KR102021177B1 - Method and system for falsification and modulation verification through transmission of message authentication code in dynamic separation channel - Google Patents

Abstract

The present invention relates to a forgery verification method and system by transmitting a message authentication code in a dynamic separation channel. When a message to be transmitted is selected, a first message authentication code (mac) is generated corresponding to the message. And dividing a plurality of communication channels using different communication schemes into a security channel and a message transmission channel, and separately transmitting the message and the first message authentication code, separating the security channel and the message transmission channel. Receiving the transmitted message and the first message authentication code, generating a second message authentication code corresponding to the message, comparing the message with the first message authentication code, and determining whether the message is forged or not according to a match It includes.

Description

Method and system for falsification and modulation verification through transmission of message authentication code in dynamic separation channel

The present invention relates to a forgery verification method and system by transmitting a message authentication code, and more particularly to a forgery verification method, and more particularly, by transmitting a message and a message authentication code (Message Authentication Code) using a different communication method The present invention relates to a method and a system capable of verifying forgery and alteration of a.

Recently, a method using a cryptographic algorithm for data protection has been widely used. Typical applications of encryption algorithms include securing confidentiality, integrity, and authenticity of data.

Here, confidentiality means that the data can only be seen by the designated person, integrity means that the data can be checked whether or not it was forged in the middle, and authentication means that the data can be identified from whom.

To secure the confidentiality of data, encryption algorithms are used a lot, and to secure integrity, a message authentication code is generated using a hash algorithm (Hash), and a message and a message authentication code are combined and transmitted.

However, in the above case, since a message and a message authentication code are transmitted by a single channel in a combined state, there is a high risk of physically tapping one communication scheme. In this case, there is a high possibility that the message or the message authentication code is forged or tampered by a third party and thus is vulnerable to security.

Korean Unexamined Patent Publication No. 10-2014-0089251 (published Jul. 14, 2014)

The embodiments of the present invention transmit a message and a message authentication code by using different communication methods so that even if one communication method is physically tapped, forgery of data is more robust. To provide a forgery verification method using MAC transmission over a dynamic separate channel capable of verifying.

In order to achieve the above object, in the forgery verification method through message authentication code transmission in the dynamic separation channel proposed by the present invention, if a message to be transmitted is selected, a first message authentication code corresponding to the message (Message Authentication) Generating a Code: mac, dividing a plurality of communication channels using different communication schemes into a security channel and a message transmission channel, and separately transmitting the message and the first message authentication code. Receiving the message and the first message authentication code separately transmitted through a message transmission channel, generating a second message authentication code corresponding to the message, comparing the message with the first message authentication code, and matching It may include determining whether the forgery.

Each of the first message authentication code and the second message authentication code may be generated using a hash function.

The separating and transmitting may include calculating a channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security level, and then selecting a channel having the highest channel priority as the secure channel. .

In another aspect, the method and system for forgery verification by transmitting a message authentication code in the dynamic separation channel proposed by the present invention, if a message to be transmitted is selected, the first message authentication code corresponding to the message (Message A transmission device for generating an Authentication Code (mac), dividing a plurality of communication channels using different communication schemes into a security channel and a message transmission channel, and separating and transmitting the message and the first message authentication code; Receives the message and the first message authentication code separately transmitted through the secure channel and the message transmission channel, generates a second message authentication code corresponding to the message, compares with the first message authentication code, and matches It may include; a receiving device for determining whether or not forgery according to.

Each of the first message authentication code and the second message authentication code may be generated using a hash function.

The transmission apparatus may calculate a channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security degree, and then select the channel having the highest channel priority as the secure channel.

Embodiments of the present invention transmit a message and a message authentication code using different communication methods, so that even if one communication method is physically tapped, the message authentication code is more robust. Forgery can be verified.

1 is a view for explaining the MPTCP applied to the present invention.
2 is a diagram illustrating a protocol stack for a conventional TCP and MPTCP applied to the present invention.
3 is a diagram illustrating an MPTCP proxy applied to the present invention.
4 is a diagram illustrating a forgery verification method through message authentication code transmission in a dynamic separation channel according to an embodiment of the present invention.
5 is a diagram illustrating a forgery verification method and system through message authentication code transmission in a dynamic separation channel according to an embodiment of the present invention.
6 is a diagram illustrating an apparatus for transmitting a message and a first message authentication code according to another embodiment of the present invention.

Technical terms used in the present invention are merely used to describe specific embodiments, it should be noted that it is not intended to limit the present invention. In addition, the technical terms used in the present invention should be interpreted as meanings generally understood by those skilled in the art unless the present invention has a special meaning defined in the present invention, and is excessively comprehensive. It should not be interpreted in the sense of or in the sense of being excessively reduced. In addition, when a technical term used in the present invention is an incorrect technical term that does not accurately express the spirit of the present invention, it should be replaced with a technical term that can be properly understood by those skilled in the art. In addition, the general terms used in the present invention should be interpreted as defined in the dictionary or according to the context before and after, and should not be interpreted in an excessively reduced sense.

Also, the singular forms used in the present invention include plural forms unless the context clearly indicates otherwise. In the present invention, terms such as “consisting of” or “comprising” should not be construed as necessarily including all of the various components or steps described in the invention, and some of the components or some of the steps are included. It should be construed that it may not be, or may further include additional components or steps.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings, and the same or similar components will be given the same reference numerals regardless of the reference numerals, and redundant description thereof will be omitted.

In addition, in describing the present invention, when it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted. In addition, it should be noted that the accompanying drawings are only for easily understanding the spirit of the present invention and should not be construed as limiting the spirit of the present invention by the accompanying drawings.

Embodiments of the present invention include a computer readable medium including program instructions for performing various computer-implemented operations. This medium records a program for executing a system such as file division, file name and password generation described above. This medium may include data files, data structures, program instructions, and the like. Examples of program instructions include machine language code, such as produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter.

Hereinafter, with reference to the accompanying drawings for the present invention will be described in more detail.

1 is a view for explaining the MPTCP applied to the present invention.

Standardization work related to MPTCP is ITU and IETF. The ITU introduces the need for MPTCP and the extent of industry trends. For the IETF, standards for MPTCP have been developed. However, the main purpose of MPTCP is for Carrier Aggregation (CA) to improve the speed of 4G, which allows network operators to offload 4G bandwidth shortage to wired or WiFi, as well as load balancing and high speed between data centers. It is standardized for communication.

As shown in Figure 1, MPTCP is a protocol that allows to recognize and utilize all of the WiFi, 3G, 4G communication network. MPTCP is a technology to configure a multipath TCP session by simultaneously configuring multiple subflows using multiple network addresses between terminals. Heterogeneous networks using a TCP connection are called subflows, and MPTCP adds or removes subflows depending on the situation, and can respond more quickly to congestion.

2 is a diagram illustrating a protocol stack for a conventional TCP and MPTCP applied to the present invention.

As shown in Figure 2, Figure 2 (a) shows a protocol stack for TCP, Figure 2 (b) shows a protocol stack for MPTCP.

MPTCP is applied on top of the Transport layer, which is a conventional TCP layer. Since MPTCP is implemented at the application layer or the presentation / session layer, MPTCP does not know the existence of MPTCP in the case of network equipment that is implemented only at the network layer or below.

The basic structure of MPTCP is configured as shown in FIG. MPTCP basically consists of two layers, the MPTCP layer and several subflow layers beneath it. The MPTCP layer is responsible for managing connections and reordering packets sent to the application, and each subflow layer is responsible for reliable packet transmission and network congestion control.

3 is a diagram illustrating an MPTCP proxy applied to the present invention.

As shown in Fig. 3, the proxy server acts as an intermediary between the server and the client (a user connecting to the server), even though the server does not support MPTCP, so that only the client can support it. Do it. In other words, if the server sends data, the proxy server can split the data in two and send it to the client in two separate paths. Even if the target server does not support MPTCP, the client can communicate in multiple paths through the MPTCP proxy server if the smartphone supports MPTCP.

The MPTCP Proxy Server enables clients to support MPTCP because multiple paths are always available, whether or not the server is supported. In other words, if your smartphone supports MPTCP, you can always use LTE and WiFi at the same time through the proxy. In addition, MPTCP is a standard of the IETF and is not related to 3GPP, and does not require major updates to the existing LTE network itself. As such, the network equipment is inevitably implemented and managed through an MPTCP proxy.

4 is a diagram illustrating a forgery verification method through message authentication code transmission in a dynamic separation channel according to an embodiment of the present invention.

As shown in Figure 4, the forgery verification method through the transmission of the message authentication code in the dynamic separation channel, generating a first message authentication code corresponding to the message (S110), the message and the first message authentication code Separating and transmitting (S120), receiving the separated transmitted message and the first message authentication code (S130), generating a second message authentication code corresponding to the message (S140), and the first message Comparing the authentication code and the second message authentication code may include the step of determining whether the forgery (S150).

When a message to be transmitted is selected, a first message authentication code is generated for the message. In this case, the first message authentication code may be generated using a hash function (S110).

In addition, the first message authentication code may be generated using the hash function and the shared secret key in step S110.

Thereafter, a plurality of communication channels using different communication schemes are divided into a security channel and a message transmission channel, and the message and the first message authentication code are separated and transmitted (S120). At this time, in step S120, after calculating channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security degree, the channel having the highest channel priority may be selected as the secure channel.

The channel quality may be a value in which noise information values such as signal-to-noise ratios are pre-stored by scanning a plurality of communication channels in advance for channel selection, and the quality may be determined according to the pre-stored values. In addition, the channel selection history may be information obtained by accumulating the history of channel information selected by the sender and calculating the probability. The channel security may be a secure channel in which the transmitting side and the receiving side share channel information in advance. .

Thereafter, the receiving device receives the separated message and the first message authentication code (S130).

In operation S140, a second message authentication code corresponding to the message is generated. In this case, the second message authentication code may generate a new second message authentication code using a shared secret key and a hash function.

Then, the first message authentication code is compared with the newly generated second message authentication code to determine whether or not forgery (S150).

By transmitting a message and a message authentication code using a different communication method through the above method, even if one communication method is physically tapped, the stronger message authentication code can be obtained. It is effective to verify forgery and alteration.

5 is a diagram illustrating a forgery verification system through message authentication code transmission in a dynamic separation channel according to an embodiment of the present invention.

As shown in FIG. 5, the forgery verification system 1 through the message authentication code transmission in the dynamic separation channel of the present invention includes a message and a first message authentication code transmission device 100, a message and a first message authentication code reception device. 200.

The message and the first message authentication code transmission apparatus 100 may include a first message authentication code generation unit 110, a control unit 120, a channel selector 130, and a transmission unit 140.

When the message to be transmitted is selected, the first message authentication code generation unit 110 generates a first message authentication code for the message. In this case, the first message authentication code may be generated using a hash function.

In addition, the first message authentication code generation unit 110 may generate a first message authentication code using a hash function and a shared secret key together.

The shared secret key may be a shared secret key promised in advance by the transmitter 100 and the receiver 200.

The channel selector 130 calculates a channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security degree, and then selects the channel having the highest channel priority as the secure channel. .

In this case, the channel quality may be a value in which noise information values such as signal-to-noise ratio are pre-stored by scanning a plurality of communication channels in advance for channel selection, and the quality may be determined according to the pre-stored value. In addition, the channel selection history may be information obtained by accumulating the history of channel information selected by the sender and calculating the probability. The channel security may be a secure channel in which the transmitting side and the receiving side share channel information in advance. .

The controller 120 controls the transmitter to separate and transmit the security channel and the message transmission channel selected by the channel selector.

The transmitter 140 includes a message transmitter 141 and a first message authentication code transmitter 142.

The message transmitter 141 transmits the message, and the first message authentication code transmitter 142 transmits the first message authentication code. In other words, the message and the authentication code is transmitted separately.

That is, the message and the first message authentication code are separately transmitted using a plurality of communication channels using different communication methods such as WiFi, 3G, and 4G. In particular, to distinguish the secure channel of the first message authentication code from the message transmission channel, so that the tracking of the first message authentication code becomes more difficult.

In addition, it can be seen that the eavesdropping by the third party is to establish a very difficult communication environment.

The message and first message authentication code receiver 200 may include a receiver 210, a second message authentication code generator 220, and a forgery determination unit 230.

The receiver 210 includes a message receiver 211 and a first message authentication code receiver 212, and receive a message and a first message authentication code, respectively.

The second message authentication code generation unit 220 and the forgery determination unit 230 may be included.

The second message authentication code generating unit 220 generates a second message authentication code corresponding to the message received by the message receiving unit 211 using a hash function. In addition, a second message authentication code may be generated using a secret shared key previously shared with the transmitter 100.

The tampering determination unit 230 compares the second message authentication code generated by the second message authentication code generation unit 220 with the first message authentication code received by the first message authentication code receiving unit 211 to match. Determine whether or not forgery by comparing with.

By transmitting a message and a message authentication code using a different communication method through the above method, even if one communication method is physically tapped, the message authentication code is more robust. It is effective to verify the forgery of.

6 is a diagram illustrating an apparatus for transmitting a message and a message authentication code according to another embodiment of the present invention.

According to another embodiment, the message and the first message transmission device 100 of the present invention may further include a message divider 150.

The message dividing unit 150 may divide a message and a message authentication code by a preset dividing rule.

The preset division rule may include a rule for dividing a message in a horizontal direction, a vertical direction, a horizontal and vertical direction, and a diagonal direction. In addition, the present invention is not limited thereto, and may be divided based on a block unit, and may be divided based on the X, Y, and Z directions. It may also be changed from time to time at predetermined times or at regular intervals.

In this case, the division rule may be generated using a known algorithm or may be generated as a solution specially developed for a specific need such as military use, satellite communication connection, and the like.

The first message authentication code generation unit 110 may generate a first message authentication code corresponding to the divided message using a hash function and a secret shared key.

At this time, the secret shared key includes the partition rule information.

The controller 120 controls the channel selection unit 130 to separate and transmit the divided message and the generated first message authentication code.

In this case, the divided plurality of messages and the plurality of first message authentication codes may be separately distributed and transmitted using a plurality of communication channels using different communication methods such as WiFi, 3G, and 4G.

In particular, to distinguish the secure channel of the first message authentication code from the message transmission channel, so that the tracking of the first message authentication code becomes more difficult.

Message and the first message authentication code receiving apparatus 200 receives the divided message and the first message authentication code. Thereafter, the second message authentication code generation unit 220 generates a new second message authentication code using a secret shared key and a hash function that share the message received from the message receiving unit 211 in advance.

The tampering determination unit 230 compares the second message authentication code generated by the second message authentication code generation unit 220 with the first message authentication code received by the first message authentication code receiving unit 211 to match. Determine whether or not forgery by comparing

Features, structures, effects, and the like described in the above embodiments are included in at least one embodiment of the present invention, and are not necessarily limited to only one embodiment. In addition, the features, structures, effects, and the like illustrated in the embodiments may be combined or modified with respect to other embodiments by those skilled in the art to which the embodiments belong.

Therefore, contents related to such combinations and modifications should be construed as being included in the scope of the present invention. In addition, the above description has been made with reference to the embodiments, which are merely examples and are not intended to limit the present invention, and those skilled in the art to which the present invention pertains may be illustrated as above without departing from the essential characteristics of the present embodiments. It will be appreciated that various modifications and applications are possible. For example, each component specifically shown in the embodiments may be modified. And differences relating to such modifications and applications will have to be construed as being included in the scope of the invention defined in the appended claims.

100: message and the first message authentication code transmission device
110: first message authentication code generation unit
120: control unit
130: channel selector
140: transmission unit
150: message divider
141: message transmission unit
142: first message authentication code transmission unit
200: apparatus for receiving message and first message authentication code
210: receiver
211: message receiving unit
212: first message authentication code receiving unit
220: second message authentication code generation unit
230: forgery judgment unit

Claims (6)

When a message to be transmitted is selected, generating a first message authentication code corresponding to the message;
Dividing a plurality of communication channels using different communication schemes into a security channel and a message transmission channel, transmitting the message through the message transmission channel, and separating and transmitting the first message authentication code into the secure channel;
Receiving the message and the first message authentication code separately transmitted through the secure channel and the message transmission channel; And
Generating a second message authentication code corresponding to the message, comparing the message with the first message authentication code, and determining whether the message is forged or not according to a match; Verification method.
The method of claim 1,
Each of the first message authentication code and the second message authentication code
A forgery verification method through message authentication code transmission in a dynamic separation channel, characterized in that it is generated using a hash function.
The method of claim 1,
The separate transmission step
After calculating a channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security level, a channel having the highest channel priority is selected as the secure channel. Forgery verification method through message authentication code transmission in.
When a message to be transmitted is selected, a first message authentication code corresponding to the message is generated, a plurality of communication channels using different communication methods are divided into a security channel and a message transmission channel, and then the A transmitter for transmitting a message to the message transmission channel and separating and transmitting the first message authentication code to the secure channel; And
Receives the message and the first message authentication code separately transmitted through the secure channel and the message transmission channel, generates a second message authentication code corresponding to the message, compares with the first message authentication code, and matches A forgery verification system by transmitting a message authentication code in the dynamic separation channel comprising a;
The method of claim 4, wherein
Each of the first message authentication code and the second message authentication code
A forgery verification system through message authentication code transmission in a dynamic separate channel, characterized in that it is generated using a hash function.
The method of claim 4, wherein
The secure channel and the message transmission channel,
After calculating a channel priority based on at least one of channel quality, channel selection history, channel operating cost, and channel security level, a channel having the highest channel priority is selected as the secure channel. Forgery verification system through message authentication code transmission in.

Images