CN101137222B - Access authentication processing method and system and device - Google Patents

Abstract

The invention discloses an access authentication processing method, system and device. The method includes the following steps: the authentication server of the local home access network of the user terminal records user attribution information such as roaming IP address attribute information and roaming IP type attribute information; maintains and manages the recorded roaming IP address attribute information and roaming IP type attribute information Wait for the user's attribution information, and when the user terminal changes, actively send a notification to the access network authentication server for operation. It enables the authentication server of the local home access network of the roaming user terminal to effectively locate the authentication server of the remote home access network to which the user terminal currently belongs, with low cost and less resource occupation, and is suitable for practical application.

Description

Access authentication processing method, system and device

technical field

The invention relates to the field of data communication in a mobile communication system, in particular to a processing method, system and device for performing access authentication of an access network authentication server (AN-AAA) to a roaming user in a mobile communication system.

Background technique

Before the user can access the network, generally, the network first needs to perform access authentication on the user to determine the authenticity of the user's identity. In the Code Division Multiple Access 2000-Evolution Data Only (CDMA2000-EVDO) mobile communication system, the access network authentication server (Access Network-Authentication, Authorization, Accounting, AN-AAA) is used as The authentication network element on the access network side performs access authentication on Evolution Data Only (EVDO) terminals.

Wireless access network authentication is a mechanism to confirm the legitimacy of EVDO terminals that will access the EVDO wireless network (AN). Access authentication is completed by the cooperation of the access network (AN) side and the access network authentication server (AN-AAA), using the Challenge Handshake Authentication Protocol (Point to Point Protocol, PPP), CHAP) authentication, after the authentication is successful, the access network authentication server (AN-AAA) returns the mobile node identifier (MNID) to the access network (AN), which is used to determine the A8/A9 (for bearing services/for transmission) Signaling), A10/A11 (for bearer services/for transmission signaling) interface messages in the mobile node identifier (MNID). Once the user is authenticated by the access network authentication server, his identity information will be retained on the access network side. Under normal circumstances, the next time the user initiates a call, he does not need to go through the authentication of the access network authentication server, and directly establishes a connection according to the identity information retained on the access network side.

The communication between the access network and the authentication server of the access network is carried out through a standard A12 interface (for transmitting authentication information), and the authentication is completed through the interaction of A12 messages. The specific process includes the following steps:

(1) The access network (AN) side receives a call request from an EVDO terminal. If it is determined that it is a new user or a user requiring authentication, it needs to perform access authentication, that is, immediately initiate an authentication request, and construct an A12 interface The access request message is sent to the access network authentication server (AN-AAA) through the Remote Authentication Dial In User Service (RADIUS) protocol stack for authentication.

(2) Management of the retransmission mechanism of the A12 interface access request message. If no authentication response from the access network authentication server (AN-AAA) is received within a period of time, the access request message is resent.

(3 The access network side receives the authentication result from the access network authentication server, and returns a valid mobile node identifier (MNID) if the authentication is successful, otherwise rejects the terminal to establish a connection.

However, the existing authentication process does not fully consider the mobility of the user terminal. In consideration of the mobility of user terminals, there usually exist a first access network (AN1) and a second access network (AN2)..., the nth access network (ANn); the first access network (AN1) connects to the One access network authentication server (AN-AAA1), the second access network (AN2) is connected to the second access network authentication server (AN-AAA2)..., the nth access network (ANn) is connected to the nth access network Access Authentication Server (AN-AAAn). If the first access network (AN1) is the user's local home access network, then the first access network authentication server (AN-AAA1) is the user's local home authentication server. When an EVDO terminal roams, it will face the following situations:

Case 1: If the local home authentication server (i.e. the first access network authentication server, AN-AAA1) and the second access network authentication server (AN-AAA2) are the same server, usually the local home access network (that is, the first access network, AN1) and the second access network (AN2) need to be configured as adjacent cells, and A13 handover will occur when a roaming user roams from the first access network to the second access network (for transfer handover information), the second access network will obtain user identity information from the first access network to establish a connection;

The second case: if the local home authentication server (that is, the first access network authentication server, AN-AAA1) and the second access network authentication server (AN-AAA2) are not the same server, the roaming user The access network (namely the first access network, AN1) roams to the second access network (AN2), because the second access network has no user identity information and needs to be rebuilt; at the same time, there is no user in the authentication server of the second access network The registration information can only be verified through the local attribution authentication server interconnected with it (that is, the first access network authentication server, AN-AAA1), and can only access the Internet after confirming that the authentication is passed.

The first case is the roaming mode supported by existing standards. For the second case, the following problems may occur in remote authentication of roaming users:

(1) If the user has been surfing the Internet in a different place and at the same time logs out locally, even if the user's registration information on the local home authentication server (that is, the first access network authentication server, AN-AAA1) and the local home access network (i.e. the first access network, AN1), but since the user terminal has retained the identity information and passed the authentication while roaming in the second access network (AN2), it can always access the Internet until it is performed again. Authentication is required to determine that the user's identity is outdated.

(2) The roaming user has left identity information in the remote home access network (such as the second access network, AN2). Once the user leaves, the information will be kept forever, which will occupy the system resources of the remote home access network. If there are many roaming users, resource occupation will affect the normal local home access network user terminal access.

Considering the above problems, the reason is that the remote access network authentication server (such as the second access network authentication server, AN-AAA2) can pass the RADIUS (Remote Authentication Dial-In User Service) message of the roaming terminal. UserName (user name) and Calling-Station-ID (calling station identification) attribute information to analyze the domain to which the user belongs. Generally, if multiple access network authentication servers are configured in the domain, the packet will be sent to the access network authentication server with higher priority according to the priority, and if unsuccessful, then the packet will be sent to the lower-level access network authentication server. Unless it is not configured, it will be forwarded successfully, so that it can be connected to the original home authentication server through the remote home access authentication server to confirm the legitimacy of the user's identity. But in the opposite direction, if the local home authentication server of the roaming user wants to locate the remote home access authentication server of the roaming user, it must first determine the remote home access authentication server, but there is no better solution at present. If broadcast notification is adopted, it is necessary to notify all remote home access authentication servers interconnected with the local home access authentication server, which is costly and consumes more resources, and is not suitable for practical application.

Contents of the invention

The problem to be solved by the present invention is to provide an access authentication processing method, system and device, which enable the authentication server of the local home access network of the roaming user terminal to effectively locate the authentication server of the remote home access network to which the user terminal currently belongs. server, and then perform corresponding operations.

An access authentication processing method provided to achieve the purpose of the present invention includes the following steps:

In step A, the authentication server of the local home access network of the user terminal records user affiliation information; the user affiliation information includes roaming IP address attribute information and roaming IP type attribute information.

Step B, when the user terminal's local home access network authentication server changes the user terminal's access network, it updates and stores the user's affiliation information according to the user's current access network, and stores the user's affiliation information in the user terminal's registration information or access network information. When a change occurs, actively send a notification to the access network authentication server to perform authentication operations.

In the step A, the authentication server of the local home access network of the user terminal records the user home information, including the following situations:

If the user terminal accesses the local home access network at the local home access authentication server, the roaming IP address attribute information stores the IP address information of the local home access network; the roaming IP type attribute information records the local home access network Network access type information;

If the user terminal accesses the access network while roaming in another place, the roaming IP address attribute information record stores the IP address information of the remote home access network authentication server; and the roaming IP type attribute information record stores the remote home access network authentication server. Authorization server type information.

Said step B may comprise the following steps:

Step B1, the local home access network authentication server of the user terminal maintains and manages the roaming IP address attribute information and the roaming IP type attribute information of the user terminal;

Step B2, when the registration information of the user terminal changes, actively notify the current remote home access network authentication server where the roaming user terminal is located, and perform the authentication operation again; or when the access network of the user terminal changes, Notify the original remote home access network to delete the user terminal identity information saved in the original home access network of the user terminal, and notify the original access network authentication server that the next time the user terminal enters the original access network, it needs to re- An authentication operation is performed, and the registration information is the registration information of the authentication server of the access network to which the user terminal belongs locally.

In the step B, the user terminal's local home access network authentication server maintains and manages the recorded user home information, which may include the following steps:

When the user terminal returns to the local area from a different place and accesses the local home access network, the roaming IP address attribute information is updated to store the IP address information of the local home first access network; and the roaming IP type attribute information is updated and stored as the local home network. Access network type information;

When a user roams from a local to a different place and accesses the remote home access network, the roaming IP address attribute information is updated to store the IP address information of the remote home access network authentication server; and the roaming IP type attribute information is updated to store the remote home access network. Network access authentication server type information;

When a user roams from a different place to a new one and accesses a new access network belonging to the other place, the roaming IP address attribute information is updated to store the IP address information of the new access network authentication server belonging to the new remote place; and the roaming IP type The attribute information is updated to store the type information of the new access network authentication server belonging to the remote location.

In the step B, when the registration information of the user terminal or the access network changes, actively sending a notification to the access network authentication server to perform the authentication operation may include the following steps:

When the user returns to the local home from a different place and accesses the local home access network, the local home access network authentication server of the user terminal notifies the user terminal of the home The home access network clears the user information;

When a user roams from a different place to a different place and accesses a new remote home access network, the local home access network authentication server of the user terminal notifies the user terminal of the remote home access network authentication server where the user terminal originally roamed and the original roaming location The remote home access network clears user information.

In the step B, when the registration information of the user terminal or the access network changes, actively sending a notification to the access network authentication server to perform the authentication operation may also include the following steps:

When the user terminal roams from the local to a different place and accesses the remote home access network, the authentication server of the user terminal's local home access network notifies the user that the local home access network needs to re-authenticate the next time the user terminal accesses locally .

In the step B, when the user terminal changes, actively send a notification to perform the change operation, and may further include the following steps:

When a user terminal enters another remote home access network from one remote home access network, the authentication server of the new remote home access network notifies the original remote home access network of the user terminal, and the next time the user terminal is in the original remote home access network An authentication operation is required when the home access network accesses.

In order to achieve the purpose of the present invention, an access authentication processing system is also provided, including a user terminal, a local home access network where the user terminal is located, an authentication server of the local home access network where the user terminal is located, and a plurality of different locations where the user terminal is located. The home access network, and multiple remote home access network authentication servers where the user terminal is located, the local home access network authentication server includes a user home information recorder and an authentication processor; wherein:

The user affiliation information recorder is configured to record user affiliation information, and the user affiliation information includes roaming IP address attribute information and roaming IP type attribute information;

The authentication processor is configured to update and store the user affiliation information recorded in the user information recorder according to the current access network of the user when the access network of the user terminal changes, and to store the user affiliation information recorded in the user terminal's registration information or access network. When the access network changes, it actively sends a notification to the access network authentication server for authentication operations.

The access authentication processing system is characterized in that the local home access network authentication server further includes a database unit, and the user attribution information recorder is located in the database unit of the local home first access network authentication server middle.

The maintenance and management of the user affiliation information recorded in the user information recorder refers to updating the user affiliation information when the user terminal's affiliation access network changes.

When the registration information of the user terminal or the access network changes, actively sending a notification to the access network authentication server to perform authentication operations includes the following situations:

If the access network of the user terminal changes, a notification is actively sent to the original access network authentication server to notify the original access network to delete the user terminal identity information stored in the original home access network of the user terminal.

When the registration information of the user terminal or the access network changes, actively sending a notification to the access network authentication server to perform the authentication operation also includes the following situations:

If the registration information of the user terminal changes, a notification is actively sent to the authentication server of the access network where the user terminal is located, and the access network is notified to perform the authentication process again. The registration information is the access network to which the user terminal belongs locally. Registration information of the authentication server.

When the registration information of the user terminal or the access network changes, actively sending a notification to the access network authentication server to perform the authentication operation further includes the following situations:

When the access network of the user terminal changes, the authentication server of the original access network is notified, and the authentication operation needs to be performed again when the user terminal enters the original access network next time.

In order to realize the purpose of the present invention, an access network authentication server is further provided, which is characterized in that it includes a user attribution information recorder and an authentication processor; wherein:

The user affiliation information recorder is configured to record user affiliation information, and the user affiliation information includes roaming IP address attribute information and roaming IP type attribute information;

The authentication processor is configured to update and store the user affiliation information recorded in the user information recorder according to the current access network of the user when the access network of the user terminal changes, and to store the user affiliation information recorded in the user terminal's registration information or access network. When the access network changes, it actively sends a notification to the access network authentication server for authentication operations.

The access network authentication server further includes a database unit, and the user attribution information recorder is located in the database unit of the local home access network authentication server.

The beneficial effects of the present invention are: through the access authentication processing method, system and device of the present invention, the legitimacy information of the remote roaming user terminal can be notified in time to the local home access network and the remote home access network, protecting the interests of legitimate users , to avoid the time difference in the determination of the user's home access network, not to give illegal users an opportunity, and to optimize the use of system resources. Its cost is small, occupies less resources, and is suitable for practical application.

Description of drawings

Fig. 1 is a flow chart of the access authentication processing method of the present invention;

Fig. 2 is the specific process flowchart of step S200 in Fig. 1;

Fig. 3 is the flow chart of the authentication server authentication of the access network authentication server in the CDMA2000-EVDO mobile communication system where the roaming user terminal initiates a call;

Fig. 4 is the flow chart that the registration information of the roaming user terminal 76 in the CDMA2000-EVDO mobile communication system is changed, and the authentication server of the remote home access network is actively notified to perform re-authentication processing;

Fig. 5 is a flow chart of access authentication processing for a user terminal roaming in the CDMA2000-EVDO mobile communication system to return to the local area from a different place and access the first access network of the local home;

6 is a flow chart of access authentication when a roaming user roams between access networks belonging to different places in the CDMA2000-EVDO mobile communication system;

Fig. 7 is a schematic structural diagram of the access authentication processing system of the present invention.

Detailed ways

In order to make the purpose, technical solution and advantages of the present invention clearer, an access authentication processing method, system and device of the present invention will be further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described here are only used to explain the present invention, not to limit the present invention.

The embodiment of the present invention is described in terms of a method, system and device for implementing access authentication processing initiated by an access network authentication server for roaming users in a CDMA2000-EVDO mobile communication system. It should be noted that although the embodiments of the present invention have been described with reference to terrestrial wireless communication systems such as CDMA2000-EVDO mobile communication systems, it should be understood that the present invention can also be used in other wired and wireless communication systems, such as in In the satellite communication system; It should also be understood that the embodiment of the present invention can also be used in many alternative wireless communication systems, such as broadcast communication system, global system for mobile communication (Global System Mobile, GSM), code division multiple access (CodeDivision Multiple Access (CDMA) communication system, Wideband Code Division Multiple Access (WCDMA) communication system, Time-Division Synchronization Code Division-Multiple-Access (TD-SCDMA) communication system, Or in other known access authentication applications in wireless communication systems.

In the following description of the implementation of the present invention, it is set in order to better understand the present invention (but not limit the present invention):

The local home authentication server of the user terminal is the first access network authentication server (AN-AAA1);

The local home access network of the user terminal is the first access network (AN1);

The remote home authentication server of the user terminal is the second access network authentication server (AN-AAA2), ..., the nth access network authentication server (AN-AAAn);

The remote home access network of the user terminal is the second access network (AN2), ..., the nth access network (ANn).

An access authentication processing method of the present invention is described in detail below:

As shown in Figure 1, the access authentication processing method of the present invention includes the following steps:

In step S100, the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76 records the user's home information.

In the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76, add user attribution information to each user terminal information managed by the database, that is, add roaming IP address (RoamIPAddress) attribute information and roaming IP Type (RoamIPType) attribute information, which records the user's attribution information;

Roaming IP address (RoamIPAddress) attribute information is used to record and store IP address information; roaming IP type (RoamIPType) attribute information is used to record and store type information.

If the user terminal 76 accesses the first local access network 71 (AN1) at the local home first access authentication server (AN-AAA1), the roaming IP address (RoamIPAddress) attribute information stores the local home first access network 71 (AN1). The IP address information of the access network 71 (AN1), and the roaming IP type (RoamIPType) attribute information records the first access network 71 (AN1) type information of the local home;

If the user terminal 76 roams in different places and accesses the nth access network 710 (ANn) belonging to different places, then the roaming IP address (RoamIPAddress) attribute information record stores the nth access network authentication server 79 (AN-AAAn) belonging to different places ) IP address information; and the roaming IP type (RoamIPType) attribute information records and stores the type information of the nth access network authentication server 79 (AN-AAAn) belonging to a different place.

In step S200, the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76 maintains and manages the recorded user affiliation information, and actively sends a notification to perform a change operation when the user terminal 76 changes.

If the access network of the user terminal 76 changes, a notification is actively sent to the original access network authentication server to notify the original access network to delete the user terminal identity information stored in the original home access network of the user terminal 76.

Preferably, when the access network of the user terminal 76 changes, the authentication server of the original access network is notified, and the authentication operation needs to be performed again when the user terminal 76 enters the original access network next time.

If the registration information of the user terminal 76 changes, a notification is actively sent to the authentication server of the access network where the user terminal 76 is located, and the access network is notified to perform authentication processing again.

As shown in Figure 2, step S200 specifically includes the following steps:

Step S210, the local home first access network authentication server 72 of the user terminal 76 maintains and manages the roaming IP address (RoamIPAddress) attribute information and the roaming IP type (RoamIPType) attribute information of the user terminal 76, to ensure that the attribute information is updated in time;

The local home first access network authentication server 72 of the user terminal 76 maintains and manages the user affiliation information of the user terminal, including roaming IP address (RoamIPAddress) attribute information and roaming IP type (RoamIPType) attribute information, which means that the user terminal 76 belongs to When the access network changes, the user attribution information is updated.

The step S210 includes the following situations:

When the user terminal 76 returns to the local area from a different place and accesses the local home first access network 71 (AN1), the roaming IP address (RoamIPAddress) attribute information is updated to store the IP address of the local home first access network 71 (AN1). Address information; and the roaming IP type (RoamIPType) attribute information is updated and stored as the first access network 71 (AN1) type information of local attribution;

When the user roams from this place to another place and accesses the second access network 78 (AN2) belonging to the other place, the roaming IP address (RoamIPAddress) attribute information is updated and stored in the second access network authentication server 77 (AN-2) belonging to the other place. AAA2) IP address information; and the roaming IP type (RoamIPType) attribute information updates and stores the type information of the second access network authentication server 77 (AN-AAA2) belonging to the remote place;

When the user roams from a different place to a new one and accesses the nth access network 710 (ANn) belonging to the different place, the roaming IP address (RoamIPAddress) attribute information is updated and stored in the nth access network authentication server 79 of the new belonging to the different place (AN-AAAn) IP address information; and the roaming IP type (RoamIPType) attribute information is updated to store the type information of the nth access network authentication server 79 (AN-AAAn) belonging to a different place.

Step S220, when the user terminal 76 is changed, actively send a notification to perform the change operation. That is, when the registration information of the user terminal 76 changes, actively notify the current non-locally belonging nth access network authentication server 79 (AN-AAAn) where the roaming user terminal 76 is located, and perform the authentication operation again; or the user terminal When the access network of 76 changes, notify the original non-locally belonging nth access network 710 (ANn) to delete the user terminal identity information stored in the originally belonging nth access network 710 (ANn) of the user terminal 76, and notify the original The authentication server of the access network needs to perform the authentication operation again when the user terminal 76 enters the original access network next time.

The step S220 includes the following situations:

When the registration information of the local first access network authentication server 72 (AN-AAA1) of the user terminal 76 changes, the first local access network authentication server 72 (AN-AAA1) of the user terminal 76 notifies The nth access network authentication server 79 (AN-AAAn) belonging to the remote location where the user terminal 76 roams initiates a re-authentication operation for the user;

When the user terminal 76 roams from the local to a different place and accesses the remote second access network 78 (AN2), the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76 notifies the user of the local home network. The first access network 71 (AN1) needs to re-authenticate when the user terminal 76 accesses locally next time;

When the user returns to the local area from a different place and accesses the local home first access network 71 (AN1), the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76 notifies the user terminal 76 that the original roaming The nth access network authentication server 79 (AN-AAAn) belonging to the remote place where it is located and the nth access network 710 (ANn) belonging to the remote place where the original roaming is located clear user information;

When a user roams from another place to another place and accesses the remote nth access network 710 (ANn), the local first access network authentication server 72 (AN-AAA1) of the user terminal 76 notifies the user terminal 76 of the original roaming The remote nth access network authentication server 79 (AN-AAAn) and the original roaming remote nth access network 710 (ANn) clear user information.

The following takes the CDMA2000-EVDO mobile communication system as an example to describe in detail the flow of authentication processing for remote access of the roaming user terminal 76 in the authentication processing method of the embodiment of the present invention. As shown in FIG. 3 , it is a flow chart of the roaming user terminal 76 in the CDMA2000-EVDO mobile communication system making a call from another place and the access network authentication server authenticating. It specifically includes the following steps:

Step a1, the user roams from the original local first access network 71 (AN1) to the remote second access network 78 (AN2), and prepares to make a call;

In step b1, the roaming user terminal 76 initiates a call in a different place, and the second access network 78 (AN2) to which the user terminal 76 belongs in a different place creates identity information for the user terminal 76 . Owing to be that the user terminal 76 of roaming newly logs in, so need to authenticate;

Step c1, the second access network authentication server 77 (AN-AAA2) belonging to the remote place where the user terminal 76 is roaming receives the authentication request, and determines that the user terminal 76 is a roaming user through message analysis, and then according to the analysis result, the The request is sent to the domain specified in the message;

Step d1, the access authentication request is forwarded to the local home first access network 71 (AN1) where the roaming user terminal 76 is located;

In step e1, the local home first access network 71 (AN1) judges the originally stored attribute information data before saving the attribute information. Since the user terminal 76 is roaming from local to different places, the IP address information and the local home first access network 71 (AN1) should be stored in the roaming IP address (RoamIPAddress) attribute information and the roaming IP type (RoamIPType) attribute information. Access network 71 (AN1) type information. In this case, the information needs to be temporarily stored first, and discarded after notifying the local home first access network 71 (AN1). The local first access network authentication server 72 (AN-AAA1) of the user terminal 76 updates and stores the roaming IP address (RoamIPAddress) attribute information of the user terminal 76 in the database as the second access network authentication server of the remote home 77 (AN-AAA2) IP address information; and the roaming IP type (RoamIPType) attribute information is updated and stored as the type information of the second access network authentication server 77 (AN-AAA2) belonging to another place. At the same time, according to the access request, the user is authenticated;

Step f1, the user's access authentication is successful, then notify the second access network authentication server 77 (AN-AAA2) belonging to the remote place, and turn to step g1; if the authentication fails, then send a notification to reject the user's access, If the roaming user identity information exists in the second access network 78 (AN2) belonging to another place, it will be notified to delete it. At the same time, the local home first access network 71 of the user terminal 76 is notified that an authentication operation is required for the next user access.

Step g1, the authentication server 77 (AN-AAA2) of the second access network belonging to the remote place forwards the notification that the authentication is successful and the access is allowed to the second access network 78 (AN2) of the roaming user terminal 76 currently belonging to the remote place;

In step h1, the roaming user terminal 76 starts to perform normal EVDO service flow with the remote second access network 78 (AN2).

Taking the CDMA2000-EVDO mobile communication system as an example below, in the authentication processing method of the embodiment of the present invention, the registration information of the roaming user terminal 76 in the local home first access network authentication server 72 (AN-AAA1) When a change occurs, actively notify the authentication server 79 (AN-AAAn) of the nth access network at which the roaming user terminal 76 is located to stimulate the user to re-authenticate the roaming user terminal 76 at the nth access network 710 (ANn) at which the user belongs to another place. rights handling process. As shown in FIG. 4 , it is a flow chart of the registration information of the roaming user terminal 76 in the CDMA2000-EVDO mobile communication system being changed, and actively notifying the remote home access network authentication server to perform re-authentication processing.

It specifically includes the following steps:

Step a2, the user terminal 76 is in the roaming state, and the user registration information in the local home first access network authentication server 72 (AN-AAA1) changes, such as withdrawing from the network, and the quality of service (Quality of Service, QoS) level changes , permission changes, etc.;

Step b2, the local home first access network authentication server 72 (AN-AAA1) of the user terminal 76, according to the database of the first home access network authentication server 72 (AN-AAA1) of the user terminal 76 The roaming IP address (RoamIPAddress) attribute information and the roaming IP type (RoamIPType) attribute information record of recording in, determine that the user terminal 76 is currently in the roaming state and the remote home of the user terminal 76 of roaming The nth access network 710 (ANn) and the first n access network authentication server 79 (AN-AAAn), immediately sends a notification;

In step c2, the remote home nth access network authentication server 79 (AN-AAAn) of the roaming user terminal 76 immediately notifies the roaming user's current home remote nth access network 710 (ANn).

In step d2, the remote home nth access network 710 (ANn) to which the roaming user currently belongs initiates a re-authentication operation for the user terminal 76 .

In step e2, the roaming user terminal 76 restarts the remote authentication process. See the process shown in Figure 3.

The following takes the CDMA2000-EVDO mobile communication system as an example to describe in detail the authentication processing method of the embodiment of the present invention, the roaming user terminal 76 returns to the local area from a different place, and accesses the access authentication processing of the local home access network process. As shown in FIG. 5 , it is a flow chart of the access authentication process for the user terminal 76 roaming in the CDMA2000-EVDO mobile communication system to return to the home from a different place and access the first access network 71 (AN1) of the home.

It specifically includes the following steps:

Step a3, the roaming user terminal 76 returns to the first access network 71 (AN1) of the local home from the non-local home nth access network 710 (ANn), and is no longer in the roaming state;

In step b3, the user terminal 76 initiates a call to the local first access network 71 (AN1). Since the locally owned first access network authentication server 72 (AN-AAA1) has notified the locally owned first access network 71 (AN1) that authentication is required for the next user access when it is determined that the user is roaming, the locally owned The first access network 71 (AN1) needs to initiate an authentication request to the first access network authentication server 72 (AN-AAA1);

Step c3, the local first access network 71 (AN1) initiates an authentication request to the local first access network authentication server 72 (AN-AAA1);

In step d3, the locally owned first access network authentication server 72 (AN-AAA1) determines that the user terminal 76 is not a roaming user terminal, but the roaming IP address (RoamIPAddress) attribute information and the roaming IP type (RoamIPType) attribute information store the user The roaming IP address information and the roaming IP type information of the nth access network authentication server 79 (AN-AAAn) in the remote place where the terminal 76 roams originally, then temporarily store this information, and send the remote data to the remote place where the user terminal 76 roamed originally. The home nth access network authentication server 79 (AN-AAAn) sends the notification and discards it. Then the roaming IP address (RoamIPAddress) attribute information is updated and stored as the IP address information of the first access network 71 (AN1) at home; and the roaming IP type (RoamIPType) attribute information is updated and stored as the first access network 71 (AN1) ) type information;

Step e3, the local first access network authentication server 72 (AN-AAA1) notifies the user terminal 76 of the original roaming location nth access network authentication server 79 (AN-AAAn), so that the user terminal 76 originally roams The remote home nth access network 710 (ANn) where the roaming is located clears the identity information of the user. At the same time, the authentication result is sent to the first access network 71 (AN1), if it is allowed, it can be accessed, and if it is denied, it cannot be accessed.

Step f3, after receiving the notification, the remote home nth access network 710 (ANn) where the user terminal 76 originally roamed deletes the identity information created and retained by the remote home nth access network 710 (ANn) where the user terminal originally roamed .

Taking the CDMA2000-EVDO mobile communication system as an example, the following describes in detail the access authentication process of the roaming user roaming between access networks belonging to different places in the authentication processing method of the embodiment of the present invention. As shown in FIG. 6 , it is a flow chart of access authentication when a roaming user roams between access networks belonging to different places in the CDMA2000-EVDO mobile communication system.

It specifically includes the following steps:

Step a4, the roaming user terminal 76 roams from the remote home nth access network 710 (ANn) to the remote home second access network 78 (AN2)

Step b4, the roaming user terminal 76 initiates a call at the new remote home second access network (AN2), and the remote home second access network (AN2) will create identity information for it, since the roaming user terminal 76 newly logs in , so authentication is required.

Step c4, the second access network authentication server (AN-AAA2) belonging to the remote place receives the authentication request, determines that the user is a roaming user through message analysis, and then sends the request to the domain specified in the message according to the analysis result;

Step d4, the access authentication request is forwarded to the local home first access network authentication server 72 (AN-AAA1) where the roaming user terminal 76 is located;

Step e4, the local home first access network authentication server 72 (AN-AAA1) where the user terminal 76 is located determines that the user terminal 76 has roamed to different remote home access networks, but the roaming IP address (RoamIPAddress) attribute information and roaming The IP type (RoamIPType) attribute information still stores the roaming IP address information and roaming IP type information of the nth access network authentication server (AN-AAAn) when the user originally roams, then temporarily stores this information, and returns to the remote home The nth access network authentication server (AN-AAAn) discards after sending the notification. Then the roaming IP address (RoamIPAddress) attribute information is updated as the IP address of the second access network authentication server (AN-AAA2) of the new remote home; and the roaming IP type (RoamIPType) attribute information is updated as the new remote home The second access network authentication server (AN-AAA2) type; at the same time, according to the access request, the user is authenticated;

Step f4, the first local access network authentication server 72 (AN-AAA1) notifies the user terminal 76 of the original roaming location nth access network authentication server (AN-AAAn), so that the user terminal 76 originally roams The remote belonging nth access network (ANn) clears the identity information of the user;

Step g4, after receiving the notification, the nth access network (ANn) belonging to the remote place deletes the identity information created and retained by the nth access network (ANn) belonging to the remote place for the original roaming user terminal 76;

In step h4, if the access authentication of the user is successful, the new second access network authentication server (AN-AAA2) belonging to another place is notified. If the authentication fails, a notification is sent to deny user access, and if the roaming user identity information already exists in the new remote second access network (AN2), it is deleted.

Preferably, the following steps are also included: the first access network authentication server (AN-AAA1) of the local home notifies the original remote home of the user terminal 76 to the nth access network (ANn), and the next time the user terminal 76 is in the original An authentication operation needs to be performed when accessing the first access network (ANn) belonging to a remote location;

Step i4, the new second access network authentication server (AN-AAA2) belonging to another place forwards the notification of successful authentication and access permission to the second access network (AN2) to which the roaming user terminal 76 currently belongs;

In step j4, the roaming user terminal 76 starts to perform EVDO service with the new second access network authentication server (AN-AAA2) belonging to another place.

What needs to be explained here is that steps f4-g4 and steps h4-i4 can be performed simultaneously without affecting the execution of the flow. It is not intended to limit the implementation process of the present invention.

Corresponding to the access authentication processing method of the present invention, the present invention also provides an access authentication processing system.

As shown in FIG. 7 , the access authentication processing system of the present invention includes a user terminal 76, a local home first access network 71 (AN1) where the user terminal 76 is located, and a local home first access network where the user terminal 76 is located. Authentication server 72 (AN-AAA1), a plurality of remote homed nth access networks 710 (ANn) where user terminal 76 is located, and multiple remote homed nth access network authentication servers 79 (ANn) where user terminal 76 is located -AAAn), wherein the first access network authentication server 72 (AN-AAA1) includes a user affiliation information recorder 74 and an authentication processor 75 .

The user affiliation information recorder 74 is configured to record user affiliation information; the user affiliation information includes roaming IP address (RoamIPAddress) attribute information and roaming IP type (RoamIPType) attribute information. The user attribution information recorder 74 is located in the database unit 73 of the local attribution first access network authentication server 72 .

The authentication processor 75 is used to maintain and manage the user affiliation information recorded in the user information recorder, and actively send a notification to the access network authentication server for operation when the information of the user terminal 76 changes.

Maintaining and managing the user affiliation information recorded in the user information recorder refers to updating the user affiliation information when the access network to which the user terminal 76 belongs changes. two

If the access network of the user terminal 76 changes, the authentication processor 75 actively sends a notification to the original access network authentication server, notifying the original access network to delete the user terminal 76 . The user terminal identity information stored in the original home access network.

Preferably, when the access network of the user terminal 76 changes, the authentication processor 75 notifies the original access network authentication server that the authentication operation needs to be performed again when the user terminal 76 enters the original access network next time. .

If the registration information of the user terminal 76 changes, the authentication processor 75 actively sends a notification to the access network authentication server where the user terminal 76 is located, and notifies the access network to perform authentication processing again.

The access authentication processing method, system and device of the present invention can realize the timely notification of the legality information of the remote roaming user terminal 76 to the local home access network and the remote home access network, protect the interests of legitimate users, and prevent users from belonging to the access network. The time difference in judgment will not give illegal users an opportunity to take advantage of, and at the same time help optimize the use of system resources. Its cost is small, occupies less resources, and is suitable for practical application.

The working process of the access authentication processing system of the present invention is the same as that of the aforementioned access authentication processing method, so no detailed description will be given in the embodiments of the present invention.

Since the embodiments of the present invention provide a description of the foregoing preferred embodiments to enable anyone skilled in the art to reproduce the present invention. Various modifications to these embodiments within the scope of the claims of the present invention, if it is obvious to those skilled in the art, or the technical solutions provided here can be applied to other embodiments without creative work, then All within the protection scope of the present invention. Therefore, the present invention is not limited to the embodiments shown here, but should encompass the broadest scope consistent with the technical features of the claims disclosed herein.

Claims (10)

1. An access authentication processing method, characterized in that, comprising the following steps: Step A, the local home access network authentication server of the user terminal records user attribution information, and the user attribution information includes roaming IP address attribute information and roaming IP type attribute information; Step B1, when the user terminal's local home access network authentication server changes the user terminal's access network, it updates and stores the user's attribution information according to the current access network of the user; Step B2, when the registration information of the user terminal changes, actively notify the current remote home access network authentication server where the roaming user terminal is located, and perform the authentication operation again; or when the access network of the user terminal changes, Notify the original remote home access network to delete the user terminal identity information saved in the original home access network of the user terminal, and notify the original access network authentication server that the next time the user terminal enters the original access network, it needs to re- An authentication operation is performed, and the registration information is the registration information of the authentication server of the access network to which the user terminal belongs locally. 2. The access authentication processing method according to claim 1, wherein in said step A, the local home access network authentication server of the user terminal records the user home information, comprising the following steps: If the user terminal accesses the local home access network at the local home access authentication server, the roaming IP address attribute information stores the IP address information of the local home access network; the roaming IP type attribute information records the local home access network Network access type information; If the user terminal accesses the access network while roaming in another place, the roaming IP address attribute information record stores the IP address information of the remote home access network authentication server; and the roaming IP type attribute information record stores the remote home access network authentication server. Authorization server type information. 3. The access authentication processing method according to claim 1 or 2, wherein the step B1 comprises the following steps: When the user terminal returns to the local area from a different place and accesses the local home access network, the roaming IP address attribute information is updated to store the IP address information of the local home access network; and the roaming IP type attribute information is updated and stored as the local home access network network type information; When a user roams from a local to a different place and accesses the remote home access network, the roaming IP address attribute information is updated to store the IP address information of the remote home access network authentication server; and the roaming IP type attribute information is updated to store the remote home access network. Network access authentication server type information; When a user roams from a different place to a new one and accesses a new access network belonging to the other place, the roaming IP address attribute information is updated to store the IP address information of the new access network authentication server belonging to the new remote place; and the roaming IP type The attribute information is updated to store the type information of the new access network authentication server belonging to the remote location. 4. The access authentication processing method according to claim 1 or 2, characterized in that, in the step B2, the original remote home access network is notified to delete the user terminal stored in the original home access network of the user terminal Identity information, including: When the user returns to the local home from a different place and accesses the local home access network, the local home access network authentication server of the user terminal notifies the user terminal of the home The home access network clears the user information; When a user roams from a different place to a different place and accesses a new remote home access network, the local home access network authentication server of the user terminal notifies the user terminal of the remote home access network authentication server where the user terminal originally roamed and the original roaming location The remote home access network clears user information. 5. The access authentication processing method according to claim 4, characterized in that, in the step B2, the original access network authentication server is notified that authentication needs to be performed again when the user terminal enters the original access network next time. operations, including: When the user terminal roams from the local to a different place and accesses the remote home access network, the authentication server of the user terminal's local home access network notifies the user that the local home access network needs to re-authenticate the next time the user terminal accesses locally . 6. The access authentication processing method according to claim 5, characterized in that, in the step B2, the original access network authentication server is notified that authentication needs to be performed again when the user terminal enters the original access network next time. rights to operate, including: When a user terminal enters another remote home access network from one remote home access network, the authentication server of the local home access network notifies the original remote home access network of the user terminal, and the next time the user terminal enters another remote home access network. Authentication is required when accessing the network. 7. An access authentication processing system, comprising a user terminal, a local home access network where the user terminal is located, an authentication server of the local home access network where the user terminal is located, multiple remote home access networks where the user terminal is located, And multiple remote home access network authentication servers where the user terminal is located, wherein the local home access network authentication server includes a user home information recorder and an authentication processor; wherein: The user affiliation information recorder is configured to record user affiliation information, and the user affiliation information includes roaming IP address attribute information and roaming IP type attribute information; The authentication processor is configured to update and store the user affiliation information recorded in the user information recorder according to the current access network of the user when the access network of the user terminal changes, and is also configured to: If the registration information of the user terminal changes, a notification is actively sent to the authentication server of the access network where the user terminal is located, and the access network is notified to perform the authentication process again. The registration information is the access network to which the user terminal belongs locally. Registration information of the authentication server; If the access network of the user terminal changes, it will actively send a notification to the original access network authentication server, notify the original access network to delete the user terminal identity information stored in the original home access network of the user terminal, and notify The original access network authentication server needs to perform the authentication operation again when the user terminal enters the original access network next time. 8. The access authentication processing system according to claim 7, wherein the local home access network authentication server further includes a database unit, and the user attribution information recorder is located in the local home access network authentication server. In the database unit of the server. 9. An access network authentication server, characterized in that it includes a user attribution information recorder and an authentication processor; wherein: The user affiliation information recorder is configured to record user affiliation information, and the user affiliation information includes roaming IP address attribute information and roaming IP type attribute information; The authentication processor is configured to update and store the user affiliation information recorded in the user information recorder according to the current access network of the user when the access network of the user terminal changes, and is also configured to: If the registration information of the user terminal changes, a notification is actively sent to the authentication server of the access network where the user terminal is located, and the access network is notified to perform the authentication process again. The registration information is the access network to which the user terminal belongs locally. Registration information of the authentication server; If the access network of the user terminal changes, it will actively send a notification to the original access network authentication server, notify the original access network to delete the user terminal identity information stored in the original home access network of the user terminal, and notify The original access network authentication server needs to perform the authentication operation again when the user terminal enters the original access network next time. 10. The access network authentication server according to claim 9, further comprising a database unit, and the user attribution information recorder is located in the database unit of the local home access network authentication server.

Images