A153, HA go to the described MN-HA-AE authentication extension territory in the login request message to authenticate according to 2 pairs of key K of preserving in it are described, after authentication is passed through, stop corresponding data forwarding passage, send by FA simultaneously and go registration reply message, comprised the MN-HA authentication extension territory of using key K 2 to calculate in the message to described Authenticator;

A154, described Authenticator go to the MN-HA authentication extension territory in the registration reply message to authenticate according to 2 pairs of key K of preserving in it are described, if authentication is passed through, then confirm to finish registration process, and go the response message notice BS that succeeds in registration to go the registration process success by transmission.

9. according to claim 3 or 7 described methods, it is characterized in that described steps A 111 or steps A 141 specifically comprise:

A1111, MS send the MIP login request message by FA to HA, have comprised the extension field MN-AAA-AE and the MN-HA KeyGenNonce Rq indication of message in the message;

A1112, described HA receive described MIP login request message, and send described Radius AccRq message to AAA Server, have comprised described MN-AAA-AE and MN-HAKeyGenNonce Rq indication in the message;

A1113, AAA Server obtain key K 1 information according to root key information, and according to described K1 the MN-AAA-AE of the described Radius AccRq message that receives are verified; After checking is passed through, AAA Server generates random number MN-HA KeyGenNonce, and, send MIP RAA response message to HA then according to described random number generation key K 2 information, comprised described K2 and described random number MN-HA KeyGenNonce in the message.

10. method according to claim 1 is characterized in that, described steps A 2 specifically comprises:

A21, when BS detects MS session abnormal end, use message/primitive notice Authenticator to send the HA of Radius message informing aaa server in corresponding connectivity serving network and initiate to go the registration indication;

A22, AAA Server send Radius message to HA after receiving message, and notice HA goes corresponding M S to registration, stops relevant data forwarding passage;

After A23, described HA receive described Radius message, according to described message indication corresponding M S is gone registration, and stop relevant data forwarding passage.

11. method according to claim 10 is characterized in that, described steps A 21 specifically comprises:

A211, when BS detects MS session abnormal end, BS discharges the related resource of MS in this locality, obtain the relevant information of MS simultaneously, and by message informing Authenticator entity;

A212, described Authenticator initiate to go the registration indication according to the HA of described message informing aaa server in corresponding connectivity serving network.

12. method according to claim 11 is characterized in that, described steps A 212 also comprises:

A2121, described HA loopback AAA Server remove the response message that succeeds in registration;

A2122, described AAA Server are according to the response message that receives, and loopback Radius response message is given described Authenticator;

A2123, described Authenticator send response message/primitive notice BS and have completed successfully corresponding M S and gone registration process;

The relevant network element of A2124, described BS notice discharges the resource that takies of corresponding MS.

Images