KR102057577B1 - Method and apparatus for network address registration through key management - Google Patents

Abstract

Disclosed is a method for registering a network address through key management. Particularly, a method for operating a first communication node comprises the steps of: receiving an address registration request message from a second communication node; transmitting the address registration request message to a gateway; receiving a first response message including an address registration result and a link key between the second communication node and a first communication node from the gateway; and transmitting a second response message generated based on the first response message to the second communication node. The first and second communication nodes respectively have first and second symmetric keys previously distributed by the gateway. The link key is a symmetric key generated based on the second symmetric key, and the address registration request message includes an address to be registered, and a first authenticator generated based on the second symmetric key and the address to be registered. Therefore, the performance of a communication system can be improved.

Description

METHOD AND APPARATUS FOR NETWORK ADDRESS REGISTRATION THROUGH KEY MANAGEMENT}

The present invention relates to a network address registration method, and more particularly, to a network address registration method through key management for improving network security and building an efficient network.

Internet of Things (IoT) services are attracting attention to establish a more convenient and safe society, and are actively researching in various fields recently. Wireless communication technology is a major foundation technology that enables Internet of Things (IoT) services, and a security problem in a wireless communication network is a very important factor for building a secure communication network.

An authentication method using a key may be used to confirm whether the communication node is an authorized device to join the network.

Authentication methods through key management include public key method and symmetric key method. Public key method can be economically inferior because of long key length, slow decryption speed, and complicated mathematical operation. have. Therefore, it may be difficult to use it in a low power wireless network.

Therefore, an authentication method through a symmetric key may be considered. The authentication method through symmetric keys can be faster and more economical in encryption, but if the number of hops is large due to the large number of keys to be managed, a large memory capacity can be required, and the distribution of keys is difficult. There may be.

An object of the present invention for solving the above problems is to provide a key management technique that efficiently improves security in a multi-hop based communication network.

A method of operating a first communication node in a wireless personal area network (WPAN) -based communication network including a gateway and a plurality of communication nodes according to an embodiment of the present invention for achieving the above object, the first communication node Receiving an address registration request message from the second communication node connected to the gateway through; transmitting the address registration request message to the gateway; an address registration result from the gateway and the first communication with the second communication node; Receiving a first response message including a link key between nodes, and transmitting a second response message generated based on the first response message to the second communication node. The first communication node and the second communication node are each a first symmetric key previously distributed from the gateway and Having a 2 symmetric key, the link key is a symmetric key generated based on the second symmetric key, and the address registration request message is generated based on the address to be registered and the second symmetric key and the address to be registered. It may include a first authenticator.

Here, the address registration request message and the first response message are messages protected through an Institute of Electrical and Electronic Engineers (IEEE) 802.15.4 hop-by-hop security using the first symmetric key. Can be.

Here, when the IP address of the second communication node is registered in the network, the message between the second communication node and the first communication node can be protected through the IEEE 802.15.4 hop-by-hop security using the link key. .

The address registration request message may include an identifier of the second communication node, a counter indicating the number of address registration requests of the second communication node, and a life time indicating the address valid period of the second communication node. lifetime) and gateway authentication information.

Here, the first authenticator may be a hash value based on an identifier of the second communication node, the address to be registered, the counter, the life time, the gateway authentication information, and the second symmetric key.

The link key may be generated based on the second symmetric key, the counter, and the gateway authentication information.

Here, the link key included in the first response message is encrypted using the first symmetric key, and the first response message further includes a second authenticator, and the second authenticator is the first authenticator. It may be a hash value based on the authenticator, the address registration result, and the link key.

Here, the second response message may further include a second authenticator, and the second authenticator may be a hash value based on the first authenticator, the address registration result, and the link key.

A second communication node connected to the gateway through a first communication node in a wireless personal area network (WPAN) -based communication system including a gateway and a plurality of communication nodes according to another embodiment of the present invention for achieving the above object. A method of operation, comprising: receiving a gateway authentication information message, determining an address based on the gateway authentication information message, an address including the address and a first authenticator generated based on the address and the second symmetric key Sending a registration request message to the first communication node, receiving a response message of the gateway from the first communication node, between the first communication node and the second communication node based on the first symmetric key Determining a link key and verifying the response message using the link key. It said first symmetric key and the second symmetric key may be distributed in advance from the gateway.

Here, when the IP address of the second communication node is registered in the network, a message between the second communication node and the first communication node is transmitted to the Institute of electrical and electronics engineers (IEEE) 802.15.4 hop by using the link key. Can be protected through hop security.

The address registration request message may include an identifier of the second communication node, a counter indicating the number of address registration requests of the second communication node, and a life time indicating the address valid period of the second communication node. lifetime) and gateway authentication information.

Here, the first authenticator may be a hash value based on the identifier of the second communication node, the address, the counter, the life time, the gateway authentication information, and the second symmetric key.

Here, the response message may include an address registration result and a second authenticator, and the second authenticator may be a hash value based on the first authenticator, the address registration result, and the link key.

A method of operating the gateway in a wireless personal area network (WPAN) -based communication system including a gateway and a plurality of communication nodes according to another embodiment of the present invention for achieving the above object, the second communication node is a first communication Receiving an address registration request message of the second communication node connected to the gateway through a node and including a first authenticator, determining validity of the address registration request message, determining whether address duplication; Determining a link key between the first communication node and the second communication node, sending a response message including an address registration result and a second authenticator generated based on the link key through the first communication node; And transmitting to the node, wherein the first communication node and the second communication node are each previously separated from the gateway. Having a first symmetric key and a second symmetric key multiplied, the link key may be generated based on the second symmetric key.

Here, the address registration request message and the response message may be messages protected by an Institute of Electrical and Electronic Engineers (IEEE) 802.15.4 hop-by-hop security using the first symmetric key. have.

The address registration request message may include an identifier of the second communication node, a counter indicating the number of address registration requests of the second communication node, and a life time indicating the address valid period of the second communication node. lifetime) and gateway authentication information.

Here, the first authenticator may be a hash value based on an identifier of the second communication node, the address to be registered, the counter, the life time, the gateway authentication information, and the second symmetric key.

The determining of the validity of the address registration request message may be performed based on a predetermined table, in which the symmetric key and address are mapped for each identifier of a communication node permitted to register a network. A symmetric key corresponding to the identifier of the first communication node, an identifier of the first communication node on the table, the address to be registered included in the address registration request message, the life time included in the address registration request message, and Calculating a hash value based on the counter included in the address registration request message and the gateway authentication information stored in the gateway; and checking whether the calculated hash value is the same as the first authenticator included in the address registration request message. And determining whether to approve the address registration comprises: If the address corresponding to the identifier of the first communication node on the table is the same as the address included in the address registration request message or the address corresponding to the identifier of the first communication node does not exist in the table, the address registration is performed. It may include the step of approving.

Here, the response message further includes a value in which the link key is encrypted using the first symmetric key, and the second authenticator included in the response message includes the first authenticator, the address registration result, and It may be a hash value based on the link key.

Here, the link key is generated based on the second symmetric key, the counter and the gateway authentication information, the second symmetric key and the gateway authentication information is a value stored in the gateway, and the counter is the address registration request. It may be a value included in the message.

According to the present invention, a communication node may perform an authentication procedure for address registration in a network based on a symmetric key initially distributed from a gateway. The authentication procedure may be performed at the gateway, and all authorized communication nodes may each receive a pair of symmetric keys from the gateway.

A communication node that is single hop away from the gateway may perform the authentication procedure through the distributed symmetric key. A communication node that is multi-hop away from the gateway may perform an authentication procedure through another communication node serving as a router between the gateway and the communication node. Here, the communication node to perform the authentication procedure for address registration and the other communication node serving as a router existing between the gateway and the communication node generate a new link key based on their symmetric keys distributed from the gateway. The security of communication can be maintained. Therefore, the performance of the communication system can be improved.

1 is a conceptual diagram illustrating a first embodiment of a communication system.
2 is a conceptual diagram illustrating key distribution between a gateway and a communication node.
3 is a block diagram showing a first embodiment of a communication node constituting a communication system.
4 is a flowchart illustrating an address registration procedure of a communication node.
5 is a flowchart illustrating an address registration procedure performed at a gateway.
6 is a flowchart illustrating a procedure for checking validity of an authenticator of K3.
7 is a flowchart illustrating a procedure for checking address duplication.

As the present invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all modifications, equivalents, and substitutes included in the spirit and scope of the present invention.

Terms such as first and second may be used to describe various components, but the components should not be limited by the terms. The terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present invention, the first component may be referred to as the second component, and similarly, the second component may also be referred to as the first component. The term and / or includes a combination of a plurality of related items or any item of a plurality of related items.

When a component is said to be "connected" or "connected" to another component, it may be directly connected to or connected to that other component, but it may be understood that another component may be present in the middle. Should be. On the other hand, when a component is said to be "directly connected" or "directly connected" to another component, it should be understood that there is no other component in between.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present disclosure does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in the commonly used dictionaries should be construed as having meanings consistent with the meanings in the context of the related art and shall not be construed in ideal or excessively formal meanings unless expressly defined in this application. Do not.

Hereinafter, with reference to the accompanying drawings, it will be described in detail a preferred embodiment of the present invention. In the following description of the present invention, the same reference numerals are used for the same elements in the drawings and redundant descriptions of the same elements will be omitted.

1 is a conceptual diagram illustrating a first embodiment of a communication system.

Referring to FIG. 1, a communication system may include a gateway 100 and a plurality of communication nodes 110, 120, and 130. Here, a communication system may be referred to as a "communication network." Each of the plurality of communication nodes may support at least one communication protocol.

Gateway 100 and communication nodes 110, 120, 130 may support IEEE 802.15.4. In addition, the gateway 100 and the communication nodes 110, 120, and 130 may support IPv6 over low-power wireless personal area network (6LoWPAN) based on IEEE 802.15.4. The gateway 100 may operate as a 6LoWPAN border router (6LBR) of 6LoWPAN, and the communication nodes 110, 120, and 130 may operate as a 6LoWPAN node (6LN). The 6LN can operate as a 6LoWPAN host or 6LR (6LoWPAN router).

A pair of symmetric keys may be installed between the communication nodes 110, 120, 130 and the gateway 100 for the security mechanism. A pair of symmetric keys installed between the communication nodes 110, 120, 130 and the gateway 100 is called a device key.

2 is a conceptual diagram illustrating key distribution between a gateway and a communication node.

Referring to FIG. 2, a pair of device keys K1 may be installed between the gateway 100 and the communication node # 1 110. A pair of device keys K2 may be installed between the gateway 100 and the communication node # 2 120. A pair of device keys K3 may be installed between the gateway 100 and the communication node # 3 130. Only communication nodes (e.g., communication node # 1 110, communication node # 2 120, communication node # 3 130) authorized to access a low-power wireless personal area network (LoWPAN) may use the gateway ( And a pair of device keys.

Device keys K1, K2, K3 may be used to verify that communication nodes 110, 120, 130 are authorized to access LoWPAN. The symmetric key may not be shared in advance between two different communication nodes.

Referring back to FIG. 1, the communication node # 1 110 may belong to the coverage of the gateway 100. The communication node # 1 110 and the gateway 100 may share a device key K1 which is a symmetric key. The communication node # 1 110 and the gateway 100 may directly exchange messages with each other. Messages between communication node # 1 110 and gateway 100 may be protected via IEEE 802.15.4 hop-by-hop security using device key K1.

Communication node # 2 120 may belong within coverage of communication node # 1 110. Communication node # 1 110 and communication node # 2 120 may share a link key K12 that is a symmetric key. The link key K12 may be generated and distributed by the gateway 100 during IPv6 over low-power wireless personal area network-neighbor discovery (6LoWPAN-ND) address registration of communication node # 2 120. Since communication node # 2 120 does not belong to the coverage of gateway 100, communication node # 2 120 cannot directly exchange messages with gateway 100, but communication node # 2 120 communicates with gateway # 1 110 through gateway. You can send and receive messages with 100. Here, the communication node # 1 110 may operate as a router. Messages between communication node # 2 120 and communication node # 1 110 may be protected through IEEE 802.15.4 hop by hop security using link key K12.

Communication node # 3 130 may belong within coverage of communication node # 2 120. Communication node # 2 120 and communication node # 3 130 may share a link key K23 that is a symmetric key. Link key K23 may be generated and distributed by gateway 100 during 6LoWPAN-ND address registration of communication node # 3 130. Since communication node # 3 130 is not within the coverage of gateway 100, communication node # 3 130 cannot directly exchange messages with gateway 100, but communication node # 3 130 is communication node # 2 120 and communication node. A message may be exchanged with the gateway 100 through # 1 110. The communication node # 2 120 and the communication node # 1 110 may operate as a router. Messages between communication node # 3 130 and communication node # 2 120 may be protected through IEEE 802.15.4 hop by hop security using link key K23.

Meanwhile, communication nodes (for example, the gateway 100 and the communication nodes 110, 120, and 130) constituting the communication system may be configured as follows.

3 is a block diagram showing a first embodiment of a communication node constituting a communication system.

Referring to FIG. 3, the communication node 200 may include at least one processor 210, a memory 220, and a transceiver 230 that communicates with a network. In addition, the communication node 200 may further include an input interface device 240, an output interface device 250, a storage device 260, and the like. Each component included in the communication node 200 may be connected by a bus 270 to communicate with each other.

The processor 210 may execute a program command stored in at least one of the memory 220 and the storage device 260. The processor 210 may refer to a central processing unit (CPU), a graphics processing unit (GPU), or a dedicated processor on which methods according to embodiments of the present invention are performed. Each of the memory 220 and the storage device 260 may be configured as at least one of a volatile storage medium and a nonvolatile storage medium. For example, the memory 220 may be configured as at least one of a read only memory (ROM) and a random access memory (RAM).

Next, techniques for network address registration method through key management will be described. Here, even when the method (for example, the transmission or reception of a signal) is performed among the communication nodes is described, the corresponding communication node # 2 corresponds to the method performed in the communication node # 1. (Eg, reception or transmission of a signal). That is, when the operation of the communication node is described, the corresponding gateway may perform an operation corresponding to the operation of the terminal. In contrast, when the operation of the gateway is described, the communication node corresponding thereto may perform an operation corresponding to the operation of the gateway.

4 is a flowchart illustrating an address registration procedure of a communication node.

Referring to FIG. 4, the communication system may be the same as or similar to the communication system shown in FIG. 1. The communication nodes (communication node # 1 (110), communication node # 2 (120), communication node # 3 (130)) of FIG. 2 120, communication node # 3 130, and the gateway 100 of FIG. 4 may be the gateway 100 of FIG. 1. The communication node # 3 130 may be in a state that is not joined to the LoWPAN, and the communication node # 2 120 and the communication node # 1 110 may already be subscribed to the LoWPAN.

The communication node # 3 130 may transmit an information request message to an adjacent communication node (ie, communication node # 2) in order to join the LoWPAN (S400). The information request message may be transmitted in a multicast manner to all adjacent communication nodes.

The communication node # 2 120 may receive an information request message, and the communication node # 2 120 may transmit an information response message to the communication node # 3 130 (S401). The information response message may include gateway information. The gateway information may be information obtained when the communication node # 2 120 joins LoWPAN. The communication node # 3 130 may receive an information response message and may obtain gateway information included in the information response message.

The communication node # 3 130 may configure a global unicast address based on the prefix of the received gateway information, and increment the counter by one. In the case of the first address registration, the counter may be set to one.

The communication node # 3 130 may transmit an address registration request message to the gateway 100 through the communication node # 2 120 and the communication node # 1 110. The communication node # 2 120 and the communication node # 1 110 may operate as a router.

The address registration request message may include an authenticator using an identifier of the communication node # 3 130, a global unicast address configured based on a prefix of gateway information, a life time, a counter, and a device key K3. The lifetime may represent the period during which the address of the communication node becomes valid on the network. The gateway 100 may manage identifiers, addresses, and lifetimes of communication nodes authorized to access the network. When the address of the communication node is registered in the gateway 100, a life time for the corresponding address may be set, and the life time may be reduced as time passes from the registered time. When the lifetime reaches zero, the address is revoked and other communication nodes can use it. Accordingly, communication nodes registered with an address in the network may continuously reregister the address with the gateway 100. Unlike the lifetime managed at the gateway 100, the communication node has a constant lifetime value. The lifetime of the communication node can be used to update the lifetime in the address re-registration procedure. For example, when the lifetime value at the communication node # 3 130 is set to 100 and the address # 3 of the communication node # 3 130 is registered at the gateway 100, the address # 3 registration time point. In the gateway 100, the lifetime # 3 for the address # 3 of the communication node # 3 130 may be 100. After registration, the life time # 3 of the communication node # 3 130 may be reduced by the time elapsed. If time has elapsed by 30, then life time # 3 may be 70. At this time, if the address # 3 re-registration procedure of the communication node # 3 130 is performed, the lifetime # 3 may be updated to 100 again.

The authenticator may refer to a hash value based on the identifier of the communication node # 3 130, the global unicast address, the lifetime, the counter, the gateway information, and the device key K3.

The communication node # 3 130 may transmit an address registration request message to the communication node # 2 120 (S410). Communication node # 2 120 may receive an address registration request message. The communication node # 2 120 may transmit an address registration request message to the communication node # 1 110 (S411). Here, the address registration request message transmitted from the communication node # 2 120 to the communication node # 1 110 may be protected through IEEE 802.15.4 hop-by-hop security using the link key K12.

The communication node # 1 110 may receive an address registration request message. The communication node # 1 110 may transmit an address registration request message to the gateway 100 (S412). Here, the address registration request message transmitted from the communication node # 1 110 to the gateway 100 may be protected through IEEE 802.15.4 hop-by-hop security using the device key K1.

The gateway 100 may receive an address registration request message. The gateway 100 may perform an address registration procedure based on the received address registration request message (S420). Hereinafter, an address registration procedure performed in the gateway 100 will be described.

5 is a flowchart illustrating an address registration procedure performed in the gateway 100.

Referring to FIG. 5, the gateway 100 may receive an address registration request message of the communication node # 3 130 from the communication node # 1 110, and the communication node # 3 included in the received address registration request message. The identifier of 130 may be checked. The gateway 100 may check whether an identifier of the communication node # 3 130 exists in a previously stored duplicate address detection (DAD) table (S500). If the identifier of the communication node # 3 130 does not exist in the DAD table, the gateway 100 may delete the address registration request message and terminate the address registration procedure (S501).

Table 1 may be a DAD table stored in the gateway 100. The DAD table of Table 1 may be a DAD table in which address registration of the communication node # 3 130 is not yet completed. The node identifier of the DAD table includes identifiers of communication nodes authorized to access LoWPAN (for example, identifier of communication node # 1 110, identifier of communication node # 2 120, and identifier of communication node # 3 130). ) May be included. The address may include the global unicast address of each authorized communication node. However, if address registration of the authorized communication node is not completed, the address may not exist. The life time may include life time information of an authorized communication node. The counter may include a counter of an authorized communication node. If address registration of the communication node has never been made, the counter may be set to zero. When the first address registration is performed, the counter may be set to one. For example, when the communication node # 3 130 requests the address registration from the gateway 100 for the first time, since the address registration of the communication node # 3 130 has not been performed before, the communication node # 3 130 The counter corresponding to the identifier of) may be 0.

If the identifier of the communication node # 3 130 exists in the DAD table, the gateway 100 may check whether the authenticator of the device key K3 included in the address registration request message is valid (S502). The procedure for checking whether the authenticator of the device key K3 is valid is as follows.

FIG. 6 is a flowchart illustrating a procedure of checking validity of an authenticator of K3 in FIG. 5.

Referring to FIG. 6, the gateway 100 may select counters # 3 and K 3 corresponding to the communication node # 3 130 stored in the DAD table (S600).

The gateway 100 may compare the value of the counter # 3 included in the address registration request message of the communication node # 3 (130) received from the communication node # 1 110 with the value of the counter # 3 stored in the DAD table ( S601). If the value of the stored counter # 3 is greater than or equal to the value of the counter # 3 of the received address registration request message, the gateway 100 may delete the address registration request message and terminate the address registration procedure (S503).

If the value of the counter # 3 of the received address registration request message is larger than the value of the counter # 3 stored in the DAD table, the gateway 100 may generate an authenticator of K 3 based on the information stored on the DAD table (S602). ).

The authenticator of K3 generated based on the information stored on the DAD table may be generated using information included in the received address registration request message. That is, the global unicast address, life time, and counter of the communication node # 3 130 required for generating the authenticator may use information included in the received address registration request message as it is. The identifier of communication node # 3 130 may use the information on the DAD table, or may use the identifier included in the received address registration request message. However, the gateway information and the device key K3 may use a value stored in the DAD table. That is, the procedure for determining validity of the authenticator may be a procedure for determining validity of the gateway information.

The gateway 100 may compare whether the authenticator of K3 generated based on the information stored on the DAD table is the same as the authenticator of K3 included in the received address registration request message (S603). If the authenticators are different, the gateway 100 may delete the address registration request message and terminate the address registration procedure (S605). If the authenticators are identical to each other, the gateway 100 may perform an address duplication check procedure (S504).

Referring back to FIG. 5, if it is determined that the authenticator of K3 included in the received address registration request message is not valid, the gateway 100 may delete the address registration request message and terminate the address registration procedure (S503).

If it is determined that the authenticator of K3 is valid, the gateway 100 may perform an address duplication check (S504). Next, the address duplication check procedure performed when the authenticator of K3 is determined to be valid will be described.

7 is a flowchart illustrating a procedure for checking address duplication.

Referring to FIG. 7, the gateway 100 may select address # 3 corresponding to the identifier of the communication node # 3 130 stored in the DAD table (S700). The gateway 100 may determine whether a value of address # 3 stored in the DAD table does not exist or is the same as address # 3 of the received address registration request message (S701). If the value of address # 3 stored in the DAD table does not exist or is the same as address # 3 included in the received address registration request message, the gateway 100 may provide information corresponding to communication node # 3 130 of the DAD table ( That is, the address # 3, the life time # 3, and the counter # 3 may be updated to values included in the received address registration request message (S506). When the value of address # 3 stored in the DAD table does not exist, it can be considered that the communication node # 3 130 registers the address in the network for the first time. When the value of address # 3 stored in the DAD table exists. It can be seen that the communication node # 3 (130) re-registers the address.

If the stored address # 3 has a value other than the address # 3 value of the received address registration request message, the gateway 100 may determine that the corresponding address is already used by another communication node. Therefore, the gateway 100 may determine that address registration has failed due to duplication (S505).

Referring back to FIG. 5, when the addresses do not overlap, the gateway 100 may update the DAD table (S506) and set the result of the address registration request to “success”. If it is determined that the address is duplicated, the gateway 100 may set the result of the address registration request to "duplicate". The result information (eg, success or duplication) for the address registration request may be included in the address registration response message.

The gateway 100 then generates an authenticator of the link key K23 and the link key K23 between the communication node # 2 120 and the communication node # 3 130, and converts the generated link key K23 into a device key ( K2) can be encrypted (S507). The link key K23 may be generated based on the device key K3, the counter # 3, the information of the communication node # 3 130, the information of the communication node # 2 120, and the information of the gateway 100. The link key K23 may be generated through a pseudo random function using the above information. Since the link key K23 is derived from the device key K3 of the communication node # 3 130, it may also be generated in the communication node # 3 130.

The gateway 100 may generate an authenticator of the link key K23 based on the link key K23. The authenticator of the link key K23 may mean a hash value based on the authenticator of the device key K3, an address registration request result (ie, success or duplication), and the link key K23. In addition, the gateway 100 may encrypt the link key K23 using the device key K2.

Referring back to FIG. 4, the gateway 100 determines the value of the link key K23 encrypted using the authenticator of the link key K23 and the device key K2 as a result of the address registration request generated through the address registration procedure. Hereinafter, an address registration response message including K2_K23 may be transmitted to communication node # 3 130 through communication node # 1 110 and communication node # 2 120. Here, the communication node # 2 120 and the communication node # 1 110 may operate as a router.

The gateway 100 may transmit an address registration response message to the communication node # 1 110 (S430). The address registration response message transmitted from the gateway 100 to the communication node # 1 110 may be protected through IEEE 802.15.4 hop by hop security using the device key K1. The communication node # 1 110 may receive an address registration response message from the gateway 100.

The communication node # 1 110 may transmit an address registration response message to the communication node # 2 120 (S431). The address registration response message transmitted from the communication node # 1 110 to the communication node # 2 120 may be protected through IEEE 802.15.4 hop by hop security using the link key K12. The communication node # 2 120 may receive an address registration response message from the communication node # 1 110.

The communication node # 2 120 may obtain the link key K23 by decrypting the encrypted link key K2_K23 included in the address registration response message. The link key K23 obtained by the communication node # 2 120 is used to transmit / receive a message between the communication node # 3 130 and the communication node # 2 120 after the address registration of the communication node # 3 130 is completed. It can be used for IEEE 802.15.4 hop by hop security.

The communication node # 2 120 may transmit an address registration response message to the communication node # 3 130 (S432). Here, the address registration response message transmitted from the communication node # 2 120 to the communication node # 3 130 may not include an encrypted link key K2_K23. The communication node # 3 130 may receive an address registration response message from the communication node # 2 120.

The communication node # 3 130 may generate the link key K23 without relying on the address registration response message. The communication node # 3 130 may generate an authenticator of the link key K23 using the authenticator of the link key K23 and the device key K3 as a result of the address registration request included in the address registration response message. It may be compared with the authenticator of the link key K23 included in the registered address registration response message. That is, the validity of the authenticator of the link key K23 included in the received address registration response message may be checked. If the authenticator of the link key K23 included in the received address registration response message is valid, the communication node # 3 130 can accept the result of the address registration request. The result of the address registration request may be successful or duplicate.

When the gateway 100 registers the IP address of the communication node # 3 130, message transmission / reception between the communication node # 3 130 and the communication node # 2 120 later uses the link key K23. Can be protected through IEEE 802.15.4 hop-by-hop security.

The methods according to the invention can be implemented in the form of program instructions that can be executed by various computer means and recorded on a computer readable medium. Computer-readable media may include, alone or in combination with the program instructions, data files, data structures, and the like. The program instructions recorded on the computer readable medium may be those specially designed and constructed for the present invention, or may be known and available to those skilled in computer software.

Examples of computer readable media include hardware devices that are specifically configured to store and execute program instructions, such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code, such as produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device described above may be configured to operate with at least one software module to perform the operations of the present invention, and vice versa.

Although described with reference to the above embodiments, those skilled in the art will understand that the present invention can be variously modified and changed without departing from the spirit and scope of the invention described in the claims below. Could be.

Claims (20)

A method of operating a first communication node in a wireless personal area network (WPAN) based communication network comprising a gateway and a plurality of communication nodes,
Receiving an address registration request message from a second communication node connected to the gateway through the first communication node;
Transmitting the address registration request message to the gateway;
Receiving a first response message including an address registration result and a link key between the second communication node and the first communication node from the gateway; And
Sending a second response message generated based on the first response message to the second communication node,
The first communication node and the second communication node each have a first symmetric key and a second symmetric key previously distributed from the gateway, and the link key is a symmetric generated based on the second symmetric key. Key,
The address registration request message includes a first authenticator generated based on the address to be registered, the second symmetric key and the address to be registered, an identifier of the second communication node, and an address registration request of the second communication node. And a counter indicating whether or not it is the second. The method according to claim 1,
The address registration request message and the first response message are messages protected by an Institute of Electrical and Electronic Engineers (IEEE) 802.15.4 hop-by-hop security using the first symmetric key. Method of operation of the first communication node. The method according to claim 1,
When the IP address of the second communication node is registered in the network, a message between the second communication node and the first communication node is protected via IEEE 802.15.4 hop by hop security using the link key. How Nodes Work The method according to claim 1,
The address registration request message further includes a lifetime and gateway authentication information indicating an address validity period of the second communication node. The method according to claim 4,
Wherein the first authenticator is a hash value based on an identifier of the second communication node, the address to be registered, the counter, the lifetime, the gateway authentication information, and the second symmetric key. Method of operation. The method according to claim 4,
And the link key is generated based on the second symmetric key, the counter and the gateway authentication information. The method according to claim 1,
The link key included in the first response message is encrypted using the first symmetric key,
The first response message further includes a second authenticator,
And the second authenticator is a hash value based on the first authenticator, the address registration result, and the link key. The method according to claim 1,
The second response message further includes a second authenticator,
And the second authenticator is a hash value based on the first authenticator, the address registration result, and the link key. A method of operating a second communication node connected to the gateway through a first communication node in a wireless personal area network (WPAN) -based communication system including a gateway and a plurality of communication nodes,
Receiving a gateway authentication information message;
Determining an address based on the gateway authentication information message;
Sending an address registration request message including a first authenticator generated based on the address and a second symmetric key to the first communication node;
Receiving a response message of the gateway from the first communication node;
Determining a link key between the first communication node and the second communication node based on a first symmetric key; And
Verifying the response message using the link key, wherein the first symmetric key and the second symmetric key are previously distributed from the gateway,
The address registration request message further includes a counter indicating the number of the identifier of the second communication node and the address registration request of the second communication node. The method according to claim 9,
When the IP address of the second communication node is registered in the network, a message between the second communication node and the first communication node is transferred to the Institute of Electrical and Electronics Engineers (IEEE) 802.15.4 hop-by-hop security using the link key. Protected by the second communication node. The method according to claim 9,
The address registration request message further includes a lifetime and gateway authentication information indicating an address validity period of the second communication node. The method according to claim 11,
Wherein the first authenticator is a hash value based on an identifier of the second communication node, the address, the counter, the lifetime, the gateway authentication information, and the second symmetric key. Way. The method according to claim 9,
The response message includes an address registration result and a second authenticator,
And the second authenticator is a hash value based on the first authenticator, the address registration result, and the link key. A method of operating the gateway in a wireless personal area network (WPAN) -based communication system including a gateway and a plurality of communication nodes,
A second communication node is connected with the gateway via a first communication node,
Receiving an address registration request message of the second communication node including a first authenticator;
Determining the validity of the address registration request message;
Determining whether address duplication;
Determining a link key between the first communication node and the second communication node; And
Transmitting a response message including a second authenticator generated based on an address registration result and the link key to the second communication node through the first communication node,
The first communication node and the second communication node each have a first symmetric key and a second symmetric key previously distributed from the gateway, the link key being generated based on the second symmetric key,
And the address registration request message includes a counter indicating a number of an identifier of the second communication node and an address registration request of the second communication node. The method according to claim 14,
The address registration request message and the response message are messages of a gateway protected by an Institute of Electrical and Electronic Engineers (IEEE) 802.15.4 hop-by-hop security using the first symmetric key. How it works. The method according to claim 14,
The address registration request message further includes a lifetime and gateway authentication information indicating an address validity period of the second communication node. The method according to claim 16,
And the first authenticator is a hash value based on an identifier of the second communication node, an address to be registered, the counter, the lifetime, the gateway authentication information, and the second symmetric key. The method according to claim 17,
Determining the validity of the address registration request message,
Is performed based on a predetermined table,
In the table, symmetric keys and addresses are mapped to identifiers of communication nodes permitted to register a network.
A symmetric key corresponding to the identifier of the first communication node on the table, an identifier of the first communication node on the table, the address to be registered included in the address registration request message, the life included in the address registration request message Calculating a hash value based on a time, the counter included in the address registration request message, and gateway authentication information stored in the gateway; And
Confirming whether the calculated hash value is the same as the first authenticator included in the address registration request message;
The determining of the address duplication,
The address registration if the address corresponding to the identifier of the first communication node in the table is the same as the address included in the address registration request message or the address corresponding to the identifier of the first communication node does not exist in the table. Approving a step, the operation method of the gateway. The method according to claim 14,
The response message further includes a value in which the link key is encrypted using the first symmetric key,
And the second authenticator included in the response message is a hash value based on the first authenticator, the address registration result, and the link key. The method according to claim 16,
The link key is generated based on the second symmetric key, the counter and the gateway authentication information,
The second symmetric key and the gateway authentication information are values stored in the gateway, and the counter is a value included in the address registration request message.

Images