KR20110030126A - How to provide seamless FMC services - Google Patents

Abstract

The present invention relates to a method for providing a seamless FMC service, wherein the FMC supporting apparatus allocates a tunnel IP address to a user terminal requesting access to the first network and matches the IP address of the user terminal allocated in the first network. Storing the data; establishing, by the FMC supporting apparatus, a first VPN tunnel with the user terminal; making data to be transmitted using the first encryption key generated by the FMC supporting apparatus and the user terminal as packet data; Exchanging the packet data through a first VPN tunnel; determining whether the user terminal requesting access to the second network from the FMC supporting apparatus is a handed over terminal; the user terminal in the FMC supporting apparatus In the case of the handovered user terminal, the previously stored IP address of the user terminal is assigned to the IP address allocated from the second network. Establishing a second VPN tunnel with the user terminal in the FMC-supporting device, and transmitting data to the packet data by using the second encryption key generated in the step in the FMC-supporting device and the user terminal. Creating and exchanging the packet data over the second VPN tunnel.

FMC Service, Handover, Tunneling, Seamless

Description

How to provide seamless FMC service {Method for providing a seamless FMC service}

The present invention relates to a Fixed Mobile Convergence (FMC) service. In particular, the present invention relates to a seamless FMC service providing method during handover from an enterprise network to a public network for a wireless terminal.

Recently, FMC (Fixed Mobile) uses a wireless terminal (e.g. mobile phone, PDA, smart phone, etc.) as a local wireless communication network (e.g., Wireless Local Area Network (WLAN), etc.) and a cellular network outside the building. Convergence) service is commercially available.

With the activation of these FMC services, companies are increasingly inclined to use corporate application services (eg, United Communications, Groupware, E-mail, etc.).

Currently, FMC's wireless security provides security functions through WLAN's Wi-Fi Protected Access (WPA) method and protects information leakage due to the use of enterprise application services.

However, when FMC subscribers use an enterprise application service by accessing an outdoor cellular network outside a corporate WLAN, corporate information may be easily leaked to third parties.

FMC service must provide continuity of service so that various application services provided by enterprise can be used anytime and anywhere regardless of access network while moving freely between local area wireless network and cellular network. Security must also be maintained.

Accordingly, there is a need for an FMC service that provides security and confidentiality at the same time as seamless handover between cellular networks in a short range wireless communication network.

SUMMARY OF THE INVENTION The present invention provides a seamless FMC service providing method for ensuring seamless mobility and security and confidentiality of data communication in a cellular network when moving from an enterprise network consisting of a short-range wireless communication network to an authorized network of a cellular network. To provide.

To this end, the present invention provides a seamless FMC service providing method between a first network and a second network to which a Fixed Mobile Convergence (FMC) service is applied. The seamless FMC service providing method includes (a) assigning a tunnel IP address to a user terminal requesting access to the first network from an FMC supporting apparatus and matching and storing the IP address of the user terminal assigned in the first network. (B) establishing, by the FMC-supporting device, a first virtual private network (VPN) tunnel with the user terminal; and (c) generating, by the FMC-supporting device and the user terminal, in step (a). 1) making data to be transmitted using an encryption key into packet data and exchanging the packet data through the first VPN tunnel; and (d) the user terminal requesting access to the second network from the FMC support apparatus. Determining whether the terminal has been overwritten, (e) when the user terminal is a handovered user terminal in the FMC supporting apparatus, the stored IP address of the user terminal; Updating to an IP address allocated from the second network; (f) establishing a second VPN tunnel with the user terminal in the FMC supporting apparatus; and (g) (f) in the FMC supporting apparatus and the user terminal. And converting the packet data into packet data using the second encryption key generated in the step, and exchanging the packet data through the second VPN tunnel, wherein the FMC supporting apparatus is one of the first network and the second network. It is characterized in that the coverage is located in a small net.

The first VPN tunnel is established by a security negotiation for generating a master key between the FMC support device and the user terminal and an encryption negotiation for generating an encryption key, and the second VPN tunnel is configured by the FMC support device and the user. It is set by the encryption negotiation between the terminal, wherein the security negotiation is characterized in that the security negotiation at the time of establishing the first VPN tunnel is used.

 The first and second VPN tunnel settings may be configured using IPsec (Internet Protocol Security) or SSL (Secure Socket Layer).

 In step (d), the FMC supporting apparatus compares the IP address of the user terminal received to the second network with the IP address of the previously stored user terminal to determine whether the user terminal is handovered. do.

The first network is an enterprise network, the second network is an authorized network, and the FMC support apparatus is located in the first network.

According to an exemplary embodiment of the present invention, when a user terminal moves from an authorized network in an enterprise network and uses an application service of an enterprise network, an issue of providing a seamless FMC service while solving a problem of leaking corporate information to a third party is provided. There is.

In addition, according to an embodiment of the present invention, by providing a security protocol based FMC service in the enterprise network / authorized network to which the user terminal is connected, it is possible to expand the scope of the enterprise application services and at the same time activate the FMC service. .

In addition, according to an embodiment of the present invention, by protecting the FMC service from various attacks for corporate information leakage, there is an effect of providing a new revenue model base with the increase of FMC subscribers due to the activation of the FMC service.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. The present invention may, however, be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention, and like reference numerals designate like parts throughout the specification.

Now, the seamless FMC service providing method according to an embodiment of the present invention with reference to the drawings will be described in detail.

1 is a diagram illustrating a network configuration according to an embodiment of the present invention.

As shown in FIG. 1, the network according to the embodiment of the present invention includes a public IP network, that is, a public network N2 based on an enterprise network N1 and a public IP (Internet Protocol), which are short-range wireless communication networks, and Located at the edge (edge) of the enterprise network (N1) includes an FMC support device 100 for supporting the FMC service of the user terminal 10.

The user terminal 10 is a terminal capable of wireless communication in both the enterprise network N1 and the authorized network N2, for example, a smartphone, a mobile phone, a PDA, a notebook computer and a computer. However, the user terminal 10 is not limited to names of smartphones, mobile phones, PDAs, notebook computers, and the like, and includes all terminals existing or developed in the future.

Enterprise network (N1) consists of a short-range wireless communication network independent of the public network (N2), the most commonly used form of WLAN. Therefore, hereinafter, the enterprise network N1 will be described as WLAN.

The public network N2 is a network for communicating using public IP, and is a Universal Mobile Telecommunication Systems (UMTS) (for example, CDMA, WCDMA, etc.), WiBro, and the like. Hereinafter, for the sake of understanding, the public network N2 will be described as WCDMA.

The FMC support apparatus 100 supports communication in the corporate network N1 for the user terminal 10, supports communication in the authorized network N2, and mobility from the corporate network N1 to the authorized network N2. Support and mobility from N2 to enterprise network N1.

The FMC support apparatus 100 is connected to a communication system of an enterprise network N1 or an authorized network N2 (eg, an AP (Access Point) of a WLAN, a Gateway GPRS Support Node (GGSN, etc.) of WCDMA), and through this, Receive a connection notification of the user terminal 10 from the enterprise network (N1) or authorized network (N2).

When the FMC supporting apparatus 100 receives the access notification of the user terminal 10 from the network N1 or N2, the FMC supporting apparatus 100 performs communication support or mobility support for the FMC service in the network N1 or N2.

Here, in order to support communication in the corresponding network (N1 or N2), the FMC support apparatus 100 creates a VPN (Virtual Priviate Network) tunnel with the user terminal 10 and performs wireless communication with the user terminal 10 through the VPN tunnel. To perform.

In order to support mobility for the FMC service, the FMC supporting apparatus 100 newly creates a VPN tunnel that updates a VPN tunnel formed in a network located before the handover, and the user terminal 10 and the newly created VPN tunnel. Perform wireless communication.

Hereinafter, the FMC support apparatus 100 according to an embodiment of the present invention will be described in detail with reference to FIG. 2. 2 is a block diagram of an FMC support apparatus according to an embodiment of the present invention.

As shown in FIG. 2, the FMC supporting apparatus 100 according to an exemplary embodiment of the present invention includes a local communication unit 110, an authentication unit 120, a handover confirmation unit 130, a subscriber information storage unit 140, Terminal address storage unit 150, tunnel generation unit 160, security / password negotiation unit 170, encryption unit 180 and decryption unit 190.

The local communication unit 110 accesses a service server (or device) (not shown) in the backbone network requested by the user terminal 10, provides data transmitted from the user terminal 10 to the service server, and provides the service server. Receive data.

The authentication unit 120 performs authentication on the user terminal 10 in association with the subscriber information storage unit 140.

When the handover confirmation unit 130 receives the access notification of the user terminal 10 from the enterprise network (N1) or authorized network (N2), the user terminal 10 is connected to the terminal address storage unit 150 is the enterprise network Check whether it is moved from (N1) to the public network (N2), or from the public network (N2) to the enterprise network (N1), or whether the initial connection.

Subscriber information storage unit 140, the subscriber identification information, identification information of the user terminal (for example, MAC (Media Access Control) address, telephone number, ESN (Electric Serial Number), etc.), master in order to interwork with the user terminal 10, Key (master key) and the like are stored.

The terminal address storage unit 150 stores the IP address or tunneling IP address of the user terminal 10 currently connected to the corporate network N1 or the authorized network N2. The IP address stored in the terminal address storage unit 150 is used to determine the current location of the user terminal 10.

The tunnel generator 160 provides the tunnel IP address to the user terminal 10 and generates a tunnel with the user terminal 10. The tunnel IP address provided to the user terminal 10 is matched with the identification information of the user terminal 10 and stored in the terminal address storage 150.

The security / password negotiation unit 170 is operated by the tunnel generation unit 160 by operating based on a standardized Internet security protocol such as Internet Protocol Security (IPsec) or Secure Socket Layer (SSL) (or TLS (Transport Layer Security)). Security negotiation, encryption negotiation, and generation and management of encryption keys are performed for security and confidentiality of data transmitted through the created tunnel.

The encryption unit 180 encrypts and transmits data to be transmitted through the tunnel by using the encryption key generated by the security / password negotiation unit 170. The decryptor 190 decrypts data received through the tunnel by using the encryption key generated by the security / password negotiation unit 170.

3 is a diagram illustrating a VPN tunnel generation and a communication process using a VPN tunnel between a user terminal and an FMC supporting apparatus according to an embodiment of the present invention, in which IPsec is used as a security protocol.

When the user terminal 10 is connected to the enterprise network (N1) or authorized network (N2) and transmits a request message for requesting the creation of a VPN tunnel to the FMC support apparatus 100 (S301). Here, the request message includes information of the user terminal 10 such as identification information and IP address of the user terminal 10. Of course, the request message requesting the creation of the VPN tunnel may be transmitted in the AP connected to the user terminal 10 in the enterprise network N1 on behalf of the user terminal 10 or in the GGSN in the authorized network N2.

Upon receiving the request message, the FMC apparatus 100 checks the information of the user terminal 10 included in the request message (S302), and performs user authentication using the subscriber information storage unit 140 (S303).

If the user authentication succeeds, the FMC support apparatus 100 performs an operation for establishing a VPN tunnel with the user terminal 10.

That is, in the process of creating a VPN tunnel, the FMC supporting apparatus 100 generates and provides a tunnel IP address to the user terminal 10 so that the user terminal 10 can transmit data to the VPN tunnel using the tunnel IP address. do.

Then, the FMC supporting apparatus 100 negotiates a Security Association (SA) for encryption algorithm, hash algorithm, key exchange procedure, etc. with the user terminal 10 using the IKE (Internet Key Exchange) protocol, and the Diffie-Helman key. A master key is generated using an exchange protocol (S304).

The master key generated by the IKE SA setting process is shared between the user terminal 10 and the FMC support apparatus 100 (S305).

When the FMC supporting apparatus 100 sets the IKE SA, the FMC supporting apparatus 100 performs the IPsec SA setting process (S306). At this time, the FMC support apparatus 100 and the user terminal 10 encrypts the messages exchanged for the IPsec SA settings using the master key.

In the IPsec SA setup process, IPsec SA negotiation including the encryption algorithm to be used in the Encapsulating Security Payload (ESP) mode and the authentication algorithm to be used in the Authentication Header (AH) mode is performed on the actually transmitted / received packets. Create a key.

Here, encryption algorithms include 3DES and AES, and SHA-1 and MD5 are used as hash algorithms.

When the IPsec SA setup is completed in this way, the user terminal 10 and the FMC support apparatus 100 transmit the data to be transmitted into an IPsec packet using ESP or / and AH negotiated during the IPsec SA setup process.

For example, the user terminal 10 makes the data to be transmitted into an IPsec packet (S307), and transmits the IPsec packet to the FMC support apparatus 100 through the VPN tunnel generated in the corresponding network N1 or N2 (S308).

Then, the FMC support apparatus 100 receives the IPsec packet transmitted from the user terminal 10 and performs authentication and decryption on the data (that is, the IPsec packet) using the session key generated in the IPsec SA setting process ( S309).

In this case, the FMC support apparatus 100 rejects the reception from the user terminal 10 when data is modified or a problem occurs in the decoding process.

The FMC support apparatus 100 transmits the decrypted data to the service server in the enterprise network N1 through the backbone network after completing the authentication and decryption of the data.

When receiving data to be transmitted to the user terminal 10 from the service server, as in S310, the data to be transmitted is made into an IPsec packet (S310), and the IPsec packet is transmitted to the user terminal 10 through the VPN tunnel (S311).

Of course, the user terminal 10 also performs authentication and decryption on the received IPsec packet using the session key.

Here, an example of the form of the IPsec packet transmitted and received between the user terminal 10 and the FMC support apparatus 100 is shown in FIG. 4 illustrates an example of an IPsec packet type used in FIG. 3 according to an embodiment of the present invention.

In FIG. 4, (a) is an IPsec packet generated using only AH, (b) is an IPsec packet generated using only ESP, and (c) is an IPsec packet generated using AH and ESP. It is a form.

In the case of the IPsec packet format shown in (a), a keyed-hash message authentication code (HMAC) is used to check whether the message has been tampered with. The AH includes payload length, security parameter index (SPI), and authentication data. The IPsec packet receiver finds the hash algorithm applied to the authentication data by looking at the SPI, and compares the authentication data by performing a hash function using the payload data and the IP address as input values.

The IPsec packet format illustrated in (b), that is, the ESP format, provides confidentiality by encrypting data so that a third party other than the user terminal 10 and the FMC support apparatus 100 cannot see the data. The IPsec packet receiver decrypts the encrypted payload data using the encryption algorithm defined in the SPI included in the ESP.

Of course, the form of the IPsec packet shown in (a), (b), and (c) of FIG. 4 is a form that appears in the case of using standardized IPsec, and corresponds to a publicly known technique.

Now, a seamless FMC service providing method according to an embodiment of the present invention will be described with reference to FIG. 5. 5 is a data flow diagram of a seamless FMC service providing method according to an exemplary embodiment of the present invention, in which the user terminal 10 performs a handover from the enterprise network N1 to the authorized network N2. Hereinafter, the corporate network N1 is referred to as WLAN and the authorized network N2 is referred to as WCDMA.

When the user terminal 10 is located in the WLAN N1 and requests a connection to a service server in the WLAN N1 (S501), the AP (not shown) of the WLAN N1 authenticates the connection to the user terminal 10. Perform and assign an IP address (S502).

When the AP of the WLAN N1 authenticates the connection to the user terminal 10, the FMC supporting apparatus 100 requests creation of a VPN tunnel for the user terminal 10 (S503).

At this time, the message for requesting the creation of the VPN tunnel includes the assigned IP address. Of course, the VPN tunnel creation request may be made by the FMC supporting apparatus 100 in the user terminal 10 authenticated access.

When the FMC support apparatus 100 receives the VPN tunnel creation request for the user terminal 10, the FMC support apparatus 100 stores the IP address assigned by the user terminal 10 and transmits the IP address to the user terminal 10 based on the subscriber information storage 140. Perform authentication for

In this case, the authentication for the user terminal 10 performed by the FMC support apparatus 100 is duplicated because the procedure has already been performed in the AP. Therefore, the FMC support apparatus 100 may omit the authentication procedure corresponding to the VPN tunnel creation request received through the WLAN (N1), and if the VPN tunnel creation request is received from an AP that is more reliable than the user terminal 10. This is especially true.

According to the VPN tunnel creation request, the FMC support apparatus 100 performs a VPN tunnel with the user terminal 10 through a VPN tunnel generation process, an IKE SA setup process, and an IPsec SA setup process with reference to FIG. Tunnel "is set (S504).

When tunneling is performed between the user terminal 10 and the FMC support apparatus 100, the user terminal 10 and the FMC support apparatus 100 perform data communication for exchanging IPsec packets through the first VPN tunnel (S505). .

If the user terminal 10 moves to the WCDMA N2 during the data communication through the first VPN tunnel, the user terminal 10 determines that the handover situation is performed (S506), and makes a connection request to the WCDMA N2 (S507). ).

In response to the access request of the user terminal 10, the WCDMA N2 performs a handover procedure with the user terminal 10. At this time, the WCDMA N2 allocates a new IP address to the user terminal 10 (S508).

When the connection of the user terminal 10 is completed, the GGSN of the WCDMA N2 informs the FMC supporting apparatus 100 of the newly allocated IP address of the user terminal 10 together with the identification information of the user terminal 10 and the IP address. Request the update of (S509).

The FMC supporting apparatus 100 performs authentication on the user terminal 10 according to the IP address update request for the user terminal 10, and the IP address or / and tunnel IP address of the user terminal 10 stores the terminal address. Determine if it is in the unit 150. Through such grasping, the FMC supporting apparatus 100 may check whether the user terminal 10 is a handed over user terminal.

If the user terminal 10 is a user terminal handed over, the FMC supporting apparatus 100 uses the existing tunnel IP as it is, and uses the IP address of the corresponding user terminal 10 stored in the terminal address storage unit 150. Update (S510).

Of course, the FMC supporting apparatus 100 may allocate a new tunnel IP address to the handovered user terminal 10 and update the corresponding tunnel IP address in the terminal address storage unit 150.

Then, the FMC supporting apparatus 100 sets up a VPN tunnel (hereinafter referred to as a “second VPN tunnel”) by omitting the IKE SA setting process (S307) illustrated in FIG. 3 (S511). Of course, the information for setting the IKE SA, which is omitted when the second VPN tunnel is set, uses the information for setting the IKE SA used when the first VPN tunnel is set in the WLAN N1.

When tunneling is performed between the user terminal 10 and the FMC support apparatus 100 on the WCDMA network, the user terminal 10 and the FMC support apparatus 100 perform data communication for exchanging IPsec packets through a second VPN tunnel. (S512).

On the other hand, the seamless FMC service providing method according to an embodiment of the present invention for the case where the user terminal 10 moves from WCDMA (N2) to WLAN (N1), which is an enterprise network, is readily available to those skilled in the art from the description with reference to FIG. It is predictable so it will be omitted.

The embodiments of the present invention described above are not only implemented by the apparatus and method but may be implemented through a program for realizing the function corresponding to the configuration of the embodiment of the present invention or a recording medium on which the program is recorded, The embodiments can be easily implemented by those skilled in the art from the description of the embodiments described above.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

1 is a diagram illustrating a network configuration according to an embodiment of the present invention.

2 is a block diagram of an FMC support apparatus according to an embodiment of the present invention.

3 is a diagram illustrating a VPN tunnel generation and a communication process using a VPN tunnel between a user terminal and an FMC supporting apparatus according to an exemplary embodiment of the present invention.

4 illustrates an example of an IPsec packet type used in FIG. 3 according to an embodiment of the present invention.

5 is a data flowchart of a seamless FMC service providing method according to an embodiment of the present invention.

Claims (5)

In the seamless FMC service providing method between the first network and the second network to which Fixed Mobile Convergence (FMC) service is applied, (a) assigning a tunnel IP address to a user terminal requesting access to the first network in the FMC supporting apparatus and storing the same as the IP address of the user terminal allocated in the first network; (b) establishing, by the FMC supporting apparatus, a first VPN (Virtual Private Network) tunnel with the user terminal; (c) the FMC supporting apparatus and the user terminal making the data to be transmitted using the first encryption key generated in the step (a) into packet data and exchanging the packet data through the first VPN tunnel; (d) determining whether the user terminal requesting access to the second network is a handover terminal by the FMC supporting apparatus; (e) updating the previously stored IP address of the user terminal with the IP address allocated in the second network when the user terminal is a handovered user terminal in the FMC supporting apparatus; (f) establishing a second VPN tunnel with the user terminal in the FMC supporting apparatus, and (g) making the data to be transmitted using the second encryption key generated in step (f) in the FMC supporting apparatus and the user terminal into packet data and exchanging the packet data through the second VPN tunnel. , The FMC support device is a seamless FMC service providing method, characterized in that the network is located in the smaller coverage of the first network and the second network. The method of claim 1, The first VPN tunnel is established by a security negotiation for generating a master key made between the FMC supporting apparatus and the user terminal and an encryption negotiation for generating an encryption key, The second VPN tunnel is established by the encryption negotiation between the FMC supporting apparatus and the user terminal, and the security negotiation is seamless FMC service, wherein the security negotiation at the time of establishing the first VPN tunnel is used. How to Provide. The method according to claim 1 or 2, The first and the second VPN tunnel configuration is a seamless FMC service providing method characterized in that using the Internet Protocol Security (IPsec) or Secure Socket Layer (SSL). The method of claim 3, In step (d), the FMC supporting apparatus compares the IP address of the user terminal received to the second network with the IP address of the previously stored user terminal to determine whether the user terminal is handovered. How to provide seamless FMC services. The method of claim 3, And the first network is an enterprise network and the second network is an authorized network, and the FMC supporting apparatus is located in the first network.

Images