JP2009031848A - Authentication transfer device - Google Patents

Abstract

【Task】
Originally, if all transfer requests from subscriber terminals are transferred to the authentication server, an unauthorized authentication request is transferred from the authentication transfer device to the authentication server side. Therefore, there is a possibility of being a target of attack such as DoS attack or hacking. is there.
[Solution]
An authentication transfer device that transfers an authentication request from a subscriber terminal to an authentication server updates a first storage unit that stores authentication status information of the subscriber terminal and authentication status information according to authentication processing for the subscriber terminal. And an authentication processing unit that performs processing for transferring an authentication request from the subscriber terminal based on the authentication status information of the subscriber terminal.
[Selection] Figure 3

Description

  The present invention relates to an authentication process when a subscriber device (for example, a subscriber wireless device (MS: mobile station)) is connected to a network.

  Standards such as IEEE 802.16 and WiMAX are known as communication methods for connecting subscriber wireless devices to a network. Standards such as WiMAX stipulate that subscriber wireless devices perform authentication processing with an authentication server in the connectivity service network (CSN) via the access service network ASN. In standards such as IETF, IEEE 802.16, and WiMAX, the above authentication processing is defined as extended authentication protocol authentication (EAP authentication: Extensible Authentication Protocol authentication). There are two EPA processes: a WiMAX Single-EAP authentication method that performs only device authentication, and a WiMAX Double-EAP authentication method that performs both device authentication and user authentication.

  In EAP authentication, ASN forwards an authentication request from a subscriber wireless device to CSN. Further, in the EAP authentication, the ASN transfers the authentication result from the authentication server in the CSN to the subscriber radio apparatus MS. There is an authentication transfer device in the ASN, and the authentication transfer device (ASN-GW or Authenticator) performs the above transfer processing. The authentication transfer apparatus extracts an authentication server address from a network access identifier (NAI) notified from the MS at the start of EAP authentication, and transfers the authentication request to the server of the extracted address.

  Since the above authentication transfer device in the WiMAX standard system only transfers the authentication request from the subscriber wireless device to the authentication server, when the authentication server address is valid, transfer of an unauthorized authentication request cannot be prevented. Eventually, an unauthorized authentication request is likely to be NG due to the authentication processing performed by the transfer destination authentication server. However, since an unauthorized authentication request that should not be transferred is transferred from the authentication transfer device to the authentication server side, an attack that overloads the server and stops the service (DoS: Denial of Service) or hacking There is a possibility of becoming an attack target.

Patent Document 1 is known as a known document.
JP 2005-338887 A

  An object of the present invention is to provide an authentication transfer apparatus that blocks an unauthorized authentication request to a CSN.

  The present invention adopts the following configuration in order to achieve the above-described object.

  An authentication transfer apparatus for transferring an authentication request from a subscriber terminal to an authentication server includes a first storage unit that stores authentication status information of the subscriber terminal, and the authentication status information according to an authentication process for the subscriber terminal. An authentication processing unit that updates and performs a transfer process of an authentication request from the subscriber terminal based on the authentication status information of the subscriber terminal.

  According to the present invention, an authentication transfer apparatus can block an unauthorized authentication request. Therefore, it is possible to prevent the authentication server for the higher level network from becoming an attack target such as a DoS attack or hacking.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. The configuration of the embodiment is an exemplification, and the present invention is not limited to the configuration of the embodiment.

  In this embodiment, the NAI notified from the MS in the transfer process of the authentication request of the authentication transfer apparatus (ASN-GW: Access Service Network Gateway or Authenticator) that supports the WiMAX Double-EAP authentication method in which the authentication order is defined. The address of the transfer destination authentication server is resolved, and the validity of the authentication state of the MS and the use of the authentication server specified from the NAI is verified to determine whether the authentication request can be transferred.

[WiMAX network]
A WiMAX network according to the embodiment will be described with reference to FIG. 1 is a subscriber wireless device, 2 is a wireless base station, 3 is an access service network, 4 is an authentication transfer device, 5 is a connectivity service network, 6 is a router, 7 is a device authentication server, and 8 is a user authentication server. Show.

  The subscriber radio device 1 includes at least a mobile station (MS or SS) defined in a standard such as WiMAX. The subscriber radio apparatus 1 performs radio communication with the radio base station 2 and makes an authentication request when starting communication. Although this embodiment will be described using a subscriber radio device, the present invention can also be applied to a subscriber device that does not use radio.

  The access service network 3 includes an access service network defined in a standard such as WiMAX. The access service network 3 includes a radio base station 2, an authentication transfer device 4, and a device authentication server 7. The access service network 3 is provided between the subscriber wireless device 1 and the connectivity service network 5. The access service network 3 and the subscriber radio apparatus 1 are a wireless network. The access service network 3 is managed by a network access provider.

  The radio base station 2 includes a base station (BS) defined in a standard such as WiMAX. The radio base station 2 is provided in the access service network 3. The wireless base station 2 has functions of performing wireless communication with the subscriber wireless device 1 and exchanging packet data with the authentication transfer device 4.

  The authentication transfer device 4 includes an ASN-GW or an Authenticator defined in a standard such as WiMAX. The authentication transfer device 4 performs an authentication process using an authentication protocol (EAP) defined in the standard. The authentication transfer device 4 transfers the authentication request from the subscriber wireless device 1 to the authentication server in the ASN and the authentication server in the connectivity service network 5 (CSN). Further, the authentication transfer device 4 transfers the authentication results from the authentication server in the ASN and the authentication server in the CSN to the subscriber radio device 1. The authentication transfer apparatus extracts the address of the authentication server from a network access identifier (NAI) notified from the subscriber radio apparatus 1 at the start of EAP authentication. Furthermore, the authentication transfer device detects an unauthorized authentication request from the authentication server address of the extracted authentication destination and the current and past authentication states (the order of authentication), and does not forward the unauthorized authentication request to the authentication server. .

  The device authentication server 7 includes an authentication / authorization / accounting server (AAA Server) defined in a standard such as WiMAX. The device authentication server 7 performs authentication processing of the authentication request transferred from the authentication transfer device 4, and returns an authentication processing result to the authentication transfer device.

  The connectivity service network 5 includes a CSN defined in a standard such as WiMAX. The connectivity service network 5 includes a router 6 and a user authentication server 8. The connectivity service network 5 is managed by a network service provider.

The user authentication server 8 includes an authentication / authorization / accounting server (AAA Server) defined in a standard such as WiMAX. The user authentication server 8 performs authentication processing of the authentication request transferred from the authentication transfer device 4 and returns an authentication processing result to the authentication transfer device.
[Authentication sequence]
A double-EAP authentication scheme sequence according to the embodiment will be described with reference to FIG. The Double-EAP authentication method sequence is an authentication sequence between the subscriber wireless device 1, the wireless base station 2, the authentication transfer device 4, the device authentication server 7, and the user authentication server 8. The authentication sequence is performed in the order from step S1 to step S30.

  In step S1, the subscriber radio apparatus 1 notifies the radio base station 2 of the basic capabilities (SBC-REQ) supported by the subscriber radio apparatus 1. In step S 2, the radio base station 2 sends a NetEntry MS State Change Request to the authentication transfer device 4. In step S2.1, the authentication transfer apparatus 4 determines which of single-EAP or double-EAP authentication method is adopted. In step S3, the authentication transfer apparatus 4 sends the determined authentication method to the radio base station 2. In step S4, the authentication method determined by the wireless base station 2 is transferred to the subscriber wireless device 1. In step S <b> 5, the radio base station 2 issues a receipt notification to the authentication transfer device 4. As described above, in steps S1 to S5, the authentication method (for example, the Authentication-Policy-Support value) employed by the subscriber wireless device 1 / wireless base station 2 / authentication transfer device 4 is determined, and the subscriber wireless device 1 To notify.

  In step S <b> 6, the authentication transfer apparatus 4 transmits an EAP-request / identify message (= identify notification request) serving as a first-stage EAP authentication start trigger to the radio base station 2.

  In step S <b> 7, the radio base station 2 transmits an EAP-request / identify message (= identify notification request) serving as a first-stage EAP authentication start trigger to the subscriber radio apparatus 1.

In step S8, when the subscriber radio apparatus 1 receives the EAP-request / identify message, it transmits an EAP-response / identify message (= identify notification) to the radio base station 2 as a response. NAI is set as the identify. In a standard such as WiMAX, the NAI includes an area (Realm) in which an authentication server is described. In the Realm portion of the NAI, the domain name of the authentication server (device authentication server or user authentication server) is described. (In a standard such as WiMAX, this is a domain name, but any information that can identify an authentication server may be used. For example, an address name of the authentication server)
In step S 9, when the radio base station 2 receives the EAP-response / identify message from the subscriber radio device 1, the message is transferred to the authentication transfer device 4.

  In step S9.1, referring to the server address table storing the server domain name, server address name, and server usage from the domain name of the Realm part of the NAI acquired by the authentication transfer apparatus 4 from the subscriber radio apparatus 1, Performs server address analysis processing to determine the device authentication server address. Further, the validity of the authentication server authentication application is verified according to the server address analysis processing result and the authentication state of the subscriber wireless device 1. Validity verification of authentication application of authentication server is whether or not the server specified in the authentication request is correct at the authentication stage (one authentication or second authentication), or the type of authentication (device authentication or user It is verified whether it is correct on (authentication). That is, in EAP, the user authentication is defined after the device authentication is performed in the authentication order. Therefore, if the user authentication is requested in the first authentication, it is determined as an unauthorized authentication request. Further, since the first authentication is device authentication, a request for performing user authentication to the server is determined as an unauthorized authentication request. Based on the determination result, it is determined whether the authentication request message from the subscriber terminal can be transferred.

  In step S <b> 10, the authentication transfer device 4 transmits an authentication request message to the device authentication server 7 when the validity of the authentication of the subscriber wireless device 1 can be confirmed.

  In step S <b> 11, first stage device authentication is performed between the subscriber wireless device 1 and the device authentication server 7. The first stage device authentication is performed to confirm whether the subscriber wireless device 1 is an authorized user of the network.

  In step S <b> 12, the authentication transfer apparatus 4 receives the device authentication result from the device authentication server 7. In step S <b> 13, the authentication transfer apparatus 4 transmits the device authentication result received from the device authentication server 7 to the radio base station 2. In step S <b> 14, the radio base station 2 transmits the device authentication result received from the authentication transfer apparatus 4 to the subscriber radio apparatus 1.

  In step S14.1, the authentication transfer apparatus 4 generates EIK when the subscriber wireless apparatus 1 passes the device authentication which is the first step authentication. The EIK is used for message authentication that proves that the first-step authentication used until the completion of the second-step authentication is passed.

  In step S15, the authentication transfer apparatus 4 notifies the radio base station 2 of the device authentication result and AK-Context (only EIK as contents), and prompts the MS status change. In step S <b> 16, the wireless base station 2 returns a device authentication result and an AK-Context receipt notification to the authentication transfer apparatus 4. In step S <b> 17, the radio base station 2 transfers the device authentication result and AK-Context to the subscriber radio apparatus 1.

  It should be noted that the message exchanged between the subscriber radio apparatus 1 and the radio base station 2 after Step S17 described above is an EPA integral key (for encryption between the subscriber radio apparatus 1 and the radio base station 2). A message authentication code (MAC) including EIK) is attached to prove that the first-step authentication has been passed. This completes the first stage authentication procedure. As an example, this embodiment uses a cheaper message authentication code (CMAC) as a certificate.

  In step S <b> 18, the subscriber radio apparatus 1 sends a second stage authentication start message to the radio base station 2. In step S <b> 19, the radio base station 2 transmits a second stage authentication start message from the subscriber radio apparatus 1 to the authentication transfer apparatus 4.

  In step S <b> 20, the authentication transfer apparatus 4 transmits an EAP-Request / Identity message (= Identity notification request) serving as a second-stage EAP authentication start trigger to the radio base station 2. In step S <b> 21, the radio base station 2 transfers the EAP-Request / Identity message to the subscriber radio device 1.

  In step S <b> 22, when the subscriber radio apparatus 1 receives the EAP-Request / Identity message, it transmits an EAP-Response / Identity message (= Identity notification) to the radio base station 2 as a response. As Identity, NAI (Network Access Identifier) is set. In the Realm part of the NAI set here, the domain name (address) of the user authentication server is described, and the user authentication server is specified. In step S23, the radio base station 2 transfers the EAP-Response / Identity message from the subscriber radio device 1 to the authentication transfer device 4.

  In step S23.1, user authentication is performed by referring to the server address table storing the server name, server address name, and server usage from the domain name of the Realm part of the NAI acquired by the authentication transfer apparatus 4 from the subscriber radio apparatus 1. Performs server address analysis processing to determine the server address. Furthermore, the validity of the authentication server application is verified according to the server address analysis processing result and the authentication state of the subscriber wireless device 1. Validity verification of authentication application of authentication server is whether or not the server specified in the authentication request is correct at the authentication stage (one authentication or second authentication), or the type of authentication (device authentication or user It is verified whether it is correct on (authentication). That is, in EAP, the user authentication is defined after the device authentication is performed in the authentication order. Therefore, if the device authentication is requested in the second authentication, it is determined as an unauthorized authentication request. Further, since the second authentication is a user authentication, a request for device authentication to the server is determined as an unauthorized authentication request. Based on the determination result, it is determined whether the authentication request message from the subscriber terminal can be transferred.

  In step S <b> 24, when the authentication transfer device 4 can confirm the validity of the authentication of the subscriber wireless device 1, it transmits an authentication request message to the user authentication server 8.

  In step S <b> 25, second-stage user authentication is performed between the subscriber wireless device 1 and the user authentication server 8.

  In step S <b> 26, the authentication transfer device 4 receives the user authentication result from the user authentication server 8. In step S <b> 27, the authentication transfer apparatus 4 transfers the user authentication result received from the user authentication server 8 to the radio base station 2. In step S <b> 28, the wireless base station 2 transfers the user authentication result received from the authentication transfer device 4 to the subscriber wireless device 1.

  In step S27.1, the authentication transfer apparatus 4 generates a Key, and stores it as a Security Context when the subscriber wireless apparatus 1 passes the user authentication which is the second stage authentication, and stores it as a Security Context. The authentication status of the device 1 is updated.

  In step S29, the authentication transfer device 4 transfers the user authentication result and AK-Context (other than EIK) to the radio base station 2. In step S30, the radio base station 2 changes the status of the subscriber radio apparatus 1, and the radio base station 2 returns a receipt notification to the authentication transfer apparatus 4. By completing step S30, the second stage authentication procedure is completed.

[Authentication transfer device]
FIG. 3 is a block diagram illustrating a configuration example of the authentication transfer apparatus 4 according to the first embodiment of FIGS. 1 and 2. The authentication transfer device 4 includes an authentication message processing unit 10 and a system setting information database 11.

  The authentication message processing unit 10 includes a WiMAX authentication relay (Auth Relay) protocol processing unit 10a, an authentication processing unit 10h, an authentication control unit 10b, an AAA client 10c, a server address resolution processing unit 10d, an MS authentication state determination unit 10e, and MS information. A database 10f and a server address table 10g are provided.

  The WiMAX authentication relay protocol processing unit 10a is connected to the radio base station 2 and the authentication control unit 10b. The WiMAX authentication relay protocol processing unit 10a receives a packet transmitted by the authentication relay (AuthRelay) protocol transmitted from the radio base station 2, extracts an EAP packet from the packet, and passes it to the authentication control unit 10b.

  The authentication processing unit 10h includes an authentication control unit 10b, a server address resolution processing unit 10d, and an MS authentication state determination unit 10e. The authentication processing unit 10h performs Steps s9.1 and s23.1 of the process of FIG.

  The authentication control unit 10b includes a WiMAX authentication relay protocol processing unit 10a, an authentication control unit 10b, an AAA client 10c, a server address resolution processing unit 10d, a subscriber wireless device authentication state determination unit 10e, a subscriber wireless device information database 10f, a server address The table 10g and the system setting information database 11 are connected. The authentication control unit 10b controls the entire authentication function and manages the authentication state of the subscriber wireless device 1. In the embodiment, it is determined from the results from the subscriber wireless device authentication state determination unit 10e and the server address resolution processing unit 10d whether the identified authentication server is appropriate in the authentication state of the subscriber wireless device 1, Determines whether or not the authentication message can be transferred.

The server address table 10g stores authentication state information including a domain, an address, and an authentication method in association with the authentication server. (See FIGS. 7 and 10)
The server address analysis processing unit 10d is connected to the authentication control unit 10b and the server address table 10g. The server address analysis processing unit 10d searches the server address table 10g included in the Realm information notified from the authentication control unit 10b, and authenticates the server IP address and authentication state information (for example, authentication use information and authentication stage information). Notify the control unit 10b.

The subscriber wireless device information database 10f stores authentication status information for each subscriber terminal. The authentication status information of the subscriber terminal stores what level of authentication the subscriber terminal has completed. That is, it stores whether the subscriber terminal is in an unauthenticated state, a device authentication completed state, or a user authentication completed state. These are updated based on the result of extracting NAI information during packet exchange in EAP. (See FIGS. 7 and 10)
The subscriber wireless device authentication state determination unit 10e is connected to the authentication control unit 10b and the subscriber wireless device information database 10f. The subscriber wireless device authentication state determination unit 10e determines the authentication method (Single-EAP or Double-EAP) applied to the corresponding subscriber wireless device 1 in the subscriber wireless device information database 10f and the subscriber wireless device authentication state. The authentication mode (device authentication or user authentication) required for the subscriber wireless device 1 is determined, and the result is notified to the authentication control unit 10b.

  The AAA client 10c is connected to the device authentication server 7 and the user authentication server 8 shown in FIGS. The AAA client 10c is an interface of the device authentication server 7, the user authentication server 8, and the authentication transfer device 4, and encapsulates the EAP packet and other information passed from the authentication control unit 10b with the AAA protocol (for example, RADIUS) to perform device authentication. Send to server and user authentication server.

  The system setting information database 11 is connected to the authentication control unit 10b. The system setting information database 11 is a database in which information set in the authentication transfer device 4 is stored, and can be set statically by an operator or the like.

[Authentication request transfer processing]
FIG. 4 shows an authentication request transfer process flowchart in the authentication transfer apparatus 4 of the first embodiment.

Step S401:
Step S401 is a step of performing WiMAX protocol termination processing. First, the packet of the authentication request message transmitted from the subscriber wireless device 1 is encapsulated by the wireless base station 2 using the WiMAX authentication relay protocol and transferred to the authentication transfer device 4. After receiving the packet encapsulated by the WiMAX authentication relay protocol, the authentication transfer device 4 sends the EAP packet and the subscriber wireless device authentication ID (MSID) included in the received packet to the authentication control unit 10b.

Step S402:
Step S402 is a step for performing EAP packet processing. Upon receiving the EAP packet and the MSID, the authentication control unit 10b analyzes the message code and data type of the EAP packet, extracts the NAI stored as data, and extracts it into the corresponding MSID area in the subscriber wireless device information database 10f. Write the NAI. Further, the authentication control unit 10b notifies the MS authentication status determination unit 10e of the MSID and the server address resolution processing unit 10d of the Realm area of the NAI.

Step S403:
Step S403 is a step of performing a server address search process. The server address analysis processing unit 10d searches the server address table 10g using the domain described in the Realm of the received NAI as a key, and the corresponding server address and authentication server authentication status information (for example, server usage information). And the search result is notified to the authentication control unit 10b.

Step S404:
Step S404 is a step of performing a subscriber wireless device authentication state determination process. At substantially the same time as S403, the subscriber wireless device authentication state determination unit 10e searches the MS information database 10f using the received MSID as a key to obtain authentication state information of the subscriber wireless device, and sends it to the subscriber wireless device. The Auth-Policy value (Single-EAP or Double-EAP) indicating the applied authentication method, the subscriber wireless device device authentication state, and the subscriber wireless device user authentication state are acquired, and are currently required for the MS. The authentication form is determined, and the determination result is notified to the authentication control unit 10b.

Step S405:
Step S405 is a step of determining whether or not the authentication request can be transferred. The authentication control unit 10b includes the server IP address and server usage information notified from the server address resolution processing unit 10d and the authentication mode (device authentication or user authentication) to be performed by the subscriber wireless device 1 notified from the MS authentication state determination unit 10e. ) To determine whether or not transfer is possible and determine the next process.

Step S406:
Step S406 is a step in which the authentication request is transferred by the AAA client. The AAA client 10c transmits the EAP packet and other information to the authentication server having the IP address notified by the AAA protocol (for example, RADIUS).

Step S407:
Step S407 is a step for discarding or retransmitting the authentication request. If transfer is impossible as a result of the transfer permission / inhibition determination in the authentication control 10b, the authentication request is discarded or a request for retransmission to the subscriber wireless device is made.

The subscriber wireless device authentication state determination process and the authentication message transfer permission determination process have a plurality of embodiments. Each embodiment will be described below.
<First Embodiment>
[Subscriber Wireless Device Authentication State Determination Processing of First Embodiment]
FIG. 5 is a specific example of the subscriber wireless device authentication state determination process in the authentication transfer device 4 of the first embodiment. FIG. 5 is a flowchart for explaining step S404 in FIG. 4 in detail.

Step S501:
First, when the MSID is notified, the MS information database 10f is searched, and the authentication policy information (Auth-Policy information) of the subscriber wireless device 1, the subscriber wireless device device authentication state, and the subscriber wireless device user authentication state information are obtained. get. The device authentication information acquired from the subscriber wireless device information database 10f has one of three states: device authentication state-unauthenticated, device authentication state-authentication disabled, and device authentication state-authentication enabled. The user authentication status information acquired from the subscriber wireless device information database 10f has one of three statuses: user authentication status-unauthenticated, user authentication status-authentication disabled, and user authentication status-authentication enabled.

Step S502:
Next, based on the acquired Auth-Policy information, it is determined whether the authentication method performed by the subscriber radio apparatus 1 is Single-EAP or Double-EAP, and is distributed. If it is Single-EAP, the determination result is notified to the authentication control unit 10b. If it is Double-EAP, the authentication method required for the subscriber radio apparatus 1 is determined in the authentication state determination table.

Step S503:
In the authentication status determination table, the MS radio authentication status information and MS user authentication status information described in the MS context (MS-Context) in the table of the subscriber radio equipment information database 10f are used as input values. Determine the type of authentication required for the request.

  As an example, the vertical axis of the authentication status determination table describes the three statuses of device authentication status, the d column is device authentication status-unauthenticated, the e column is device authentication status-authentication disapproved, and the f column is device authentication. Status-Indicates the status of authentication permission. The horizontal axis of the authentication status determination table describes three statuses of user authentication status, a column is user authentication status-unauthenticated, b column is user authentication status-authentication not allowed, and c column is user authentication status-authentication. Indicates permission status. When the user authentication state acquired in step S501 is unauthenticated and the device authentication state is unauthenticated and authentication is impossible, the determination result of the necessary authentication type is device authentication, and the user authentication state acquired in step S501 is unauthenticated and the device When the authentication status is “authentication permitted”, the required authentication type determination result is user authentication. When the user authentication status acquired in step S501 is authentication not permitted, the device authentication status is unauthenticated, and authentication is not permitted, the determination result of the required authentication type is device authentication, and the user authentication status acquired in step S501 is not authenticated. When the device authentication status is “permitted”, the required authentication type determination result is user authentication. When the user authentication state acquired in step S501 is authentication permission, the device authentication state is unauthenticated, authentication is not permitted, and the device authentication state is authentication permission, the required authentication type determination result is device authentication.

Step S504:
The determination result in step S503 is notified to the authentication control unit 10b, and a transfer permission / inhibition determination process is executed.
[Authentication Message Transfer Allowability Judgment Processing of First Embodiment]
6 is an authentication message transfer permission determination processing flowchart in the authentication transfer apparatus 4 of the first embodiment. Steps S601 and S602 in FIG. 6 show a specific example of the transfer feasibility determination in step S406 in FIG.

Step S601:
The transfer permission / inhibition determination process in the authentication control unit 10b includes the MS authentication state determination result notified from the MS authentication state determination unit 10e (step S404) and the server address table search result notified from the server address resolution processing unit 10d (step S403). Is applied to the transfer enable / disable determination table to determine the determination result.

  As an example, the vertical axis of the transfer enable / disable determination table describes the determination criteria for four states including the IP address obtained in step S403 and the usage information of the server. The horizontal axis of the transfer permission determination table describes the determination criteria for the three states of the MS authentication state determination result obtained in step S404. The horizontal a column describes determination criteria for Single-EAP authentication, the horizontal b column describes determination criteria for Double-EAP device authentication, and the horizontal c column describes determination criteria for Double-EAP user authentication. The vertical d column has an IP address and the server usage is a device authentication criterion, the vertical e column has an IP address and the server usage is a user authentication criterion, and the vertical f column has an IP address and a server Is used as a blank determination criterion, and the vertical g column describes a determination criterion for an IP address and a blank server usage.

  When the MS authentication state determination result is Single-EAP authentication a, the authentication request can be transferred to the device authentication server and the user authentication server with d, e, and f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP device authentication b, the authentication request can be transferred to the device authentication server and the user authentication server with d, and e, f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP user authentication c, the authentication request can be transferred to the device authentication server and the user authentication server as e, and d, f, and g cannot be transferred.

Step S602:
Next, if the obtained determination result is transferable, the AAA client 10c requests transmission to the AAA server. If transfer is impossible, discard or resend processing is executed.

[Database holding information element of the authentication transfer apparatus of the first embodiment]
FIG. 7 shows an information element group held by the authentication transfer apparatus of this embodiment.
-Server address table:
The server address table 10g is a database in which the authentication server domain name, IP address, and server usage information are stored in association with each other. The server address table 10g associates the authentication server domain name 10g-1, the authentication server IP address 10g-2, and the server usage information 10g-3 of the authentication server. In the authentication message transfer process, the server address table 10g is used for the server address resolution and the validity determination process between the server application and the MS authentication state. The use information here describes whether the server described in the authentication server domain name 10g-1 is a device authentication server or a user authentication server.
System setting information database 11:
The system setting information database 11 is statically set by an operator or the like. The column 11a of the system setting information database 11 includes an Auth-Policy setting item for determining an MS authentication method as an example of an item set by the operator. In the column 11b of the system setting information database 11, a value corresponding to the column 11a is set. When 11a is Auth-Policy, either Double-EAP or Single-EAP is described.
・ MS information database:
The MS information database 10f stores MS-Context. The MS-Context is an information element group in which an authentication state of the MS generated for each MS, information assigned to the MS, and the like are described.

  10f-a item column 10f-1 line is a terminal ID (MSID), 10f-2 line is an authentication policy (Auth-Policy), 10f-3 line is a first network access identifier (NAI (1)), Line 10f-4 is the second network access identifier (NAI (2)), line 10f-5 is the authentication key (AK-Context), line 10f-6 is the MS device authentication status, and line 10f-7 is the MS user authentication. The state is described. In the column 10f-b, values corresponding to the above items are stored.

  The terminal ID is described in the value column 10f-b of the subscriber wireless terminal ID (MSID) 10f-1. The value column 10f-b of the authentication policy (Auth-Policy) 10f-2 describes whether to perform double-EAP authentication or single-EAP authentication. In the present embodiment, it is described that Double-EAP authentication 10f-3 is performed.

  The column 10f-b of the first network access identifier (NAI (1)) 10f-3 and (NAI (2)) 10f-4 describes the address of the subscriber radio apparatus.

  In the value column 10f-b of the authentication key (AK-Context) 10f-5, a key used for authentication is described. The value column 10f-b of the MS device authentication status 10f-6 describes the device authentication status. In the case of unauthenticated, Not performed is written, in the case of authentication, “pass” is written. The value column 10f-b of the MS user authentication state 10f-7 describes the user authentication state. In the case of unauthenticated, Not performed is written, in the case of authentication, “pass” is written.

<Second Embodiment>
The second embodiment shows an example in which the authentication request is not transferred to the authentication server in the order of authentication requests having an incorrect authentication order. In the second embodiment, the authentication server and the MS determined from the authentication request (NAI) from the MS in the state where the authentication stage (1st or 2nd) that can be processed by the server is defined in the server address table in advance. -From the 1st authentication state of the context and the 2nd authentication state, the server requested by the MS determines whether it is valid in the authentication state of the MS and determines whether transfer is possible.

[MS Authentication State Determination Processing of Second Embodiment]
FIG. 8 is an MS authentication state determination process flowchart according to the second embodiment. The MS information acquisition process in step 501 in FIG. 8 and the table configuration in step 503 are different from those in steps 501 and 503 in FIG.

Step 501:
In step 501, when the subscriber wireless terminal ID (MSID) is notified, the MS information database 10f is searched to obtain MS authentication policy information (Auth-Policy information), MS 1st authentication status, and MS 2nd authentication status information. To do.

Step 502:
Next, in step 502, it is determined whether the authentication method performed by the MS is Single-EAP or Double-EAP from the obtained Auth-Policy information, and then distributed. If it is Single-EAP, the judgment result is notified to the authentication control unit 10b. If it is Double-EAP, the authentication stage required for the MS is determined in the MS authentication state determination table.

Step 503:
Next, in step 503, in the MS authentication status determination table, the MS 1st authentication status information and the MS 2nd authentication status information acquired from the MS-Context are used as input values to determine the authentication stage required for the MS.

  As an example, the vertical axis of the authentication status determination table describes the three statuses of the device authentication stage, the d column is the first authentication status-unauthenticated, the e column is the first authentication status-authentication not allowed, f The column indicates the first authentication state-authentication permission state. The horizontal axis of the authentication status determination table describes the three statuses of the user authentication stage. The a column indicates the second authentication status-unauthenticated, the b column indicates the second authentication status-authentication not permitted, and the c column indicates the first status. 2 shows the authentication status-authentication permission status.

  When the second authentication state acquired in step S501 is unauthenticated and the first authentication state is unauthenticated and authentication is impossible, the determination result of the necessary authentication type is the first authentication, and the second authentication state acquired in step S501 When the authentication state is unauthenticated and the first authentication state is authentication permission, the required authentication type determination result is the second authentication. When the second authentication state acquired in step S501 is authentication disapproved and the first authentication state is unauthenticated and unauthenticated, the required authentication type determination result is the first authentication, and the first authentication state acquired in step S501. The determination result of the necessary authentication type when the authentication status of 2 is not authenticated and the first authentication status is authentication enabled is the second authentication. When the second authentication state acquired in step S501 is authentication permission and the first authentication state is unauthenticated, the determination result of the necessary authentication type is the second authentication, and the second authentication state acquired in step S501 When the first authentication status is authentication permission and authentication permission, the required authentication type determination result is the first authentication.

Step S504:
The determination result of step S503 is notified to the authentication control unit 10b, and a transfer permission / inhibition determination process is executed.

[Authentication Message Transfer Allowability Judgment Processing of Second Embodiment]
FIG. 9 is an authentication message transfer permission / inhibition determination flowchart according to the second embodiment. FIG. 9 is the same as FIG. 6 except for the configuration of the table of s601.

  The transfer permission / inhibition determination process in the authentication control unit 10b includes the MS authentication state determination result notified from the MS authentication state determination unit 10e (step S404) and the server address table search result notified from the server address resolution processing unit 10d (step S403). Is applied to the transfer enable / disable determination table to determine the determination result.

  As an example, the vertical axis of the transfer enable / disable determination table describes the determination criteria for four states including the IP address obtained in step S403 and the usage information of the server. The horizontal axis of the transfer permission determination table describes the determination criteria for the three states of the MS authentication state determination result obtained in step S404. The horizontal a column describes the single-EAP authentication criteria, the horizontal b column lists the Double-EAP first authentication criteria, and the horizontal c column lists the Double-EAP second authentication criteria. The vertical d column has an IP address and the server usage is the first authentication criterion, the vertical e column has the IP address and the server usage is the second authentication criterion, and the vertical f column is the IP address And the usage criteria of the server are blank, and the vertical g column describes the judgment criteria of the IP address and blank usage of the server.

  When the MS authentication state determination result is Single-EAP authentication a, the authentication request can be transferred to the device authentication server and the user authentication server with d, e, and f, and g can be transferred. When the MS authentication status determination result is Double-EAP first authentication b, the authentication request can be transferred to the device authentication server and the user authentication server at d, and e, f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP second user authentication c, the authentication request can be transferred to the device authentication server and the user authentication server with e, and d, f, and g cannot be transferred.

Step S602:
Next, if the obtained determination result is transferable, the AAA client 10c requests transmission to the AAA server. If transfer is impossible, discard or resend processing is executed.

  FIG. 10 illustrates an information element group held by the authentication transfer apparatus according to the second embodiment.

10 differs from FIG. 7 in the server address table 10g, and the other points are the same as those in FIG. Therefore, the server address table 10g will be described below.
-Server address table:
The server address table 10g is a database in which the authentication server domain name, IP address, and server usage information are stored in association with each other. The server address table 10g associates the authentication server domain name 10g-1, the authentication server IP address 10g-2, and the server authentication stage information 10g-3 of the authentication server. The usage information here describes in which authentication stage the server described in the domain name 10g-1 of the authentication server is used. In the second embodiment, device. ne. The server of jp is a second authentication server, user. ne. The jp server is a first authentication server.
<Third Embodiment>
The third embodiment shows an authentication message transfer process in a case where both device authentication and user authentication are required but there is no provision regarding the order of executing authentication, and is calculated from an authentication request (NAI) from the MS. The server requested by the MS determines whether it is valid in the authentication state of the MS from the authenticated authentication server, the MS device authentication state of the MS-context, and the MS user authentication state, and determines whether transfer is possible.

[MS Authentication State Determination Processing of Third Embodiment]
FIG. 11 is an MS authentication state determination process flowchart according to the third embodiment. The MS information acquisition process in step 501 in FIG. 11 and the table configuration in step 503 are different from those in steps 501 and 503 in FIG.

Step 501:
In step 501, when the MSID is notified, the MS information database 10f is searched, and the Auth-Policy information, the subscriber wireless device device authentication state, and the subscriber wireless device user authentication state information of the subscriber wireless device 1 are acquired. The device authentication information acquired from the subscriber wireless device information database 10f describes one of three states: device authentication state-unauthenticated, device authentication state-authentication not possible, device authentication state-authentication permitted. The user authentication status information acquired from the subscriber wireless device information database 10f describes one of three statuses: user authentication status-unauthenticated, user authentication status-authentication disabled, and user authentication status-authentication enabled.

Step 502:
Next, in step 502, it is determined whether the authentication method performed by the MS is Single-EAP or Double-EAP from the obtained Auth-Policy information, and then distributed. If it is Single-EAP, the judgment result is notified to the authentication control unit 10b. If it is Double-EAP, the authentication stage required for the MS is determined in the MS authentication state determination table.

Step 503:
In the authentication status determination table, the MS device authentication status information and the MS user authentication status information described in the MS-Context in the table of the subscriber radio equipment information database 10f are used as input values, which are necessary for the request of the subscriber radio equipment. The type of authentication to be determined is determined.

  As an example, the vertical axis of the authentication status determination table describes the three statuses of device authentication status, the d column is device authentication status-unauthenticated, the e column is device authentication status-authentication disapproved, and the f column is device authentication. Status-Indicates the status of authentication permission. The horizontal axis of the authentication status determination table describes three statuses of user authentication status, a column is user authentication status-unauthenticated, b column is user authentication status-authentication not allowed, and c column is user authentication status-authentication. Indicates permission status. When the user authentication state acquired in step S501 is unauthenticated and the device authentication state is unauthenticated and authentication is impossible, the determination result of the necessary authentication type is device authentication or user, and the user authentication state acquired in step S501 is unauthenticated. When the device authentication status is “authentication permitted”, the required authentication type determination result is user authentication. When the user authentication state acquired in step S501 is authentication not permitted, the device authentication state is unauthenticated, and authentication is not permitted, the required authentication type determination result is device authentication or user authentication, and the user authentication state acquired in step S501 If the authentication is not permitted and the device authentication status is authentication permitted, the determination result of the necessary authentication type is user authentication. When the user authentication state acquired in step S501 is authentication permission, the device authentication state is unauthenticated, authentication is not permitted, and the device authentication state is unauthenticated and authentication is not permitted, the required authentication type determination result is device authentication. The authentication required when the user authentication state acquired in S501 is authentication permission and the device authentication state is authentication permission is device authentication or user authentication.

Step S504:
The determination result of step S503 is notified to the authentication control unit 10b, and a transfer permission / inhibition determination process is executed.
[Authentication Message Transfer Allowability Judgment Processing of Third Embodiment]
FIG. 12 is an authentication message transfer permission / inhibition determination flowchart according to the third embodiment. FIG. 12 differs from FIG. 6 in the structure of the transfer determination table in step 601, but performs the same operation except for the above.

  12 is an authentication message transfer availability determination processing flowchart in the authentication transfer apparatus 4 of the third embodiment. Steps S601 and S602 in FIG. 12 show a specific example of the transfer feasibility determination in step S406 in FIG.

Step S601:
The transfer permission / inhibition determination process in the authentication control unit 10b includes the MS authentication state determination result notified from the MS authentication state determination unit 10e (step S404) and the server address table search result notified from the server address resolution processing unit 10d (step S403). Is applied to the transfer enable / disable determination table to determine the determination result.

  As an example, the vertical axis of the transfer enable / disable determination table describes the determination criteria for four states including the IP address obtained in step S403 and the usage information of the server. The horizontal axis of the transfer permission determination table describes the determination criteria for the three states of the MS authentication state determination result obtained in step S404. The horizontal a column describes determination criteria for Single-EAP authentication, the horizontal b column describes determination criteria for Double-EAP device authentication, and the horizontal c column describes determination criteria for Double-EAP user authentication. The horizontal h column describes determination criteria for Double-EAP device authentication and user authentication. The vertical d column has an IP address and the server usage is a device authentication criterion, the vertical e column has an IP address and the server usage is a user authentication criterion, and the vertical f column has an IP address and a server Is used as a blank determination criterion, and the vertical g column describes a determination criterion for an IP address and a blank server usage.

  When the MS authentication state determination result is Single-EAP authentication a, the authentication request can be transferred to the device authentication server and the user authentication server with d, e, and f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP device authentication b, the authentication request can be transferred to the device authentication server and the user authentication server with d, and e, f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP user authentication c, the authentication request can be transferred to the device authentication server and the user authentication server as e, and d, f, and g cannot be transferred. When the MS authentication state determination result is Double-EAP device authentication and user authentication h, the authentication request can be transferred to the device authentication server and the user authentication server with d and e, and f and g cannot be transferred.

Step S602:
Next, if the obtained determination result is transferable, the AAA client 10c requests transmission to the AAA server. If transfer is impossible, discard or resend processing is executed.

  Since the retained information element of the authentication transfer apparatus of the third embodiment is the same as that of the first embodiment, the description thereof is omitted.

  The above-described embodiments can be appropriately combined as necessary.

Diagram showing the WiMAX network model Double-EAP authentication method sequence Authentication transfer device block diagram Authentication request transfer process flowchart in the embodiment MS authentication state determination processing flowchart in the first embodiment Authentication message transfer permission / inhibition determination flowchart in the first embodiment The figure which shows the holding | maintenance information element of the authentication transfer apparatus in 1st Embodiment MS authentication state determination processing flowchart in the second embodiment Authentication message transfer permission / inhibition determination flowchart in the second embodiment The figure which shows the holding | maintenance information element of the authentication transfer apparatus in 2nd Embodiment MS authentication state determination process flowchart in the third embodiment Authentication message transfer permission / inhibition determination flowchart in the third embodiment

Explanation of symbols

1 subscriber wireless device 2 wireless base station 3 access service network 4 authentication transfer device 5 connectivity service network 6 router 7 device authentication server 8 user authentication server 10 authentication message processing unit 10a WiMAX authentication relay protocol processing unit 10b authentication control unit 10c AAA client 10d Server address analysis processing unit 10e Subscriber wireless device authentication status determination unit 10f Subscriber wireless device information database 10g Server address table 11 System setting information database

Claims (4)

In an authentication transfer device that transfers an authentication request from a subscriber terminal to an authentication server,
A first storage unit for storing authentication status information of the subscriber terminal;
An authentication processing unit that updates the authentication status information according to the authentication process for the subscriber terminal and performs a transfer process of an authentication request from the subscriber terminal based on the authentication status information of the subscriber terminal. An authentication transfer device.   2. The authentication transfer apparatus according to claim 1, wherein the authentication use of the authentication server is stored in the server address table as the authentication status information corresponding to the authentication server, and whether or not the authentication request message of the authentication processing unit can be transferred. An authentication transfer apparatus that performs the authentication use of the server and the authentication status information of the subscriber terminal. The authentication transfer apparatus according to claim 1, wherein an authentication stage of the authentication server is stored in the server address table as the authentication status information corresponding to the authentication server,
An authentication transfer device characterized in that whether or not the authentication request message of the authentication processing unit can be transferred is determined by the authentication stage of the server and the authentication status information of the subscriber terminal. The authentication transfer device according to claim 1, further comprising a second storage unit that stores authentication state information of the authentication server,
The authentication transfer device, wherein the authentication processing unit determines whether or not to transfer an authentication request message from the subscriber terminal based on the authentication status information of the subscriber terminal and the authentication status information of the authentication server.

Images