KR20220130438A - Method for 5g lan service - Google Patents

Abstract

Provided is an operation method of an enterprise mobile gateway (EMG) which provides a 5G local area network (LAN) service. The method comprises the steps of: receiving, from a primary terminal, an authentication request including information on a secondary terminal connected to the primary terminal through a LAN; performing authentication to determine whether the information on the secondary terminal is valid; and if the authentication is successful, transmitting an authentication result including an authentication key to the primary terminal. The authentication key is used to generate a dedicated internet protocol security (IPSec) tunnel for the secondary terminal between the primary terminal and the EMG. The present invention provides fixed IP mobility for the secondary terminal.

Description

How to provide 5G LAN service {METHOD FOR 5G LAN SERVICE}

The present invention relates to a method for providing a 5G local area network (LAN) service.

A user may use a network service such as the Internet by connecting a secondary terminal to a primary terminal connected to the network.

Conventionally, the primary terminal connected to the corporate intranet through 5G dedicated to the enterprise can provide mobility to the enterprise fixed IP. However, the secondary terminal is able to use a limited fixed IP address by a port forwarding method to the primary terminal that is assigned a specific static IP address, but cannot provide mobility.

In addition, since the conventional primary terminal accommodates the traffic of all secondary terminals using one secure tunnel for each primary terminal, traffic paths for each secondary terminal could not be classified. Therefore, since the encryption key between the primary terminal and the secondary terminal is equally applied, there is a possibility of security infringement in a LAN section such as WiFi.

The task to be solved is to provide a 5G LAN service method that provides fixed IP mobility to a secondary terminal by configuring a LAN through tunneling between the primary terminal and an Enterprise Mobile Gateway (EMG) in a wireless private network environment.

According to one feature, as an operation method of an Enterprise Mobile Gateway (EMG) providing a 5G Local Area Network (LAN) service, an authentication request including information of a secondary terminal connected to the primary terminal through a LAN from a primary terminal Receiving a, performing authentication to determine whether the information of the secondary terminal is valid, and if the authentication succeeds, transmitting an authentication result including an authentication key to the primary terminal, The authentication key is used to create a dedicated Internet Protocol Security (IPSec) tunnel for the secondary terminal between the primary terminal and the EMG.

The authentication result includes an IP address allocated to the secondary terminal by the EMG, and the IP address allocated to the secondary terminal is stored in the primary terminal, and the DHCP (Dynamic Host Configuration Protocol) method The primary terminal may allocate to the secondary terminal.

The primary terminal performs the authentication for each of a plurality of secondary terminals connected to the primary terminal, creates dedicated IPSec tunnels based on each authentication key obtained from the EMG, and receives data from the secondary terminal Based on the IP address and authentication key obtained from , a corresponding dedicated IPSec tunnel may be identified from among the dedicated IPSec tunnels, and the received data may be routed through the identified dedicated IPSec tunnel.

The authentication key may be transmitted from the EMG to the primary terminal through an Internet Key Exchange (IKE) protocol, and may be transmitted from the primary terminal to the secondary terminal through an Extensible Authentication Protocol (EAP).

The EMG includes an EMG-U operating as an IKE v2 responder, and an EMG-C operating as a Remote Authentication Dial In User Service (RADIUS) Authentication Authorization Accounting (AAA) server, and the authentication key is through a RADIUS packet. It may be transmitted from the EMG-C to the EMG-U, and may be transmitted from the EMG-U to the primary terminal through the IKE protocol.

According to the embodiment, the authentication path and the data path are separated for each secondary terminal by creating an independent secure tunnel for each secondary terminal in the primary terminal. Therefore, it is possible not only to strengthen the network security between the primary terminal and the EMG-U, but also to strengthen the security of the WiFi section by generating a security key according to a separate authentication.

1 illustrates a 5G LAN service system according to an embodiment.
2 shows a general Extensible Authentication Protocol (EAP) authentication structure.
3 shows a general Internet Key Exchange (IKE) authentication structure.
4 shows an authentication structure according to an embodiment.
5 shows a conventional tunneling structure.
6 shows a tunneling structure according to an embodiment.
7A and 7B are a series of flowcharts illustrating a 5G LAN service method according to an embodiment.

Hereinafter, with reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art to which the present invention pertains can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain component, it means that other components may be further included, rather than excluding other components, unless otherwise stated.

In addition, terms such as “…unit”, “…group”, “…module”, etc. described in the specification mean a unit that processes at least one function or operation, which may be implemented by hardware or software or a combination of hardware and software. can

The devices described in the present invention are composed of hardware including at least one processor, a memory device, a communication device, and the like, and a program executed in combination with the hardware is stored in a designated place. The hardware has the configuration and capability to implement the method of the present invention. The program includes instructions for implementing the method of operation of the present invention described with reference to the drawings, and is combined with hardware such as a processor and a memory device to execute the present invention.

As used herein, "transmission or provision" may include not only direct transmission or provision, but also transmission or provision indirectly through another device or using a detour path.

In this specification, expressions described in the singular may be construed as singular or plural unless an explicit expression such as “a” or “single” is used.

In this specification, the same reference numbers refer to the same components regardless of the drawings, and "and/or" includes each and every combination of one or more of the referenced components.

In this specification, terms including an ordinal number such as first, second, etc. may be used to describe various elements, but the elements are not limited by the terms. The above terms are used only for the purpose of distinguishing one component from another. For example, without departing from the scope of the present disclosure, a first component may be referred to as a second component, and similarly, a second component may also be referred to as a first component.

In the flowchart described with reference to the drawings in this specification, the order of operations may be changed, several operations may be merged, some operations may be divided, and specific operations may not be performed.

In the specification, a terminal (Terminal/User Equipment) accesses a base station of an Access Network/Radio Access Network (RAN) and uses Network Functions (NFs) of the Core Network. Here, the base station may include an eNB, a gNB, an AP, etc. according to an access network. The terminal may be a terminal of various types and uses, such as a portable terminal, an IoT terminal, a vehicle terminal, a display terminal, a broadcasting terminal, and a game terminal. The devices constituting the network may be implemented by hardware or software or a combination of hardware and software.

Embodiments of the present invention are 3GPP (3rd Generation Partnership Project) Long Term Evolution (LTE), LTE-A, 3GPP2, IEEE (Institute of Electrical and Electronics Engineers) system, 3GPP such as FS_NextGen (Study on Architecture for Next Generation System). It may be supported by standard documents related to at least one of the 5G systems. That is, steps or parts not described in order to clearly reveal the technical spirit of the present invention among the embodiments of the present invention may be supported by the document. In addition, all terms disclosed in this document may be described by the standard document.

In the present disclosure, a user equipment (UE), an edge computing system, various devices, and various modules are operated by at least one processor, and one or more processors, a memory for loading a computer program executed by the processor, and a computer program and a storage device for storing various data and a communication interface. A computer program may include instructions that, when loaded into memory, cause a processor to perform methods/operations according to various embodiments of the present disclosure. That is, the processor may perform the method/operations according to various embodiments of the present disclosure by executing the instructions. An instruction refers to a set of computer readable instructions grouped on the basis of a function, which is a component of a computer program and is executed by a processor.

In the specification, a terminal directly connected to the network may be referred to as a primary terminal or an upper terminal, and a terminal connected to the primary terminal to access the network may be referred to as a secondary terminal or a lower terminal. The secondary terminal is not limited to a lower-order terminal directly connected to the primary terminal, but refers to a lower-order terminal communicating through the primary terminal, and may be an n-th terminal. The primary terminal may be a mobile router such as a wireless egg, or a mobile terminal (routing terminal) equipped with a mobile routing function. The secondary terminal is a non-3GPP terminal that can be connected to the primary terminal, and can be connected to the primary terminal through WiFi, Universal Serial Bus (USB), Local Area Network (LAN), or the like.

The network to which the primary terminal is connected may be a 3G network, a Long Term Evolution (LTE) network, or a 5G network. In the description, a 5G network will be described as an example.

The 5G network includes a core network composed of a radio access network (RAN) to which a primary terminal wirelessly accesses, and a plurality of network functions. The core network creates a PDU session by the Access and Mobility Management Function (AMF), Session Management Function (SMF), and SMF, and is connected to the Data Network (DN) to control traffic. User Plane Function (UPF) to process, Policy Control Function (PCF) to control billing and quality of service policies, Unified Data Management (UDM) to manage subscriber information and integration It may include a data repository (Unified Data Repository, UDR), a network exposure function (NEF), and the like.

1 illustrates a 5G LAN service system according to an embodiment.

Referring to FIG. 1 , the secondary terminal 200 is connected to the primary terminal 100 through short-range communication. The primary terminal 100 is connected to the base station 300 . The base station 300 is connected to a user plane function (UPF) 400 . The UPF 400 is connected to the corporate intranet 500 . At this time, an Enterprise Mobile Gateway (EMG) 600 is installed between the UPF 400 and the corporate intranet 500 . Accordingly, the UPF 400 is coupled to the EMG 600 , and the EMG 600 is coupled to the corporate intranet 500 . In this way, the primary terminal 100 is directly connected to the network, and the secondary terminal 200 is connected to the lower level. The number of secondary terminals 200 connected to the primary terminal 100 may be singular or plural.

The secondary terminal 200 may be connected to the primary terminal 100 , and may be connected to a network through the primary terminal 100 . At this time, the primary terminal 100 and the secondary terminal 200 may have an interface that can be connected via WiFi, Universal Serial Bus (USB), Local Area Network (LAN), etc., and can be connected through a known communication interface in addition to have.

The primary terminal 100 is a terminal for routing the traffic of the secondary terminal 200 to the network, and may be, for example, a mobile router accessing a 5G network or a mobile terminal equipped with a routing function. The primary terminal 100 may access the base station (gNB) 300 of an access network/radio access network (RAN) and transmit traffic to the core network. At this time, for convenience of explanation, only the UPF 400 for processing data traffic among the network devices of the core network is illustrated in FIG. 1 .

A corporate wireless private network section P1 is formed between the primary terminal 100 and the UPF 400 .

A corporate wireless security private network section P2 is formed between the primary terminal 100 and the EMG 600 .

Enterprise terminal user traffic transfer P3 is performed between the secondary terminal 200 and the corporate intranet 500 .

According to the embodiment, a 5G LAN that provides IP mobility of the secondary terminal 200 through the primary terminal 100 in a wireless private network environment is implemented.

The primary terminal 100 is connected to the corporate intranet 500 through the UPF 400 and EMG 600 which are 5G gateways dedicated to the enterprise. Accordingly, it is possible to provide mobility for the enterprise static IP for the primary terminal 100 . However, the secondary terminal 200 can only use a limited static IP for port forwarding to the primary terminal 100 , and it is difficult to provide mobility. To solve this, by configuring a LAN through L2 tunneling between the primary terminal 100 and the EMG 600 , it is possible to provide fixed IP mobility to the secondary terminal 200 .

The primary terminal 100 serves as an Address Resolution Protocol (ARP) proxy, and the EMG 600 serves as a default gateway of the secondary terminal 200, so that each secondary terminal 200 As one IP can be allocated, the efficiency of IP use can be increased.

According to the embodiment, an IKE (Internet Key Exchange) authentication section is added, a secure tunnel is created for each secondary terminal 200, and a VLAN structure is provided in the UPF (400) - EMG (600) - corporate intranet 500 section. introduce For the VLAN structure, the primary terminal 100 creates a secure tunnel with the EMG 600 . In this case, the secure tunnel is created exclusively for each secondary terminal 200 . For example, if three secondary terminals 200 are connected, the primary terminal 100 may create an independent secure tunnel for each of the three secondary terminals 200 .

According to the embodiment, by introducing a source NAT structure for access to a common control plane (control plane), it is possible to classify the traffic for each company. That is, the primary terminal 100 identifies a corresponding secure tunnel based on the source IP address of the data received from the secondary terminal 200 among the plurality of secure tunnels, and routes the received data to the identified secure tunnel. can

FIG. 2 shows a general Extensible Authentication Protocol (EAP) authentication structure, FIG. 3 shows a general Internet Key Exchange (IKE) authentication structure, and FIG. 4 shows an authentication structure according to an embodiment.

Referring to FIG. 2 , a process of generating a LAN section encryption key through MSK generated through protocol authentication for EAP authentication is shown. The EAP authentication structure consists of a Supplicant 10 , an Authenticator 20 , and a Remote Authentication Dial In User Service (RADIUS) Authentication Authorization Accounting (AAA) server 30 .

The supplicant 10 is a connection requesting terminal or an authentication requester, and may include a wired terminal such as a PC or the like to access the network or a wireless terminal such as a mobile terminal. The authenticator 20 is an authenticator, an access grantor, and an authentication performer, and may include a network access control device or server such as a bridge, a switch, and an access point (AP). The RADIUS AAA server 30 operates as an authentication server, and the authenticator 20 operates as a client of the RADIUS AAA server 30 .

Authentication Exchange is made between the Supplicant 10 and the RADIUS AAA server 30, and the Authenticator 20 only performs a bridge role.

An EAP authentication procedure is performed between the supplicant 10 and the RADIUS AAA server 30, and the EAP transport protocol is operated separately for each section. That is, between the Supplicant 10 and the Authenticator 20, an EAP authentication packet such as EAPoL is loaded onto an Ethernet packet through the LAN and transmitted (S11). Between the authenticator 20 and the RADIUS AAA server 30, the EAP authentication packet is carried in the RADIUS packet and transmitted (S12). The RADIUS AAA server 30 loads the MSK (Master Session Key) in the EAP packet through the RADIUS protocol and transmits it to the authenticator 20 (S13, S14). The authenticator 20 performs 4-way key handshaking with the supplicant 10 (S16). The authenticator 20 loads the MSK received from the RADIUS AAA server 30 (S15) in an EAP packet and delivers it to the supplicant 10 (S17).

Referring to FIG. 3 , an EAP in IKEv2 (external AAA) structure is shown. The IKEv2 authentication structure consists of an IKEv2 initiator 40 , an IKEv2 responder 50 , and a RADIUS AAA server 30 , and performs an EAP authentication procedure. At this time, the RADIUS AAA server 30 uses the same reference numerals as in FIG. 2 .

An EAP authentication packet is transmitted between the IKEv2 initiator 40 and the IKEv2 responder 50 through the IKE protocol (S21). An EAP authentication packet is transmitted through the RADIUS protocol between the IKEv2 responder 50 and the RADIUS AAA server 30 (S22). As described above, sections are divided according to whether the transport protocol for transmitting the EAP authentication packet is IKE or RADIUS. That is, the RADIUS AAA server 30 delivers the MSK included in the EAP packet to the IKEv2 responder 50 through the RADIUS protocol (S23, S24), but the MSK delivery is non-standard. The IKEv2 responder 50 loads the MSK received from the RADIUS AAA server 30 (S25) in an EAP packet through the IKE authentication protocol and delivers it to the IKEv2 initiator 40 (S26, S27). An IKE authentication (AUTH) procedure is performed between the IKEv2 initiator 40 and the IKEv2 responder 50 .

In general, when using EAP authentication with IKEv2, public key-based certificates must be used together. However, by utilizing the EAP-Only Authentication notification of RFC 5996, authentication of the IKE responder can be performed based on EAP although the server certificate is omitted. That is, the MSK generated as a result of the EAP authentication is delivered to the IKEv2 responder 50, so that the IKEv2 initiator 40 and the IKEv2 responder 50 perform mutual authentication with the corresponding MSK-based AUTH data. That is, the corresponding MSK will eventually play the role of PSK (Phase Shift Keying).

The authentication structure according to the embodiment of the present invention constitutes the authentication and security system of the EMG by fusing the structures of FIGS. 2 and 3 . That is, the IKE structure of FIG. 3 was combined with the EAP authentication system shown in FIG. 2, and the authentication system and security system were also combined, and additional communication according to the combination was defined as a separate standard. This will be explained as shown in FIG. 4 .

Referring to FIG. 4 , the EMG structure includes a primary terminal 100 , a secondary terminal 200 , and an EMG 600 . In this case, the EMG 600 is composed of an EMG-U 610 and an EMG-C 620 .

Here, the primary terminal 100 corresponds to the supplicant 10 of FIG. 2 . The secondary terminal 200 corresponds to the authenticator 20 and the IKEv2 initiator 40 of FIG. 2 . The EMG-U 610 is a user plane device of the EMG 600 and corresponds to the IKEv2 responder 50 of FIG. 2 . The EMG-C 620 is a control plane device of the EMG 600 and corresponds to the RADIUS AAA server 30 of FIGS. 1 and 2 .

According to the embodiment, an organic security system is established between the secondary terminal 200 - the primary terminal 100 - the EMG-U 610 - the EMG-C 620 and the security tunnel for each secondary terminal 200 is separated. . There are two main types of certification of the EMG structure for this purpose. That is, the EMG authentication structure consists of an IKE authentication structure and an EAP authentication structure. According to the IKE authentication structure, two nodes in the IKE communication section are the primary terminal 100 and the EMG-U 610 . According to the EAP authentication structure, two nodes in the EAP communication section are the secondary terminal 200 and the EMG-C 620 .

Between the secondary terminal 200 and the primary terminal 100, the EAP authentication packet is carried on an Ethernet packet through the LAN and transmitted (S31). An EAP authentication packet is transmitted between the primary terminal 100 and the EMG-U 610 through the IKE protocol (S32). An EAP authentication packet is transmitted between the EMG-U 610 and the EMG-C 620 through the RADIUS protocol (S33).

The EMG-C 620 transmits the MSK generated through EAP authentication (S34) in an EAP authentication packet through the RADIUS protocol to the EMG-U 610 (S35, S36). The EMG-U 610 carries the MSK in the EAP authentication packet through the IKE protocol to the primary terminal 100 and delivers it (S37). At this time, the primary terminal 100 and the EMG-U 610 performs the IKE authentication procedure (S38). Here, S37 corresponds to a non-standard standard. The primary terminal 100 transmits the MSK obtained through the IKE protocol (S39) to the secondary terminal 200 through a 4-Way key handshaking procedure (S40). The secondary terminal 200 acquires the MSK through the EAP authentication packet while performing the procedure of S40 from the primary terminal 100 (S41).

In general, authentication of the IKE section should use one of the PSK (Phase-shift keying) method or EAP + server certificate as a standard. . However, as shown in FIG. 4 , when IKE section authentication and EAP section authentication are performed in one flow, it is difficult for the four nodes 100 , 200 , 610 , and 620 to have an organic integrated authentication security system like a single system. It is possible.

The IKE section uses the EAP-only Authentication option, but by applying EAP authentication for the secondary terminal 200 to the authentication process instead of the authentication for the primary terminal 100, it is possible not to add authentication of a separate IKE section. have.

By performing authentication using the MSK generated through the secondary terminal 200 and EMG-C 620 section authentication to generate IKE section AUTH data, not only the effect of PSK-based IKE authentication is achieved, but also the inconvenience of PSK management, That is, periodic changes, management of the deployment process, etc. can be excluded. That is, by utilizing the EAP authentication of the secondary terminal 200 for IKE mutual authentication between the primary terminal 100 and the EMG-U 610, additional authentication methods such as certificate-based authentication or PSK-based authentication do not need to be considered. There are advantages. And by performing encryption of the primary terminal 100 and the secondary terminal 200 section using the MSK generated through EAP authentication, and performing authentication of the IKE section with the same key, not each separate security section, but the secondary terminal ( 200), the primary terminal 100, and the EMG-U 610 can be viewed as an integrated security section.

As described above, the contents that are changed by adding the IKE section are the addition of the EAP over IKE standard (S32), the delivery of the MSK generated by EAP authentication through the IKE section (S37), and the use of the delivered MSK (S38). At this time, the delivered MSK is used to generate the WiFi section encryption key and is used for IKE section authentication. That is, it is used when generating the AUTH payload. Here, the WiFi section is a communication section between the primary terminal 100 and the secondary terminal 200 , and the IKE section refers to a communication section between the primary terminal 100 and the EMG-U 610 .

5 shows a conventional tunneling structure, and FIG. 6 shows a tunneling structure according to an embodiment.

Referring to FIG. 5 , a primary terminal is connected to a plurality of secondary terminals using a common encryption key, and the primary terminal uses a UPF and one public encryption tunnel. Therefore, since the primary terminal accommodates traffic of all secondary terminals using one secure tunnel, it is not possible to separate traffic paths for each secondary terminal. In addition, since the encryption key between the primary terminal and the secondary terminal cannot but be equally applied, there is a possibility of a security breach of the WiFi section between the primary terminal and the secondary terminal.

On the other hand, as shown in FIG. 6 , according to the embodiment, the primary terminal 100 is an independent secure tunnel for each EMG-U 610 and the secondary terminal 200 , that is, dedicated for each secondary terminal 200 . Create an Internet Protocol Security (IPSec) tunnel. That is, the primary terminal 100 creates an encryption tunnel 1 using the encryption key 1, an encryption tunnel 2 using the encryption key 2, and an encryption tunnel 3 using the encryption key 3 with the EMG-U 610 . Here, encryption key 1, encryption key 2, and encryption key 3 refer to MSKs issued from the EMG-C 620 after EAP authentication.

The primary terminal 100 performs EAP authentication for each of the plurality of secondary terminals 200 connected to the primary terminal 100, and based on each authentication key (MSK) obtained from the EMG 600 , a dedicated IPSec tunnel create each The primary terminal 100 identifies a corresponding dedicated IPSec tunnel from among the dedicated IPSec tunnels based on the IP address and the authentication key (MSK) obtained from the data received from the secondary terminal 200 . The primary terminal 100 routes the data of the secondary terminal 200 through the identified dedicated IPSec tunnel.

In this way, since the authentication path and the data path for each secondary terminal 200 are separated, the network security between the primary terminal 100 and the EMG-U 610 is strengthened as well as the WiFi section by generating a security key according to separate authentication. security can also be strengthened. In other words, even if the key is exposed due to an attack on a specific encryption tunnel and data is leaked, user traffic other than the corresponding user uses a separate encryption key, so it is not leaked together, making it safer against attack. In addition, the PSK in which the encryption key of the WiFi section is input by the user may be vulnerable to security due to a dictionary attack, periodic update impossible, and use of a public PSK for each user.

However, according to an embodiment of the present invention, the MSK used as the authentication key is dynamically newly generated every time EAP authentication is performed, and is systematically randomly generated differently for each user, that is, the secondary terminal 200 . Therefore, it can be considered safe from the various attacks listed above.

7A and 7B are a series of flowcharts illustrating a 5G LAN service method according to an embodiment.

7A and 7B are specific service flows implemented by applying the features of FIG. 4, and are specific service flows in which EAP authentication and IKE section authentication are not separately performed, but organically combined.

At this time, the messages used in the EAP authentication procedure and the IKE authentication procedure, and parameters (or information) included in the messages are known, and therefore will be briefly described.

First, referring to FIG. 7A , the secondary terminal 200 performs a WiFI Association/Ehernet Link UP procedure with the primary terminal 100 ( S101 ).

The secondary terminal 200 transmits an EAPOL Start message to the primary terminal 100 (S102).

The primary terminal 100 transmits an EAP-Request/Identity message to the secondary terminal 200 (S103).

The secondary terminal 200 transmits an EAP-Response message to the primary terminal 100 (S104).

The primary terminal 100 exchanges an IKE_SA_INIT message with the EMG-U 610 (S105). The IKE_SA_INIT message may include a Header, Sec.associations, D-Hvalues, and Nonce.

The primary terminal 100 transmits an IKE_Auth_Req message to the EMG-U 610 (S106). The IKE_Auth_Req message is a MAC address (Media Access Control Address) of the secondary terminal 200 , a Mobile Directory Number (MDN) of the primary terminal 100 , and an access interface between the primary terminal 100 and the secondary terminal 200 . , EAP-Res (Identity), and the like. Here, the MAC address of the secondary terminal 200 is used as information for identifying the secondary terminal 200 , and is used to create an independent secure tunnel for each secondary terminal 200 .

The EMG-U 610 transmits a Radius Access-Request message to the EMG-C 620 (S107). The Radius Access-Request message may include the MAC address of the secondary terminal obtained in S106, the MDN of the primary terminal, an access interface, and EAP-Res (Identity).

The EMG-C 620 performs device authentication based on the MAC address of the secondary terminal 200 (S108). That is, the EMG-C 620 performs device authentication to determine whether the MAC address of the secondary terminal 200 received in S107 is a MAC address previously registered in the EMG-C 620 .

The EMG-C 620 transmits a Radius Access-Challenge (EAP-Req (PEAP start.)) message to the EMG-U 610 (S109).

The EMG-U 610 transmits an IKE_AUTH_Rsp (EAP-Req (PEAP start)) message to the primary terminal 100 (S110).

The primary terminal 100 transmits an EAP-Request (PEAP start) message to the secondary terminal 200 (S111).

The secondary terminal 200 transmits an EAP-Response (Client hello) message to the primary terminal 100 (S112).

The primary terminal 100 transmits an IKE_AUTH_Req (EAP-Res (Client Hello)) message to the EMG-U 610 (S113).

The EMG-U 610 transmits a RADIUS_ACCESS_Req (EAP-Res (Client Hello)) message to the EMG-C 620 (S114).

The EMG-C 620 transmits a RADIUS_ACCESS_Challenge (EAP-Res (Server Hello (certificate))) message to the EMG-U 610 (S115).

The EMG-U 610 transmits an IKE_AUTH_Req (EAP-Res (Server Hello (certificate))) message to the primary terminal 100 (S116).

The primary terminal 100 transmits an EAP-Request (Server Hello (certificate)) message to the secondary terminal 200 (S117).

An EAP-TLS (Transport Layer Security) tunnel is formed between the primary terminal 100 , the secondary terminal 200 , the EMG-U 610 , and the EMG-C 620 ( S118 ).

Referring to FIG. 7B , the EMG-C 620 transmits a RADIUS_ACCESS_Challenge (EAP-Req)) message to the EMG-U 610 (S119).

The EMG-U 610 transmits an IKE_AUTH_Req (EAP-Req) message to the primary terminal 100 (S120).

The primary terminal 100 transmits an EAP-Request message to the secondary terminal 200 (S121).

The secondary terminal 200 transmits an EAP-Response message to the primary terminal 100 (S122).

The primary terminal 100 transmits an IKE_AUTH_Req (EAP-Res) message to the EMG-U 610 (S123).

The EMG-U 610 transmits a RADIUS_ACCESS_Req (EAP-Res) message to the EMG-C 620 (S124). A user authentication procedure using an ID/password is performed through S119 to S124.

Then, the EAP-TLS tunnel formed in S118 between the primary terminal 100 , the secondary terminal 200 , the EMG-U 610 , and the EMG-C 620 is released ( S125 ).

When EAP authentication (device authentication and user authentication) is successfully performed, the EMG-C 620 allocates an IP to the secondary terminal 200 and generates an MSK for the secondary terminal 200 (S126). The EMG-C 620 transmits a Radius Access-Accept message to the EMG-U 610 (S127). At this time, the Radius Access-Accept message of S127 includes the secondary terminal IP address allocated in S126, the EAP authentication result (EAP-Success or EAP failure), and the MSK. At this time, the MSK, which is the security key, is generated by the EMG-C 620 for the secondary terminal 200 upon successful EAP authentication.

The EMG-U 610 stores the secondary terminal IP address received in S127 (S128).

The EMG-U 610 transmits an IKE_AUTH_Res message to the primary terminal 100 (S129). The IKE_AUTH_Res message includes the EAP authentication result (EAP-Succes or EAP failure) and MSK obtained in S127.

When the EMG for the secondary terminal 200 is enabled, the primary terminal 100 transmits an EAP-Success to the secondary terminal 200 (S130).

Actual EAP authentication is performed between the secondary terminal 200 and the EMG-C 620, and a 4 WAY KEY EXCHANGE is performed using only the resulting MSK (S131). That is, based on the MSK generated as a result of EAP, 4 WAY KEY EXCHANGE is performed.

The primary terminal 100 transmits an IKE_AUTH-Req message (Header, AUTH) to the EMG-U 610 (S132).

The EMG-U 610 transmits an IKT_AUTH-Rsp message to the primary terminal 100 (S133). At this time, the configuration payload of the IKT_AUTH-Rsp message contains the secondary terminal IP address stored in S128.

The primary terminal 100 sets the secondary terminal IP address to the DHCP server (S134). The primary terminal 100 may operate as a DHCP server, and DHCP may exist separately from the primary terminal 100 .

The secondary terminal 200 performs a DHCP process with the primary terminal 100 (S135). At this time, the secondary terminal 200 receives the secondary terminal IP address allocated from the EMG-U 610 from the primary terminal 100 through the DHCP procedure (S135).

The primary terminal 100 creates the EMG-U 610 and the IPsec tunnel in units of the secondary terminal 200 based on the MSK obtained in S129 (S136). When several secondary terminals 200 are connected to the primary terminal 100, steps S101 to S135 are repeatedly performed for each secondary terminal 200, and the MSKs obtained through this are used in units of the secondary terminal 200. can create an IPsec tunnel.

As described above, while allocating a company fixed IP for the secondary terminal 200 other than the range controlled by the communication company, that is, the EMG 600 to the primary terminal 100, up to the primary terminal 100 It is possible to provide a 5G LAN structure that can extend the security system to the secondary terminal 200 . In addition, security can be configured between the primary terminal 100 and the secondary terminal 200 and between the primary terminal 100 and the EMG-U 610 based on the authentication key (MSK) generated as a result of the authentication. .

The embodiment of the present invention described above is not implemented only through the apparatus and method, but may be implemented through a program for realizing a function corresponding to the configuration of the embodiment of the present invention or a recording medium in which the program is recorded.

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto. is within the scope of the right.

Claims (5)

A method of operating an Enterprise Mobile Gateway (EMG) that provides a 5G Local Area Network (LAN) service, the method comprising:
Receiving an authentication request including information of a secondary terminal connected to the primary terminal through a LAN from the primary terminal;
performing authentication to determine whether the information of the secondary terminal is valid; and
If the authentication is successful, comprising the step of transmitting an authentication result including an authentication key to the primary terminal,
The authentication key is
used to create a dedicated Internet Protocol Security (IPSec) tunnel for the secondary terminal between the primary terminal and the EMG. In claim 1,
The authentication result is
including the IP address allocated to the secondary terminal by the EMG;
The IP address assigned to the secondary terminal is,
The method is stored in the primary terminal and allocated by the primary terminal to the secondary terminal in a DHCP (Dynamic Host Configuration Protocol) method. In claim 2,
The primary terminal is
Create dedicated IPSec tunnels based on each authentication key obtained from the EMG by performing the authentication for each of the plurality of secondary terminals connected to the primary terminal,
A method of identifying a corresponding dedicated IPSec tunnel from among the dedicated IPSec tunnels based on the IP address and the authentication key obtained from the data received from the secondary terminal, and routing the received data through the identified dedicated IPSec tunnel. In claim 1,
The authentication key is
The method is transmitted from the EMG to the primary terminal through an Internet Key Exchange (IKE) protocol, and transmitted from the primary terminal to the secondary terminal through an Extensible Authentication Protocol (EAP). In claim 4,
The EMG is
EMG-U acting as an IKE v2 Responder, and
Includes EMG-C operating as a RADIUS (Remote Authentication Dial In User Service) AAA (Authentication Authorization Accounting) server,
The authentication key is
The method is transmitted from the EMG-C to the EMG-U through a RADIUS packet, and transmitted from the EMG-U to the primary terminal through the IKE protocol.

Images