KR100837817B1 - Network / service access management system and method for linkage between network access and application service access - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to a network / service access management system and method for linkage between network access and application service access.

2. The technical problem to be solved by the invention

The present invention enables the user to conveniently use the additional application service without inputting separate authentication information to the user by interconnecting the network connection and the additional application service connection, that is, managing the application service connection using the network connection information. In addition, the network / service access management system and method for the connection between the network access and the application service access, which maximizes the profit generation effect by providing the network service with the network access service, can also be provided with the application service. And a computer readable recording medium having recorded thereon a program for realizing the method.

3. Summary of Solution to Invention

The present invention, in the network / service connection management server for the connection between the network connection and the application service access, performs a network access authentication process with the user terminal, and the unique identification number (terminal ID) of the user terminal in the network access authentication process Network access management means for obtaining session information; After receiving the terminal ID and the session information from the network access management means, a shared key (server-side shared key) is generated using the session information and stored in association with the terminal ID. Authentication gateway means for delivering the server-side shared key in response to a request of the means; And receiving the terminal ID and the shared key (terminal side shared key) together with the service authentication request from the user terminal, and comparing the server side shared key received by the authentication gateway means with the terminal side shared key. And means for providing said application service for performing access authentication.

4. Important uses of the invention

The present invention is used in a network / service access management system.

Open network, network / service access management system, network access, application service access, session information, shared key, terminal ID

Description

System and Method of Network / Service Connection Management for linkage between Network Connection and Application Service for connection between network access and application service connection

1 is a configuration diagram of an embodiment of a network / service access management system for linkage between network access and application service access according to the present invention;

2 is a flowchart illustrating a network / service access management method for linkage between network access and application service access according to the present invention.

* Explanation of symbols on the main parts of the drawing

100: user terminal 101: network access manager (WCM)

102: Common Session Manager (WCSM) 103: APP Client

110: network / service access management server 111: network access management server (or AAA server)

112: authentication gateway (G / W) 113: APP server

The present invention relates to a network / service connection management system and method for linkage between a network connection and an application service connection. More particularly, the present invention relates to an application using network connection information by interconnecting a network connection and an additional application service connection. By managing service access, users can conveniently use additional application services without inputting separate authentication information, and also provide network service providers with application services in connection with network access services. The present invention relates to a network / service connection management system for linkage between a network connection and an application service connection and a method thereof, and a computer-readable recording medium having recorded thereon a program for realizing the method.

Conventional mobile communication networks such as Code Division Multiple Access (CDMA) and Personal Communications Services (PCS) are a type of closed network in which operators that are not authorized by a network provider (network operator) cannot provide services. However, next-generation IP networks, such as Wibro, are all-IP based open networks, and like the wired Internet, anyone can provide services. In addition, in the case of a user terminal using the next generation wireless service, it is a general trend to use a general-purpose operating system (OS) such as Microsoft's Windows (MS Windows), Linux (Linux). Therefore, 'network access (network access service)' and 'service connection (additional application service access)' are separated. Here, the network access service is to enable the use of IP-based services such as the Internet through the connection between the user terminal and the network provided by the network operator for a fee, and the additional application service is based on the network access service. Value-added application service provided by various providers using a browser or application program.

However, in order to generate more profits, network providers (network operators) are not only providing network access services but also providing value-added value-added services.

As described above, in order for the network provider (network operator) to provide both the network access service and the additional application service, the user terminal may conveniently provide the network access service and the additional application service using one identity. There is a desperate need for an environment in which to receive. That is, it is required to establish a convenient service use environment through the connection management between the separated network access service and the additional application service.

On the other hand, in terms of the user who is a service user, in order to use the additional application service in the existing Internet environment, the user had to input ID / password even after the network connection, and the application program on the user terminal uses the input authentication information. The service access authentication process with the service providing system was performed according to the service access protocol. That is, the conventional access management system which operates the network access process and the application additional service access process separately, allows the user to input service authentication information (ID and password) separately for use of the application additional service even after the network access. There was a problem causing inconvenience. In other words, even if a general-purpose mobile terminal such as a PDA becomes a main user terminal in an open network-based All-IP network such as WLAN and WiBro, there is a problem that a separate user information input process is required for service authentication.

 The present invention has been proposed to solve the above problems, by connecting the network connection and the additional application service connection to each other, that is, by managing the application service access by using the network access information, without adding additional authentication information to the user Network for linkage between network access and application service access, which makes it possible to use application services conveniently and also provides network service providers with application services in conjunction with network access services to maximize profit generation. It is an object of the present invention to provide a service connection management system and a method thereof, and a computer-readable recording medium which records a program for realizing the method.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. It will also be appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

 In order to achieve the above object, the present invention provides a network / service access management server for linkage between a network access and an application service access, performing a network access authentication process with a user terminal, and performing a network access authentication process of the user terminal. Network access management means for obtaining a unique identification number (terminal ID) and session information; After receiving the terminal ID and the session information from the network access management means, a shared key (server-side shared key) is generated using the session information and stored in association with the terminal ID. Authentication gateway means for delivering the server-side shared key in response to a request of the server; And receiving the terminal ID and the shared key (terminal side shared key) together with the service authentication request from the user terminal, and comparing the server side shared key received by the authentication gateway means with the terminal side shared key. And the application service providing means for performing connection authentication.

On the other hand, the present invention, in the user terminal for the connection between the network connection and the application service connection, performs a network access authentication process with the network / service connection management server, and in the network access authentication process unique identification number ( Network access management means for obtaining a terminal ID) and session information; After receiving the terminal ID and the session information from the network access management means, a shared key (terminal side shared key) is generated using the session information and stored in association with the terminal ID. Common session management means for delivering the terminal-side shared key in response to a request from the client; And the application service requesting means for transmitting the terminal ID and the terminal side shared key together with a service authentication request to the network / service access management server.

On the other hand, the present invention, in the network / service access management method applied to the network / service access management server, performs a network access authentication process with the user terminal, the unique identification number (terminal ID) of the user terminal in the network access authentication process And network access authentication step of obtaining session information; Generating a shared key (server-side shared key) using the session information when the network connection is authenticated in the network access authentication step, and then managing the server-side shared key in association with the terminal ID; A terminal ID / shared key receiving step of receiving a corresponding terminal ID and a shared key (terminal side shared key) together with a service authentication request from the user terminal; And a service authentication step of searching for the corresponding server-side shared key using the terminal ID received from the user terminal and performing service access authentication by comparing the retrieved server-side shared key with the terminal-side shared key. . The method may further include an authentication result transmitting step of transmitting a service access authentication result in the service authentication step to the user terminal.

On the other hand, the present invention, in the network / service access management method applied to the user terminal, performs a network access authentication process with the network / service access management server, the unique identification number of the user terminal (terminal in the network access authentication process ID) and network access authentication step for obtaining session information; A shared key generation step of generating a shared key (terminal side shared key) using the session information and managing the terminal side shared key in association with the terminal ID when the network access is authenticated in the network access authentication step; And a service authentication request step of requesting service access authentication while transmitting the terminal ID and the terminal-side shared key to the network / service access management server. The method may further include receiving an authentication result from the network / service access management server.

On the other hand, the present invention, in order to link between the network connection and the application service connection, the network / service connection management server having a processor, performs a network access authentication process with the user terminal, the uniqueness of the user terminal in the network access authentication process A network access authentication function for obtaining an identification number (terminal ID) and session information; A shared key generation function for generating a shared key (server-side shared key) using the session information and managing the server-side shared key in association with the terminal ID when the network connection is authenticated in the network access authentication function; A terminal ID / shared key receiving function for receiving a corresponding terminal ID and a shared key (terminal side shared key) together with a service authentication request from the user terminal; And searching for the corresponding server-side shared key using the terminal ID received from the user terminal, and realizing a service authentication function by performing service access authentication by comparing the retrieved server-side shared key with the terminal-side shared key. A computer readable recording medium having recorded thereon a program is provided. The recording medium of the present invention further performs an authentication result transmission function of transmitting a service access authentication result of the service authentication function to the user terminal.

Meanwhile, the present invention performs a network access authentication process with a network / service connection management server to a user terminal provided with a processor for linkage between a network connection and an application service connection. A network access authentication function for obtaining a unique identification number (terminal ID) and session information; A shared key generation function for generating a shared key (terminal side shared key) using the session information and managing the terminal side shared key in association with the terminal ID when the network connection in the network access authentication function is authenticated; And a computer-readable recording medium recording a program for realizing a service authentication request function for requesting service access authentication while transmitting the terminal ID and the terminal-side shared key to the network / service access management server.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of an embodiment of a network / service access management system for linkage between network access and application service access according to the present invention.

The network / service connection management system according to the present invention mainly includes a user terminal 100 and a network / service connection management server 110, where the user terminal 100 is a wireless connection manager (WCM) 101. ), A common session manager (WCSM) 102, an APP (application) client 103, and the network / service connection management server 110 includes a network connection management server 111 and an authentication gateway (G). / W) 112, APP (application) server 113 is made.

First, each component of the user terminal 100 for linkage between a network connection and an application service connection will be described.

The network access manager (WCM) 101 performs a network access authentication process with the network access management server 111 of the network / service access management server, and unique identification number (terminal ID) of the user terminal in the network access authentication process. And session information (network connection session information). Here, the network access service (network access authentication process) is performed according to an international standardized authentication protocol such as Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA). The session information is shared with the network / service connection management server 110 in a network access authentication process.

As a result of the network connection success, the same session information (secret key called session key) is shared between the user terminal 100 and the network access management server 111. This private key is not information directly exchanged between the user terminal 100 and the network access management server 111 in a network access process, but using the information exchanged during the access process, the user terminal 100 and the network access management server 111. ) Is a value derived by calculation separately, so it is safe for security.

Meanwhile, the common session manager (WCSM) 102 receives the terminal ID and the session information from the network connection manager (WCM) 101, and then uses the session information to use a shared key (as a key for service authentication, the user terminal). And a key shared by the network / service connection management server) (hereinafter referred to as a 'terminal shared key') and stored in association with the terminal ID. Then, when the common session manager (WCSM) 102 receives the service authentication factor from the APP (application) client 103, it transmits the corresponding terminal ID and the encrypted terminal side shared key in response thereto. do.

The APP (application) client 103 is an 'application service request means' and transmits a terminal ID and a terminal side shared key to the APP (application) server 103 of the network / service connection management server together with the service authentication request. After transmission, the authentication result (including user information) is received in response.

Next, each component of the network / service connection management server 110 for linkage between the network connection and the application service connection will be described.

The network access management server 111 performs a network access authentication process with the user terminal 100 and obtains a unique identification number (terminal ID) and session information of the user terminal in the network access authentication process. Here, a network access service (network access authentication process) is performed according to an international standardized authentication protocol such as EAP-AKA. The session information is shared with the user terminal 110 in the network access authentication process. That is, the user terminal 100 and the network / service access management server 110 share the same session information. In implementation, the network access management server 111 may be an AAA (Authentication, Authorization and Accounting) server (see FIG. 2).

The authentication gateway (G / W) 112 receives the terminal ID and session information (network access session information) from the network access management server 111, and then uses the session information to generate a shared key (server-side shared key). It is generated and stored in association with the terminal ID. Here, the shared key generation process using the session information is performed in the user terminal 100 and the network / service access management server 110, respectively, the algorithm is used the same.

Subsequently, when the authentication gateway (G / W) 112 receives a service authentication factor from the APP (application) server 113, the authentication gateway (G / W) 112 receives the corresponding terminal ID and the encrypted server-side shared key in response thereto. To pass.

The APP (application) server 113 is an 'application service providing means', and together with the service authentication request from the APP (application) client 103 of the user terminal, a terminal ID and a shared key (terminal shared key) If received, the server requests the server-side shared key using the received terminal ID as an index to the authentication gateway (G / W) 112. The APP server 113 then receives the server-side shared key from the authentication gateway (G / W) 112, compares the terminal-side shared key and the server-side shared key, If they are identical to each other, an authentication success message (which may include user information such as a user profile) is transmitted to the user terminal 100, and if the shared key is different, an authentication failure message is transmitted to the user terminal 100. Here, the authentication success message may include user information such as a user profile.

As described above, the present invention uses the session information (secret key) generated during the network connection process, so that the user can access and use the additional application service conveniently and safely without receiving a separate ID / password. .

2 is a flowchart illustrating a method for managing a network / service connection for linkage between a network connection and an application service connection according to the present invention, which is applied to a wireless LAN service (open network environment) such as WiBro as well as wired Internet. .

First, a network access procedure 200 performed between a network access manager (WCM) 101 and an AAA server 111 (which corresponds to the network access management server in FIG. 1) will be described.

The network access manager (WCM) 101 performs network access authentication with the AAA server 111 using the EAP-AKA protocol (200). In this case, the identifier used is a unique identifier (terminal ID) of the user terminal and is a terminal-specific identifier which is not exposed to the user and the outside.

When the network access authentication is completed, the same session information (the session key as a secret key, MSK (Master Session Key) corresponding thereto) is generated in the WCM 101 and the AAA server 111. This session information is not a value transmitted through the network in the network connection process, but is made through calculation by using information exchanged during authentication process in the WCM 101 and the AAA server 111 due to the nature of the protocol. Losing is a value.

In short, the network connection manager (WCM) 101 and the AAA server 111 obtain a terminal ID and session information through an authentication process.

Next, a process (202, 204, 206, 208) of generating a shared key between the common session manager (WCSM) 102 and the authentication G / W 112 will be described.

When the network connection is completed, a process of transmitting a terminal ID and session information (network access session information) by the WCM 101 to the common session manager (WCSM) 102 is performed at the user terminal 100. In step 202, the network / service connection management server 110 performs a process 204 in which the AAA server 111 delivers the terminal ID and session information (network access session information) to the authentication G / W 112.

The common session manager (WCSM) 102 and the authentication G / W 112 hash and store the received session information using the same algorithm. Thus, the common session manager (WCSM) 102 and the authentication G / W 112 are not exposed to the outside, and generate a shared key uniquely known to both sides (206, 208). That is, the common session manager (WCSM) 102 and the authentication G / W 112 generate a shared key using the session information.

Next, the service (additional application service) connection process 20 will be described.

The various APP (application) clients 103 on the user terminal side do not receive an ID and password separately from the user for service connection with the APP (application) server 113, and use a common session manager (WCSM) ( 102 requests the shared key (terminal shared key) and the terminal ID and receives them (210, 212).

The APP (application) client 103 requests service authentication from the APP (application) server 113 (214). At this time, the algorithm for authentication may use a variety of standards, the shared key is encrypted, and is transmitted to the APP (application) server 113 with the terminal ID.

The APP (application) server 113, which has received the authentication request, receives and transmits the corresponding server side shared key to the authentication G / W 112 using the 'received terminal ID' as an index (216 and 218).

APP (application) server 113 performs a service authentication through the process of checking whether the terminal-side shared key and the server-side shared key is the same (220), and the authentication result is the APP (application) client ( 103, and transmits to block 103. At this time, the user information may be transmitted along with the authentication result, and the user information is received from the authentication G / W 112.

In other words, the APP (application) server 113 knows which user requests service authentication through the user information received from the authentication G / W 112, and the APP (application) ) Responds to client 103.

As a result, the APP (application) server 113 has not received a separate ID and password from the user, but succeeds in accessing the service by using the unique ID and the shared key of the terminal, and can know the user's information. .

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

In the present invention as described above, if only the network connection is made, by performing the service access authentication using the terminal (user terminal) unique information and the network access session information obtained in the network access process, the user information for additional service authentication There is an effect that can be provided conveniently to the application service without additional input.

In addition, the present invention can provide a more convenient service to customers by enabling the SSO (Single-Sign-On) processing network connection and service connection to the operator (network operator) side that provides the network connection, and also separate By using the result of the network connection without the service access procedure of the service, it is possible to access the service, thereby locking in the service provided by the company to create more profits.

Claims (24)

In the network / service access management server for linkage between network access and application service access, Network access management means for performing a network access authentication process with a user terminal and obtaining a unique identification number (terminal ID) and session information of the user terminal in the network access authentication process; After receiving the terminal ID and the session information from the network access management means, a shared key (server-side shared key) is generated using the session information and stored in association with the terminal ID. Authentication gateway means for delivering the server-side shared key in response to a request of the server; And As the terminal ID and the shared key (terminal side shared key) are received together with the service authentication request from the user terminal, the server side shared key received by requesting the authentication gateway means is compared with the terminal side shared key to access the service. The application service providing means for performing authentication Network / service access management server for linkage between network access and application service access, including. The method of claim 1, The network connection management means, A network / service access management server for linkage between network access and application service access, characterized in that to perform network access authentication with the user terminal according to the EAP-AKA protocol. The method of claim 2, The network connection management means, Network / service access management server for linkage between network access and application service access, characterized in that the AAA (Authentication, Authorization and Accounting) server. The method according to any one of claims 1 to 3, The application service providing means, The server-side shared key is compared with the terminal-side shared key, and if the shared key is the same, an authentication success message is transmitted to the user terminal, and if the shared key is different, an authentication failure message is transmitted to the user terminal. Network / service access management server for linkage between network access and application service access. The method of claim 4, wherein The application service providing means, The network / service access management server for linkage between the network access and the application service access, characterized in that the user information is added to the authentication success message and transmitted. The method of claim 4, wherein The session information, A network / service access management server for linkage between a network access and an application service access, characterized in that shared with the user terminal in a network access authentication process in the network access management means. A user terminal for linkage between network access and application service access, Network access management means for performing a network access authentication process with a network / service access management server and obtaining a unique identification number (terminal ID) and session information of a user terminal in the network access authentication process; After receiving the terminal ID and the session information from the network access management means, a shared key (terminal side shared key) is generated using the session information and stored in association with the terminal ID. Common session management means for transferring the terminal-side shared key in response to a request from the client; And The application service requesting means for transmitting the terminal ID and the terminal-side shared key together with a service authentication request to the network / service access management server User terminal for linkage between network access and application service access comprising a. The method of claim 7, wherein The network connection management means, A user terminal for linkage between network access and application service access, characterized in that for performing network access authentication with the network / service access management server according to the EAP-AKA protocol. The method of claim 7, wherein The session information, The user terminal for linkage between network access and application service access, characterized in that shared with the network / service connection management server in the network access authentication process in the network access management means. The method according to any one of claims 7 to 9, The application service request means, And a user terminal for linkage between the network access and the application service connection, wherein the terminal side shared key is encrypted and transmitted. The method of claim 10, The application service request means, And a function of receiving a service authentication result from the network / service access management server. In the network / service access management method applied to the network / service access management server, A network access authentication step of performing a network access authentication process with the user terminal and obtaining a unique identification number (terminal ID) and session information of the user terminal in the network access authentication process; Generating a shared key (server-side shared key) using the session information when the network connection is authenticated in the network access authentication step, and then managing the server-side shared key in association with the terminal ID; A terminal ID / shared key receiving step of receiving a corresponding terminal ID and a shared key (terminal shared key) together with a service authentication request from the user terminal; And A service authentication step of searching for the corresponding server-side shared key using the terminal ID received from the user terminal and performing service access authentication by comparing the found server-side shared key with the terminal-side shared key; Network / service access management method in a network / service access management server comprising a. The method of claim 12, Authentication result transmission step of transmitting a service access authentication result in the service authentication step to the user terminal Network / service access management method in the network / service access management server further comprising. The method of claim 13, The authentication result transmission step, And adding user information to the service access authentication result and transmitting the user information. The method according to any one of claims 12 to 14, The network access authentication process in the network access authentication step, A network / service access management method in a network / service access management server, characterized in that performed according to the EAP-AKA protocol. The method of claim 15, The session information, The network / service access management method of the network / service access management server, characterized in that shared with the user terminal in the network access authentication process in the network access authentication step. In the network / service access management method applied to the user terminal, Performing a network access authentication process with a network / service access management server, and obtaining a unique identification number (terminal ID) and session information of a user terminal in the network access authentication process; A shared key generation step of generating a shared key (terminal side shared key) using the session information and managing the terminal side shared key in association with the terminal ID when the network access is authenticated in the network access authentication step; And  A service authentication request step of requesting service access authentication while transmitting the terminal ID and the terminal-side shared key to the network / service access management server; Network / service access management method in a user terminal comprising a. The method of claim 17, An authentication result receiving step of receiving a service authentication result from the network / service access management server Network / service access management method in the user terminal further comprising. The method of claim 17 or 18, The network access authentication process in the network access authentication step, Network / service access management method of the user terminal, characterized in that performed according to the EAP-AKA protocol. The method of claim 19, The session information, Network / service access management method of the user terminal, characterized in that shared with the network / service access management server in the network access authentication process in the network access authentication step. The method of claim 20, The service authentication request step, And encrypting and transmitting the shared key. In order to link between network access and application service access, a network / service access management server having a processor, A network access authentication function for performing a network access authentication process with the user terminal and obtaining a unique identification number (terminal ID) and session information of the user terminal in the network access authentication process; A shared key generation function for generating a shared key (server-side shared key) using the session information and managing the server-side shared key in association with the terminal ID when the network connection is authenticated in the network access authentication function; A terminal ID / shared key receiving function for receiving a corresponding terminal ID and a shared key (terminal side shared key) together with a service authentication request from the user terminal; And A service authentication function for searching for the corresponding server-side shared key using the terminal ID received from the user terminal, and performing service access authentication by comparing the searched server-side shared key with the terminal-side shared key. A computer-readable recording medium having recorded thereon a program for realizing this. The method of claim 22, Authentication result transmission function for transmitting a service access authentication result in the service authentication function to the user terminal A computer-readable recording medium that records a program for further realization. In order to link between a network connection and an application service connection, to a user terminal having a processor, A network access authentication function for performing a network access authentication process with a network / service access management server, and for obtaining a unique identification number (terminal ID) and session information of a user terminal in the network access authentication process; A shared key generation function for generating a shared key (terminal side shared key) using the session information and managing the terminal side shared key in association with the terminal ID when the network connection in the network access authentication function is authenticated; And  A service authentication request function for requesting service access authentication while transmitting the terminal ID and the terminal-side shared key to the network / service access management server. A computer-readable recording medium having recorded thereon a program for realizing this.

Images