CN1221149C - System and method for public network authentication - Google Patents

Abstract

The invention relates to a public network authentication system, which is characterized by at least comprising: a mobile station; an authentication server; an authentication agent having a subscriber identity module corresponding to the mobile station; wherein the mobile station is authenticated by the authentication agent, which is authenticated by the authentication server using the subscriber identity module. The public authentication system of the invention does not install the user identification module on the mobile station, but installs in the authentication agent, so that the mobile station of the user does not need to change the design, and saves the manufacturing cost of the mobile station. The aim of authenticating the mobile station by the authentication server can also be achieved by the authentication agent performing authentication by the mobile station and the authentication agent performing authentication by the authentication server using the subscriber identity module of the mobile station.

Description

System and method for public network authentication

(1) Technical field

The present invention relates to a public network (Public Network), especially an authentication system and method for a wireless local area network (Wireless Local Area Network, WLAN) to provide public services (Public Services).

(2) Background technology

Since the launch of the Global System for Mobile communication (GSM), wireless communication has made a major breakthrough in security. This breakthrough comes from GSM installing the Subscriber Identity Module (SIM) on the mobile phone to assist the mobile network in Authentication and Encryption. Fig. 1 is a prior art GSM authentication system architecture diagram. The mobile phone 100 is equipped with a SIM card 88 and is authenticated with the GSM network. In the GSM network, the base station 36 (BaseStation, BS) is responsible for exchanging the radio signal from the mobile phone 100 and the wired signal from the mobile switching center (Mobile Switch Center, MSC) 70. The task of the mobile switching center 70 and the visitor location register (Visitor Location Register, VLR) 75 is to authenticate the mobile phone 100. (Mobile switching center 70 and visitor location register 75 are usually designed together). The visitor location register 75 requests the mobile switching center 70 to authenticate the mobile phone 100 whenever the mobile phone 100 requests service. The mobile switching center 70 is responsible for sending an authentication request (AuthenticationRequest) to the mobile phone 100, and receives an authentication response (Authentication Response) from the mobile phone 100, and compares whether the authentication response of the mobile phone 100 is successfully authenticated. If the authentication is successful, the mobile switching center 70 notifies the mobile phone 100 of service acceptance; if it fails, the mobile switching center 70 notifies the mobile phone 100 of service rejection. Among other components of the GSM network, the authentication center (Authentication Center, AuC) 95 is responsible for keeping the authentication key Ki of the mobile phone 100, generating authentication parameters (such as: RAND, SRES, etc.), and passing through the Home Location Register (Home Location Register, HLR) ) 90 to the visitor location register 75. The billing center (Billing Center, BC) 80 accepts the bill (Charging DataRecord) 86 generated by the mobile switching center 70, so as to issue the bill.

In recent years, due to the growth of the wireless local area network (WLAN) market, the wireless local area network can be used to provide public services (Public Services). When the public uses wireless local area network cards to obtain Internet services through public wireless local area networks laid by service providers, security is the most important issue. Therefore, major international manufacturers install SIM cards in WLAN card products to enhance the security of WLANs. FIG. 2 is a structural diagram of a public wireless local area network authentication system in the prior art. This architecture includes four categories of components: client, access network end, Internet end, and GSM core network end. The client component includes a mobile station (Mobile Station, MS) 10 and a wireless local area network card 200, wherein the wireless local area network card 200 has a SIM card 88. The access network end includes a base station (Access Point, AP) 30 of the wireless local area network, a router (Router) 40 and an authentication gateway (Authentication Gateway, AG) 250 . The Internet end includes an Internet 50 and a server (Server) 60 . The components of the GSM core network include a mobile switching center 70, a visitor location register 75, an authentication center 95, a home location register 90 and a billing center 80 (identical to FIG. 1). In the architecture of FIG. 2, if the mobile station 10 passes the authentication, it can have the access right of the base station 30 and the router 40, connect to the Internet 50, and obtain the Internet service of the server 60. During the authentication process, when the mobile station 10 needs Internet services, it sends a service request (Service Request) to the authentication gateway 250. The authentication gateway 250 forwards the service request to the visitor location register 75, and the visitor location register 75 requires the mobile switching center 70 to issue an authentication request to the mobile station 10. The authentication request is forwarded to the mobile station 10 via the authentication gateway 250 , and the mobile station 10 executes an authentication response according to the SIM card 88 of the WLAN card 200 . The authentication response is forwarded to the mobile switching center 70 via the authentication gateway 250 to compare whether the authentication is successful. If the authentication is successful, the mobile switching center 70 notifies the authentication gateway 250 of service acceptance (Services Accept), and the authentication gateway 250 opens the mobile station 10 to use the base station 30 and the router 40 to connect to the Internet 50; if it fails, the mobile switching center 70 notifies the authentication Gateway 250 Service Reject (ServicesReject). When the mobile station 10 is successfully authenticated, the router 40 generates usage records, and the authentication gateway 250 generates a bill 86 to the billing center 80 according to these usage records. Therefore, the task of the authentication gateway is mainly to process the service requirements of the mobile station, forward the authentication signaling between the mobile station and the mobile switching center, control the use right of the mobile station to connect to the Internet, and generate bills to the billing center.

Since the wireless local area network card 200 in FIG. 2 embeds the SIM card 88, the design complexity of the wireless local area network card is increased. Therefore, some manufacturers seek to make the mobile station have the function of the SIM card without changing the design of the existing WLAN card. Mobile station 10 as shown in Figure 3 is equipped with WLAN card 20, and reads the data of SIM card 88 through computer interface 300 (such as: PCMCIA, USB, RS232 etc.) in addition, to authenticate to the network. (The network side components in Figure 3 are exactly the same as those in Figure 2).

It is obvious from FIG. 1 , FIG. 2 and FIG. 3 that the SIM card 88 is embedded in the client device. These client devices are, for example, the mobile phone 100 in FIG. 1 , the WLAN card 200 in FIG. 2 , and the notebook computer mobile station 10 in FIG. 3 . In these previous authentication systems, a client device uses a SIM card to authenticate with an authentication server (Authentication Server, such as: a mobile switching center). However, if the SIM card is embedded in the client device, a SIM card slot must be designed in the client device, which will increase the design complexity and cost of the client device.

(3) Contents of the invention

The object of the present invention is to propose a system and method for public wireless network authentication, which can avoid changing the design of client devices, reduce the cost of client devices, and enable public wireless network authentication.

The public network authentication system of the present invention is characterized in that the system at least includes: a mobile station; an authentication server; an authentication agent, equipped with a subscriber identification module corresponding to the mobile station; wherein the mobile station is controlled by the mobile station Authentication is performed by an authentication agent, which is authenticated by the authentication server using the subscriber identity module.

The mobile station does not need to install a Subscriber Identity Module (SIM card), but the SIM card of the mobile station is installed on the authentication agent, which makes the mobile station authenticated by the authentication agent, which uses the authentication agent The SIM card of the mobile station is authenticated by the authentication server. In addition, the authentication agent is also responsible for processing the service requirements of the mobile station, controlling the use right of the mobile station to connect to the Internet, and generating bills to the billing center.

In order to further illustrate the purpose, structural features and effects of the present invention, the present invention will be described in detail below in conjunction with the accompanying drawings.

(4) Description of drawings

Fig. 1 is a prior art GSM authentication system architecture diagram.

FIG. 2 is a structural diagram of a public wireless local area network authentication system in the prior art.

FIG. 3 is a structural diagram of a public wireless local area network authentication system in the prior art.

FIG. 4 is a structure diagram of the public wireless network authentication system of the present invention.

FIG. 5 is a signaling flow chart (Signaling Flow Chart) of the general mobile station authentication system of the present invention.

FIG. 6 is a signaling flow chart of the roaming mobile station in the authentication system of the present invention.

(5) specific implementation

FIG. 4 is a structure diagram of the public wireless network authentication system of the present invention. This architecture includes five categories of components: client, access network end, external access network end, Internet end, and GSM core network end. The client component includes a mobile station (Mobile Station, MS) 10 and a wireless local area network card 20. The access network end includes a WLAN base station 30 , a router 40 and an authentication agent (AuthenticationAgent, AA) 800 . Wherein, the authentication agent 800 is connected to a SIM card slot 888 through a computer interface 886, and the SIM card slot 888 includes a SIM card 88 and the like. The computer interface 886 can be RS232, USB, PCI bus, or PCMCIA, etc., so that the authentication agent 800 can read the authentication information of the SIM card 88 . The external access network includes a WLAN base station 35 , a router 45 and an Access Right Controller (ARC) 600 . The Internet side includes the Internet 50 and the server 60 . The components on the GSM core network side include a mobile switching center 70, a visitor location register 75, an authentication center 95, a home location register 90, and a billing center 80 (the components on the GSM core network side are exactly the same as in FIG. 1).

In the architecture of FIG. 4 , when the mobile station 10 needs Internet service, the mobile station 10 must authenticate with the authentication agent 800 , and the authentication agent 800 uses the SIM card 88 of the mobile station 10 to authenticate with the mobile switching center 70 . The authentication communication protocol between the mobile station 10 and the authentication agent 800 does not necessarily need a standard (Standard), such as remote authentication embedded user service (Remote Authentication User Service, RADIUS) or Kerberos, and can also be defined by the service provider (Proprietary) . If the authentication of the mobile station 10 fails, the service is rejected. If the mobile station 10 passes the authentication, it can have the right to use the base station 30 and the router 40 , connect to the Internet 50 , and obtain the Internet service of the server 60 . When the mobile station 10 obtains Internet service, the router 40 generates usage records, and the authentication agent 800 generates a bill 86 to the billing center 80 according to the usage records.

Fig. 5 is a signaling flow chart of the authentication system of the present invention. In FIG. 5 , there are three authentication components: a mobile station 10 , an authentication agent 800 , and an authentication server 700 . Wherein, the authentication agent 800 has the SIM card 88 of the mobile station 10, and assists the authentication server 700 to authenticate the mobile station 10 on behalf of the mobile station. The authentication server 700 may be a mobile switching center 70 in the GSM network, responsible for performing authentication on the SIM card 88 . When the mobile station 10 needs Internet service, it sends a service request to the authentication agent 800 (signaling 510), and performs authentication with the authentication agent 800 (signaling 520). If the authentication of the mobile station 10 fails, the service is rejected; if the authentication is successful, the authentication agent 800 sends a service request to the authentication server 700 (signaling 530). The authentication server 700 sends an authentication request (signaling 540) to the authentication agent 800, and the authentication agent 800 executes an authentication response according to the SIM card 88 of the mobile station 10 (signaling 550). After the authentication server 700 receives the authentication response 550, it compares whether the authentication is successful. If the authentication is successful, the authentication server 700 informs the authentication agent 800 that the service is accepted (signaling 560), and the authentication agent 800 notifies the mobile station 10 that the service is accepted (signaling 570), and the authentication agent 800 opens the mobile station 10 to connect Internet; if it fails, the authentication server 700 notifies the authentication agent 800 of the service rejection (signaling 580), and the authentication agent 800 notifies the mobile station 10 of the service rejection (signaling 590).

Therefore, the authentication agent of the authentication system of the present invention has the SIM card of the mobile station, and its tasks include processing the service requirements of the mobile station, authenticating with the mobile station, authenticating with the authentication server (such as: mobile switching center), and controlling the mobile station to connect to the Internet. Use rights, and generate bills to the billing center, etc.

In the Figure 4 architecture, mobile station 10 may roam to foreign access networks. If the mobile station 10 needs Internet service, it must first obtain the right to use the base station 35 and the router 45 . In the external access network, the usage rights of the base station 35 and the router 45 are monitored by the usage rights controller 600 . Therefore, the mobile station 10 must issue a service request to the usage right controller 600 until the service acceptance of the usage right controller 600 is obtained.

FIG. 6 is a signaling flow chart of the roaming mobile station in the authentication system of the present invention. In FIG. 6 , four authentication components are included: a mobile station 10 , a usage right controller 600 , an authentication agent 800 , and an authentication server 700 . When the mobile station 10 roams to an external access network and needs Internet service, the mobile station 10 sends a service request to the usage right controller 600 (signaling 610). The usage right controller 600 then sends a service request to the authentication agent 800 of the mobile station 10 (signaling 615). The authentication agent 800 begins authenticating 620 the mobile station 10 . If the authentication of the mobile station 10 fails, the service is rejected; if the authentication is successful, the authentication agent 800 and the authentication server 700 perform authentication (same as signaling 530~580 in FIG. 5). If the authentication is successful, the authentication agent 800 notifies the right to use controller 600 that the service is accepted (signaling 660), and then the right to use controller 600 notifies the mobile station 10 that the service is accepted (signaling 665), and the right to use controller 600 opens the service The mobile station 10 connects to the Internet; if it fails, the authentication agent 800 notifies the usage right controller 600 of the service rejection (signaling 680), and then the usage right controller 600 notifies the mobile station 10 of the service rejection (signaling 685).

The public authentication system of the present invention does not install the SIM card on the mobile station, but installs it in the authentication agent, so that the design of the user's mobile station does not need to be changed, and the manufacturing cost of the mobile station is saved. The mobile station is authenticated by the authentication agent and the authentication agent uses the SIM card of the mobile station to be authenticated by the authentication server, so that the mobile station is authenticated by the authentication server.

Although the system of this embodiment is applied to a public wireless local area network, it can also be applied to a public wired network.

Of course, those of ordinary skill in the art should recognize that the above embodiments are only used to illustrate the present invention, rather than as a limitation to the present invention, as long as within the scope of the spirit of the present invention, the implementation of the above Changes and modifications of the examples will fall within the scope of the claims of the present invention.

Claims (12)

1. the system of an identifying public network is characterized in that, this system comprises at least:

One travelling carriage;

One certificate server;

One authentication proxy's device possesses and the corresponding subscriber identification module of this travelling carriage;

Wherein this travelling carriage is authenticated by this authentication proxy's device, and this authentication proxy's device uses this subscriber identification module to be authenticated by this certificate server.

2. the system as claimed in claim 1 is characterized in that, this system further comprises:

One access network;

Wherein, this travelling carriage is controlled this access network through this authentication proxy's device authentication success by this authentication proxy's device, connects the Internet to permit this travelling carriage.

3. the system as claimed in claim 1 is characterized in that, this system further comprises:

One booking center;

One router;

Wherein, this authentication proxy's device is controlled this router and is produced bill to this booking center.

4. the system as claimed in claim 1 is characterized in that, this system further comprises:

One external access network comprises a right to use controller;

This travelling carriage roams to this external access network, and this travelling carriage is notified this right to use controller to permit this travelling carriage by this authentication proxy's device and connected the Internet through this authentication proxy's device authentication success.

5. the method for an identifying public network is characterized in that, this method comprises:

One travelling carriage authenticates with one first agreement with the authentication proxy's device that has with the corresponding subscriber identification module of this travelling carriage; And

This authentication proxy's device uses this subscriber identification module and a certificate server to authenticate with one second agreement.

6. method as claimed in claim 5 is characterized in that, this method further comprises:

This travelling carriage, is permitted this travelling carriage and is connected the Internet by this authentication proxy's device control access network through this authentication proxy's device authentication success.

7. method as claimed in claim 5 is characterized in that, this method further comprises:

Control a router by this authentication proxy's device and produce bill to a booking center.

8. method as claimed in claim 5 is characterized in that, this method further comprises:

This travelling carriage roams to an external access network, and this travelling carriage is notified a right to use controller to permit this travelling carriage by this authentication proxy's device and connected the Internet through this authentication proxy's device authentication success.

9. authentication proxy's device of a public network, it is characterized in that, this authentication proxy's utensil has and the corresponding subscriber identification module of a travelling carriage, this authentication proxy's device and this travelling carriage use one first agreement to authenticate, and this authentication proxy's device uses one second agreement to authenticate according to this subscriber identification module and a certificate server.

10. authentication proxy as claimed in claim 9 device is characterized in that, this authentication proxy's device is controlled an access network and connected the Internet to permit this travelling carriage.

11. authentication proxy as claimed in claim 9 device is characterized in that, this authentication proxy's device is controlled a router and is produced bill to a booking center.

12. authentication proxy as claimed in claim 9 device is characterized in that, this authentication proxy's device is notified a right to use controller of an external access network, permits connecting when this travelling carriage roams to this external access network the Internet.

Images