JP5888749B2 - Network connection authentication method and system - Google Patents

Description

  The present invention relates to an authentication technique for performing terminal connection authentication in cooperation between a fixed network and a mobile network operated by a communication carrier.

  Authentication methods that do not require user operations such as input of a user name and password when connecting to a network operated by a telecommunications carrier are defined in each of the fixed network and the mobile network. Here, the fixed network means a network provided by a communication carrier in order to provide a wired communication service (Internet connection or the like) such as an optical fiber. The mobile network means a network provided by a communication carrier in order to provide a wireless communication service (Internet connection or the like) such as 3G / LTE.

  In the fixed network, a line unit is used between the subscriber premises equipment (HGW: Home GateWay) and the router equipment (also referred to as “edge router”) in the fixed network that accommodates the subscriber premises equipment. Line authentication for performing authentication is defined (see Non-Patent Document 1).

  As a standard authentication procedure in a mobile network, there is EAP-SIM / AKA (Extensible Authentication Protocol-Subscriber Identity Module / Authentication and Key Agreement) (see Non-Patent Documents 2, 3, and 4). FIG. 8 is a system configuration diagram illustrating an authentication method using EAP-SIM / AKA, and FIG. 9 is a sequence chart illustrating authentication processing using EAP-SIM / AKA.

  As shown in FIG. 8, the fixed network 100 includes an edge router 110 that accommodates the subscriber premises equipment 310, an authentication server 120 that performs authentication on a line basis, and authentication, authorization, and accounting (Accounting). AAA server 130 that performs or relays). The mobile network 200 also houses a home subscriber server (HSS) 210 that authenticates the wireless terminal 10 equipped with a SIM card (Subscriber Identity Module) using authentication information in the SIM card. In the subscriber premises 50, the subscriber premises equipment 310 and a wireless access point are connected to construct a wireless LAN (Local Area Network) 300. The access point for constructing the wireless LAN 300 may be installed in the subscriber premises apparatus 310.

  An authentication procedure by EAP-SIM / AKA will be described with reference to FIG. In EAP-SIM / AKA, according to the IEEE 802.1X procedure, as shown in FIG. 9, first, the wireless terminal 10 equipped with a SIM card transmits a connection request to the subscriber premises apparatus 310 (step S1). Next, the subscriber premises apparatus 310 transmits EAP-Request / Identity to the wireless terminal 10 (step S2). Next, the wireless terminal 10 transmits EAP-Response / Identity together with authentication information (IMSI) in the SIM card to the subscriber premises device 310 (step S3). The message is received by the home subscriber server 210 via the AAA server 130. Next, the home subscriber server 210 transmits EAP-Request / AKA-Challenge to the wireless terminal 10 (step S4). Next, the wireless terminal 10 responds EAP-Response / AKA-Challenge to the home subscriber server 210 (step S5). The home subscriber server 210 transmits EAP-Success to the wireless terminal 10 when authentication is successful by the above processing (step S6). The subscriber premises apparatus 310 performs port control of the access point so as to permit the connection of the wireless terminal 10 (step S7). As described above, in EAP-SIM / AKA, mutual authentication between the wireless terminal 10 and the mobile network 200 is realized with the home subscriber server 210 which is an authentication device in the mobile network 200, using authentication information in the SIM card. doing.

"NGN Functional Architecture; Network Attachment Sub-System (NASS)", ETSI ES 282 004, [online], [searched January 15, 2013], Internet <URL: http: //www.etsi.org/deliver /etsi#es/282000#282099/282004/03.04.01#60/> "Extensible Authentication Protocol Method for Global System for Mobile Communications (GSM) Subscriber Identity Modules (EAP-SIM)", RFC4186, [online], [searched on January 15, 2013], Internet <URL: http: // www .ietf.org / rfc / rfc4186.txt> "Extensible Authentication Protocol Method for 3rd Generation Authentication and Key Agreement (EAP-AKA)", RFC4187, [online], [searched January 15, 2013], Internet <URL: http://www.ietf.org/ rfc / rfc4187.txt> "3GPP System Architecture Evolution (SAE); Security aspects of non-3GPP accesses", 3GPP TS 33.402, [online], [searched January 15, 2013], Internet <URL: http://www.3gpp.org /ftp/Specs/html-info/33402.htm>

  By the way, the above-mentioned authentication technology by EAP-SIM / AKA is operated in the case where the wireless LAN 300 and the mobile network 200 are operated by the same communication carrier, or even in cooperation with each other even if different communication carriers. There is no particular problem in such cases. On the other hand, for example, when the wireless LAN 300 is constructed in a private home, that is, when the individual contracts with a communication carrier that operates the fixed network 100, the following problems occur. That is, as shown in FIG. 8, even if a third party other than the individual family (for example, a passerby around the individual house or a resident in an adjacent house), the third party contracts with the mobile network 200. If so, the third-party wireless terminal 10 can also be connected to the fixed network 100 via the wireless LAN 300. In other words, a third party “free rides” the line to the fixed network 100. Such a problem occurs because the SIM authentication (access part to the wireless LAN 300) and the line authentication (between the subscriber home device 310 and the edge router 110) are independent from each other. Therefore, some kind of cooperation is required between the line information and the SIM information.

  The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a method and system capable of appropriate authentication processing to a fixed network using authentication information in a mobile network. is there.

In order to achieve the above object, the present invention provides a fixed network in which a communication carrier provides a wired communication service, a mobile network in which a communication carrier provides a wireless communication service, an access point for constructing a wireless LAN, , The subscriber premises equipment that connects the wireless LAN to the fixed network, the edge router that is placed in the fixed network and accommodates the subscriber premises equipment, and the connection of the subscriber premises equipment placed in the fixed network to the fixed network is authenticated Mobile network authentication information used for authentication processing in the mobile network authentication server in a network comprising a fixed network authentication server that performs authentication and a mobile network authentication server that is disposed in the mobile network and authenticates the connection of a wireless terminal to the mobile network And system for authenticating connection of wireless terminal to access point using mobile network authentication information to access point connected to subscriber premises equipment Access permission information storage means for storing access permission information in association with the line identification information of the line accommodating the subscriber premises equipment and the mobile network authentication information is provided in the fixed network or the mobile network, and the line provided in the fixed network The identification information acquisition means acquires line identification information of a line accommodating the access point when a predetermined authentication process related to a connection request to the access point using the mobile network authentication information is started from the wireless terminal, and the fixed network Alternatively, the availability information acquisition means provided in the mobile network acquires the access availability information from the access availability information storage means based on the line identification information acquired by the line identification information acquisition means, and the authentication provided in the fixed network or mobile network The process control means makes the predetermined authentication process so that the authentication result of the predetermined authentication process follows the access permission information acquired by the permission information acquisition means. Process is continued, and, wherein the processing on behalf of the mobile network authentication server predetermined authentication processing according to a connection request to the access point using the mobile network authentication information from the wireless terminal.

  According to the present invention, when accessing the fixed network via the access point using the authentication information used in the mobile network, the access in the unit of line in which the access point is accommodated is referred to by referring to the access permission information storage means. It is possible to authenticate whether or not it is possible. As a result, free access points can be prevented.

In the present invention, the access permission information storage means, the permission information acquisition means, and the authentication processing control means may be arranged in either the fixed network or the mobile network, and the mounting position / mounting form depends on the embodiment. Is unquestionable. Similarly, the line identification information acquisition means may be arranged in any of a fixed network, an access point, or a subscriber premises apparatus .

  Also, various types of line identification information can be used depending on the embodiment. Examples of the line identification information include subscriber identification information used for authentication processing in a fixed network authentication server, access point identification information, and the like.

  Examples of means for rejecting packet communication from a terminal whose authentication has been rejected include an implementation method using an access point, a subscriber premises apparatus, an edge router, and the like.

  According to the present invention, when accessing a fixed network via an access point using authentication information used in a mobile network, it is possible to authenticate whether or not access is possible in units of lines in which the access point is accommodated. As a result, free access points can be prevented.

FIG. 1 is a network configuration diagram illustrating an overview of a network authentication method according to the present invention. Sequence chart for explaining a network authentication method according to the first embodiment (when authentication is successful) Sequence chart for explaining a network authentication method according to the first embodiment (when authentication fails) Sequence chart for explaining a network authentication method according to the second embodiment (when authentication is successful) Sequence chart for explaining a network authentication method according to the second embodiment (when authentication fails) Sequence chart for explaining a network authentication method according to the third embodiment (when authentication is successful) Sequence chart for explaining a network authentication method according to the third embodiment (when authentication is successful) Network configuration diagram explaining an overview of conventional network authentication methods Sequence chart explaining conventional network authentication method (when authentication is successful)

  An authentication method and system according to an embodiment of the present invention will be described with reference to the drawings. FIG. 1 is a network configuration diagram for explaining the outline of the present invention. In addition, the same code | symbol is attached | subjected about the element same as the prior art demonstrated with reference to FIG.8 and FIG.9.

  As shown in FIG. 1, the fixed network 100 includes an edge router 110 that accommodates a subscriber premises apparatus 310, an authentication server 120 that performs authentication in units of lines, and authentication, authorization, and accounting (Accounting). ) Or an AAA server 130 that relays a message related thereto. The mobile network 200 also houses a home subscriber server (HSS) 210 that authenticates the wireless terminal 10 equipped with a SIM card (Subscriber Identity Module) using authentication information in the SIM card. The subscriber premises apparatus 310 includes an access point, and a wireless LAN (Local Area Network) 300 is constructed in the subscriber premises 50 by the access point. Note that the access point and the subscriber premises apparatus may be implemented as separate apparatuses.

  In the present invention, identification information (hereinafter referred to as “line identification information”) for identifying the line in which the subscriber premises apparatus 310 is accommodated, in other words, the access point is accommodated, and authentication information ( (Hereinafter referred to as “mobile network authentication information”), and a database (hereinafter referred to as “accessibility DB”) 400 that holds information (hereinafter referred to as “accessibility information”) for determining whether or not the wireless terminal 10 can be connected is introduced. To do. The accessibility DB 400 is installed in either the mobile network 200 or the fixed network 100, but may be integrated with an existing network device or DB.

  As the line identification information, for example, a subscriber identification ID for identifying a subscriber (contractor) of a line that accommodates the subscriber premises equipment 310, which is used for the authentication processing in the authentication server 120, or the subscriber premises Examples include a line ID for identifying the line itself that accommodates the device 310, an AP identifier for identifying an access point of the wireless LAN 300, and the like. Also, as mobile network authentication information, for example, IMSI (International Mobile Subscriber Identity) stored in a SIM card can be cited.

  In the present invention, when a wireless terminal 10 equipped with a SIM card or the like starts a connection procedure to an access point of a home wireless LAN 300 accommodated in the fixed network 100, as defined by EAP-SIM / AKA or the like, the mobile network 200 The authentication processing procedure is started.

  At this time, any device in the fixed network 100 or the subscriber premises device 310 or the access point that has received the EAP-SIM / AKA authentication message acquires the line identification information by some means. The method for acquiring the line identification information differs depending on the type of line identification information. For example, the authentication server 120 may be inquired using an identifier for identifying the edge router 110 and information for specifying a line such as a VLAN port number.

  In the present invention, the access permission information is inquired of the access permission DB 400 using the acquired line identification information and mobile network authentication information in a mobile network such as IMSI included in the authentication message as keys. The entity that makes an inquiry about the accessibility information may be the device that acquired the line identification information, or may be another device in the fixed network 100 or the mobile network 200.

  Next, in the present invention, the authentication processing procedure of the mobile network 200 is controlled so that the result of the authentication processing of the wireless terminal 10 matches the access permission information. That is, if the access permission / prohibition information is access permission, the conventional EAP-SIM / AKA procedure is continued on the assumption that the authentication process is successful. On the other hand, if the access permission / prohibition information is access denial, the conventional EAP-SIM / AKA procedure is continued assuming that the authentication process has failed. Here, the entity that controls the authentication processing procedure may be a device that has made an inquiry about the accessibility information, or may be another device in the fixed network 100 or the mobile network 200. In a typical example, this is performed by the home subscriber server 210 that performs authentication processing of the mobile network 200. When a device other than the home subscriber server 210 controls the authentication processing procedure, the device processes all or part of the authentication processing procedure (for example, processing at the time of authentication failure) on behalf of the home subscriber server 210. You may do it. In the present invention, the access point of the wireless LAN 300 permits or rejects the connection of the wireless terminal 10 based on the authentication result.

  A case where access permission information is managed by the mobile network 200 will be described with reference to FIGS. FIG. 2 is an example in which the connection is permitted after successful authentication, and FIG. 3 is an example in which the connection is rejected due to the authentication failure. In this embodiment, the accessibility DB 400 is integrated with the home subscriber server 210 of the mobile network 200. In this embodiment, a subscriber identification ID is used as the line identification information.

  As shown in FIGS. 2 and 3, the subscriber premises apparatus 310 sends an EAP-Request / Identity message to the wireless terminal 10 that has made the connection request (steps S101 and S151) (steps S102 and S152). . Receiving this, the wireless terminal 10 sends the mobile network authentication information, such as IMSI, stored in the SIM card of the wireless terminal 10 to the subscriber premises device 310 in the EAP-Response / Identity message. Send it including. The subscriber premises apparatus 310 transfers this to the edge router 110 (steps S103 and S153).

  In the fixed network 100, subscriber identification can be performed by using, for example, the VLAN port number of the edge router 110 to which the subscriber premises device 310 is connected as a key. In this embodiment, the edge router 110 makes an inquiry to the authentication server 120 installed in the fixed network 100 by using the information of its own edge router 110 and the VLAN port number as a key, so that the fixed line subscriber as the line identification information is obtained. Are obtained (steps S104, S105, S154, S155).

  The edge router 110 adds this subscriber identification ID to the EAP-Response / Identity message sent from the wireless terminal 10 (steps S106 and S156) and sends it to the home subscriber server 210 inside the mobile network 200 (step S107). , S157).

  The home subscriber server 210 of the mobile network 200 can acquire the mobile network authentication information of the connection source terminal 10 and the line identification information of the connection source fixed line from the EAP-Response / Identity message. As described above, the home subscriber server 210 holds the access permission DB 400. The IMSI that is the mobile network authentication information of the mobile network 200, the subscriber identification ID that is the line identification information of the fixed network 100, and the access permission DB 400 are stored. By matching, it is possible to determine whether or not the authentication requesting terminal 10 can be connected on this fixed line (steps S108 and S158).

  If the connection is possible, the EAP-SIM / AKA authentication procedure in the conventional mobile network 200 is continued as shown in FIG. 2 (steps S109 to S112). If the connection is impossible, the authentication procedure is interrupted at that point as shown in FIG. Specifically, the home subscriber server 210 transmits a message indicating an authentication failure in EAP-SIM / AKA to the terminal 10 (steps S159 to S162).

  A case where access permission information is managed by the fixed network 100 will be described with reference to FIGS. FIG. 4 is an example in which the connection is permitted after successful authentication, and FIG. 5 is an example in which the connection is rejected due to the authentication failure. In this embodiment, the accessibility DB 400 is integrated with an authentication server 120 that performs line authentication of the fixed network 100. In this embodiment, a line ID is used as line identification information.

  When the edge router 110 receives the EAP-Response / Identity message including the IMSI from the subscriber premises apparatus 310 (steps S201 to S203, S251 to 253) as shown in FIGS. Along with the IMSI, the VLAN number information of the edge router 110 to which the subscriber premises equipment 310 is connected is added to the message and transmitted to the authentication server 120 in the fixed network 100 (steps S204 and S254). As in the first embodiment, the authentication server 120 resolves the line ID that is the line identification information from the VLAN number information, and further matches the combination of the resolved line ID and the IMSI that is the mobile network authentication information with the access permission DB 400. Thus, it is determined whether or not the authentication requesting terminal 10 can be connected to the fixed line (steps S205 and S255), and the determination result is transmitted to the edge router 110 (steps S206 and S256).

  Then, as in the first embodiment, as shown in FIG. 4, the EAP-SIM / AKA authentication procedure is continued if connection is possible (steps S207 to S211). When the connection is impossible, as shown in FIG. 5, the edge router 110 transmits a message indicating an authentication failure in EAP-SIM / AKA to the terminal 10 (steps S257 to SS60).

  An example in which an access point identifier is used as a line identification method of the fixed network 100 will be described with reference to FIGS. FIG. 6 is an example in the case where the access permission DB 400 exists in the mobile network 200 as in the first embodiment, and FIG. 7 is an example in the case where the access permission DB 400 exists in the fixed network 100 as in the second embodiment. 7 and 8 are examples in which authentication is successful and connection is permitted. Here, it is assumed that the access point is installed in the subscriber premises apparatus 310.

  As shown in FIGS. 7 and 8, the subscriber premises apparatus 310 that is an access point that has received the EAP-Response / Identity message from the wireless terminal 10 adds the identifier of its own access point to the message (steps S301 to S301). S304, S351 to 3544).

  If the access permission DB 400 is present in the mobile network 200, the home subscriber server 210 collides, for example, in the same manner as in the first embodiment, and determines whether connection is possible (step S306). On the other hand, when the access permission DB 400 exists in the mobile network 200, the authentication server 120 in the fixed network 100 determines whether or not connection is possible, for example, as in the second embodiment (step S357). The subsequent processes are also the same as those in the first and second embodiments (steps S307 to S310, S358 to S363).

  DESCRIPTION OF SYMBOLS 10 ... Wireless terminal, 100 ... Fixed network, 110 ... Edge router, 120 ... Authentication server, 130 ... AAA server, 200 ... Mobile network, 210 ... Home subscriber server, 300 ... Wireless LAN, 310 ... Subscriber premises equipment

Claims (5)

A fixed network in which a telecommunications carrier provides a wired communication service, a mobile network in which a telecommunications carrier provides a wireless communication service, an access point for constructing a wireless LAN, and a subscriber premises that connects the wireless LAN to the fixed network A device, an edge router that is placed in a fixed network and accommodates a subscriber premises device, a fixed network authentication server that is placed in the fixed network and authenticates the connection of the subscriber premises device to the fixed network, and is placed in the mobile network In a network provided with a mobile network authentication server that authenticates the connection of the wireless terminal to the mobile network, the connection to the access point of the wireless terminal having mobile network authentication information used for authentication processing in the mobile network authentication server is authenticated. A way to
Access information indicating whether or not access using mobile network authentication information to an access point connected to the subscriber premises equipment is stored in association with the line identification information of the line accommodating the subscriber premises equipment and the mobile network authentication information Providing availability information storage means in the fixed network or mobile network,
When the line identification information acquisition means provided in the fixed network, the access point, or the subscriber premises device starts a predetermined authentication process related to a connection request from the wireless terminal to the access point using the mobile network authentication information, the access point The line identification information of the line that contains the
Accessibility information acquisition means provided in the fixed network or mobile network acquires access permission information from the access permission information storage means based on the line identification information acquired by the line identification information acquisition means,
An authentication process control means provided in a fixed network or a mobile network continues the predetermined authentication process so that an authentication result of the predetermined authentication process follows the accessibility information acquired by the availability information acquisition means; and A network connection authentication method characterized in that a predetermined authentication process related to a connection request to an access point using mobile network authentication information from a wireless terminal is processed on behalf of a mobile network authentication server . Connection authentication method according to claim 1 Symbol placement network is characterized by using a subscriber identification information used for authentication processing in the fixed network authentication server as the line identification information. Using fixed network authentication server, the connection authentication method according to claim 2, wherein the network from the identification information of the virtual LAN, characterized in that the solution to the subscriber identification information assigned to the network comprising the edge routers subscriber premises device . Connection authentication method according to claim 1 Symbol placement network, characterized by using the identification information of the access point as the line identification information. A fixed network in which a telecommunications carrier provides a wired communication service, a mobile network in which a telecommunications carrier provides a wireless communication service, an access point for constructing a wireless LAN, and a subscriber premises that connects the wireless LAN to the fixed network A device, an edge router that is placed in a fixed network and accommodates a subscriber premises device, a fixed network authentication server that is placed in the fixed network and authenticates the connection of the subscriber premises device to the fixed network, and is placed in the mobile network In a network provided with a mobile network authentication server that authenticates the connection of the wireless terminal to the mobile network, the connection to the access point of the wireless terminal having mobile network authentication information used for authentication processing in the mobile network authentication server is authenticated. A system that
Access permission information using mobile network authentication information for an access point provided in a fixed network or a mobile network and connected to the subscriber premises equipment, the line identification information of the line accommodating the subscriber premises equipment, and the mobile Access permission information storage means stored in association with network authentication information;
When a predetermined authentication process related to a connection request from a wireless terminal to an access point using mobile network authentication information is started in a fixed network, an access point, or a subscriber premises device, the line in which the access point is accommodated Line identification information acquisition means for acquiring line identification information;
Availability information acquisition means provided in a fixed network or a mobile network, for acquiring access permission information from the access permission information storage means based on the line identification information acquired by the line identification information acquisition means;
Provided in a fixed network or a mobile network, and continues the predetermined authentication process so that the authentication result of the predetermined authentication process follows the access permission information acquired by the permission information acquisition means , and the mobile terminal authenticates the mobile network. A network connection authentication system comprising: authentication processing control means for processing a predetermined authentication process related to a connection request to an access point using information on behalf of a mobile network authentication server .

Images