KR20040056392A - METHOD FOR PROVIDING A SECURE AUTOCONFIGURATION OF IPv6 ADDRESS AND UNIQUE NAME IN A HOME NETWORK INFORMATION APPLIANCE - Google Patents

Abstract

PURPOSE: A method for automatically setting an IPv6 address and a name of information home appliance in home network environment is provided to enable information home appliances to smoothly communicate with each other. CONSTITUTION: It is determined whether a specific interface, namely, each information home appliance, is connected to network(S400). If a specific interface is connected to network, each home appliance automatically generates an IPv6 address of its own link criteria(S402). Each home appliance generates an IPv6 address of its own site criteria(S404). Each home appliance determines its own domain name(S406). Each home appliance generates a zone file for each DNS(Domain Name Service) with the domain name and IPv6 address of the site criteria(S408).

Description

How to automatically set IP6 address and name of information appliance in home network environment {METHOD FOR PROVIDING A SECURE AUTOCONFIGURATION OF IPv6 ADDRESS AND UNIQUE NAME IN A HOME NETWORK INFORMATION APPLIANCE}

The present invention relates to a network setting technology in a home network environment based on IPv6 (Internet Protocol version 6), and more particularly, to an IPv6 address and device name between information appliances in a home network environment including information appliances with various subnetwork characteristics. The present invention relates to a method of automatically setting an IPv6 address and a name of an information appliance in a home network environment suitable for automatically setting the configuration.

IPv6-based autoconfiguration technology means creating an address that can be used globally using an interface ID that extends a 48-bit link layer address to 64-bit in the EUI-64 method. .

The 128-bit IPv6 address for unicast is created by combining 64-bit prefix information with a 64-bit interface ID. This prefix information is used by using information predefined by Internet communication network management regulation or assigned from router connected to external network, and interface ID is automatically used by using identifier information assigned to network interface card. Produce it.

Such identifier information is unique in the world because it is composed of a combination of a company code assigned to each company and an order value sequentially assigned to each produced product. Therefore, this identifier information can be used to construct a unique IPv6 address worldwide. This method of automatic generation of interfaces is defined in the Internet standards RFC2462 and RFC2463.

However, considering the size of a home network composed of IPv6-based information appliances in each home, security functions should be considered first. In particular, when using a public WLAN, security is most important. Therefore, privacy cannot be guaranteed by the method of RFC 2463 in which the link layer address is exposed as it is.

At present, in order to supplement this to mobile IPv6 and ICMPv6 (Internet Control Message Protocol version 6), the ABK (Address Based Key) and CGA (Cryptographically Generated Address) methods are being studied. The ABK method generates a public key and a private key and provides them to each node based on information that uniquely identifies each node. based Cryptosystem). In contrast, the CGA method is that each node generates its own unique public key and private key and uses the generated public key to generate an IPv6 address. In this case, the CGA method should consider a method for informing the counterpart of the public key.

In addition, the conventional IPv6-based automatic configuration technology requires a skilled network administrator for complex network configuration, and there is no fixed domain name service (DNS) server or dynamic host configuration protocol (DHCP) server. There is.

Therefore, each information appliance must store its IPv6 address and domain name locally and notify the user when requested. In other words, instead of having a centralized DNS server, each home appliance must act as a DNS server for its own address. This technology is currently being studied only in the link-local category under the name Link-layer Multicast Name Resolution (LLMNR) in the Internet Engineering Task Force (IETF). Each node multicasts the domain name for the IP address it wants to know in a link-local category, and the nodes that have subscribed to this multicast address are unicast if they match their domain name. Will be delivered.

In conclusion, the conventional addressing method and domain service proposed in an environment without a network administrator such as a home network are not only weak in security, but the research is limited only in the link local category.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problems of the prior art, by setting an IPv6 address with extended security functions and securely generating a unique domain name of the device, thereby enabling a smooth communication between information appliances. An object of the present invention is to provide a method of automatically setting an IPv6 address and name of an information appliance in a network environment.

Another object of the present invention is to provide a method for automatically setting an IPv6 address and a name of an information appliance in a home network environment in which each node arbitrarily selects its own domain name in an environment without a domain service server and guarantees uniqueness. have.

According to a preferred embodiment of the present invention for achieving this object, a method for automatically setting an IPv6 address and name of an information appliance in a home network environment, the method comprising: setting an IPv6 address of a link category of each information appliance; Setting a site category IPv6 address; Setting a unique domain name for each device; A method of automatically setting an IPv6 address and name of an information appliance in a home network environment, the method comprising storing an IPv6 address and a domain name in a site category in each information appliance.

1 is a block diagram illustrating a home network in which information appliances are connected based on an IPv6-based home gateway to which a method according to the present invention is applied;

2 is an exemplary diagram of a site-category unicast address format for version 6 based on the RFC 2373 standard according to the present invention;

3 is a domain name structure diagram defined to uniquely identify information appliances according to the present invention;

4 is a method for automatically setting an IPv6 address and name of an information appliance in a home network environment according to a preferred embodiment of the present invention, a flowchart of a process of setting a unique domain name and site category IPv6 address of each information appliance;

5 is a flowchart of a process of generating an IPv6 address of a site category according to the ID-based encryption scheme of FIG. 4;

FIG. 6 is a timing chart of a process of transmitting and receiving a DNS query and a response message based on the site category IPv6 address generated in FIG. 5. FIG.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

1 is a block diagram illustrating a home network in which information appliances are connected based on an IPv6-based home gateway to which a method according to the present invention is applied.

The home network as shown in FIG. 1 may be referred to as a site category IPv6-based environment in which information appliances supporting various networks are connected with one home gateway connected to an external network. At this time, such a home gateway serves as a router for connection with an external network.

The present invention is to propose a method for setting an extended IPv6 address security function and a method of safely generating a unique domain name of the device for smooth communication between information appliances in the home network environment as shown in FIG.

4 is a method for automatically setting an IPv6 address and name of an information appliance in a home network environment according to a preferred embodiment of the present invention, and is a flowchart of a process of securely setting a unique domain name and site category IPv6 address of each information appliance.

As shown in FIG. 4, in step S400, it is determined whether a specific interface, that is, IPv6-based information appliances are connected to a network, and if so, proceeds to step S402.

In step S402, each device automatically generates its own link category IPv6 address. In other words, according to the existing autoconfiguration method under the 128-bit IPv6 unicast address system, the interface identifier (IID) is an IPv6 address obtained by extending the 48-bit link layer address to 64 bits of the EUI-64 method. By using the lower 64 bits of, the IPv6 address is automatically generated.

The upper 64 bits of the IPv6 address are automatically generated by receiving the upper 64 bits from the router or by configuring the upper 64 bits using the default prefix. In addition, a process of verifying uniqueness of the IPv6 address is performed in the link category. In order to achieve the present invention, such a process must be preceded.

In the next step S404, the information appliances generate their own IPv6 address of the site category. This address is as illustrated in FIG. 2.

FIG. 2 is an exemplary view of a site-local unicast address format for version 6 based on the RFC 2373 standard according to the present invention, generally from a router (home gateway in the embodiment of the present invention). A prefix provided in a Router Advertisement (RA) message is used to generate an IPv6 address of a site category by configuring the upper 64 bits and the lower 64 bits of the IID generated in the previous link category IPv6 addressing step.

The upper 64-bit prefix is provided from the RA message periodically provided by the home gateway, and the RA message provided to each network includes a subnet ID suitable for each subnet.

That is, as shown in FIG. 3, the RA message periodically provided by the home gateway is extended to include a subnet ID suitable for each subnetwork, and the lower 64-bit IDs are assigned to the link category IID as described below. It is provided with a security service by encrypting with a private key generated according to the underlying cryptosystem.

Table 1 below lists the integer values defined to be used for these subnet IDs.

TABLE 1

Network format Subnet ID Ethernet 0 Public wifi One IEEE1394 2 PLC 3 HomePNA 4 reservation 5 ~

5 is a flowchart illustrating a process of generating an IPv6 address of a site category according to the ID-based encryption scheme of FIG. 4.

As shown in FIG. 5, if there is a link category unicast address assigned to a specific interface (S500), the IID is extracted from the link category IPv6 unicast address (S502).

Subsequently, each information appliance generates its own public key (IPuK) and ID-based private key (IPrK) according to the ID-based encryption system (S504) (S506).

At this time, the ID used is an IID which is the lower 64 bits of the link category's IPv6 address.

In addition, ID is considered unique because it went through DAD (Duplicate Address Detection) process in the automatic configuration of link category IPv6 address.

The public key (IPuK) is generated by an ID-based Public Key Generator (IPuKG) using this IID as an input value. The technique used by this IPuKG may be negotiated in advance, or one option may be defined and used in the RA message. In other words, all information appliances on the home network should be made common.

Therefore, all information appliances can easily know the public key of each device simply by knowing the link layer address obtained by performing the Address Resolution Protocol (ARP) process by the NDP (Neighbor Discovery Protocol). do.

The private key (IPrK) is generated by an ID-based Private Key Generator (IPrKG) maintained by each device individually. At this time, all information appliances should be careful not to expose their IPrKG, and the security technique for IPrKG may be arbitrarily selected by each information appliance among various methods that have been proposed. Of course, IPrKG should have a cryptographic relationship with IPuKG.

The lower 64-bit value of the site category's IPv6 address is determined by encrypting the IID of the link category's IPv6 address with the IPrK generated by IPrKG.

The security technique that accomplishes this is one of the digital signature methods widely used.

That is, in step S508, the IID of the link category IPv6 address is digitally signed (encrypted) by IPrK and selected as the new IID of the site category IPv6 address.

Thereafter, in step S510, a site category IPv6 address is generated according to the prefix included in the RA message received from the home gateway. That is, the prefix of the site category received through the RA message from the home gateway router is combined with the newly generated ID.

Meanwhile, referring back to step S406 of FIG. 4, each information appliance determines its own domain name. The domain name of each information appliance includes a user identifier, a node identifier, and a domain.

In this case, the user identifier is selected by each information electronic device arbitrarily or at the request of the user, and the uniqueness of the user identifier needs to be verified only in each device.

The information appliance identifier is a value used to verify uniqueness between each appliance and uses the lower 64 bits of the IPv6 address of the site category used in the previous step.

The domain uses a new definition of "secure.homenet" for secure home networks. The domain name thus constructed is ultimately verified because uniqueness is verified among all devices belonging to the home network by the information appliance device identifier, and uniqueness is verified within each device by the user identifier.

In the next step (S408), each information appliances create a zone file for their respective Domain Name Service (DNS) with the domain name and IPv6 address of the configured device.

When the IPv6 addresses of the information appliances generated by the above procedure are to be known to each other, the present invention extends the conventional Multicast Name Resolution (MNR) method. That is, digital signature security technique suitable for home network environment is used to perform security function.

FIG. 6 is a timing chart of a process of transmitting / receiving a DNS query and a response message based on the site-category IPv6 address generated in FIG. 5, and an MNR technique having an extended security function is applied.

First, in step (1), an information appliance that wants to know the site category IPv6 address for a specific domain name transmits a query message to an already promised multicast address. That is, the DNS query for obtaining the IPv6 address of the information appliance C is transmitted by multicast.

Steps (2) and (3) are processes for the device C receiving the query message to obtain the link layer address of the transmitting device A. That is, in steps (2) and (3), an NS message for acquiring the link layer address of the device A is transmitted from the device C to the device A, and if the link layer address of the device A is obtained, the link layer address is obtained. Send a NA message to device C.

In step (4), the public key of the device A is generated based on the obtained link layer address, and the digital signature value included in the transmission address is verified using the generated public key.

Finally, step (5) sends a response to the query. That is, the DNS response message including the IPv6 address of the device C is transmitted to the device A.

As described above, according to the present invention, by expanding the existing automatic address setting scheme, it is possible to automatically set the IPv6 of the site category while providing privacy in a home network environment composed of various sub-networks. In addition, in the absence of a DNS server, the security of each information appliances to act as a DNS server for their IPv6 address has been expanded in terms of security. Therefore, a replay attack that reuses query and response messages generated by a legitimate information appliance can be prevented.

As mentioned above, although this invention was demonstrated concretely based on the Example, this invention is not limited to this Example, Of course, various changes are possible within the range which does not deviate from the summary of the claim mentioned later.

Claims (8)

In the method of setting the Internet Protocol version 6 (IPv6) address and name of the information appliances in a home network environment that includes information appliances with various sub-network characteristics, A first step of generating a link category IPv6 address of the information appliance when any one of the information appliances is connected to the home network environment; Generating a site category IPv6 address; A third step of generating a unique domain name of the information appliance; And automatically storing the IPv6 address and domain name of the site category generated in the second and third steps in the information appliance. The method of claim 1, The second step, Generating an ID-based Public Key (IPuK) of the information appliances according to the ID-based encryption scheme of the information appliances; Generating an ID-based Private Key (IPrK) of the information appliance according to an ID based encryption scheme of the information appliance; Setting a lower 64-bit value of a site category IPv6 address by digitally signing an IID (interface ID) of the link category IPv6 address with the public key; A method for automatically setting an IPv6 address and name of an information appliance in a home network environment, comprising: combining a site category prefix received through an RA message from a home gateway router and a newly generated ID. The method of claim 2, The public key is generated by an ID-based Public Key Generator (IPuKG) using an IID, which is the lower 64 bits of the link category's IPv6 address, as an input value. How to automatically set the machine's IPv6 address and name. The method of claim 3, wherein The ID-based public key generator automatically sets the IPv6 address and name of the information appliance in a home network environment, using a generator pre-negotiated between the information appliances or defining an option in a RA message of a router. Way. The method of claim 2, The private key is an IPv6 address and name of an information appliance in a home network environment, which is generated by an ID-based Private Key Generator (IPrKG), which is maintained individually by the information appliance. Auto setup method. The method of claim 5, wherein And the ID-based private key generator is arbitrarily selected by the information appliance. The method of automatically setting an IPv6 address and name of an information appliance in a home network environment. The method of claim 2, The RA message is extended automatically to include a subnet ID (subnet ID) for each subnet, characterized in that the IPv6 address and name automatic setting method of the information appliances in the home network environment. In the method for setting the IPv6 address and name of the information appliances in the home network environment that sends and receives DNS queries and response messages based on the site-category IPv6 address for a specific domain name, Transmitting, by multicast, a DNS Query to obtain an IPv6 address of the first information appliance; The NS message for acquiring the link layer address of the first information appliance received the query message is transmitted from the first information appliance to the second information appliance, and the link layer address of the second information appliance is obtained. Transmitting a NA message including the obtained link layer address to the first information appliance; Generating a public key of a second information appliance based on the obtained link layer address, and verifying a digital signature value included in a transmission address using the generated public key; And automatically transmitting the DNS response message including the IPv6 address of the first information appliance to the second information appliance.