KR100687721B1 - How to extend the Diameter AA protocol that supports Mobile iPad 6 - Google Patents

Abstract

The present invention relates to a method for extending a diameter AAA protocol supporting mobile IPv6. In a method for extending a diameter AAA protocol between a mobile node and a home agent in a mobile IPv6 environment interworking with an AAA infrastructure, (a) the The mobile node sending a network access request message (AAA Request) to a local AAA client; (b) converting, by the local AAA client, the network access request message to an AAA server by including it in a diameter authentication request message (ARR); (c) the AAA server receiving the diameter authentication request message to authenticate the mobile node, and when authentication is performed, sending a MIPv6 registration request message (HOR) to a home agent for mobile IPv6 processing; (d) the home agent sending a MIPv6 registration response message for the MIPv6 registration request message to the AAA server; (e) the AAA server including the authentication result for the mobile node in a network access response message (ARA) and transmitting it to the local AAA client; And (f) the local AAA client including the authentication result for the mobile node in a network access response message (AAA Response) to the mobile node. Thus, by providing mobility support, mobile IPv6 services can provide flexibility that can be used more widely in commercial networks.

Description

Method for extending of diameter AAA protocol supporting mobile IPv6}

1 is a flowchart illustrating a conventional binding calculation method of mobile IPv6.

2 is an information flow diagram of a basic diameter AAA model according to an embodiment of the present invention.

3 is an information flow diagram of an extended diameter AAA model according to another embodiment of the present invention.

4 is a flow chart of a method for handling handoff in the same diameter AAA client in FIGS. 2 and 3.

FIG. 5 is a flow chart of a method for handling re-authentication by diameter AAA in FIGS. 2 and 3.

FIG. 6 is a flow chart of a method for handling handoff between different diameter AAA clients in FIGS. 2 and 3.

7 is a flowchart of a method of processing another visited manganese handoff in FIGS. 2 and 3.

The present invention relates to an extension method of the diameter AAA protocol supporting mobile IPv6. More specifically, the authentication, authorization and billing functions are provided so that the mobile node equipped with the mobile IPv6 protocol can continuously receive the Internet service in the visited network. And an extension method of a diameter protocol that provides mobility support for a mobile node.

1 is a flowchart illustrating a conventional binding calculation method of mobile IPv6.

Referring to FIG. 1, a mobile node 100 shows a binding method of registering a current address (Care-of Address (CoA)) with a home agent 110 in order to ensure mobility.

In order to guarantee mobility by using mobile IPv6 on the Internet, the mobile node 100 registers a current address (CoA) with its home agent 110 whenever an access point to the Internet, that is, an IP address, is changed. Should be.

Mobile IPv6 requires the use of the IPSec Encapsulating Security Payload (ESP) to secure this registration process.

Such an IPSec Security Association (IPSec Security Association) is managed by the mobile node 100 and the home agent 110, which are users, respectively, and the home address of the node transmitting the message and the address of the node receiving the message. And IPSec SA used according to the type of message to be transmitted are uniquely defined.

Therefore, the mobile IPv6 protocol requires that the mobile node 100 already have a home address, and also knows the address of the home agent 110 to register. The IPSec SA between the mobile node 100 and the home agent 110 may be fixed in advance or may be dynamically generated using a key exchange protocol such as IKEv1 (Internet Key Exchange version 1).

However, there is no official Diameter Extension protocol standard for supporting mobile IPv6. Since the mobile IPv4 and the mobile IPv6 have different protocol constituent nodes and protocol processing procedures, the conventional diameter application for mobile IPv4 cannot be directly applied to mobile IPv6. Therefore, supporting mobile IPv6 requires a detailed specification of a more detailed and systematic diameter protocol for mobile IPv6.

The technical problem to be achieved in the present invention is to provide a method for extending the diameter to support mobile IPv6. As such, the home address of the mobile node in addition to authentication, authorization verification, and billing service for the mobile node for mobile IPv6 service in a network structure that performs access authentication to the Internet using the AAA server through the proposed diameter extension method. It provides more secure and efficient network service by setting up, assigning home agent, security association, and providing seamless handoff function.

The method of extending the diameter AAA protocol supporting mobile IPv6 of the present invention for solving the above technical problem is a method for extending the diameter AAA protocol between a mobile node and a home agent in a mobile IPv6 environment interworking with the AAA infrastructure. (A) the mobile node sending a network access request message (AAA Request) to a local AAA client; (b) converting, by the local AAA client, the network access request message to an AAA server by including it in a diameter authentication request message (ARR); (c) the AAA server receiving the diameter authentication request message to authenticate the mobile node, and when authentication is performed, sending a MIPv6 registration request message (HOR) to a home agent for mobile IPv6 processing; (d) the home agent sending a MIPv6 registration response message for the MIPv6 registration request message to the AAA server; (e) the AAA server including the authentication result for the mobile node in a network access response message (ARA) and transmitting it to the local AAA client; And (f) the local AAA client including the authentication result for the mobile node in a network access response message (AAA Response) to the mobile node.

In addition, the method for establishing a security association between the mobile node and the home agent of the present invention for solving the technical problem, in a method for establishing a security association between the mobile node and the home agent in a mobile IPv6 environment interworking with the AAA infrastructure, ( a) generating, by the mobile node, a secret key request signal in a network access request message (AAA Request) to a local AAA client; (b) the local AAA client including the secret key request signal in a diameter authentication request message (AA-Registration-Request) and transmitting it to a home AAA server via a local AAA server; (c) the home AAA server, when receiving the secret key request signal, generating a security association configuration signal to be used at each of the mobile node and the home agent; And (d) the home AAA server distributing each security association configuration signal generated in step (c) to the mobile node and the home agent, respectively.

In addition, the feature-data processing method requested by the mobile node of the present invention for solving the technical problem, when the home agent is included in the home AAA server that is a home network in a mobile IPv6 environment interworking with the AAA infrastructure, the request from the mobile node A method for processing feature-data, the method comprising: (a) the mobile node requesting information on the mobile node's home address, home agent address, and home agent host in a network access request message (AAA Request); Transmitting to the local AAA client, including (Feature-Data); (b) the local AAA client including the feature-data in a Diameter Authentication Request message (ARR) and sending it to a home AAA server via a local AAA server; (c) the home AAA server allocating the home agent through the feature-data received in step (b); (d) The home AAA server may include home address information (MIPv6-Mobile-Node-Address AVP) of the mobile node, the home agent address information (MIPv6-Home-Agent-Address AVP), and the home agent host information (MIPv6-). Setting a Home-Agent-Host AVP); And (e) transmitting, by the home AAA server, to the mobile node with respect to each piece of information set in step (d).

In addition, the feature-data processing method requested by the mobile node of the present invention for solving the above technical problem, when the home agent is included in the local AAA server that is a visited network in a mobile IPv6 environment interworking with the AAA infrastructure, the request from the mobile node A method for processing feature-data, the method comprising: (a) the mobile node requesting information on the mobile node's home address, home agent address, and home agent host in a network access request message (AAA Request); Transmitting to the local AAA client, including (Feature-Data); (b) the local AAA client including the feature-data in a Diameter Authentication Request message (ARR) and sending it to a local AAA server; (c) the local AAA server allocating the home agent through the feature-data received in step (b); (d) The local AAA server may include home address information (MIPv6-Mobile-Node-Address AVP) of the mobile node, the home agent address information (MIPv6-Home-Agent-Address AVP), and the home agent host information (MIPv6-). Setting a Home-Agent-Host AVP); And (e) transmitting, by the local AAA server, to the mobile node for each piece of information set in step (d).

In addition, the binding update method of the mobile node of the present invention for solving the above technical problem, in the mobile IPv6 environment interworking with the AAA infrastructure binding update when the mobile node is handed off from the first access router to the second access router 12. A method, comprising: (a) the second access router sending Router Advertisements to the mobile node; (b) the mobile node receiving the router advertisement transmitting binding update information to the second access router; (c) the second access router receiving the binding update information, determining whether the binding update information corresponds to filtering information stored in advance by the second access router; And (d) when it is determined in step (c) that the binding update information corresponds to the filling information, the second access router transmitting the binding update information to a home agent. To have.

The present invention relates to mobile IPv6 node authentication, authorization verification, billing function and mobility function for efficient mobile IPv6 service provision using a diameter protocol, and a handoff technique according to the movement of a mobile node.

First, the present invention classifies the AAA model for supporting the mobile IPv6 service, and looks at the signal flow in each model.

Here, AAA models for mobile nodes using a mobile IPv6 service can be classified into two types, one using a home agent of a home network and one using a home agent of a visited network. Each case will be described in more detail with reference to FIGS. 2 and 3.

In addition, a method of providing a smooth handoff function for handoff of a mobile node will be described in more detail with reference to FIGS. 4 to 7.

1. Basic AAA model with home agent in home network

Each mobile node is a mobile IPv6 node and receives Diameter AAA service for internet access.

The Diameter AAA service consists of a local AAA client of a visiting network, a local AAA server, a home AAA server of a home network, a home agent of a home network or a visiting network.

The connection request by the mobile node is sent to the local AAA client, which sends the received request to the local AAA server. The local AAA server sends the received connection request to the home AAA server. The mobile node's information authenticated and authorized by the home AAA server is transmitted to the home agent. When processing by the home agent is completed, the connection response is sent to the mobile node through the home AAA server, the local AAA server, and the local AAA client. do.

The constituent nodes of the present invention provide a key for ensuring that the mobile node authenticates access on the Internet and then mobility using mobile IPv6, and provides a secure network service using a key distributed between related nodes. The authentication protocol uses the Diameter protocol, which supports various authentication methods as an authentication method, and especially supports the EAP protocol.

2 shows an information flow in a basic model for providing AAA services for mobile IPv6.

Referring to FIG. 2, the mobile node 200 located in the visited network transmits a network access request message (AAA-Request) to the local AAA client 210 of the visited network (S200).

Next, the local AAA client 210 receiving the network access request message (AAA-Request) transmits a diameter authentication request message (AA-Registration-Request (ARR)) to the local AAA server (AAAL) 220 ( S210).

Next, the local AAA server 220 transmits a diameter authentication request message (ARR) to the home AAA server (AAAH) 230 of the mobile node 200 home network (S220). Here, the home AAA server 230 performs AAA authentication processing for the diameter authentication request message (ARR).

Next, when the AAA authentication process by the home AAA server 230 ends, the home AAA server 230 sends a MIPv6 registration request message to the home agent 240 for mobile IPv6 processing by the home agent (HA) 240. (Home-Agent-MIPv6-Request; HOR) is transmitted (S230). Here, the home agent 240 processes the MIPv6 registration request message (HOR).

Next, the home agent 240 processing the MIPv6 registration request message (HOR) transmits a MIPv6 registration response message (Home-Agent-MIPv6-Answer (HOA)) to the home AAA server 230 (S240).

Next, the home AAA server 230 transmits the authentication result and the authorization verification information to the local AAA server 220 through the diameter authentication response message (AA-Registration-Answer; ARA) (S250).

Next, the local AAA server 220 transmits the authentication result and authorization verification information to the local AAA client 210 through a diameter authentication response message (AA-Registration-Answer; ARA) (S260).

Next, the local AAA client 210 transmits a network access response message (AAA-Response) to the mobile node 200 (S270).

The present invention allows the diameter to support the bootstrapping function of mobile IPv6.

That is, when the mobile node 200 powers up and needs information about the mobile node 200 home address and the home agent 240, the feature-data is set to the home. Ask the AAA server 230.

In addition, when SA (security association) information (mobile IPv6 required information) between the mobile node 200 and the home agent 240 and SA information between the mobile node 200 and the local AAA client 210 are required, the mobile node ( 200 requests the home AAA server 230 to establish a corresponding SA by using a secret key request signal.

The information is converted into MIPv6-Feature-Vector AVP and MIPv6-Secret-Key-Request AVP by the local AAA client 210 and included in the Diameter Authentication Request Message (ARR) message and sent to the home AAA server 230. do.

Each AVP contains request data (Feature-Data) and secret key request message (Secret-Key-Request) from the mobile node 200.

In the present invention, the ICMPv6 message shown in Table 1 is defined to accommodate such a request of the mobile node 200.

In addition, the value of the request data (Feature-Data) and the value of the secret key request message (Secret-Key-Request) is defined as shown in Table 2.

When the authentication is successful, the home AAA server 230 checks two AVPs and generates corresponding mobility information.

The home address of the generated mobile node 200 is MIPv6-Mobile-Node-Address AVP, and the assigned home agent 240 information is set in MIPv6-Home-Agent-Address AVP and MIPv6-Home-Agent-Host AVP.

The SA (Security Association) information, i.e., IPSec Security Association (IPSec) information, between the mobile node 200 and the home agent 240 is MIPv6-MN-HA-Key AVP, MIPv6-HA-MN- as the mobile node 200. Key AVP, MIPv6-MN-HA-Key-Material AVP is set and delivered through the Diameter Authentication Response message (ARA), and as the home agent 240, MIPv6-MN-HA-Key AVP, MIPv6-HA-MN- Key AVP, MIPv6-HA-MN-Session-Key AVP is delivered through MIPv6 registration request message (HOR).

The MIPv6-MN-HA-Key AVP and the MIPv6-HA-MN-Key AVP respectively include the IPSec SA parameters excluding the keys from the mobile node 200 to the home agent 240 and the mobile node 200 at the home agent 240. IPSec SA parameters are included. Such information is converted into a network connection response message (AAA-Response) by the local AAA client 210 and transmitted to the mobile node 200. When the mobile node 200 knows both the home address and the home agent information, the authentication delay time is minimized by piggybacking and processing the Binding Update (BU) / Binding Acknowledgement (BA) message to the diameter authentication message. do.

IPSec SA parameters excluding keys are defined in Table 1 above, and MIPv6-HA-MN-Key AVP and MIPv6-MN-HA-Key AVP in a group format including this information are defined in Table 3.

2. Visit Extended AAA model with home agent in the network

3 is an information flow diagram of an extended diameter AAA model according to another embodiment of the present invention.

In the extended model, the home agent is located in the visited network, not the home network. In this case, the connection authentication request from the mobile node is transmitted to the local AAA client, and is processed in the flow of the visited network AAA server, home network AAA server, visited network AAA server, and visited home agent.

Referring to FIG. 3, first, the mobile node 300 located in the visited network transmits a network access request message (AAA-Request) to the local AAA client 310 of the visited network (S300).

Next, the local AAA client 310 receiving the network access request message (AAA-Request) transmits a diameter authentication request message (AA-Registration-Request (ARR)) to the local AAA server (AAAL) 320 ( S310).

Next, the local AAA server 320 transmits a diameter authentication request message (ARR) to the home AAA server (AAAH) 330 of the home network of the mobile node 300 (S320). Here, the home AAA server 330 performs AAA authentication processing for the diameter authentication request message (ARR).

Next, when the AAA authentication process by the home AAA server 330 ends, the home AAA server 330 requests MIPv6 registration to the local AAA server 320 for mobile IPv6 processing by the home agent (HA) 340. A message (Home-Agent-MIPv6-Request; HOR) is transmitted (S330).

Next, the local AAA server 320 transmits a MIPv6 registration request message (HOR) to the home agent 340 (S340). Here, the home agent 340 processes the MIPv6 registration request message (HOR).

Next, the home agent 340 processing the MIPv6 registration request message (HOR) transmits a MIPv6 registration response message (Home-Agent-MIPv6-Answer (HOA)) to the local AAA server 320 (S350).

Next, the local AAA server 320 transmits a MIPv6 registration response message (HOA) to the home AAA server 330 (S360).

Next, the home AAA server 330 transmits the authentication result and authorization verification information to the local AAA server 320 through a diameter authentication response message (AA-Registration-Answer; ARA) (S370).

Next, the local AAA server 320 transmits the authentication result and authorization verification information to the local AAA client 310 through a diameter authentication response message (AA-Registration-Answer; ARA) (S380).

Next, the local AAA client 310 transmits a network access response message (AAA-Response) to the mobile node 300 (S390).

The authentication process for the mobile node 300 is the same as the case where the home agent is located in the home network as shown in FIG.

However, when the home agent 340 of the mobile node 300 is dynamically allocated to the visited network, when the local AAA server 320 receives the diameter authentication request message (ARR), the feature of the mobile node 300 -Check the (feature-data) and assigns the home agent 340 to manage if it can be assigned in the visited network. In this case, the home address of the mobile node 300 is also assigned together.

The assigned home address is set in the MIPv6-Mobile-Node-Address AVP, the assigned home agent information in the MIP-Candidate-Home-Agent-Host AVP, and the MIPv6-Home-Agent-Address AVP.

In addition, the local AAA server 320 to which the home agent 340 is allocated transmits a diameter authentication request message (ARR) that sets its information to MIP-Originating-Foreign-AAA AVP to the home AAA server 330. . At this time, the request data is updated to indicate that the home agent 340 is assignable in the visited network.

The home AAA server 330 receiving the Diameter Authentication Request message (ARR) is a policy capable of assigning the home agent 340 to the visited network according to the policy. The local AAA server 320 included in the MIP-Originating-Foreign-AAA AVP for the MIPv6 registration request message (HOR) having information of 340 set to MIPv6-Home-Agent-Address AVP and MIPv6-Home-Agent-Host AVP. Through the home agent 340 of the visited network through the transmission. The MIPv6 registration response message (HOA) is also sent to the home AAA server 330 via the local AAA server 320.

3. Move Interface Between Nodes and Local AAA Clients

In the present invention, the ICMPv6 is used for communication between the mobile node 200 and the local AAA client 210, and the home agent-to-agent communication in the local AAA client 210 uses a diameter protocol.

An authentication request message (AAA-Request) and an authentication response message (AAA-Response) between the mobile node 200 and the local AAA client 210 are defined as shown in Table 4. In addition, the ICMPv6 Error message is further defined to disallow binding operations from unauthorized mobile nodes.

Here, each component has been described with reference to FIG. 2, but is also applicable to FIG. 3.

4. Diameter How to Set Up Security Association (SA) for the Protocol

In addition to authentication and authorization for network access requests, the Diameter Protocol must establish a security association (SA) for the nodes that are required for the request. The diameter as a trusted-third party provides two security associations (SAs) at the request of the mobile node.

One is a security association (SA) between the mobile node 200 and the local AAA client 210, and the other is a security association (SA) between the mobile node 200 and the home agent 240. Both security associations (SAs) are created when the mobile node 200 requests (MIPv6-Security-Key-Request AVP).

More specifically, the following two cases will be described.

(1) SA (security association) between mobile node 200 and local AAA client 210

After the authentication process is completed, the home AAA server 230 generates an SA to be used between the two nodes. The components of the SA are keys and other additional information, and the content of the additional information varies depending on the link layer (PPP, Wireless, etc.) between the mobile node 200 and the local AAA client 210.

The mobile node 200 uses an AAA-key (AAA key), a preset hash algorithm, and a key material generated and delivered by the home AAA server 230 between the home AAA server 230 and the mobile node 200. To generate a key.

Here, the key material may use a random number, or, if using EAP, may use a Master Secret Key generated during the authentication process.

The generated key is transmitted to the local AAA client 210 through the AAA message, and the key material is transmitted to the mobile node 200 since the interval between the mobile node 200 and the local AAA client 210 is not secure.

(2) SA between mobile node and home agent (IPSec SA)

Dynamic key exchange protocols such as IKEv1, as specified by Mobile IPv6, can also be used, but must be done after the authentication process is completed, resulting in multiple round-trips. Accordingly, in the present invention, the home AAA server 230 sets up the corresponding IPSec SA and transmits it to the mobile node 200 and the home agent 240.

The home AAA server 230 sets all the necessary information at the request of the mobile node 200 at the time of completing the authentication.

When the mobile node 200 requests, the IPSec SA is set based on the home address of the mobile node 200 and the home agent 240 that have been determined. Since the IPSec SA is basically one-way, the home AAA server 230 allows the mobile node 200 to generate a pair of IPSec SAs for the home agent 240 and the home agent 240 for the mobile node 200.

Distribution to the home agent 240 is transmitted to the MIPv6 registration request message (HOR) message, including the corresponding key information, SPI, key (Key) information, the mobile node 200, the diameter authentication response message (ARA) Pass the key information, SPI, and key material to the message. At this time, the identification of each SA is managed by the address of the mobile node and the address of the home agent.

The security key generation and delivery method is the same as the mobile node 200 and local AAA client 210 SA key generation and delivery method.

Here, each component has been described with reference to FIG. 2, but is also applicable to FIG. 3.

5. Move Handoff Processing Procedure of Node

According to the present invention, when the mobile node 200 hands off, the interworking scenario between the mobile IPv6 and the diameter protocol is classified into first, first AAA client areas, second, between different AAA clients, and third, different domains. Shall be.

Each mobile node 200 receives the AAA service using the diameter protocol at the first booting and simultaneously acquires the mobile node 200's home address, home agent information and necessary security related information required for the operation of the mobile IPv6 protocol. do. Each mobile node 200 performs a reauthentication procedure using information obtained for initial authentication during reauthentication and handoff.

In order to minimize service delay for the mobile node, after the mobile node obtains the home address, home agent information, and necessary security association information, it piggybacks the Binding Update / Binding Acknowledgement on the Diameter AAA message during authentication with the diameter. By piggybacking, it is possible to provide a smooth network service for the mobile node 200 in a mobile usage environment.

The information about the mobile node 200, which has been successfully authenticated once, is transmitted to all access routers managed by the same local AAA client 210, and each access router AR subsequently uses the received information. Filtering is performed on all packets received from the mobile node 200.

Accordingly, packet processing for a mobile terminal that has moved to another access router (AR) in the same local AAA client 210 may perform a binding operation on a care-of address of the changed mobile node without separate AAA processing. Only deal with it.

In each interworking scenario, one local AAA client 210 manages a plurality of access routers (ARs). In addition, the communication between the mobile node 200 and the neighboring access router (AR) uses ICMPv6 messages.

Here, each component has been described with reference to FIG. 2, but is also applicable to FIG. 3.

4 is a flowchart of a method for processing handoff in the same AAA client area in FIGS. 2 and 3.

Referring to FIG. 4, first, a mobile node 400 powering up in a visited network includes a local AAA client 420, a local AAA server 430, a home AAA server 440, and a home agent ( The first authentication process is performed using the AAA infrastructure.

Upon successful authentication, the local AAA client 420, which has received the authentication result and authorization verification information from the home AAA server 440 via a diameter authentication response message (ARA), has all the accesses that manage the filtering information. Send to router (AR) 410.

If the mobile node 400 moves to another access router area within the same local AAA client 420 area, that is, from the first access router 411 to the area corresponding to the second access router 412, The mobile node 400 is set to a new Care-of Address (CoA) and generates a Binding Update (BU).

Here, the generated BU is transmitted to the neighboring second access router 412. The corresponding second access router 412 performs the mobile IPv6 registration procedure by routing the BU directly to the home agent 450 without passing through the AAA infrastructure by the filtering information.

FIG. 5 is a flow chart of a method for handling re-authentication by diameter AAA in FIGS. 2 and 3.

Referring to FIG. 5, there is shown a flow of handoff processing by AAA when handoff between different AAA clients. The mobile node 500, which is powered up in the visited network, performs an authentication procedure using the AAA infrastructure.

If the authentication is successfully processed, the first local AAA client 520, which receives the authentication result through the ARA, forwards the filtering information to all the first access routers 510 managing it.

When the mobile node 500 moves to another AAA client area, that is, when the mobile node 500 moves from the first local AAA client 520 to the second AAA client 530, the mobile node 500 is connected to a nearby second access router ( In step 540, the router advertisement information is received from the router.

Next, the mobile node 500 changes the CoA (current address) through the information of the Router Advertisement, generates a BU (binding update), and transmits it to the neighboring second access router 540 (S510).

Next, the second access router 540 receiving the BU processes the received BU according to a filtering rule, and receives a Destination Unreachable Error (Type = 1, Code = TBD; AAA-Request requested) message among the ICMPv6 Error Messages. Generate and transmit it to the mobile node 500 (S520).

Next, the mobile node 500 receiving the Destination Unreachable Error (Type = 1, Code = TBD; AAA-Request requested) message generates an AAA-Request and performs authentication again through the AAA infrastructure (S530).

In this case, the mobile node 500 uses the home address, home agent information, and IPSec SA information of the mobile node 500 acquired according to the first authentication as it is, and generates a BU for the newly set CoA in the authentication request message. Include it. The BU is then piggybacked in the AAA authentication request message, and in the BA processed by the home agent, also in the AAA authentication response message.

FIG. 6 is a flow chart of a method for handling handoff between different diameter AAA clients in FIGS. 2 and 3.

Referring to FIG. 6, first, a mobile node 600 powered up in a visited network includes a first local AAA client 610, a local AAA server 630, a home AAA server 640, and a home. The first authentication procedure is performed using an AAA infrastructure consisting of agents 650.

When the authentication is successfully processed, the first local AAA client 610, which receives the authentication result and the authority verification information from the home AAA server 640 through the diameter authentication response message (ARA), manages the filtering information by itself. Send to all access routers (AR).

When the mobile node 600 moves to different diameter second local AAA client 620 areas, the mobile node 600 performs an operation process as described in detail with reference to FIG. 5.

Here, the generated BU is transmitted to the neighboring access router (AR). The corresponding access router (AR) performs the mobile IPv6 registration procedure by routing the BU directly to the home agent 650 without the AAA infrastructure by the filtering information.

FIG. 7 is a flowchart of a method of processing an inter-domain handoff in FIGS. 2 and 3.

Referring to FIG. 7, the processing flow of the BU in the case where handoff occurs between different domains is shown.

When the mobile node 700 moves to another domain, the same procedure as in FIGS. 5 and 6 is performed to perform an authentication procedure using the AAA infrastructure.

At this time, the BU / BA is piggybacked on the diameter message and processed. That is, the mobile node 700 uses the first obtained (owned) home address, home agent, and security association information.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

The present invention relates to an extension method of the diameter AAA protocol supporting mobile IPv6, and has the following effects.

The present invention provides authentication, authorization verification, and billing functions for the movement of a mobile node in a mobile environment, and provides mobility support so that mobile IPv6 services can be more widely used in a commercial network. .                     

In addition, by providing the service continuity for the mobile node by detailing the handoff, it is possible to provide high quality Internet service while providing security.

Claims (12)

A method for extending the diameter AAA protocol between a mobile node and a home agent in a mobile IPv6 environment interworking with an AAA infrastructure, (a) the mobile node sending a network access request message (AAA Request) to a local AAA client; (b) converting, by the local AAA client, the network access request message to an AAA server by including it in a diameter authentication request message (ARR); (c) The AAA server receives the diameter authentication request message to authenticate the mobile node, and when authentication is performed, sends a MIPv6 registration request message (HOR) including a Binding Update to a home agent for mobile IPv6 processing. Transmitting; (d) the home agent sending a MIPv6 registration response message (HOA) including a Binding Acknowledge for the MIPv6 registration request message to the AAA server; (e) the AAA server including the authentication result for the mobile node and the MIPv6 registration result (BA) in a network access response message (ARA) to the local AAA client; And (f) the local AAA client including the authentication result of the mobile node in a network access response message (AAA Response) and transmitting to the mobile node; diameter AAA supporting mobile IPv6 How to extend the protocol. The method of claim 1, wherein the network connection request message (AAA Request), Network access identifier, data for authentication of the mobile node, feature-data requesting information on the mobile node address and home agent address, and the mobile node And a security association key (Security-Key-Request) for establishing a security association for the home agent and the mobile node and the local AAA client. . The method of claim 1, wherein the network connection response message (AAA Response), A network access identifier, data for authentication of the mobile node, feature-data requesting information on the mobile node address and home agent address, and the mobile node; A security association key (Security-Key-Request) for establishing a security association between the home agent and the mobile node and the local AAA client, the mobile node home address of the mobile node, and the home agent An extension method of the diameter AAA protocol supporting mobile IPv6, comprising: address information (Home agent address). A method for establishing a security association between a mobile node and a home agent in a mobile IPv6 environment interworking with an AAA infrastructure, (a) the mobile node including a secret key request signal in a network access request message (AAA Request) to a local AAA client; (b) the local AAA client including the secret key request signal in a diameter authentication request message (AA-Registration-Request) and transmitting it to a home AAA server via a local AAA server; (c) the home AAA server, when receiving the secret key request signal, generating a security association configuration signal to be used at each of the mobile node and the home agent; And (d) the home AAA server distributing each security association configuration signal generated in step (c) to the mobile node and the home agent, respectively. How to set up an association. The method of claim 4, wherein The security association configuration signal to be used in the mobile node is a key (MIPv6-MN-HA-Key) AVP required for transmission from the mobile node in a mobile IPv6 environment to the home agent, the mobile node in the home agent in the mobile IPv6 environment. Key (MIPv6-HA-MN-Key-Material) AVP required for transmission from the mobile node to the home agent in a mobile IPv6 environment. The security association configuration signal to be used in the home AAA server is a key required for transmission from the mobile node in a mobile IPv6 environment to the home agent (MIPv6-MN-HA-Key) AVP, the mobile node in the home agent in a mobile IPv6 environment. Key (MIPv6-HA-MN-Key) required for transmission, and a session key (MIPv6-HA-MN-Session-Key) AVP required for transmission from the home agent to the mobile node in a mobile IPv6 environment. How to set up security associations between mobile nodes and home agents. The method of claim 4 or 5, wherein step (d) The home AAA server transmits to the local AAA client a security association configuration signal to be transmitted to the mobile node among the security association configuration signals generated in step (c) in a diameter authentication response message (ARR), The home AAA server includes a security association configuration signal to be transmitted to the home agent among the security association configuration signals generated in step (c) in a MIPv6 registration request message (HOR) and transmits the mobile node to the home agent. How to set up security associations between home agents. In a mobile IPv6 environment interworking with the AAA infrastructure, a method for processing feature-data requested by a mobile node when a home agent is included in a home AAA server that is a home network, (a) The mobile node includes a local AAA client including a feature-data requesting information on the mobile node's home address, home agent address, and home agent host in a network access request message (AAA Request). Transmitting to; (b) the local AAA client including the feature-data in a Diameter Authentication Request message (ARR) and sending it to a home AAA server via a local AAA server; (c) the home AAA server allocating the home agent through the feature-data received in step (b); (d) The home AAA server may include home address information (MIPv6-Mobile-Node-Address AVP) of the mobile node, the home agent address information (MIPv6-Home-Agent-Address AVP), and the home agent host information (MIPv6-). Setting a Home-Agent-Host AVP); And (e) the home AAA server transmitting to the mobile node for each piece of information set in step (d). In a mobile IPv6 environment interworking with the AAA infrastructure, a method for processing feature-data requested by a mobile node when a home agent is included in a local AAA server that is a visiting network, (a) The mobile node includes a local AAA client including a feature-data requesting information on the mobile node's home address, home agent address, and home agent host in an AAA Request. Transmitting to; (b) the local AAA client including the feature-data in a Diameter Authentication Request message (ARR) and sending it to a local AAA server; (c) the local AAA server allocating the home agent through the feature-data received in step (b); (d) The local AAA server may include home address information (MIPv6-Mobile-Node-Address AVP) of the mobile node, the home agent address information (MIPv6-Home-Agent-Address AVP), and the home agent host information (MIPv6-). Setting a Home-Agent-Host AVP); And (e) the local AAA server transmitting the information about each piece of information set in step (d) to the mobile node. A method of performing binding update when a mobile node hands off from a first access router to a second access router in a mobile IPv6 environment interworking with an AAA infrastructure, (a) the second access router sending Router Advertisements to the mobile node; (b) the mobile node receiving the router advertisement transmits binding update information to the second access router; (c) the second access router receiving the binding update information, determining whether the binding update information corresponds to filtering information stored in advance by the second access router; And (d) if it is determined in step (c) that the binding update information corresponds to the filling information, the second access router transmitting the binding update information to a home agent; How to perform a binding update of a mobile node. delete The method of claim 9, (e) if it is determined in step (c) that the binding update information does not correspond to the filtering information, the second access router sending an error message (ICMPv6 Error) to the mobile node; And (f) the mobile node receiving the error message transmitting a network access request message (AAA Request) to the second access router. delete

Images