CN101094067B - A method and device for authenticating a user terminal in a CDMA system - Google Patents

Abstract

The invention discloses a method and device for authenticating a user terminal in a CDMA system. The method includes: the user terminal requests to access a packet data service network, and the packet data service node determines to perform authentication processing on the user terminal; The packet data service node sends an access request message containing the user network access identifier and user identifier to the authentication, authorization and accounting server; the authentication, authorization and accounting server searches for the corresponding user according to the user identifier The account information of the terminal, combined with the user network access identifier, performs authentication processing on the user terminal, and returns the authentication processing result to the packet data service node; the packet data service node according to the authentication processing result Determine to provide data services to the user terminal or terminate access to the user terminal. The invention realizes the authentication of users accessing with public accounts and the effective authentication of prepaid services in the CDMA system.

Description

A method and device for authenticating a user terminal in a CDMA system

technical field

The invention relates to a user authentication method in the communication field, in particular to a method and a device for authenticating a user accessing with a public account in a CDMA (Code Division Multiple Access) system.

Background technique

The CDMA system has been developed for more than 20 years and is now widely used all over the world. Because of its high bandwidth and smooth transition characteristics, the CDMA system has great advantages in the development of data services. With the development of data services, various requirements have emerged, such as BREW (Binary Runtime Environment for Wireless, wireless binary operating environment) services, WAP (Wireless Application Protocol, wireless application protocol) services, etc. Carrying out these services involves the authentication problem of user terminal data service access.

In the field of data communication, NAI (Network Access Identifier, Network Access Identifier) is used to uniquely identify the identity of the user terminal, expressed as: user@realm. In the CDMA system, the NAI is also used as the authentication identifier for the user terminal to access the data service. Generally, when a user terminal requests data service access, the packet data serving node (Packet Data Serving Node, PDSN) sends an authentication request message with NAI information to the authentication, authorization and accounting server (Authentication, Authorization & Accounting, AAA) authenticates the user terminal. If the authentication passes, the user access is allowed, and if the authentication fails, the user access is terminated.

In the process of data service development, for the convenience of operation, multiple users of the same service can use the same user name/password to access, that is, use public account access, and use the account name of the public account to distinguish user access To different ISP (Internet Service Provider, network service provider). For example, all wireless network card users use card/card user name/password to access and request to connect to the Internet.

In the CDMA system, before the user accesses the data service, he needs to go to the MSC (Mobile Switching Center, Mobile Switching Center) to perform authentication in advance, allocate channels, and judge whether the user has opened the data service. Only when the wireless network authentication passes and the user activates the data service, the system will transfer the user's access request to the packet data service node for processing in the next step of data service access processing.

In actual operation, all users may subscribe to the data service by default. In this way, when a user accesses the system using a public account, the user may not be authenticated for data services, but directly allowed to access.

However, whether an access user using a public account without authentication can currently perform data services, such as whether the user account has a balance, whether the user is a user who is restricted from using data services, and whether the user has subscribed to the corresponding service. If authentication is not performed when entering, the system will not be able to reasonably judge and handle these situations in order to provide users with reasonable services.

For safety reasons, users who use public accounts to request data service access also need to go to the corresponding authentication, authorization and billing server for data service authentication. The system can decide whether to provide users with data according to the user's account status and information. services or whether to allow users to perform corresponding data services.

In addition, when the system provides prepaid services, since the user needs to check the user's account information when accessing, and the PPS (PrePaid Server, prepaid server) allocates a certain quota to the user, how to use public account access Effective authentication of users is a problem that must be solved.

Through retrieval, no relevant method for solving the above problems has been found at present.

Contents of the invention

The technical problem to be solved by the present invention is to provide a method and device for authenticating user terminals in a CDMA system, which are used to implement effective authentication for users accessing with public accounts.

In order to achieve the above object, the present invention provides a method for authenticating a user terminal in a CDMA system, which is characterized in that it includes:

Step 1, the user terminal requests access to the packet data service network, and the packet data service node determines to perform authentication processing on the user terminal;

Step 2, the packet data service node sends an access request message containing the user network access identifier and the user identifier to the authentication, authorization and accounting server;

Step 3, the authentication, authorization and billing server looks up the account information of the corresponding user terminal according to the user ID, performs authentication processing on the user terminal in combination with the user network access ID, and returns the authentication processing results to said packet data serving node; and

Step 4: The packet data service node determines to provide data services to the user terminal or terminate access of the user terminal according to the authentication processing result.

The method for authenticating a user terminal in the CDMA system, wherein the user identifier is a mobile subscriber directory number, an international mobile subscriber identification code, a mobile subscriber identification code, an action identification code for a user's international roaming, or Mobile device identification.

The method for authenticating a user terminal in the CDMA system, wherein, in the third step, it further includes: the authentication, authorization and billing server judges whether the user terminal is currently allowed to use the account information of the user terminal. The step of user terminal access, if yes, the user terminal has opened an account and the account is in an available state, if not, the user terminal has not opened an account or the account is in an unavailable state, and the authentication, authorization and charging server sends The packet data serving node sends an access rejection message.

The method for authenticating a user terminal in the CDMA system, wherein, in the step 3, when allowing the user terminal to access, it also includes: the authentication, authorization and charging server according to the user The step of judging the service type of the access request by the network access identifier.

The method for authenticating a user terminal in the CDMA system, wherein, in the third step, further comprising: the authentication, authorization and billing server judging whether the user terminal is based on the account information of the user terminal The step of having subscribed to the service corresponding to the service type of the access request, if yes, the authentication, authorization and accounting server sends an access acceptance message to the packet data service node; if not, sends an access acceptance message to the packet data service node The serving node sends an Access Reject message.

The method for authenticating a user terminal in the CDMA system, wherein, in the third step, it also includes: the authentication, authorization and billing server judges whether the user is legal according to the account information of the user terminal The step of the prepaid data user, if yes, the user terminal has opened an account in the authentication, authorization and billing server and subscribed to the data prepaid service, the user terminal can currently use the prepaid service, and the authentication The authorization, authorization and accounting server sends a quota request message containing the user ID to the prepaid server, and if not, the authentication, authorization and accounting server sends an access rejection message to the packet data service node.

The method for authenticating a user terminal in the CDMA system, wherein, in the third step, further comprising: the prepaid server receives the prepaid quota request from the authentication, authorization and charging server, and according to the The user identifier allocates a quota for the user terminal, determines quota-related information, and sends the quota information to the authentication, authorization, and accounting server, and the authentication, authorization, and accounting server provides the packet data service A step in which the node sends an authentication result containing the quota information.

The method for authenticating a user terminal in the CDMA system further includes: after the user terminal accesses, the authentication, authorization and accounting server The step of charging the user terminal according to the charging information and the user identification.

In order to achieve the above object, the present invention also provides a device for authenticating a user terminal in a CDMA system, which is characterized in that it includes: a user terminal, a packet data service node, and an authentication, authorization and accounting server;

The packet data service node is used to determine whether to perform authentication on the user terminal, and when it is determined to perform authentication, send an access request containing the user network access identifier and user identifier to the authentication, authorization and accounting server message, and determine to provide data services to the user terminal or suspend access to the user terminal according to the received authentication processing result;

The authentication, authorization and billing server is used to look up the account information of the corresponding user terminal according to the user identifier, perform authentication processing on the user terminal in combination with the user network access identifier, and return an authentication processing result to the packet data serving node.

The device for authenticating a user terminal in the CDMA system further includes a prepaid server for receiving the prepaid quota request from the authentication, authorization and charging server, and according to the user identification as The user terminal allocates a quota, determines quota-related information, and sends the quota information to the authentication, authorization and accounting server.

The invention solves the problem of authenticating users who use public accounts to access in the existing CDMA system, and provides a convenient method for users to safely use data services. Since the user must effectively authenticate the user to use the data prepaid service, the present invention also solves the problem of using the data prepaid service by the user accessing the public account from another aspect.

The present invention will be described in detail below in conjunction with the accompanying drawings and specific embodiments, but not as a limitation of the present invention.

Description of drawings

Fig. 1 is the network structural diagram of existing CDMA system;

Fig. 2 is a system structure diagram of the present invention for performing data service access authentication on users using public account access;

Fig. 3 is a system flow chart of the present invention for performing data service access authentication on users using public account access;

Fig. 4 is a system flow chart of the present invention for performing prepaid data service access authentication on users using public account access.

Detailed ways

Please refer to FIG. 1 , which is a network structure diagram of an existing CDMA system. The structure includes: user terminal MS (Mobile Station) 11, radio access network/packet control function (Radio AccessNetwork/Packet Control Function, RAN/PCF) 12, mobile switching center/visit location register (Mobile Switch Center/Visit Location Register , MSC/VLR) 13, packet data service node PDSN 14, authentication, authorization and accounting server AAA 15.

MS 11 uses a public account to access the CDMA packet domain.

RAN/PCF 12 forwards the user's data service access request to PDSN 14.

PDSN 14 provides data access services for MS 11, and provides authentication for users when MS 11 accesses. At the same time, PDSN 14 collects user charging information when providing data access services for MS 11. PDSN14 is connected to home agent HA (HomeAgent) 18 through IP (Internal Protocol, Internet Protocol) network 19.

The MSC/VLR 13 provides the authentication function of the wireless access network for the MS 11. It is connected to a Home Location Register (HomeLocation Register, HLR) 17 through a SS7 (Signaling System 7, No. 7 signaling system) network 16 .

AAA 15 provides authentication, authorization and billing services for MS 11; when receiving the user access request sent by PDSN 14 through IP network 19, it will authenticate and authorize MS 11 accordingly.

Please refer to FIG. 2 , which is a system structure diagram of the present invention for performing data service access authentication on users using public account access. The system structure includes: user terminal MS 11, packet data service node PDSN 14, authentication, authorization and accounting server AAA 15.

The user terminal MS 11 requests access to the packet data service network, and the packet data service node PDSN 14 is used to determine whether to authenticate the user terminal; when it is determined that the user terminal MS 11 is authenticated, the packet data service node PDSN 14 sends an access request The message is sent to the authentication, authorization and accounting server AAA 15, which at least carries the user NAI and the user identification;

The subscriber identity can be MDN (Mobile Directory Number, mobile subscriber directory number), or IMSI (International Mobile Subscriber Identity, international mobile subscriber identity code), or MIN (Mobile Identification Number, mobile subscriber identity code), or IRM (International Roaming Mobile Identification Number, user's mobile identification code for international roaming), or MEID (Mobile Equipment Identifier, mobile equipment identifier);

The authentication, authorization and billing server AAA 15 looks up the account information of the corresponding user terminal according to the user identification, and performs authentication processing in combination with the user NAI, and then returns the authentication result to the packet data service node PDSN 14;

The packet data service node PDSN 14 determines to provide corresponding data services for the user terminal MS 11 or terminate the access of the user terminal 11 according to the authorization information returned by the authentication, authorization and accounting server AAA 15.

Please refer to FIG. 3 , which is a system flow chart of the present invention for performing data service access authentication on users using public account access. As shown in Figure 2, the process specifically includes the following steps:

Step 301, the user terminal 11 requests access to the packet data service network, and the packet data service node 14 determines to perform authentication for the user terminal 11;

Step 302, the packet data service node 11 sends an access request message to the authentication, authorization and accounting server 15, and the message carries at least the user NAI and the user identifier;

Step 303, the authentication, authorization and billing server 15 looks up the account information of the corresponding user terminal 11 according to the user identification;

Step 304, the authentication, authorization and billing server 15 judges whether the user terminal 11 is currently allowed to access according to the account information of the user terminal 11, that is, judges whether the user has opened an account and whether the account is in an available state; if the user terminal 11 is allowed to access, then If the user has opened an account and the account is available, then proceed to step 305; otherwise, if the user has not opened an account or the account is not available, perform step 307;

Step 305, the authentication, authorization and billing server 15 further judges the service type of the access request according to the user NAI, and judges whether the user terminal 11 has subscribed to this type of service according to the account information of the user terminal 11, if subscribed to this type of service service, proceed to step 306 for execution; otherwise, execute step 307;

Step 306, the authentication, authorization and accounting server 15 sends an access acceptance message to the packet data service node 14, and the system provides corresponding types of services for the user terminal 11; the process ends.

Step 307, the authentication, authorization and accounting server 15 sends an access rejection message to the packet data service node 14, and the process ends.

In this process, the packet data service node 14 sends the collected user charging information to the authentication, authorization and charging server 15, and the authentication, authorization and charging server 15 implements charging for the corresponding user according to the user identifier.

Please refer to FIG. 4 , which is a system flow chart of the present invention for performing prepaid data service access authentication on users using public account access. As shown in Figure 2, the process specifically includes the following steps:

Step 401, the user terminal 11 requests access to the packet data service network, and the packet data service node 14 determines to perform authentication for the user terminal 11;

Step 402, the packet data service node 14 sends an access request message to the authentication, authorization and accounting server 15, the message at least carries the user NAI and the user identifier;

Step 403, the authentication, authorization and billing server 15 looks up the account information of the corresponding user terminal according to the user identification, and judges whether the user is a legal prepaid data user according to the account information, that is, whether the user has been authenticated, authorized and billed. Open an account in the fee server 15 and subscribe to the data prepaid service; if the account information of the user terminal 11 indicates that the user is a legal prepaid data user, that is, the user has opened an account in the authentication, authorization and billing server 15, the user can currently use Data prepaid service, then send the quota request message with user identification to the prepaid server PPS 20, continue step 404; Otherwise, send the access rejection message to the packet data service node 14, go to step 406 and execute;

Step 404, the prepaid server PPS 20 receives the prepaid quota request from the authentication, authorization and billing server 15, searches for the account information of the user terminal 11 according to the user identification, and allocates quotas for the user terminal 11 according to the user identification, and determines quota-related information , and send this information to the authentication, authorization and accounting server 15;

Step 405, the authentication, authorization and charging server 15 sends the authentication result carrying the prepaid quota related information to the packet data service node 14;

Step 406, the packet data service node 14 determines to provide data services for the user terminal 11 or terminate user access according to the authentication result returned by the authentication, authorization and accounting server 15;

In this step, after it is determined to provide data services for the user terminal 11, it further includes: the packet data service node 14 sends the collected user billing information to the prepaid server PPS 20, and the prepaid server PPS 20 implements the corresponding user charging information according to the user identification. deduction.

The present invention provides an authentication method for users accessing with public accounts, so that user terminals can access the CDMA system more safely, and at the same time, it also provides convenience for the user terminals accessing with public accounts to realize prepaid services.

Of course, the present invention can also have other various embodiments, and those skilled in the art can make various corresponding changes and deformations according to the present invention without departing from the spirit and essence of the present invention, but these corresponding Changes and deformations should belong to the scope of protection of the appended claims of the present invention.

Claims (9)

1. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in a cdma system, it is characterized in that, comprising:

Step 1, user terminal requests accessing group data service network, packet data serving node are determined described user terminal is carried out authentication process;

Step 2, described packet data serving node transmission contain user network and insert the access request message of sign and user ID to authentication, mandate and accounting server;

Step 3, described authentication, mandate and accounting server are searched the account information of relevant user terminals according to described user ID, judge the current step that whether allows described user terminal to insert according to the account information of described user terminal, if, then described user terminal has been opened an account and the account is in upstate, if not, then described user terminal is not opened an account or the account is in down state, and described authentication, mandate and accounting server send access-reject message to described packet data serving node; And described authentication, mandate and accounting server insert sign in conjunction with described user network described user terminal are carried out authentication process, and return the authentication process result to described packet data serving node; And

Step 4, described packet data serving node is determined data, services to be provided or to end described user terminal access to described user terminal according to described authentication process result.

2. in the cdma system according to claim 1 user terminal is carried out the method for authentication, it is characterized in that described user ID is the action recognition sign indicating number or the mobile device sign of Mobile Directory Number, international mobile subscriber identity, mobile identification number, user international roaming.

3. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in the cdma system according to claim 1, it is characterized in that, in the described step 3, when allowing described user terminal to insert, also comprise: described authentication, mandate and accounting server insert sign according to described user network and judge the step that inserts the requested service type.

4. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in the cdma system according to claim 3, it is characterized in that, in the described step 3, also comprise: described authentication, mandate and accounting server judge according to the account information of described user terminal the step of the corresponding service of requested service type has been ordered and inserted to described user terminal whether, if then described authentication, mandate and accounting server send to described packet data serving node and accept message; If not, then send access-reject message to described packet data serving node.

5. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in the cdma system according to claim 1, it is characterized in that, in the described step 3, also comprise: described authentication, authorize and accounting server judges that according to the account information of described user terminal whether the user is legal prepaid data user's step, if, then described user terminal is in described authentication, authorize and accounting server in opened an account and ordered the data prepayment service, the current prepaid services of using of described user terminal, described authentication, mandate and accounting server send the quota request message that contains user ID to prepaid server, if not, then described authentication, mandate and accounting server send access-reject message to described packet data serving node.

6. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in the cdma system according to claim 5, it is characterized in that, in the described step 3, also comprise: described prepaid server receives described authentication, the pre-payment quota request of mandate and accounting server, according to described user ID is described user terminal allocated quotas, determine the quota relevant information, and this quota information sent to described authentication, authorize and accounting server described authentication, mandate and accounting server send the step of the authenticating result that contains described quota information to described packet data serving node.

7. adopt publicly-owned account to insert the method for carrying out authentication to user terminal in the cdma system according to claim 1, it is characterized in that, also comprise: after described user terminal inserts, the step that described authentication, mandate and accounting server charge to described user terminal according to the customer charging information and the described user ID of described packet data serving node transmission.

8. adopt publicly-owned account to insert the device that carries out authentication to user terminal in a cdma system, it is characterized in that, comprising: a user terminal, a packet data serving node and an authentication, mandate and accounting server;

Described packet data serving node is used to determine whether described user terminal is carried out authentication, when determining to carry out authentication, contain the access request message that user network inserts sign and user ID to described authentication, mandate and accounting server transmission, and determine data, services to be provided or to end described user terminal access to described user terminal according to the authentication process result who receives;

Described authentication, mandate and accounting server are used for searching according to described user ID the account information of relevant user terminals, insert sign in conjunction with described user network described user terminal is carried out authentication process, and return the authentication process result to described packet data serving node.

9. adopt publicly-owned account to insert the device that carries out authentication to user terminal in the cdma system according to claim 8, it is characterized in that, also comprise a prepaid server, be used to receive the pre-payment quota request of described authentication, mandate and accounting server, and be described user terminal allocated quotas according to described user ID, determine the quota relevant information, and this quota information is sent to described authentication, mandate and accounting server.

Images