KR20100072966A - Method for identifying authentication function in extensible authentication protocol - Google Patents

Abstract

PURPOSE: An authentication function identifying method in an EAP(Extensible Authentication Protocol) is provided to transmit an EAP message by defining a default authentication function. CONSTITUTION: An EAP authentication server receives an identity response message of an EAP from a user terminal(306). The EAP authentication server checks the pattern of the identity from the identity response message of the received EAP. The EAP authentication server identifies an EAP authentication function with the user terminal according to the pattern of the checked identity(308). The EAP authentication server transmits the request and response message of the EAP according to the identified authentication function(310,312). The EAP authentication server performs an authentication procedure with the user terminal.

Description

Authentication function identification method in scalable authentication protocol {METHOD FOR IDENTIFYING AUTHENTICATION FUNCTION IN EXTENSIBLE AUTHENTICATION PROTOCOL}

The present invention relates to an authentication function identification method in the scalable authentication protocol, and more particularly, by comparing the pattern of the identity of the received EAP identity response message or using the decoration of the identity, the EAP authentication function used by the user terminal (eg For example, EAP-AKA, EAP-TLS and EAP-TTLS, etc.) can be used to identify the authentication function of the user terminal without adding an EAP message, and the default authentication function in case of an error in the received identity. (E.g., EAP-AKA) and by transmitting an EAP message, the present invention relates to an authentication function identification method in the scalable authentication protocol that can prevent unnecessary retransmission of the EAP Identity Request message.

Extensible Authentication Protocol (EAP) is a protocol defined as a standard in "RFC 3748". Extensible authentication protocol is a protocol that operates at the data link layer. The extensible authentication protocol was initially developed for user authentication by the Point-to-Point Protocol (PPP) in wired networks. Recently, however, scalable authentication protocols have been used mainly in "IEEE 802" environments, especially wireless networks, as well as point-to-point protocols.

Here, the scalable authentication protocol is not an authentication mechanism itself, but an authentication framework designed to support various authentication mechanisms. That is, an authentication mechanism that provides an authentication function through an extensible authentication protocol is called an extensible authentication protocol (EAP) authentication function or an extensible authentication protocol (EAP) function. Extensible authentication protocols provide the common functionality that these Extensible Authentication Protocol (EAP) functions are needed to provide authentication functionality at various link layers.

In general, an element constituting an access network includes a network access server (NAS) for determining whether to allow access to a network, such as relaying a user to a separate operator authentication server or verifying user authority so that the user terminal can access the network. Network Access Server) and a Backend Authentication Server that authenticates the user, verifies the authority, informs the network access server of the result, and handles other charge-related processing.

When applying the authentication mechanism without using the extensible authentication protocol, the network access server must identify and process the authentication mechanism of all messages sent and received during the user authentication phase. In addition, whenever the network server additionally accepts a new authentication mechanism, it is cumbersome to constantly update the relevant software module in order for the network server to identify and process it.

To solve this problem, the extensible authentication protocol is a framework made for all EAP authentication functions in one link authentication mechanism from the link layer perspective. To this end, the extensible authentication protocol specifies various types of authentication mechanisms in the EAP header. The network access server simply relays the EAP message to the authentication server instead of processing the detailed authentication mechanism contained in the scalable authentication protocol. In other words, the actual authentication procedure is performed between the user and the authentication server. The network access server handles only the authentication result from the authentication server so that the network access server is not involved in pre-negotiation or authentication mechanism for the new authentication mechanism.

Due to this scalability, scalable authentication protocols are used as authentication frameworks in various protocols of wireless networks as well as wired networks. The Wi-Fi Protected Access (WPA) (WPA, WPA2) standard, the Wi-Fi Alliance's certification program, employs five extensible authentication protocol types as official authentication mechanisms. WiMAX Forum also requires an authentication method based on extensible authentication protocol for network access authentication of mobile Internet. In particular, WiMAX is an authentication mechanism that is housed in the extensible authentication protocol based on security review and operator requirements. Authentication and Key Agreement (AKA), Transport Level Security (TLS), Tunneled TLS (Tunneled TLS) scheme is used. These are called Extensible Authentication Protocol-Authentication and Key Agreement (EAP-AKA), Extensible Authentication Protocol Transport Layer Security (EAP-TLS), and Extensible Authentication Protocol Tunneled Transport Layer Security (EAP-TTLS), respectively.

EAP-AKA is a European mobile communication standardization organization, 3GPP (3 ^rd Generation Partnership Project) proposed AKA method the authentication function of the Extensible Authentication Protocol for encryption key generation for the wireless connection authentication and radio link encryption of the 3G mobile communication terminal in It is standardized by "IETF" as applied. In Korea, it is adopted as a method used for network connection of WiBro terminal and is in commercial service.

In the case of EAP-AKA, the network access server or the EAP authentication server sends an EAP identity request (EAP-Request / Identity) message of identity type at the start of authentication of the scalable authentication protocol. To be sent). The user terminal responds with an EAP Identity Response (EAP-Response / Identity) message. This packet contains the user's identity. There are three major identities used in AKA. The three user identities are permanent identity, pseudonym identity, and fast re-authentication identity.

Of these, the one-time identity is the one-time identity used for quick re-authentication, and the remaining fixed and floating identities are the values used for the full authentication process. The fixed identity is a fixed value that does not change, and the variable identity is a value that changes.

Users of Mobile Networks may use Mobile Country Code (MCC) 3 digits, Mobile Network Code (MNC) 2 to 3 digits and mobile subscriber identification number (MSIN) no more than 10 digits. It is identified by IMSI (International Mobile Subscriber Identity, TS23.003), which is a string not exceeding 15 digits of Mobile Subscriber Identification Number. Here, a permanent identity is usually such an IMSI based fixed value. For reference, the mobile country code and mobile network code are used to uniquely identify the GSM member companies and AuC identification for deriving authentication vectors for the user.

When the network access server receives the EAP packet from the user terminal, the network access server encapsulates the packet in the Authentication Authorization Accounting (AAA) protocol and transmits the packet to the EAP authentication server. AAA protocols such as RADIUS and Diameter identify users as Network Access Identifiers (NAIs). In a roaming environment, NAI consists of "username @ realm". The username is the part that identifies the subscriber in the realm. If a realm is not used, the user name is the user identity. If a realm is used, the NAI up to and including the realm is the user's identity. If a fixed identity is created based on IMSI, the fixed username must be in the form "0" | IMSI. Here, '|' means concatenation. That is, the first character of the fixed username must be the number "0", followed by IMSI. For example, the fixed username derived from the value that IMSI is '295023820005424' is '0295023820005424'.

Since the fixed identity is a fixed value based on IMSI, there is a problem in that tracking of the identity user becomes very easy when the fixed identity is exposed. EAP-AKA supports identity privacy based on floating identity, a temporary identity, to prevent exposure of fixed identities.

Anonymous (pseudonym) is a value similar to the Temporary Mobile Subscriber Identities (TMSI) used in cellular networks. Anonymous (pseudonym) is generated by the EAP authentication server and the generation method is implementation dependent. However, the EAP authentication server only needs to be able to map the variable identity (pseudonym identity) to the fixed identity (permanent identity).

In the case of EAP-AKA, the identity may be requested through the EAP-Request / AKA-Identity packet in addition to the EAP-Request / Identity.

AKA identification has attributes 'AT_ANY_ID_REQ', 'AT_FULLAUTH_ID_REQ', and 'AT_PERMANENT_ID_REQ'. Used when requesting all kinds of identities, when requesting fixed or variable identities, or when only requesting identities. In this case, the user terminal delivers the requested identity to the server through the 'AT_IDENTITY' attribute of the EAP-Response / AKA-Identity instead of the EAP-Response / Identity. do.

The identity format of the EAP-Response / Identity packet or the 'AT_IDENTITY' attribute of the EAP-Response / AKA-Identity is the identity of the 'AT_IDENTITY' attribute. The same is true, except that decoration is not allowed. For reference, a decoration is a string that a user terminal adds before or after a user name to supplement AAA routing information. However, because the decoration of the username can prevent the server from identifying the correct username, it is specified for use only in the identity of the EAP Identity Response Packet.

TLS is a protocol created by the "IETF" as a standard based on "SSL 3.0", the final version of the Secure Socket Layer (SSL), a security protocol in the transport layer. TLS provides mutual authentication, integrity-based authentication negotiation, and key distribution mechanism. EAP-TLS is the standardized in "IETF" by applying this TLS protocol as an authentication function of the extensible authentication protocol. In EAP-TLS, the identity value of the EAP identity response packet received in response to the EAP identity request is used to verify whether the identity value in the certificate transmitted by the user terminal is the same.

On the other hand, in EAP-TTLS, unlike the previous two cases (EAP-AKA, EAP-TLS), the identity of the actual user is not included in the EAP identity request packet. This is because user identities are not exchanged with each other until a secure channel is created.

Network access authentication includes user terminal authentication for verifying the legitimacy of the user terminal and user authentication for verifying the legitimacy of the user using the user terminal. EAP-AKA is a user authentication method and "X.509" terminal certificate based EAP-TLS is a terminal authentication method. In addition, EAP-TTLS is an authentication method that can support both user authentication and terminal authentication.

As described above, the "WiMAX Forum" recommends using one of the three EAP methods (EAP-AKA, EAP-TLS, or EAP-TTLS) according to the situation for network access authentication. "WiBro", one of the mobile WiMAX technologies in Korea, has been using EAP-AKA based on Universal IC Card (UICC) as a user network access authentication method. .

However, when additionally adopting EAP-TLS and EAP-TTLS recommended by WiMAX in the future, the authentication server distinguishes EAP authentication functions through the identity received through the EAP Identity Response (EAP-Response / Identity) message. The problem arises. That is, the identity delivered to the EAP authentication server through an EAP Identity Response (EAP-Response / Identity) message may be a fixed identity or a changed identity of EAP-AKA. It may also be the identity of EAP-TLS or EAP-TTLS. Therefore, additional processing is required to distinguish EAP authentication functions. EAP-AKA uses EAP-Request / AKA-Identity instead of EAP Identity Requests to distinguish identities specific to AKA functions, and EAP-Response / Identity is accepted as much as possible. It is also advised not to.

However, if the EAP authentication server is not sure whether the user terminal is an AKA-type user terminal or a TLS or TTLS-type user terminal, there is a problem that the EAP identity response cannot be accepted.

Therefore, the prior art as described above has a problem in that it is not possible to distinguish the EAP authentication function through the EAP identity response message received from the EAP authentication server, which is an object of the present invention.

Therefore, the present invention compares the pattern of the identity of the received EAP identity response message or uses the decoration of the identity, so that the EAP authentication functions (eg, EAP-AKA, EAP-TLS and EAP-TTLS) used by the user terminal The authentication function of the user terminal can be identified without adding the EAP message to find out, and the default authentication function (for example, EAP-AKA) is defined in case of an error of the received identity and the EAP message is transmitted. It is an object of the present invention to provide an authentication function identification method in the scalable authentication protocol that can prevent unnecessary retransmission of an EAP identity request message.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention which are not mentioned can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

In order to solve the above problem, the present invention compares the pattern of the identity of the received EAP identity response message or uses the decoration of the identity, and the default authentication function (e.g., EAP-) in case of an error of the received identity. AKA) to transmit the EAP message.

More specifically, the method of the present invention provides an authentication function identification method, comprising: an identity reception step of receiving an identity response message of a scalable authentication protocol from a user terminal; Verifying an identity pattern from an identity response message of the received scalable authentication protocol; A function identification step of identifying an authentication function of an extensible authentication protocol with the user terminal according to the pattern of the identified identity; And performing an authentication process with the user terminal by transmitting a request and response message of an extensible authentication protocol according to the identified authentication function.

Meanwhile, another method of the present invention provides an authentication function identification method, comprising: an identity request step of receiving, by a user terminal, an identity request message of a scalable authentication protocol; Adding function information required for transmission of the identity response message of the scalable authentication protocol to the decoration of the identity according to the received identity request message; And transmitting an identity added with the authentication function information to an EAP authentication server.

In addition, another method of the present invention, if receiving an EAP-Request / AKA-Identity message from the EAP authentication server instead of the identity request of the scalable authentication protocol, the type of authentication function in the negative response message of the scalable authentication protocol It further comprises the step of transmitting the authentication function.

Meanwhile, another method of the present invention provides an authentication function identification method, comprising: an identity reception step of an EAP authentication server receiving an identity response message of a scalable authentication protocol from a user terminal; A decorating step of confirming a decoration of an identity from an identity response message of the received scalable authentication protocol; A function identification step of identifying an authentication function of a scalable authentication protocol with the user terminal according to the confirmed decoration; And performing an authentication process with the user terminal by transmitting a request and response message of an extensible authentication protocol according to the identified authentication function.

The present invention as described above, EAP authentication functions (eg, EAP-AKA, EAP-TLS and EAP-TTLS) used by the user terminal by comparing the pattern of the identity of the received EAP identity response message or using the decoration of the identity It is possible to identify the authentication function of the user terminal without adding the EAP message to find out the EAP message, and define the default authentication function (for example, EAP-AKA) in case of an error of the received identity. By transmitting, there is an effect that can prevent unnecessary retransmission of the EAP identity request message.

Conventionally, one authentication method has been generally adopted and used as an EAP authentication method for authenticating a user. However, recently, even in the same network environment, various authentication methods need to be supported by various business models and user demands. In this case, the EAP authentication server must go through additional processing to identify the EAP authentication function used by the user terminal requesting authentication.

In the present invention, by comparing the pattern of the identity of the EAP identity response message received by the EAP authentication server or by using the decoration in the identity, the authentication function of the user terminal without adding the EAP message to find out the EAP authentication function used by the user terminal There is a discernible effect.

In addition, the present invention, when receiving the identity containing the error, by transmitting the EAP-Request / AKA-identity message instead of the EAP identity request message, thereby improving the efficiency of EAP authentication without additional EAP message transmission process and EAP authentication function identification process It can increase the effect.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, It can be easily carried out. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a flowchart illustrating an authentication method of a general scalable authentication protocol.

As shown in FIG. 1, the EAP authentication server 30 performs an authentication process with the user terminal 10 through the network access server 20. Here, the network access server 20 which is an authenticator starts an EAP authentication process. The user terminal 10 transmits an EAP response.

In order to start the EAP authentication process, the network access server 20 transmits an EAP identity request (EAP-Request / Identity) message to the user terminal 10 (102).

In response, the user terminal 10 transmits an EAP Identity Response (EAP-Response / Identity) message (104). The network access server 20 transmits the EAP identity response message to the EAP authentication server 30 (106). That is, the EAP identity response message is transmitted to the EAP authentication server 20 through the network access server 20.

Thereafter, additional EAP-Request and EAP-Response message communications are performed according to the type of EAP authentication function.

That is, the EAP authentication server 30 transmits an additional EAP request message to the network access server 20 according to the type of the EAP authentication function (108). Subsequently, the network access server 20 transmits an additional EAP request message to the user terminal 10 (110).

The user terminal 10 transmits the EAP response message to the network access server 20 (112). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (114).

Thereafter, the EAP authentication server 30 transmits an EAP Success (EAP-Success) or EAP Failure (EAP-Failure) message to the network access server 20 according to the authentication result of the user terminal 10 (116). Subsequently, the network access server 20 transmits an EAP success or EAP failure message to the user terminal 10 (118). Then, the EAP authentication process ends.

In the present invention, the EAP authentication function is distinguished using an identity received by the EAP authentication server 30 through an EAP identity response message in step 106. In the present invention, the default authentication mechanism is set to EAP-AKA in case the identity received from the EAP authentication server 30 is an error, thereby preventing the EAP identity request message from being retransmitted several times, thereby improving efficiency.

2 is a flowchart illustrating an EAP authentication method in case of a general identity error.

First, in order to start the EAP authentication process, the network access server 20 transmits an EAP identity request message to the user terminal 10 (202).

In response, the user terminal 10 transmits an EAP identity response message (204). The network access server 20 transmits the EAP identity response message to the EAP authentication server 30 (206). That is, the EAP identity response message is transmitted to the EAP authentication server 20 through the network access server 20.

If there is an error in the identity value transmitted from the user terminal 10 (208), the EAP authentication server 30 does not terminate the EAP authentication process, as defined in "RFC 3748 standard", at least three times the EAP identity request. The message is transmitted to the user terminal 10 through the network access server 20.

That is, when there is an error in the identity value (208), the EAP authentication server 30 first transmits the EAP identity request message to the network access server 20 (210). Subsequently, the network access server 20 transmits the EAP identity request message to the user terminal 10 (212).

The user terminal 10 transmits the EAP response message to the network access server 20 (214). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (216).

Thereafter, the EAP authentication server 30 first checks the error in the transmitted EAP response message (218).

If there is an error in the first identity value (218), the EAP authentication server 30 transmits the EAP identity request message to the network access server 20 a second time (220). Subsequently, the network access server 20 transmits an EAP identity request message to the user terminal 10 (222).

The user terminal 10 transmits the EAP response message to the network access server 20 (224). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (226).

Thereafter, the EAP authentication server 30 secondly confirms an error in the transmitted EAP response message (228).

If there is an error in the second identity value (228), the EAP authentication server 30 transmits a second EAP identity request message to the network access server 20 (230). Subsequently, the network access server 20 transmits the EAP identity request message to the user terminal 10 (232).

The user terminal 10 transmits the EAP response message to the network access server 20 (234). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (236).

Thereafter, the EAP authentication server 30 checks the third error in the transmitted EAP response message (238).

If there is an error in the third identity value (238), the EAP authentication server 30 transmits an EAP failure message to the network access server 20 to terminate the EAP authentication process (240). Subsequently, the network access server 20 transmits an EAP failure message to the user terminal 10 (242).

3 is a flowchart illustrating a method for identifying an EAP authentication function using an EAP identity according to the present invention.

First, in order to start the EAP authentication process, the network access server 20 transmits an EAP identity request message to the user terminal 10 (302).

In response, the user terminal 10 transmits an EAP identity response message (304). The network access server 20 transmits the EAP identity response message to the EAP authentication server 30 (306). That is, the EAP identity response message is transmitted to the EAP authentication server 20 through the network access server 20.

The network access server 20 identifies the EAP authentication function according to the pattern of the EAP identity type of the transmitted EAP identity response message (308). For example, the network access server 20 may use one of the EAP-AKA, EAP-TLS, and EAP-TTLS authentication functions, which are recommended by WiMAX, according to the received EAP identity. Can be identified.

According to the "WiMAX" standard, in the case of EAP-TLS, the MAC (Media Access Control) address of the user terminal must be used for the NAI user name of the EAP identity response message. The MAC address is hexadecimal and is shown in six uppercase letters.

In addition, in the case of EAP-TTLS, the identity is defined as a random number of at least 128 bits expressed in ASCII hex. Therefore, when receiving the EAP identity response message, the EAP authentication server 30 identifies an authentication function, such as '①' to '⑤', according to the length and pattern of the identity, and requests an EAP request corresponding to the identified authentication function. The message is transmitted to the network access server 20 (310).

First, as shown in '①' of FIG. 3, the EAP authentication server 30 checks the EAP identity pattern and performs the EAP authentication process using the EAP-TLS authentication function if it has a 12-digit MAC address pattern. For example, when the MAC address pattern is equal to '0A0B0C0D1012', the EAP authentication server 30 determines the EAP authentication function used by the user terminal 10 as EAP-TLS and sends an EAP request / EAP-TLS (start) message. Transmission to the network access server 20.

Second, as shown in '②' of FIG. 3, the EAP authentication server 30 checks the EAP identity pattern and performs an EAP authentication process using the EAP-TTLS authentication function when the character pattern has 32 digits. For example, if the EAP identity pattern is the 32-character character pattern 'A234F6789B123456123456789C12345', the EAP authentication function used by the user terminal 10 is determined as EAP-TTLS and the EAP request / EAP TTLS (start) (EAP-Request / EAP-TTLS (Start) message is sent to the network access server (20).

Third, as shown in '③' of FIG. 3, the EAP authentication server 30 checks the EAP identity pattern and performs the EAP authentication process using the EAP-AKA authentication function when the EAP authentication pattern has 16 digits. For example, when the EAP identity pattern is 16 digits '0295023820005424', the EAP authentication function used by the user terminal 10 is determined as EAP-AKA, and the EAP request / AKA- is applied. Challenge) message is transmitted to the network connection server 20.

Fourth, as in case of '①' to '③', as shown in '④' of FIG. 3, the EAP authentication server 30 determines EAP-AKA as an anonymous identity (Pseudonym Identity) of the EAP-AKA authentication. Perform the EAP authentication process using the function. The EAP authentication server 30 extracts the permanent identity from the anonymous identity, and transmits the EAP request / AKA request message to the network access server 20 in the same manner as in case of '③' by using the extracted permanent identity.

Fifth, when the case is not '①' to '④' as shown in '⑤' of FIG. 3, that is, when it fails to extract the permanent identity from the anonymous identity, the EAP authentication server 30 receives the received identity. Determines that an error is included in the request, and re-identifies the identity to the network access server 20. That is, the EAP authentication server 30 transmits the EAP identity request message to the network access server 20.

Subsequently, the network access server 20 identifies and transmits the EAP request message (for example, EAP request / EAP-TLS (start)) message, EAP request / EAP-TTLS (start) identified according to the '①' to '⑤'. Message), an EAP request / AKA request message, or a request message of an EAP identity request message) is transmitted to the user terminal 10 (312).

The user terminal 10 transmits the EAP response message to the network access server 20 (314). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (316).

Thereafter, the EAP authentication server 30 transmits an EAP success or EAP failure message to the network access server 20 according to the authentication result of the user terminal 10 (318). Subsequently, the network access server 20 transmits an EAP success or EAP failure message to the user terminal 10 (320). Then, the EAP authentication process ends.

4 is a flowchart illustrating another embodiment of a method for identifying an EAP authentication function using an EAP identity according to the present invention.

Unlike the method of identifying the EAP authentication function by comparing the pattern of the EAP identity described above with reference to FIG. 3, as shown in FIG. 4, in another embodiment of the present invention, an EAP is used to decorate an identity of an EAP identity response message. Identifies the authentication function.

For example, a case in which a user terminal 10 having an identity of 'user1 @ realm' uses an EAP-MD5 authentication function for EAP authentication will be described.

First, in order to start the EAP authentication process, the network access server 20 transmits an EAP identity request message to the user terminal 10 (402).

The user terminal 10 transmits the EAP identity response message to the network access server 20 by adding the EAP authentication function information to the decoration in operation 404. Subsequently, the network access server 20 transmits an EAP identity response message to the EAP authentication server 30 (416). In this case, the identity value of the EAP identity response message may have a form such as '{eap-method = md5} user1 @ realm'. Here, the part corresponding to the decoration, that is, the AVP name (eap-method part) and AVP value md5 of '{eap-method = md5}' are negotiated between the user terminal 10 and the EAP authentication server 30. It may be implemented in the form.

Subsequently, the EAP authentication server 30 checks the identity value of the received EAP identity response message and identifies the EAP authentication function according to the NAI decoration (408).

Thereafter, the EAP authentication server 30 transmits an EAP request / EAP MD5 (start) message corresponding to the identified authentication function according to the decoration of the identity to the network access server 20 (410). Subsequently, the network access server 20 transmits an EAP request / EAP MD5 (start) message to the user terminal 10 (412).

The user terminal 10 transmits the EAP response message to the network access server 20 (414). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (416).

Thereafter, the EAP authentication server 30 transmits an EAP success or EAP failure message to the network access server 20 according to the authentication result of the user terminal 10 (418). Subsequently, the network access server 20 transmits an EAP success or EAP failure message to the user terminal 10 (420). Then, the EAP authentication process ends.

5 is a flowchart illustrating an EAP authentication method in case of an identity error according to the present invention.

As shown in FIG. 5, the EAP authentication method according to the present invention relates to an EAP message transmission method for increasing efficiency by reducing the number of retransmissions of an EAP message when an identity including an error is received.

First, in order to start the EAP authentication process, the network access server 20 transmits an EAP identity request message to the user terminal 10 (502).

In response, the user terminal 10 transmits an EAP identity response message to the network access server 20 (504). The network access server 20 transmits an EAP identity response message to the EAP authentication server 30 (506). That is, the EAP identity response message is transmitted to the EAP authentication server 20 through the network access server 20.

If there is an error in the identity value transmitted from the user terminal 10 (508), the EAP authentication server 30 does not end the EAP authentication process.

That is, when there is an error in the identity value (508), the EAP authentication server 30 transmits the EAP request / AKA identity message to the network access server 20 (510). Subsequently, the network access server 20 transmits an EAP request / AKA identity message to the user terminal 10 (512).

The user terminal 10 transmits an EAP negative response (TLS support) message (EAP-Response / NAK) message supporting TLS to the network access server 20 (514). Subsequently, the network access server 20 transmits an EAP negative response message supporting the TLS to the EAP authentication server 30 (516).

Thereafter, the EAP authentication server 30 transmits an EAP request (EAP-Request) / EAP-TLS (start) message to the network access server 20 (518). Subsequently, the network access server 20 transmits an EAP request / EAP-TLS (start) message to the user terminal 10 (520).

The user terminal 10 transmits an EAP response message to the network access server 20 (522). Subsequently, the network access server 20 transmits an EAP response message to the EAP authentication server 30 (524).

Thereafter, the EAP authentication server 30 transmits an EAP success or EAP failure message to the network access server 20 according to the authentication result of the user terminal 10 (526). Subsequently, the network access server 20 transmits an EAP success or EAP failure message to the user terminal 10 (528). Then, the EAP authentication process ends.

As shown in FIG. 2, when receiving an identity including an error in general, the EAP authentication server 30 transmits at least three EAP identity request messages.

However, in the "510" process of the EAP authentication method according to the present invention, upon receiving an identity including an error, the EAP authentication server 30 transmits an EAP request / AKA identity message instead of an EAP identity request message, thereby transmitting an EAP identity request message. The number of transmissions can be reduced.

That is, a case in which the user terminal 10 that transmits an identity including an error is using an authentication function such as EAP-TLS or EAP-MD5 rather than EAP-AKA will be described. In this case, when receiving the EAP request / AKA identity message rather than the EAP identity request message from the EAP authentication server 30 as in the process of “512”, the user terminal 10 may deny the EAP as in the process of “514”. The response message (EAP-Response / NAK) is transmitted including the type of authentication function used by the user terminal 10.

The EAP authentication server 30 may directly transmit the next EAP message corresponding to the EAP authentication function used by the user terminal 10 to the user terminal 10 without additional identity verification or identity request. That is, if the error included in the identity is due to an error of the user terminal 10 itself, even if the EAP authentication server 30 re-requests the EAP identity request message, the identity received by the EAP authentication server 30 continues to have an error. It will be included. Therefore, the user terminal 10 and the EAP authentication server 30 ends the EAP authentication process after repeatedly communicating the EAP message unnecessarily. While eliminating this possibility, even if the EAP authentication server 30 receives the correct identity, the process of analyzing the pattern of the identity and verifying the EAP authentication function used by the user terminal 10 can be omitted.

On the other hand, the method of the present invention as described above can be written in a computer program. And the code and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the written program is stored in a computer-readable recording medium (information storage medium), and read and executed by a computer to implement the method of the present invention. The recording medium may include any type of recording medium that can be read by a computer.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

1 is a flowchart illustrating an authentication method of a general scalable authentication protocol;

2 is a flowchart illustrating an EAP authentication method in case of a general identity error;

3 is a flowchart illustrating an EAP authentication function identification method using an EAP identity according to the present invention;

4 is a flowchart illustrating another embodiment of a method for identifying an EAP authentication function using an EAP identity according to the present invention;

5 is a flowchart illustrating an EAP authentication method in case of an identity error according to the present invention.

* Explanation of symbols for the main parts of the drawings

10: user terminal 20: network access server

30: EAP authentication server

Claims (13)

In the authentication function identification method, An identity receiving step of receiving an identity response message of a scalable authentication protocol from a user terminal; Verifying an identity pattern from an identity response message of the received scalable authentication protocol; A function identification step of identifying an authentication function of an extensible authentication protocol with the user terminal according to the pattern of the identified identity; And Performing an authentication process with the user terminal by transmitting a request and response message of an extensible authentication protocol according to the identified authentication function; Authentication function identification method in the scalable authentication protocol comprising a. The method of claim 1, The function identification step, And identifying the authentication function of the scalable authentication protocol with the user terminal as EAP-TLS if the pattern of the identified identity is a MAC address pattern. The method of claim 1, The function identification step, And identifying the authentication function of the scalable authentication protocol with the user terminal as EAP-TTLS when the pattern of the identified identity is a character pattern. The method of claim 1, The function identification step, And identifying the authentication function of the scalable authentication protocol with the user terminal as EAP-AKA if the pattern of the identified identity is a digit value pattern. The method of claim 1, The function identification step, If the pattern of the identified identity does not match the MAC address pattern, character pattern, and digit value pattern, identifying the identified identity as a variable identity of EAP-AKA. The method of claim 5, The performing of the authentication, If the identified identity is identified as the variable identity of EAP-AKA, an authentication function in the scalable authentication protocol for transmitting an EAP request and an AKA request message to the network access server, and extracting a fixed identity from the variable identity of the EAP-AKA. Identification method. The method of claim 6, The performing of the authentication, If the extraction of the fixed identity from the change identity of the EAP-AKA fails, the authentication function identification method in the extensible authentication protocol to confirm that the identified identity contains an error and to request the identity to the network access server. The method of claim 7, wherein The performing of the authentication, If it is determined that the identified identity contains an error, an identity re-request step of transmitting an EAP-Request / AKA-Identity message instead of an EAP Identity Request message. Authentication function identification method in the scalable authentication protocol further comprising. In the authentication function identification method, An identity request step of the user terminal receiving an identity request message of a scalable authentication protocol; Adding function information required for transmission of the identity response message of the scalable authentication protocol to the decoration of the identity according to the received identity request message; And Identity transmission step of transmitting the identity to which the authentication function information is added to the EAP authentication server. Authentication function identification method in the scalable authentication protocol comprising a. The method of claim 9, When receiving the EAP-Request / AKA-Identity message from the EAP authentication server instead of the identity request of the scalable authentication protocol, the authentication function transmission step of indicating the type of authentication function in the negative response message of the scalable authentication protocol and transmits it. Authentication function identification method in the scalable authentication protocol further comprising. 11. The method according to claim 9 or 10, The function information addition step, And authentication function information included in the AVP name and the AVP value to add to the decoration of the identity. In the authentication function identification method, An identity receiving step of the EAP authentication server receiving an identity response message of a scalable authentication protocol from a user terminal; A decorating step of confirming a decoration of an identity from an identity response message of the received scalable authentication protocol; A function identification step of identifying an authentication function of a scalable authentication protocol with the user terminal according to the confirmed decoration; And Performing an authentication process with the user terminal by transmitting a request and response message of an extensible authentication protocol according to the identified authentication function; Authentication function identification method in the scalable authentication protocol comprising a. 13. The method of claim 12, The function identification step, The authentication function identification method of the scalable authentication protocol for identifying the authentication function of the scalable authentication protocol with the user terminal by using the AVP name and AVP value of the confirmed decoration.

Images