KR100968523B1 - A terminal, method for distributing session key and computer readable record-medium on which program for executing method thereof - Google Patents

Abstract

A session key distribution method is disclosed. The session key distribution method generates a session key using the first nonce value received from the network access device and the second nonce value of the terminal, encrypts the session key using a predetermined secret key, and encrypts the encrypted session key. Transmitting a nonce value to the network access device, receiving an encryption message including an encrypted session key from the network access device, decrypting the encrypted session key using the secret key, and storing the decrypted session key. do. According to the present invention, there is an advantage that a session key distribution that is not vulnerable from an attack such as a memory exhaustion attack can be secured.

802.11i, session key distribution, hash value, cookie algorithm

Description

A method for distributing session keys and a computer readable record-medium on which program for executing method

The present invention relates to a method for distributing a session key between a terminal and a network access device, and more particularly, to a method for distributing the same session key between a terminal and a network access device using a cookie algorithm, a method for executing the terminal and the method. It relates to a recording medium on which a program is recorded.

Recently, with the rapid development of information and communication technology, users using wireless communication are increasing rapidly. However, wireless communication, despite its high popularity, is seriously exposed to inevitable attacks in the wireless environment.

Due to the nature of wireless, if encryption is not provided, there is a vulnerability that exposes sensitive data to third parties. In addition, even if the encryption function is provided, if the user authentication mechanism is vulnerable, the secret communication of the user may be exposed to an attacker disguised as a normal user or a normal service provider.

Therefore, in the wireless communication service, encryption communication and user authentication must be provided.

The IEEE 802.1x standard provides authentication and security algorithms to support encrypted communication over the wireless section. However, the authentication and security algorithms provided in the conventional 802.1x have a problem that the personal information is breached in a wireless environment, or is very vulnerable to man-in-middle or denial of service.

For this reason, the IEEE has released 802.11i to provide enhanced security. 802.11i defines the session key distribution process and the mutual authentication mechanism.

In particular, 802.11i distributes the session key (4-way handshake method) using four message transmission and reception between the terminal and the network access device.

However, the conventional 802.11i has a problem in that the first message (first message) among four messages is exposed to an external attack (eg, a fake attack).

Accordingly, the session key distribution process of 802.11i is vulnerable to a denial attack (DoS attack) that causes the memory resources of the terminal to be exhausted, and a man-in-middle (man) whose key is changed by another terminal (such as a hacker's terminal). -in-middle) Attacks were possible.

Accordingly, the present invention has been made to solve the above-described problem, and the present invention proposes a session key distribution method that is resistant to denial attacks such as memory exhaustion attacks.

Another object of the present invention is to propose a session key distribution method in which the session key can not be changed by a third party (such as an attacker).

According to one aspect of the present invention, a session key distribution method is disclosed. The session key distribution method according to an embodiment of the present invention (a) generates a session key corresponding to the network access device using the first nonce value received from the network access device and the second nonce value of the terminal. step; (b) encrypting the generated session key using a preset secret key, and transmitting the encrypted session key and the second nonce value to the network access device-the terminal generates the generated session key and the Do not store encrypted session key; (c) receiving an encryption message including the encrypted session key from the network access device; And (d) decrypting the received encrypted session key using the secret key and storing the decrypted session key, wherein the network access device comprises the first nonce value and the received second key. The session key is generated using a nonce value.

The encryption message may further include an integrity check value for confirming the integrity of the encryption message.

(C) step (c-1) generating an integrity check value of the cryptographic message; And (c-2) comparing the identity of the received integrity check value with the generated integrity check value, wherein step (d) is performed only when the comparison result is the same. Can be.

In the step (a) it may be characterized in that further receiving the MAC address (MAC Address) of the network connection device.

In the step (a), the session key may be generated by further using a preset Pairwise Master Key (PMK).

The secret key may be generated using a preset pairwise master key (PMK).

According to another aspect of the present invention, a session key distribution method is disclosed. In accordance with another aspect of the present invention, a method for distributing a session key may include: (a) generating a session key corresponding to the network access device using a first nonce value received from the network access device and a second nonce value of the terminal; Making; (b) calculating a hash value of the generated session key by using a hash function and transmitting the second nonce value to the network access device; the terminal generates the generated session key and the hash value Do not save-; (c) receiving an encryption message including the hash value and the second nonce value from the network access device; And (d) regenerating a session key using the second nonce value, wherein the network access device generates the session key using the first nonce value and the received second nonce value. It is done.

The session key distribution method includes (e) calculating a hash value of the regenerated session key using the hash function, and comparing the calculated hash value with the received hash value; And (f) storing the regenerated session key if the comparison result is the same.

The encryption message may further include a message integrity code for checking the integrity of the encryption message.

Step (c) includes: (c-1) generating an integrity check value with the encryption message; And (c-2) comparing the identity of the integrity check value of the message integrity code included in the encrypted message with the generated integrity check value, wherein the step (d) is the same as the comparison result. It may be characterized in that performed.

In the step (a) it may be characterized in that further receiving the MAC address (MAC Address) of the network connection device.

In the step (a), the session key may be generated by further using a preset Pairwise Master Key (PMK).

The session key may be encrypted with a secret key generated using a preset pairwise master key (PMK).

According to another aspect of the present invention, a session key distribution terminal is disclosed. The session key distribution terminal according to another embodiment of the present invention generates a session key corresponding to the network access device by using the first nonce value and the second nonce value received from the network access device. ; An encryption unit for encrypting the generated session key using a previously stored secret key, wherein the terminal does not store the generated session key and the encrypted session key; A transmission / reception unit configured to transmit the encrypted session key and the second nonce value to the network access device, and to receive an encryption message including the encrypted session key from the network access device; And a decryption unit that decrypts the received encrypted session key using the secret key, wherein the network access device generates a session key using the first nonce value and the received second nonce value. It is done.

The apparatus may further include a storage configured to store the decrypted session key.

The encryption message may further include a message integrity code for checking the integrity of the encryption message.

The decryption unit generates an integrity check value with the encrypted message, and compares the integrity of the integrity check value of the message integrity code included in the encrypted message and the generated integrity check value, but the comparison result, And decrypt the received encrypted session key.

The transceiver may further receive a MAC address of the network access device.

The generation unit may further generate the session key by using a preset pairwise master key (PMK).

The session key may be encrypted with a secret key generated using a preset pairwise master key (PMK).

According to another aspect of the present invention, a session key distribution terminal is disclosed. The session key distribution terminal according to another embodiment of the present invention generates a session key corresponding to the network access device by using the first nonce value and the second nonce value received from the network access device. ; An encryption unit for generating a hash value of the generated session key using a hash function, wherein the terminal does not store the generated session key; A transmission / reception unit configured to transmit the hash value and the first nonce value to the network access device, and to receive an encryption message including the hash value and the second nonce value from the network access device; And a decoder configured to regenerate the session key using the second nonce value, wherein the network access device generates the session key using the first nonce value and the received second nonce value.

The apparatus may further include a storage unit for storing the regenerated session key.

The decoder calculates a hash value of the regenerated session key using the hash function and compares the calculated hash value with the received hash value. It may be characterized in that the storage.

The encryption message may further include a message integrity code for checking the integrity of the encryption message.

The decryption unit generates an integrity check value with the encrypted message, and compares the identity of the integrity check value of the message integrity code included in the encrypted message with the generated integrity check value, and, as a result of the comparison, the session only. And regenerating the key.

The transceiver may further receive a MAC address of the network access device.

The generation unit may further generate the session key by using a preset pairwise master key (PMK).

The session key may be encrypted with a secret key generated using a preset pairwise master key (PMK).

According to another aspect of the present invention, a recording medium on which a program for executing a session key distribution method is recorded. According to another embodiment of the present invention, a recording medium on which a program for executing a session key distribution method is recorded includes (a) the network using a first nonce value received from the network connection device and a second nonce value of the terminal. Generating a session key corresponding to the access device; (b) encrypting the generated session key using a preset secret key, and transmitting the encrypted session key and the second nonce value to the network access device-the terminal generates the generated session key and the Do not store encrypted session keys; (c) receiving an encryption message including the encrypted session key from the network access device; And (d) decrypting the received encrypted session key using the secret key and storing the decrypted session key, wherein the network access device comprises the first nonce value and the received second key. Provided is a recording medium recorded by a program executing a session key distribution method, wherein the session key is generated using a nonce value.

According to another aspect of the present invention, a recording medium on which a program for executing a session key distribution method is recorded. According to another embodiment of the present invention, a recording medium on which a program for executing a session key distribution method is recorded includes (a) the network access device using a first nonce value received from a network access device and a second nonce value of a terminal. Generating a session key corresponding to the session key; (b) calculating a hash value of the generated session key by using a hash function and transmitting the second nonce value to the network access device; the terminal generates the generated session key and the hash value Do not save-; (c) receiving the encryption message including the hash value and the second nonce value from the network access device; And (d) regenerating a session key using the second nonce value, wherein the network access device generates the session key using the first nonce value and the received second nonce value. A recording medium recorded by a program for executing a session key distribution method is provided.

Therefore, the present invention has a strong effect on denial attacks such as memory exhaustion attacks in session key distribution.

The present invention also has the effect of preventing the change of the session key by a third party (such as an attacker).

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms including ordinal numbers, such as second and first, may be used to describe various components, but the components are not limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the second component may be referred to as the first component, and similarly, the first component may also be referred to as the second component. And / or < / RTI > includes any combination of a plurality of related listed items or any of a plurality of related listed items.

It is to be understood that when an element is referred to as being "connected" or "connected" to another element, it may be directly connected or connected to the other element, . On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and the same or corresponding components will be given the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted.

The present invention relates to a method for sharing a session key between a terminal and a network access device. In the present specification, session key distribution in 802.11i will be described as a representative example. This is for clarity and convenience of understanding of the present invention, and it is obvious to those skilled in the art in view of the technical idea of the present invention that the present invention is not limited thereto and can be applied to any method for performing authentication and security procedures by distributing session keys. Do.

First, in order to facilitate the understanding and explanation of the overall contents of the present invention, an authentication method in 802.11i, which is the basis of the technical idea of the present invention, will be briefly described.

Hereinafter, in order to facilitate the understanding and explanation of the present invention, 802.11i will be described first. However, since the basic process of 802.11i is a technique known at the time of filing the present invention, in order to clarify the gist of the present invention, a part that is not related to the gist of the present invention will be briefly described.

The authentication process using 802.11i is performed in three steps.

First, a first step (not shown) is a step of negotiating an encryption scheme and an authentication scheme between a terminal and a network access device, and an initial authentication and connection establishment process is performed between the terminal and the network access device using seven messages.

Through the negotiation process of the first step, an authentication method and an encryption method between the terminal and the network access device are determined. In addition, the first step is a negotiation step for simple initial authentication and connection establishment between the terminal and the network access device, and a reliable security state is not established.

The second step (not shown) is a process of performing mutual authentication between the terminal and the authentication server and distributing a master session key (MSK).

In the second step, EAP (extensible authentication protocol) is used for mutual authentication between the terminal and the authentication server. Here, EAP is not an authentication method, but a framework for supporting various authentication methods. Authentication methods that can be used in 802.11i using EAP include EAP-Transport Layer Security (EAP-TLS), EAP-Tunneled TLS (EAP-TTLS), and protected EAP (PEAP).

When the message is exchanged according to the authentication method selected in the first step and it is confirmed that the authentication result is performed successfully, the terminal and the authentication server mutually authenticate in the second step. However, since the mutual authentication using the EAP is performed between the terminal and the authentication server, there is a problem in that full mutual trust cannot be guaranteed between the terminal and the network access device. Since this is obvious to those skilled in the art, a separate description will be omitted.

The third step is to confirm that the terminal and the network access device each generated the same master session key, and using a preset method (for example, a 4-way handshake), a pairwise transient key (PTK). It is a process of generating).

1 is a diagram illustrating a session key distribution method according to 802.11i used in the present invention. More specifically, it is a diagram illustrating a session key distribution method related to the present invention in step 3 of the authentication process of 802.11i described above.

Referring to FIG. 1, in step S110, the network access device prevents replay attack, a MAC address of the network access device, an arbitrary value set by the network access device (hereinafter also referred to as a first nonce value), and a replay attack. The first message including the counter information for transmitting to the terminal.

Here, since the one-to-one symmetric key (hereinafter, referred to as session key) is established between the network access device and the terminal, the first message is transmitted in plain text that is not encrypted or decrypted and is not protected.

Here, since the first message is transmitted in plain text and is not protected, the first message is easily processed by an attacker and thus is exposed to a denial attack (DoS attack) such as exhaustion of memory resources.

For example, suppose that a fake first message and a normal first message are transmitted to the terminal together in a situation where one or more forged first messages may exist.

The terminal generates a session key for the forged first message and the normal first message, respectively. The terminal stores the generated session keys and the received first nonce value in memory, respectively. The terminal may have a problem in that memory of the terminal is rapidly consumed due to a method of storing one or more unnecessary session keys and first nonce values.

For example, an attacker such as a hacker may modify a predetermined value ANonce of the first message and transmit a plurality of replicated first messages to the terminal. In this case, the terminal should store the received session key for each first message and the first nonce value in a predetermined recording area, which may cause the storage limit of the storage medium provided in the terminal to be exceeded. Therefore, if the hacker attack is successful, there is a serious problem that all previous authentication process is cancelled.

Subsequently, in step S120, the terminal receiving the first message from the network access device generates a session key (hereinafter, referred to as a terminal session key) using the first message.

Subsequently, in step S130, the terminal has a MAC address of the terminal, an arbitrary value set by the terminal (hereinafter referred to as a second nonce value), counter information for preventing a replay attack, and a message integrity code (message integrity code; MIC). (Hereinafter referred to as MIC) is transmitted to the network access device.

Here, the MIC is a code for verifying the integrity of the received message, and a process of verifying the integrity of the message will be described later.

Subsequently, in step S140, the network access device receiving the second message from the terminal generates a session key (hereinafter referred to as an AP session key) using the second message received in step S130.

In step S150, the network access device verifies whether the AP session key generated in step S140 is the same as the terminal session key.

In this case, the identity verification may use the received MIC. In more detail, in step S130, the terminal generates a MIC by encrypting predetermined factors (terminal MAC address, random value set by the terminal) included in the second message with the terminal session key, and generates the MIC. (Included in the second message) is transmitted to the network access device. The network access device encrypts predetermined factors (terminal MAC address, random value set by the terminal) excluding the MIC in the second message received in step S130 using the AP session key generated in step S140. To create a new MIC. The network access device may compare the identity of the received MIC and the generated MIC, and verify that the terminal session key and the AP session key are the same in the same case.

Subsequently, in step S160, the network access device generates a third message including a MAC address of the network access device, an arbitrary value set by the network access device (ANonce), counter information for preventing a replay attack, and a MIC. To send.

Subsequently, in step S170, the terminal verifies the identity of the AP session key and the stored terminal session key using the MIC of the third message received in step S160.

Here, the method of verifying the identity is similar to the method of verifying the identity using the MIC received by the network access device in step S150, detailed description thereof will be omitted.

When the identity of the terminal session key and the AP session key is verified, in step S180, the terminal may transmit a response message (hereinafter referred to as a fourth message) to the network access device in response to the third message received in step S160.

Subsequently, in step S190, the terminal and the network access device form a mutual secret channel.

Such 802.11i does not include MIC in the above-described first message and does not perform separate encryption. Therefore, 802.11i has a problem that is vulnerable to a memory exhaustion attack forging the first message.

So far, the session key distribution method based on 802.11i has been described with reference to FIG. Hereinafter, a session key distribution system according to an embodiment of the present invention will be described with reference to FIG. 2.

2 is a diagram illustrating a session key distribution system according to an embodiment of the present invention.

Session key distribution is a process necessary for establishing a secret channel between the terminal 210 and the network access device 220. In more detail, the session key distribution shares only a common session key between the terminal 210 and the network access device 220. As a result, the terminal 210 and the network connection device 220 maintain security of data transmitted and received to each other. In addition, the terminal 210 and the network connection device 220 recognizes the reliability of the data transmitted and received. That is, the terminal 210 and the network connection device 220 may form a secret channel for reliable data transmission.

Session key distribution can be achieved by sending and receiving four messages, as described above with reference to FIG. Unlike conventional session key distribution, the present invention distributes the session key using a cookie algorithm.

Here, the cookie algorithm refers to an algorithm in which the server transmits cookie information such as identification information to the client, and then the client that accesses the server easily uses the cookie information. According to the present invention, the cookie algorithm transmits the cookie information generated by the terminal to the network access device, and then the terminal receives the cookie information from the network access device.

The present invention enhances the security of session key distribution by applying the cookie algorithm to the session key distribution process.

In more detail, the terminal 210 generates a session key after receiving the first message. However, the terminal 210 encrypts the session key or calculates a hashing value (cookie information) without storing the generated session key. The terminal 210 transmits the encrypted session key or the calculated hash value (cookie information) to the network access device 220. Thereafter, the terminal 210 receives a third message (including cookie information) having enhanced security from the network access device 220, and acquires or regenerates a session key according to the received cookie information.

Therefore, according to the present invention, the terminal 210 receives the third message with enhanced security by using a cookie algorithm and stores a session key obtained or regenerated according to the received third message.

A detailed process of the session key distribution will be described in detail with reference to FIGS. 3 and 4 below.

Referring to FIG. 2, the session key distribution system includes a terminal 210 and a network access device 220. In addition, it will be apparent to those skilled in the art that a plurality of terminals 210 may be included, but in the present specification, a session key distribution system including one terminal 210 and one network connection device 220 is provided for understanding and clarity. It demonstrates as a typical example.

The terminal 210 is an end terminal 210 for receiving any service through a communication network. For example, the terminal 210 is not only a personal computer (PC), a hand-held PC, and a notebook PC, but also a personal digital assistant (PDA), a cellular phone, and a personal communication service (PCS). The terminal 210 may communicate with the wired / wireless Internet network 120 such as a phone, a WCDMA phone, a CDMA-2000 phone, and a mobile broadband and system (MBS) phone.

In the present invention, the terminal 210 may include a transceiver 211, a generator 212, an encryption unit 213, a decoder 214, and a storage unit 215.

The transceiver 211 may transmit / receive various data (including messages) between the network connection device 220 and the terminal 210 which will be described later. In particular, in the present invention, the transceiver 211 may transmit and receive the first to fourth messages with the network connection device 220.

The generation unit 212 may generate an arbitrary value ANonce set by the terminal 210.

In addition, the generation unit 212 may generate a session key using a value (SNonce) or the like arbitrarily generated by the network connection device 220 included in the first message. Here, the session key may be used for encrypting and decrypting data transmitted and received through a secret channel to be formed between the terminal 210 and the network access device 220.

The encryption unit 213 may encrypt the generated session key using a preset secret key. Here, the secret key is a key that only the terminal 210 knows, and the terminal 210 may encrypt and decrypt the session key using the secret key.

When the transceiver 211 receives the third message (including the encrypted session key) from the network access device 220, the decoder 214 decrypts the received encrypted session key using a preset secret key. , A session key can be obtained (first embodiment).

In addition, the decoder 214 may calculate a hash value of the session key generated in the terminal using a hash function. The generated hash value is transmitted to the network access device 220 through the transceiver 211, and then received again by the terminal along with a random value (SNonce) set by the network access device 220 through the third message. do.

In this case, the decoder 214 may regenerate the session key using an arbitrary value SNonce set by the received network access device 220. The decoder 214 may calculate a hash value of the regenerated session key and compare it with the received hash value, and the decoder 214 may store the regenerated hash value when the two hash values are the same as a result of the comparison. .

The storage unit 215 may store various programs necessary for driving the terminal 210, and may store a session key finally obtained or generated.

As described above, the role of the terminal 210 is briefly described in the present invention, but the sequential operation of the specific terminal 210 will be described in more detail with reference to FIGS. 3 and 4.

The network access device 220 may share the same session key with the terminal 210 by transmitting and receiving the first and fourth messages with the terminal 210.

The network access device 220 performs a function of connecting the terminal 210 and the network. For example, the network access device 220 may be an access point (AP) in a wireless communication network or may be a base station of a mobile communication network.

In the present specification, the network access device 220 will be described as an exemplary AP, but is not limited thereto. It will be apparent to those skilled in the art that the network access device 220 may include all devices that perform a function of connecting the terminal 210 and the network.

In the present invention, the network access device 220 transmits the first message to the terminal 210 and receives the second message from the terminal 210.

The network access device 220 may generate a session key using a value ANonce randomly generated by the terminal 210 included in the second message.

In addition, the network connection device 220 may generate the third message including the received encrypted session key or hash value (included in the second message) and transmit it to the terminal 210.

The network access device 220 may receive a response message of the third message, that is, the fourth message, and form a secret channel with the terminal 210. As described above, the network access device 220 may perform data communication in which security is maintained with the terminal 210 through the formed secret channel.

The network connection device 220 in the present invention has been briefly described, but the sequential operation of the specific network connection device 220 will be described in more detail with reference to FIGS. 3 and 4.

Hereinafter, a session key distribution method using a cookie algorithm will be described with reference to FIGS. 3 to 4.

3 is a diagram illustrating a session key distribution method according to a first embodiment of the present invention.

In step S301, the terminal 210 performs the first step (negotiating an encryption scheme and an authentication scheme between the terminal and the network access device) and the second step (initial authentication and combination between the terminal and the network access device) after performing the network. The first message is received from the access device 220.

Here, the first message may include a MAC address of the network access device 220, an arbitrary value (ANonce) set by the network access device 220, and counter information for preventing a replay attack. .

Subsequently, in step S302, the terminal 210 receiving the first message from the network access device 220 generates a session key using the first message. At this time, the terminal 210 does not store the generated session key.

Unlike the conventional session key distribution method described with reference to FIG. 1, the generated session key is not stored. This is because the generated session key is generated according to the unprotected (unverified integrity) first message and its authenticity has not been verified. In this case, the authenticity means whether the message is received from the network connection device 220 that the terminal 210 truly requests authentication.

Subsequently, in step S303, the terminal 210 encrypts the generated session key using a previously stored secret key. Here, the secret key is a key that only the terminal 210 knows, and the terminal 210 may encrypt and decrypt the session key using the secret key.

For example, the secret key is a bidirectional master key generated through the first step (negotiating encryption method and authentication method between the terminal and the network access device) and the second step (initial authentication and combination between the terminal and the network access device). It may be a key generated using a Pairwise Master Key (PMK).

In addition, the terminal 210 may generate the MIC. Here, the MIC is transmitted in addition to the message to be transmitted, and as described above, the MIC is a code for verifying the integrity of the message to be transmitted.

Subsequently, in step S304, the terminal 210 transmits a second message including the encrypted session key and the MIC to the network access device 220.

Subsequently, in steps S305 and S306, the network access device 220 receives the second message and generates and stores a session key using the received second message.

Subsequently, in step S307, the network connection device 220 generates a third message and transmits it to the terminal 210. The generated third message includes an encrypted session key received in the second message. In addition, the third message may include the MAC address of the network access device 220, any value set by the network access device 220, counter information, and MIC.

Subsequently, in step S308, the terminal 210 decrypts the encrypted session key included in the third message by using the previously stored secret key.

Subsequently, in step S309, the terminal 210 may verify the integrity of the third message using the MIC included in the third message received in step S308. Thus, the terminal 210 can verify the obtained session key.

That is, the terminal 210 may verify that the same session key as the network access device 220 is obtained. The terminal 210 stores the session key only when it is verified.

Subsequently, in step S310, the terminal 210 transmits a response message (fourth message) of the third message to the network access device 220.

Subsequently, in step S310, a secret channel may be formed between the terminal 210 and the network access device 220.

4 is a diagram illustrating a session key distribution method according to a second embodiment of the present invention.

As in the first embodiment of the present invention described above, the terminal 210 receives the first message from the network access device 220, and generates a session key using the first message (S401, S402).

Since this process is the same as the process of FIG. 3, description thereof will be omitted.

Unlike the first embodiment of the present invention described above, in the second embodiment of the present invention, the second message does not include an encrypted session key.

Subsequently, in step S403, the terminal 210 calculates a hash value of the session key generated through the hash function.

Subsequently, in step S404, the terminal 210 transmits a second message including the hash value calculated in step S403 to the network access device 220. Here, the terminal 210 does not store the session key generated according to the first message vulnerable to the attack of an external attacker (for example, a hacker).

Subsequently, in steps S405 and S406, the network access device 220 may generate and store a session key using the received second message. In the description of FIG. 3, since the network access device 220 receives the second message and generates the session key, the description thereof will be omitted for convenience and clarity.

Subsequently, in step S407, the network access device 220 transmits a third message including the hash value received in step S404 to the terminal 210. In addition, the third message includes a random value SNonce set by the network access device 220.

This is because the terminal 210 does not store the session key generated according to the first message, and the terminal 210 cannot obtain the session key using only the received hash value. Accordingly, the terminal 210 must regenerate the session key, and for this purpose, the terminal 210 needs a random value SNonce set by the network access device 220.

Accordingly, the network access device 220 transmits a third message including the hash value received from the terminal 210 and the random value SNonce generated by the network access device 220 to the terminal 210.

Subsequently, in step S408, the terminal 210 regenerates the session key according to the set random value SNonce received in step S407.

Subsequently, in step S409, the terminal 210 verifies whether the session key regenerated in step S408 is the same session key as the network access device 220.

For example, the terminal 210 calculates a hash value using the same hash function as the hash function previously used again with the generated session key. The terminal 210 may verify the regenerated session key by determining whether the calculated hash value and the received hash value are the same.

The terminal 210 stores the regenerated session key only when the regenerated session key is verified.

Subsequently, in step S410, the terminal 210 transmits a fourth message to the network access device 220 in response to the third message received in step S407.

Subsequently, in step S411, the terminal 210 and the network access device 220 may store the same session key to form a secret channel.

Although the above has been described with reference to the preferred embodiments of the present invention, those skilled in the art can vary the present invention without departing from the spirit and scope of the present invention as set forth in the claims below. It will be understood that modifications and changes can be made.

1 is a diagram illustrating a session key distribution method according to 802.11i used in the present invention.

2 is a diagram illustrating a session key distribution system according to an embodiment of the present invention.

3 is a diagram for explaining a session key distribution method according to a first embodiment of the present invention;

4 is a diagram for explaining a session key distribution method according to a second embodiment of the present invention;

<Description of the symbols for the main parts of the drawings>

210: terminal 211: transceiver

212: generation unit 213: encryption unit

214: decryption unit 215: storage unit

220: network connection device

Claims (30)

delete delete delete delete delete delete In the session key distribution method with a network access device performed by a terminal, (a) generating a session key corresponding to the network access device using the first nonce value received from the network access device and the second nonce value of the terminal; (b) calculating a hash value of the generated session key by using a hash function and transmitting the second nonce value to the network access device; the terminal does not store the generated session key and the hash value Not-; (c) receiving an encryption message including the hash value and the second nonce value from the network access device; And (d) regenerating a session key using the second nonce value; And the network access device generates the session key using the first nonce value and the received second nonce value. The method of claim 7, wherein (e) calculating a hash value of the regenerated session key using the hash function and comparing the calculated hash value with the received hash value; And (f) storing the regenerated session key if the comparison result is the same. The method of claim 7, wherein The encryption message, And a message integrity code for confirming the integrity of the cryptographic message. 10. The method of claim 9, In step (c), (c-1) generating an integrity check value with the encryption message; And (c-2) further comprising comparing the integrity check value of the message integrity code included in the cipher message with the generated integrity check value, And (d) the step of performing the comparison as a result of the comparison. The method of claim 7, wherein In the step (a), And receiving a MAC address of the network access device. The method of claim 7, wherein In the step (a), And the session key is further generated by using a preset pairwise master key (PMK). The method of claim 12, The session key is Session key distribution method, characterized in that encrypted with a secret key generated using the Pairwise Master Key (PMK). delete delete delete delete delete delete delete In the terminal for distributing the network connection device and the session key, A generation unit generating a session key corresponding to the network access device by using the first nonce value received from the network access device and the second nonce value of the terminal; An encryption unit for generating a hash value of the generated session key using a hash function, wherein the terminal does not store the generated session key; A transmission / reception unit configured to transmit the hash value and the first nonce value to the network access device, and to receive an encryption message including the hash value and the second nonce value from the network access device; And A decoder which regenerates a session key using the second nonce value, And the network access device generates the session key using the first nonce value and the received second nonce value. The method of claim 21, And a storage unit for storing the regenerated session key. The method of claim 21, The decoding unit, Computing a hash value of the regenerated session key using the hash function, and compares the calculated hash value and the received hash value, And, when the comparison result is identical, storing the regenerated session key. The method of claim 21, The encryption message, And a message integrity code for checking the integrity of the encrypted message. The method of claim 24, The decoding unit, Generating an integrity check value with the encrypted message, and comparing the integrity check value of the message integrity code included in the encrypted message with the generated integrity check value, And a session key is regenerated only in the same case as a result of the comparison. The method of claim 21, The transceiver unit, And receiving a MAC address of the network access device. The method of claim 21, The generation unit, And generating the session key by using a preset pairwise master key (PMK). The method of claim 27, The session key is Session key distribution terminal, characterized in that encrypted with a secret key generated using the Pairwise Master Key (PMK). delete A recording medium readable by an electronic device on which a program comprising typed instructions for executing a session key distribution method is recorded, the method comprising: (a) generating a session key corresponding to the network access device using the first nonce value received from the network access device and the second nonce value of the terminal; (b) calculating a hash value of the generated session key by using a hash function and transmitting the second nonce value to the network access device; the terminal does not store the generated session key and the hash value Not-; (c) receiving an encryption message including the hash value and the second nonce value from the network access device; And (d) regenerating a session key using the second nonce value; And the network access device generates the session key using the first nonce value and the received second nonce value.

Images