CN101437017A - Method for implementing user and equipment authentication separately employing diameter protocol - Google Patents

Abstract

A method for separately authenticating users and devices using the Diameter protocol. The Authenticator sets the initial state of the Diameter client authentication state machine to IDLE; the Authenticator constructs a corresponding message DER according to the received attribute values of MS authentication, and authenticates to AAA The server sends the DER message; when the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message, and if the parsed DEA message contains the attribute value of successful authentication, it indicates that the first round of authentication is successfully completed; set the first round of authentication The success flag is TRUE; the Authenticator constructs the corresponding DER message according to the received attribute value of MS authentication, and sends the DER message to the AAA authentication server; when the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message; if the parsed If the DEA message contains the attribute value of successful authentication, it will be transferred to the Open state, and the authentication is completed. The invention can support both single-round authentication and double authentication; on the basis of the original diameter authentication state machine, it can support two-round authentication with slight changes, and has backward compatibility.

Description

A method for separately authenticating users and devices using the diameter protocol

technical field

The invention relates to a communication system, in particular to a method for implementing user and equipment separate authentication (Double EAP) by adopting a diameter protocol in a mobile Wimax system.

Background technique

Four authentication methods are defined in the latest version 1.0.0 of Wimax's network structure specification: user authentication: User single EAP; device authentication: Device Single EAP; simultaneous user and device authentication: User/Device Single EAP; user and device respectively Authentication: Double EAP (two EAP procedures are performed).

The method of user and device authentication (double EAP) requires two rounds of authentication: the first round of device authentication, and the second round of user authentication. If the authentication of the user (User) and the mobile station (MS) needs to be performed separately, the double EAP method can be selected. A typical application scenario is: when the authentication of the user (User) and the mobile station (MS) are not in the same entity, for example, in different AAA servers. If the authentication of the user (User) and the mobile station (MS) occurs in the same entity, the single EAP authentication method can be selected.

The Diameter series protocol is a new generation of AAA technology. In ITU, 3GPP/3GPP2 and other international standard organizations, the Diameter protocol has been formally regarded as the preferred AAA protocol for future communication networks such as NGN, WCDMA and CDMA2000. In Wimax's future specification version 1.5 of the network structure, the Diameter protocol will be included.

In the Diameter specification RFC3588, the session state machine using the diameter protocol for authentication is given: in the idle mode, the Diameter Client sends a DER message to the AAA authentication server, including the authentication request information; when the Diameter client receives the DEA message, it includes information about the successful authentication , it will turn into the OPEN state, which means that the authentication is completed, and the user can perform related services such as call services.

According to the authentication state machine provided by the Diameter protocol, it can be seen that this method actually only supports single authentication, that is, either device authentication or user authentication, or three single authentication methods that are simultaneously performed for device authentication and user authentication. Once a round of authentication is successful, it will enter the OPEN state. Therefore, the current diameter authentication protocol does not support two rounds of authentication (double authentication) in which users and devices are authenticated separately.

Contents of the invention

The purpose of the present invention is to provide a method for realizing two-round authentication (double) of user and equipment by adopting Diameter protocol.

In order to achieve the above object, a method for implementing separate authentication of users and devices using the Diameter protocol, comprising steps:

a) Authenticator sets the initial state of the Diameter client authentication state machine to IDLE;

b) Authenticator constructs a corresponding message DER according to the received attribute value of MS authentication, and sends the DER message to the AAA authentication server;

c) When the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message, and if the parsed DEA message contains the attribute value of successful authentication, it indicates that the first round of authentication is successfully completed;

d) Set the successful flag of the first round of authentication to TRUE;

e) Authenticator constructs a corresponding DER message according to the received attribute value of MS authentication, and sends the DER message to the AAA authentication server;

f) When the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message;

i) If the parsed DEA message contains the attribute value of successful authentication, then turn to the Open state, and the authentication is completed.

The method of the present invention can support both single-round authentication (Single) and double authentication; the implementation is simple, on the basis of the original diameter authentication state machine, it can support two-round authentication with slight changes, and has backward compatibility; Strong practicability, can be used in Wimax Forum, ITU, 3GPP/3GPP2 and other network structure NGN.

Description of drawings

Fig. 1 is a method for implementing separate authentication (double EAP) of users and devices using the Diameter protocol;

Fig. 2 is an embodiment of the initial access process of the MS using the Diameter protocol to perform double EAP authentication.

Detailed ways

During the MS's initial access process, the MS and the Authenticator first exchange authentication capabilities. The Authenticator selects the correct authentication method and notifies the MS to use this method to start authentication.

EAP-method defined in Wimax: device authentication generally adopts certificate-based X.509, so the corresponding MS should support the EAP-TLS method. The MAC address of the device is passed as the NAI username in EAP-Identity/Response. For user authentication, MS should support EAP-AKA, EAP-TTLS. They use SUBC (Subcription Credential) to generate authentication vectors.

For the double authentication method that separates device authentication and user authentication, after the two rounds of authentication are successfully completed and Diameter's authentication state machine enters the OPEN state, the Authenticator will calculate the PKMv2 value based on the two MSKs generated by the two rounds of authentication during the device authentication process and the user authentication process. Relevant keys needed, such as AK, etc., and send AK to BS. MS will use EMSK to calculate other application-related keys.

The main functional entities involved include MS, BS, Authenticator (ACR), and AAA server (CSN). MS is the object to be authenticated; AAA server is the authentication server; Authenticator is the authenticator, which can also be understood as a relay, which is mainly responsible for forwarding EAPmessages (protocol conversion) between MS and AAA Server, and is also responsible for key management and session management etc.

A method adopting Diameter protocol to realize user and equipment authentication (double EAP) respectively, with reference to Fig. 1, its main steps include:

1) The MS and the Authenticator exchange authentication policies through the BS, and the Authenticator selects an authentication method to notify the MS, and requests an authentication identity (EAP-identity) from the MS. When the Authenticator receives the MS EAP-Identiy, set the state of the Diameter authentication state machine to IDLE; if the Authenticator selects Double authentication, set the initial value of the first-round authentication success flag to False; if it is Single authentication, then go to step 6);

2) The Authenticator constructs a corresponding DER message according to the received EAP-payload of the MS. Send a DER message to the AAA authentication server, including device authentication request information, etc., and the state of the Diameter authentication state machine enters the Pending state;

3) In the Pending state, when receiving the DEA message from the AAA authentication server, the Authenticator parses the DEA message, if it contains the attribute value of successful authentication, it indicates that the first round of authentication is successfully completed, go to step 5); otherwise continue to the next step ;

4) In the Pending state, the Authenticator sends the EAP-Payload in the received DEA message to the MS using the relevant protocol, and then go to step 2)

5) Set the successful flag of the first round of authentication to TRUE, and the state is still Pending state;

6) The Authenticator constructs a corresponding DER message according to the received EAP-payload of the MS. Send a DER message to the AAA authentication server, and the state of the Diameter authentication state machine is in the Pending state;

7) In the Pending state, when receiving the DEA message from the AAA authentication server, the Authenticator parses the DEA message, and if it contains the attribute value of successful authentication, turn to step 9); otherwise continue to the next step;

8) In the Pending state, the Authenticator sends the EAP-Payload in the received DEA message to the MS using the relevant protocol, and then go to step 6)

9) Transfer to the Open state; the authentication is completed.

Example

Using double EAP authentication, a certain MS uses the embodiment of the initial access process of the method proposed by the present invention, with reference to Fig. 2, its main steps include:

1) MS and Authenticator exchange authentication policies through BS;

2) The Authenticator selects the authentication method, and sends an authentication request AuthRelay_EAP_TRANSFER message to the MS through the BS, including information such as EAP-Request/Identity;

3) After receiving the EAP_TRANSFER (EAP-Request/Identity) message, the MS replies to the Authenticator through the BS with EAP_TRANSFER (EAP-response/Identity), and reports the identity required for authentication;

4) When the Authenticator receives the MS EAP-Identiy, it sets the state of the Diameter authentication state machine to IDLE, and the initial value of the first-round authentication success flag is False; and constructs a DER message according to the received MS EAP-payload.

5) The Authenticator sends a DER message to the AAA authentication server, including device authentication request information, etc.;

6) The Diameter authentication state machine is in the Pending state;

7) MS and AAA server perform end-to-end authentication; between MS and Authenticator, EAP protocol is used for carrying, and between Authenticator and AAA is a diameter protocol, that is, DER/DEA messages are used;

8) At the AAA server side, after the first round of authentication is successfully completed, construct a DEA message that includes EAP-Success, and send the message to Authenticator;

9) The authentication status of the Authenticator is Pending. When receiving the DEA message from the AAA authentication server, the Authenticator parses the DEA message. If it contains the attribute value of successful authentication, it indicates that the first round of authentication is successfully completed, and the first round of authentication is set. The success flag is TRUE;

10) The Authenticator generates an EIK based on the MSK1/PKM1 that was successfully authenticated in the first round, and sends it to the BS through the message Context_Rpt, and the BS replies with the Context_Rpt_Ack Ack message;

11) The Authenticator sends a message containing the EAP-Success attribute to the BS, and the BS uses EIK to encrypt the message and sends it to the MS;

12) After receiving the message containing the EAP-Success attribute, the MS first verifies the message, and if successful, initiates a second round of authentication request;

13) The BS forwards the MS's second-round authentication request;

14) After the Authenticator receives the second round of authentication request from MS, it constructs DER according to the content of the received message;

15) The Authenticator sends a DER message to the AAA authentication server, including the second round of authentication request information, etc., and the authentication state machine is pending.

16) The MS and the AAA server perform the second round of end-to-end authentication; the EAP protocol is used between the MS and the Authenticator, and the diameter protocol is used between the Authenticator and AAA, that is, the DER/DEA message is used;

17) At the AAA server side, after the second round of authentication is successfully completed, construct a DEA message that includes EAP-Success, and send the message to Authenticator;

18) The authentication state of the Authenticator is Pending state. When receiving the DEA message from the AAA authentication server, the Authenticator parses the DEA message. If it contains the attribute value of successful authentication, and the successful flag of the first round of authentication is TRUE, the authentication is completed. Go to the Open state;

19) Switch to the Open state, and the double authentication is completed. Authenticator uses the MSK generated by the two rounds of authentication to generate the corresponding PMK, AK, etc.;

20) The Authenticator sends a message including the EAP-Success attribute to the BS;

21) The BS forwards the message containing the EAP-Success attribute to the MS;

22) Authenticator sends information such as AK to BS, and BS sends a feedback message for information such as AK;

23) The BS and the MS verify the AK, establish a security association for the MS, and the legal TEK used for this security association, etc.;

24) Start the attach process of the MS and the establishment process of the data link. The MS completes the initial access.

The foregoing embodiment focuses on the change process and message flow of the authentication state machine at the Authenticator end using the Diameter protocol to implement separate authentication (double EAP) for users and devices. The content of the message and the process of generating keys such as AK and TEK are omitted. These should not be construed as limitations of the invention.

Claims (5)

1. A method adopting the Diameter protocol to realize user and equipment authentication respectively, comprising steps: a) Authenticator sets the initial state of the Diameter client authentication state machine to IDLE; b) Authenticator constructs a corresponding message DER according to the received attribute value of MS authentication, and sends the DER message to the AAA authentication server; c) When the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message, and if the parsed DEA message contains the attribute value of successful authentication, it indicates that the first round of authentication is successfully completed; d) Set the successful flag of the first round of authentication to TRUE; e) Authenticator constructs a corresponding DER message according to the received attribute value of MS authentication, and sends the DER message to the AAA authentication server; f) When the Authenticator receives the DEA message from the AAA authentication server, it parses the DEA message; i) If the parsed DEA message contains the attribute value of successful authentication, then turn to the Open state, and the authentication is completed. 2. The method according to claim 1, characterized in that in step a), if it is the Double authentication method, the initial value of the first round of authentication success flag is set to False. 3. The method according to claim 1, wherein in step b), the DER message includes a device authentication request message. 4. The method according to claim 1, characterized in that in steps b)-f), the state of the Diameter authentication state machine is Pending. 5. The method according to claim 1, characterized in that the DER message in step b) and the DEA message in step c) belong to the dimeter protocol.

Images