KR100667186B1 - Apparatus and method for realizing authentication system of wireless mobile terminal - Google Patents

Abstract

An apparatus and method for implementing an authentication system for a wireless mobile terminal according to the present invention, the apparatus for implementing an authentication system for a wireless mobile terminal according to the present invention detects an authentication scheme supported by a network to which a terminal is currently connected, The internal structure of the wireless mobile terminal is set such that authentication is performed by using a message used in the authentication method sensed by the authentication server for authenticating the access of the network. According to the present invention, since authentication is performed between a wireless mobile terminal and an authentication server that performs authentication with a user ID and a password by a detected authentication method, a user generated in a public wireless Internet service through a wireless LAN. In the authentication process, multiple accesses to the same ID can be prevented.

Authentication, wireless, terminal, authentication protocol, network, engine, authentication server

Description

Apparatus and Method for Implementing Authentication System for Wireless Mobile Terminals

1 is a block diagram of a wireless communication system to which the present invention is applied.

2 is a diagram illustrating a configuration of an authentication system implementing apparatus of a wireless terminal according to an exemplary embodiment of the present invention.

3 is a flowchart illustrating an operation of an apparatus for implementing an authentication system of a wireless terminal according to an exemplary embodiment of the present invention.

4 is a diagram illustrating an example of the authentication procedure illustrated in FIG. 3.

The present invention relates to an apparatus and a method for implementing an authentication system for a wireless mobile terminal, and in particular, to prevent multiple accesses with the same ID when authenticating a user in a public wireless Internet service through a wireless LAN, and to access a user. The present invention relates to a method for authenticating a user in a wireless access Internet service network which has improved user authentication.

Recently, operators have introduced wireless LAN technology into the public network, and have been using airports, schools, and schools through authentication using a user ID (ID) and password (registered through a predetermined subscription procedure) under the name of "ultra-high speed wireless Internet service." Internet service is available in hotspots such as subways and popular franchises.

Currently, public wired / wireless LAN service is performing user authentication based on IEEE 802.1x standard. That is, when the wireless user is authenticated for accessing the network through 802.1x, communication is allowed by opening a virtual port at the base station. If the wireless user is not authenticated, the communication is blocked because the virtual port cannot be used. This standard uses EAP (Extensible Authentication Protocol) authentication method between the authentication server and the terminal.

This method checks whether the user is authenticated by exchanging user ID and password through EAP (Extensible Authentication Protocol) that carries authentication information between the user terminal and the authentication server. It is used to pass authentication information between authentication servers. Actual authentication is defined and handled by EAP type. The base station serving as an authenticator serves as a proxy for allowing the requester (terminal) and the authentication server to communicate.

EAP types include roughly Message Digest 5 (EAP-MD5), Transport Layer Security (EAP-TLS), Secure Remote Password (EAP-SRP), Tunneled TLS (EAP-TTLS), Protected Extensible Authentication Protocol (EAP-PEAP), and Cisco Lightweight Extensible Authentication Protocol (LEAP).

As such, EAP is a common protocol that supports multiple authentication mechanisms such as MD5, TLS, and TTLS.It supports a number of authentication structures including smart cards, Kerberos, public key encryption, and OneTime Password (OTP). It mainly uses authentication. As such, the purpose of the 802.1x user authentication method is to check the accuracy of the user-provided ID and password.

However, there are various network connection environments provided by a network interface card on a wireless mobile terminal, and thus, various authentication methods are required. Therefore, if the network access card is changed on the wireless mobile terminal, since the same authentication structure cannot be provided on the wireless mobile terminal, authentication cannot be performed at the authentication server that authenticates the terminal's network connection with the user ID and password. .

An object of the present invention is to provide an apparatus and method for implementing an authentication system for a wireless mobile terminal that can provide the same authentication structure even when a network access card is changed on the wireless mobile terminal.

In order to solve the above problems, an apparatus for implementing an authentication system for a wireless mobile terminal according to an aspect of the present invention,

 An apparatus for implementing various authentication schemes required by various networks on a wireless mobile terminal,

An authentication standard protocol engine for detecting an authentication protocol supported in the network; And

And a network access card configured to set an internal structure of the wireless mobile terminal such that authentication is performed using a message used in the detected authentication protocol in an authentication server for authenticating the connection of the network to the wireless mobile terminal.

At this time, the authentication standard protocol engine may support an upgrade according to a new standard authentication protocol.

According to another aspect of the present invention, there is provided a method for implementing an authentication system for a wireless mobile terminal.

As a method of implementing various authentication schemes required by various networks on a wireless mobile terminal,

a) detecting an authentication scheme supported by a network to which the terminal is currently connected; b) setting an internal structure of the wireless mobile terminal such that authentication is performed by using a message used in the sensed authentication scheme in an authentication server for authenticating a connection of the network to the wireless mobile terminal; And c) after step b), performing authentication using the detected authentication method between the terminal and the authentication server.

In this case, the method may further include supporting an upgrade according to a new standard authentication method in the network.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

An apparatus and method for implementing an authentication system for a wireless mobile terminal according to an embodiment of the present invention will now be described in detail with reference to the accompanying drawings.

First, a wireless mobile communication system to which the present invention is applied will be described in detail with reference to FIG. 1.

Wireless mobile communication refers to a communication means by which a user can communicate without being fixed at a location using a mobile terminal, that is, provide mobility.

1 is a block diagram of a wireless mobile communication system to which the present invention is applied.

As shown in FIG. 1, the wireless mobile communication system includes a base station 120 and an authentication server 130.

The base station 120 is wirelessly connected to the wireless mobile terminal 110 to perform functions such as transmission and reception of radio signals, channel modulation and demodulation, power control, and protocol conversion. The base station 120 performing such a function includes a wireless authentication protocol 122 for permission of access of the wireless mobile terminal 110 and requests authentication to the authentication server 130 using the wireless authentication protocol 122. do.

The authentication server 130 includes a wireless authentication protocol 132 on the wireless network 100 for authenticating the wireless mobile terminal connected to the base station 120 and the wireless network 100, and the base station 120 According to the authentication request received from the) to authenticate the wireless mobile terminal 110 so that users can access the wireless network (100). At this time, the authentication server 130 performs authentication with a user ID and a password.

In addition, the wireless mobile terminal 110 includes a network interface card (NIC) 112 that provides a wireless access environment, and authenticates with the authentication server 130 via the base station 120. By exchanging related protocols, permission to use the wireless network 100 is obtained. The NIC 112 is a card or memory type and performs an interface function between the wireless mobile terminal 110 and the wireless network 100.

2 is a diagram illustrating an apparatus for implementing an authentication system for a wireless mobile terminal according to an exemplary embodiment of the present invention.

As shown in FIG. 2, the apparatus for implementing an authentication system for a wireless mobile terminal according to an embodiment of the present invention is located on the wireless mobile terminal 110, and each authentication scheme provided by the network is provided on the wireless mobile terminal 110. Display on the user screen. An apparatus for implementing an authentication system for a wireless mobile terminal having such a function includes a NIC 112 and an authentication standard protocol engine 114.

The NIC 112 includes an authentication protocol message generator 112-1, and the authentication protocol message generator 112-1 generates an authentication protocol message corresponding to the authentication method selected by the user, thereby generating an authentication mechanism according to the selected authentication method. Is set on the wireless mobile terminal (110). In this way, authentication is performed between the wireless mobile terminal 110 and the authentication server 130 by the authentication method selected by the user.

The authentication standard protocol engine 114 adopts authentication such as EAP-MD5, EAP-TLS, EAP-PEAP, EAP-TTLS, and Cisco LEAP, which are authentication methods in the EAP authentication structure utilized as a general authentication system, and is adopted in standards such as 802.16. Various authentication protocols are provided on the wireless mobile terminal 110 to selectively operate the unique authentication of the wireless mobile terminal 110 in accordance with the request of the wireless network 100 or the user. The authentication standard protocol engine 114 supports a new authentication method through a program upgrade on the wireless mobile terminal 110 when a new standard authentication method is introduced.

Here, the authentication method of the EAP type will be briefly described.

First, the EAP-MD5 Challenge is an EAP authentication type that provides a basic level of EAP support. In fact, since there is no mutual authentication step for the wireless mobile terminal 110 and the wireless network 100, only the one-way authentication is provided. It is one of the most important types of authentication in that it does not provide a way to retrieve the Wired Equivalent Privacy (WEP) key.

The EAP-TLS provides a certificate-based mutual authentication function for the wireless mobile terminal 110 and the wireless network 100. This method performs authentication through the wireless mobile terminal 110 side certificate and the authentication server 130 side certificate, and the user default WEP key to enhance security for subsequent communication between the wireless mobile terminal 110 and the base station 120. And dynamically generate a session-based WEP key.

EAP-TTLS is a method developed by Funk Software and Certicom as an augmentation of EAP-TLS. This security method is a certificate for the wireless mobile terminal 110 and the wireless network 100 through an encrypted channel (or “tunnel”). -Based mutual authentication and a method for generating dynamic user or session-based WEP keys. Unlike EAP-TLS, EAP-TTLS only requires server-side certificates.

LEAP is a type of EAP authentication primarily used in Cisco Aironet WLANs. It uses a dynamically generated WEP key to encrypt transmission data and supports mutual authentication.

PEAP provides a method for securely transmitting authentication data, such as legacy cryptographic based protocols, over an 802.11 wireless network 100. PEAP performs this function using tunneling between the wireless mobile terminal 110 and the authentication server 130. PEAP authenticates the wireless mobile terminal 110 by simplifying the implementation and management of a secure wireless LAN using only server-side certificates, such as Tunneled Transport Layer Security (TTLS), which performs similar functions.

Next, a method for implementing an authentication system for a wireless mobile terminal according to an embodiment of the present invention will be described in detail with reference to FIG. 3.

3 is a flowchart illustrating an operation of an apparatus for implementing an authentication system of a wireless mobile terminal according to an exemplary embodiment of the present invention.

As shown in FIG. 3, the authentication standard protocol engine 114 of the wireless mobile terminal 110 detects an authentication scheme currently provided by the wireless network 100 (S310) and authenticates the user screen on the wireless mobile terminal 110. The method is displayed (S320).

Then, the authentication standard protocol engine 114 of the wireless mobile terminal 110 further confirms the upgrade request for the authentication protocol to be supported (S330). At this time, if there is an authentication protocol to be additionally supported, an upgrade is supported on the wireless mobile terminal 110 (S340). On the other hand, if there is no authentication protocol to be additionally supported, the authentication protocol message generator 112-1 generates a message corresponding to the authentication protocol currently supported by the wireless mobile terminal 110 and sets an internal terminal structure (S360). ). At this time, the user selects the authentication method displayed on the screen in step S320 so that the authentication structure is set on the wireless mobile terminal 110 (S350).

As such, when an authentication structure is set on the wireless mobile terminal 110, an authentication procedure is performed by interworking between the wireless mobile terminal 110, the base station 120, and the authentication server 130 (S370). 110 is connected to the network by authentication (S380). From this time, the user receives the service through the wireless mobile terminal 110 (S390).

As described above, according to an embodiment of the present invention, by implementing the authentication scheme on the basic message format, it is possible to provide authentication only by upgrading the authentication standard protocol engine 114 in the wireless mobile terminal. Even if the NIC 112 is changed on the 110, the same authentication structure may be provided on the wireless mobile terminal 110. In addition, the authentication server that performs the authentication function with the user ID and password performs authentication by the authentication method supported by the network, thereby preventing multiple access to the same ID during the user authentication process that occurs in the public wireless Internet service. Will be.

4 is a diagram illustrating an example of the authentication procedure illustrated in FIG. 3. In FIG. 4, it is assumed in step S350 that the user has selected the MD5 authentication method that is mainly used in the public wireless mobile communication service.

As shown in FIG. 4, when the wireless mobile terminal 110 enters the service area of the base station 120, the wireless mobile terminal 110 undergoes an association process defined in the IEEE 802.11 control procedure. The user authentication process then begins.

The wireless mobile terminal 110 makes a wireless access request to the base station 120 equipped with the IEEE 802.1x function as an EAPOL Start message for notifying the start of the EAP (S402). In response, the base station 120 transmits an EAP-Request / Identity message to the terminal, which means to identify who the wireless mobile terminal 110 is (S404), and the wireless mobile terminal 110 directly inputs the user. The ID is transmitted to the base station 120 in the EAP-Response / Identity message (S406). At this time, the base station 120 receiving the EAP-Response / Identity message from the wireless mobile terminal 110 sends the user ID in the Access-Request (EAP-Type) to the authentication server 130 and transmits the wireless mobile terminal 110. Attempt to connect to the authentication server 130 using the ID received from the (S408).

If the user ID exists, the authentication server 130 creates an MD5-Challenge packet in the Access-Challenge message and transmits it to the base station 120 (S410). Upon receiving the MD5-Challenge, the base station 120 converts it into an EAP-Request / MD5-Challenge message and transmits it to the wireless mobile terminal 110 (S412).

The wireless mobile terminal 110 transmits the hash result with the password to the base station 120 in response to the MD5-Challenge request to the EAP-Response / MD5-Challenge message again (S414). Then, the base station 120 loads the MD5-Challenge value in the Access Request message and transmits it to the authentication server 1300 (S416). The authentication server 130 then hashes the MD5 hash of the user ID and the result of the MD5 hash. In this case, if the passwords match, the authentication server 130 loads the EAP-Success in the Access-Accept message to the base station 120 (S418) and transmits the EAP-Success message. The authentication success is notified to the wireless mobile terminal 110 at step S420. On the other hand, if the password does not match, the authentication server 130 loads the EAP-Failure in the Access-Reject message to the base station 120 (S418), The authentication failure is notified to the wireless mobile terminal 110 through the EAP-Failure message (S420).

The above embodiments are intended to illustrate the present invention, the scope of the present invention is not limited to the embodiments, it can be modified or modified by those skilled in the art within the scope of the invention defined by the appended claims.

According to the present invention, an authentication method such as EAP-TLS, which is an authentication method in an EAP authentication structure utilized as a general-purpose authentication system, and a wireless terminal-specific authentication method adopted by the standards such as 802.16 may be selectively operated according to a network and a user request. By properly operating the structure and function on the terminal, the same authentication structure can be provided on the terminal even if the wireless network access device is changed on the portable mobile terminal. Therefore, when accessing the Internet and other networks in the current wired / wireless network, by supporting the network-specific authentication method on the terminal can be utilized as a general terminal authentication scheme structure.

Claims (8)

An apparatus for implementing various authentication schemes required by various networks on a wireless mobile terminal, An authentication standard protocol engine for detecting an authentication protocol supported in the network; And A network access card for setting an internal structure of the wireless mobile terminal so that authentication is performed using a message used in the detected authentication protocol in an authentication server for authenticating the connection of the network to the wireless mobile terminal. Apparatus for implementing the authentication system of a wireless mobile terminal comprising a. The method of claim 1, The authentication standard protocol engine is an authentication system implementation apparatus for a wireless mobile terminal that supports upgrade according to a new standard authentication protocol. The method of claim 2, The network connection card, Authentication protocol message generator for generating a message used for the authentication protocol Apparatus for implementing the authentication system of a wireless mobile terminal comprising a. The method according to any one of claims 1 to 3, And the network access card is connected to the wireless mobile terminal by a standard interface. In a method for implementing various authentication schemes required by various networks on a wireless mobile terminal, a) detecting an authentication scheme supported by a network to which the terminal is currently connected; b) setting an internal structure of the wireless mobile terminal such that authentication is performed by using a message used in the sensed authentication scheme in an authentication server for authenticating a connection of the network to the wireless mobile terminal; And c) performing authentication by the detected authentication method between the terminal and the authentication server after step b) Authentication system implementation method of a wireless mobile terminal comprising a. The method of claim 5, Supporting upgrade according to a new standard authentication method in the network Authentication system implementation method of a wireless mobile terminal further comprising. The method of claim 6, Displaying the authentication method detected in the step a) on the wireless mobile terminal to allow the user to select Authentication system implementation method of a wireless mobile terminal further comprising.  The method according to any one of claims 5 to 7, The authentication method is a method for implementing an authentication system for a wireless mobile terminal including EAP authentication on an Extensible Authentication Protocol (EAP) authentication structure and a unique authentication method of the wireless mobile terminal adopted in the 802.16 standard.

Images