WO2017190414A1

WO2017190414A1 - Mobile device network-access authentication mechanism in wia-pa wireless networks for industrial automation

Info

Publication number: WO2017190414A1
Application number: PCT/CN2016/088054
Authority: WO
Inventors: 魏旻; 曹志豪; 王平; 王震
Original assignee: 重庆邮电大学
Priority date: 2016-05-06
Filing date: 2016-07-01
Publication date: 2017-11-09
Also published as: CN105744524B; CN105744524A

Abstract

The present invention relates to a mobile device network-access authentication mechanism in WIA-PA wireless networks for industrial automation, falling within the technical field of wireless networks for industrial automation. The devices, in WIA-PA wireless networks for industrial automation, involved in the authentication process comprise: a gateway device, a routing device, a field device and a mobile device. The authentication mechanism contains the first network-access authentication of the mobile device and the k^th (k ≥ 2) repeated network-access authentication of the mobile device. The first network-access authentication of the mobile device contains the processing and network-access authentication of a Ticket_net and a Ticket_mobile, and the k^th (k ≥ 2) repeated network-access authentication of the mobile device contains the k^th (k ≥ 2) repeated network-access authentication flow and network-access authentication of the mobile device. By means of the mechanism, the validity of the network-access re-authentication of an authenticated mobile device is improved, and the number of times of message interaction and network resource overheads of the network-access re-authentication of the mobile device are reduced. An authentication code of the network-access re-authentication of the mobile device is changed into a user-selectable dynamic change mode from a static mode, effective defense is performed on a possible replay attack, etc., and the security of a network is effectively improved.

Description

Mobile device network access authentication mechanism in WIA-PA industrial wireless network

Technical field

The invention belongs to the technical field of industrial wireless networks, and relates to a network access authentication mechanism for mobile devices in a WIA-PA industrial wireless network.

Background technique

Industrial Wireless Network WIA (Wireless Networks for Industrial Automation) technology is a highly reliable, ultra-low power intelligent multi-hop wireless sensor network technology with independent intellectual property rights in China. This technology provides a self-organizing and self-healing intelligent routing mechanism. It maintains high reliability and stability of network performance for dynamic changes in application conditions and environments. The WIA-PA (Wireless Networks for Industrial Automation Process Automation) standard is a WIA sub-standard for wireless network systems for industrial process measurement, monitoring and control. Currently, the WIA-PA standard has formed a national standard.

In recent years, in the context of the gradual application of industrial Internet of Things, traditional fixed nodes can no longer meet the needs of industrial applications, and industrial Internet of Things's support for mobility is imminent. A large number of mobile devices, such as handheld meter reading devices, on-site mobile cooling fans, handheld inspection devices, mobile humidifiers, etc., enter industrial wireless networks for intelligent manufacturing.

Application scenarios based on WIA-PA industrial wireless networks are increasing, such as smart meter reading systems based on WIA-PA. In the smart meter reading system, it is necessary to use a mobile device for meter reading, and the mobile device performs meter reading accompanied by multiple repeated network access problems of the mobile device.

The characteristics of mobile devices are: they are mobile. When moving and running in the network, they will repeatedly access the network from different access points according to their location. There is no special way for traditional industrial wireless networks to treat mobile devices repeatedly. For example, in the WIA-PA industrial wireless network, once the mobile device leaves a subnet and joins a new subnet again, the same network access process needs to be performed.

At present, the security authentication mechanism in the WIA-PA industrial wireless network mainly has the following disadvantages: 1) The mobile device needs to perform the same network access authentication process every time it enters the network, and the process requires the mobile device to perform more with the security manager of the industrial wireless network. The second interaction, especially when the mobile device moves frequently in the network, the network resource overhead is large. 2) When the mobile device joins the network for the first time, the security authentication code for authentication is generally generated by the pre-configured key; in the traditional method, after the mobile device leaves the network, the pre-configured key is not updated, and then Each time the network is connected, the same pre-configuration key is used to generate the same authentication code, which is vulnerable to attack.

Summary of the invention

In view of this, the object of the present invention is to provide a mobile device network access authentication mechanism in a WIA-PA industrial wireless network, which can solve the shortcomings of the WIA-PA standard for the mobile network repeated network authentication mechanism.

In order to achieve the above object, the present invention provides the following technical solutions:

A network access authentication mechanism for mobile devices in a WIA-PA industrial wireless network, wherein the WIA-PA industrial wireless network devices involved in the authentication process include: gateway devices, routing devices, field devices, and mobile devices;

The authentication mechanism includes the first network access authentication of the mobile device and the kth (k ≥ 2) repeated network access authentication of the mobile device; the first network access authentication of the mobile device includes the processing and network authentication of the ticket _net and the ticket _mobile , and the mobile device is k ( K≥2) The repeated network access authentication includes the kth (k≥2) repeated network access authentication process and network access authentication of the mobile device.

Further, the first network access authentication of the mobile device includes: the mobile device is authenticated at the gateway device, and after the authentication is successful, the network administrator in the gateway device saves the authentication ID of the mobile device, and the authentication ID is a device long address; The security manager generates Ticket _net and Ticket _mobile , distributes the Ticket _net to all routing devices on the network, and distributes the Ticket _mobile to the mobile device.

Further, after the mobile device is successfully authenticated, the ticket _{mobile is} encapsulated into a successful response, and the mobile device successfully joins the network and obtains the ticket _mobile after receiving the successful response. The format of the successful response command packet is as follows:

14字节14 bytes	1字节1 byte	1字节1 byte	2字节2 bytes	24字节24 bytes
网络层包头Network layer header	命令标识符＝35Command identifier = 35	执行结果Results of the	待加入设备短地址To be added to the device short address	Ticket_mobile Ticket _mobile

The command identifier of the success response command packet is 35. If the join succeeds, the execution result returns “SUCCESS”, the mobile device short address subfield value is to be added, and the ticket _{mobile is} valid; if the join fails, the execution result returns “FAILURE”. , the mobile device short address subfield value to be added, Ticket _{mobile is} invalid.

Further, the Ticket _net and Ticket _mobile processing comprising generating Ticket _net and the Ticket _mobile, Ticket _net Ticket _mobile and distribution of, and Ticket _mobile Ticket _net Ticket _net update the store and the Ticket _mobile.

Further, the encrypted ciphertext in the ticket _net is the ciphertext encrypted by the authentication ID, and the length is 8 bytes. The key in the ticket _mobile is the key of the encryption algorithm in the ticket _net , and the length is 16 bytes; the ticket _net and the ticket _{mobile are} distributed. In the WIA-PA industrial wireless network, when the routing device enters the network at the gateway device, the gateway device acts as the parent node to record the standby routing device as its child node in its parent-child relationship information table; the routing device is at the network routing device. When the network is connected to the network, the routing device on the network as the parent node records the router device to be accessed as its child node in its parent-child relationship information table. The gateway device queries the parent-child relationship information table, and sends a ticket _net distribution command packet to all child node routing devices. After receiving the ticket _net distribution command packet and saving the ticket _net , the corresponding routing device continues to query the parent-child relationship information table stored by itself. It will be sent to all child nodes Ticket _net routing equipment parent-child relationship information table, in order to distribute the Ticket _net.

The Ticket _net distribution command packet is used by the routing device/gateway device to distribute Ticket _net . The ticket _net distribution command packet format is as follows:

14字节14 bytes	1字节1 byte	8字节8 bytes
网络层包头Network layer header	命令标识符＝33Command identifier = 33	Ticket_net Ticket _net

The ticket _net forwarding command packet command identifier is 33; the ticket _net adopts a caching mechanism, which is cached on the network routing device and the gateway device, and the ticket _mobile is fixedly stored in the mobile device; and the four update modes of the ticket _net and the ticket _mobile are provided, the user According to the actual situation, the update mode is 1. The update mode 1 is that the time when the mobile device leaves the network for the first time is t ₁ . After a period of time t, the ticket _{net is} automatically updated to the ticket _net1 , and the ticket _{mobile is} automatically updated to the corresponding ticket _mobile1 . this process was repeated a subsequent update, the update mode mobile device 2 is repeated for subsequent network views g, g + 1 in the first sub-network, generating a new security manager and Ticket _mobile Ticket _net, and perform forwarding Ticket _net Ticket _mobile again, The update mode 3 is to set the maximum lifetime T of the ticket _net and the ticket _{mobile. After the} maximum survival time T, the routing device and the gateway device in the WIA-PA network automatically clear the ticket _{net in the} cache, and the mobile device simultaneously clears the ticket _mobile ; When using the mobile device for the first time into the network authentication process, update mode 4 is not updated for Ticket _net and Ticket _mobile .

Further, the first mobile device k (k≥2) repeats the authentication network comprising: a mobile network to be sent to a Ticket _mobile routing device, the routing device to decrypt the authentication information obtained Ticket _net according Ticket _mobile, and comparing the authentication information is consistent If the mobile device obtains the link resource and accesses the network, the routing device forwards the decrypted authentication information to the security manager in the gateway device, and the security manager re-authenticates the authentication information; if the authentication fails, the communication is disconnected. On the mobile device, if the authentication is successful, the network administrator in the gateway device assigns the corresponding authority to the mobile device.

Further, in the k (k ≥ 2) repeated network access process of the mobile device, two command packets are defined, that is, the mobile device rejoins the request command packet and the device re-authentication request command packet; the mobile device joins the request command packet again. After the mobile device sends a re-join request, the mobile device joins the request command packet format again as follows:

14字节14 bytes	1字节1 byte	24字节24 bytes
网络层包头Network layer header	命令标识符＝34Command identifier = 34	Ticket_mobile Ticket _mobile

The command identifier of the mobile device rejoining the request command packet is 34;

The device re-authentication request packet is used by the routing device to forward the device re-authentication request. The format of the device re-authentication request command packet is as follows:

14字节14 bytes	1字节1 byte	8字节8 bytes
网络层包头Network layer header	命令标识符＝32Command identifier = 32	解密后的认证IDDecrypted authentication ID

The command identifier of the device re-authentication request command packet is 32, and the decrypted authentication ID is used for authentication by the security manager.

The invention has the following advantages: 1) improving the effectiveness of the re-entrant authentication of the authenticated mobile device in the WIA-PA industrial wireless network, reducing the number of packet interactions and network resource overhead of the mobile device re-entry authentication; 2) moving The authentication code of the device re-entry authentication changes from static to user-selectable dynamic change mode, which effectively defends against possible replay attacks and effectively improves network security.

DRAWINGS

In order to make the objects, technical solutions and advantageous effects of the present invention more clear, the present invention provides the following drawings for explanation:

1 is a network reference model in which a mobile device moves in a WIA-PA network;

2 is a process diagram of a mobile device joining a WIA-PA network for the first time;

Figure 3 shows the Ticket _net and Ticket _mobile formats;

Figure 4 shows the distribution model of Ticket _net and Ticket _mobile ;

Figure 5 is a diagram of the kth (k ≥ 2) repeated network access process of the mobile device;

Figure 6 is a timing diagram of the mobile device security joining network in the WIA-PA standard.

detailed description

The invention provides a mobile device network access authentication mechanism in a WIA-PA industrial wireless network, and the WIA-PA industrial wireless network devices are: a gateway device, a routing device, a field device and a mobile device; and a mobile device in a WIA-PA industrial wireless network The authentication mechanism improves the re-entry network authentication of the authenticated mobile device, reduces the number of packet exchanges for mobile device re-entry authentication, and reduces network resource overhead. The authentication code of the mobile device re-entry authentication changes from static to user-selectable dynamic change. Mode, effective defense against possible replay attacks, etc., effectively improve network security; WIA-PA industrial wireless network mobile network access authentication mechanism includes mobile device first network access authentication and mobile device k (k ≥ 2) times Repeated network access authentication; mobile device first network access authentication includes ticket _net and ticket _mobile processing and network access authentication, mobile device k (k ≥ 2) repeated network access authentication includes mobile device k (k ≥ 2) repeated network access authentication Process and network access certification.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings.

FIG. 1 is a network reference model for a mobile device to move in a WIA-PA network. As shown in FIG. 1 , the network device of the WIA-PA industrial wireless network involved in the present invention includes: a gateway device, a routing device, a field device, and a mobile device.

Gateway device: Responsible for protocol conversion and data mapping between WIA-PA network and other networks, and develops Network Manager (NM) and Security Manager (SM) in the gateway device, where the network administrator uses Manage and monitor the entire network. Security administrators use key management and security authentication for gateway devices, routing devices, field devices, and mobile devices. The detailed functions are described in Table 1.

Table 1 Introduction to gateway device features

Routing device (cluster head): manages and monitors field devices and mobile devices; is responsible for securely aggregating and forwarding data of cluster members and other cluster heads; the management functions that the cluster head is mainly responsible for are completed as shown in Table 2.

Table 2 Introduction to routing device management functions

Field device (cluster member): Responsible for obtaining field data and sending it to the cluster head.

Mobile device (cluster member): responsible for mobile collection of industrial field data, and the acquired acquired data is sent to the gateway device through the mesh network; it is responsible for collecting data on the site and performing data analysis, making a response suitable for the current demand and giving feedback on the execution result. To the master computer; responsible for providing direct data to the operator.

1. Mobile device first network authentication

The process of joining a mobile device to the WIA-PA network for the first time is shown in Figure 2. When a mobile device joins the WIA-PA industrial wireless network for the first time, it needs to go through the following steps:

(1) Before the new mobile device joins the WIA-PA network, the handheld configuration device reads the 64-bit long address of the new mobile device and passes the address to the security manager. The security manager generates a join key KJ (JoinKey) for the new mobile device. The handheld configuration device passes the KJ to the new mobile device.

(2) A new mobile device with KJ continuously listens for available channels within the network to obtain beacons sent by routing devices on the network.

(3) The new mobile device selects a routing device or gateway device that sends a beacon as the cluster head, and completes time synchronization according to the time information in the beacon.

(4) The new mobile device generates security information using the long address of the device and KJ, and sends the security information to the cluster head. The cluster head sends a join security request to the mobile device, and after receiving the request, the mobile device sends a security join response to the cluster head. The cluster head then sends a join request with the security information to the NM for the new mobile device.

(5) After receiving the join request, the network manager transmits the security information of the new mobile device to the security manager. The security manager authenticates the security information of the new mobile device. If the authentication fails, the network manager returns a join failure response and disconnects. If the authentication is successful, the network administrator saves the authentication ID of the mobile device, the security manager generates Ticket _net and Ticket _mobile , and the network administrator returns a successful response.

Security managers Ticket _net and Ticket _mobile management, management include the update Ticket _net and generate the Ticket _mobile, Ticket _net and distribution of Ticket _mobile, Ticket _net and Ticket _mobile storage and Ticket _net and the Ticket _mobile.

1) Generation of Ticket _net and Ticket _mobile

Figure 3 shows the Ticket _net and Ticket _mobile formats, and Ticket _net and Ticket _mobile are generated by the security manager. The authentication ID is the long address of the mobile device. The mobile device in the WIA-PA industrial wireless network has a globally unique 64-bit long address, and the long address is allocated and set by the manufacturer according to EUI-64.

In Ticket _net , the encrypted ciphertext is the ciphertext encrypted by the authentication ID, and its length is 8 bytes. In Ticket _mobile , the encryption key Key is an encryption key for encrypting the authentication ID in Ticket _net , and the length is 16 bytes.

2) Distribution of Ticket _net and Ticket _mobile

The distribution model of Ticket _net and Ticket _mobile is shown in Figure 4. The distribution process of Ticket _net and Ticket _mobile is as follows:

A) After the mobile device is successfully authenticated, the network administrator returns a successful response, and the format of the successful response command packet is as shown in Table 3:

Table 3 Adding a successful response command packet format

The command identifier for adding a successful response command packet is 35. If the join is successful, the execution result returns "SUCCESS", the mobile device short address subfield value is to be added, and the ticket _{mobile is} valid; if the join fails, the execution result returns "FAILURE", to be added to the mobile device short address subfield value, and Ticket _mobile invalid. This command packet is a non-segmented packet, and the number of bytes in the network layer header is 14 bytes.

B) adding a successful response through the B, F routing device to the mobile device, the mobile device successfully joins the network and obtains the ticket _mobile after receiving the successful response;

C) In the WIA-PA industrial wireless network, when the routing device enters the network at the gateway device, the gateway device acts as the parent node to record the standby routing device as its child node in its parent-child relationship information table; the routing device is at the network routing device. When the network is connected to the network, the routing device on the network as the parent node records the router device to be accessed as its child node in its parent-child relationship information table. The network administrator queries the parent-child relationship information table in the gateway device, and sends a ticket _net distribution command packet to all routing devices in the parent-child relationship information table according to the query information, and the ticket _net distribution command packet is used by the routing device/gateway device to distribute the ticket. _Net , Ticket _net distribution command packet format is shown in Table 4:

Table 4 Ticket _net distribution command packet format

The ticket _net distribution command packet command identifier is 33. This command packet is a non-segmented packet, and the number of bytes in the network layer header is 14 bytes.

After receiving the ticket _net distribution command packet and saving the ticket _net , the corresponding routing device continues to query the parent-child relationship information table stored by itself, and sends the ticket _net to all routing devices in the parent-child relationship information table according to the query information. Distribution of Ticket _net . Ticket _net is distributed n times in the network in the above distribution method.

The specific method of ticket _net distribution is as follows: When the network is networked, routing devices A, B, and C enter the network at the gateway device, routing device G enters the network at routing device A, and routing device F enters the network at routing device B. Routing device E And D enters the network at routing device C. The gateway device queries the routing device that is in the network at the gateway device in the parent-child relationship information table, queries the routing devices A, B, and C, and sends the ticket _net distribution command packet to routing devices A, B, and C, and routing devices A and B. And C receives the Ticket _net distribution command package and saves the ticket _net . The routing device A queries the parent-child relationship information table to obtain the routing device G, sends the ticket _net distribution command packet to the routing device G, and the routing device G receives the ticket _net distribution command packet and saves the ticket _net ; the routing device B queries the parent-child node relationship information. The routing device F is sent, the ticket _net distribution command packet is sent to the routing device F, the routing device F receives the ticket _net distribution command packet and saves the ticket _net ; the routing device C queries the parent-child node relationship information table to obtain the routing devices D and E, and sends Ticket _net distributes the command packet to routing devices D and E. Routing devices D and E receive the ticket _net distribution command packet and save the ticket _net . The distribution path is shown in Figure 4.

If a new routing device joins the network, the selected cluster head distributes Ticket _net for the new routing device when it joins the network.

3) Storage of Ticket _net and Ticket _mobile

Ticket _{net is} cached on the in-network routing device and gateway device, and Ticket _{mobile is} fixedly stored on the mobile device.

4) Updates to Ticket _net and Ticket _mobile

The technical solution provides four update modes of ticket _net and ticket _mobile , and the user selects the update mode according to the actual situation:

Update mode 1: The time when the mobile device leaves the network for the first time is t ₁ . After a period of time t, the ticket _{net is} automatically updated to Ticket _net1 , and the ticket _{mobile is} automatically updated to the corresponding Ticket _mobile1 . Subsequent updates repeat the process.

Update mode 2: After the mobile device repeats the network g times, the value of g is selected according to the network size. When the g+1th network is entered, the security manager generates a new ticket _net and ticket _mobile , and executes the ticket _net again. And the distribution process of Ticket _mobile .

Update mode 3: Set the maximum lifetime T of the ticket _net and the ticket _{mobile. After the} maximum lifetime T, the routing device and the gateway device in the WIA-PA network automatically clear the ticket _net , and the mobile device also clears the ticket _mobile . When the mobile device enters the network for the next time, the mobile device enters the network for the first time.

Update Mode 4: Does not update Ticket _net and Ticket _mobile .

The update mode 4 is adopted in the message analysis in the technical solution.

(6) After receiving the successful response, the mobile device successfully joins the network and obtains the ticket _mobile .

(7) Using the ticket _net distribution process, the ticket _{net is} sent to all the in-network routing devices, and the network routing device caches the ticket _net .

2. The kth (k ≥ 2) repeated network access process of the mobile device

The mobile device k (k ≥ 2) repeated network access process is shown in Figure 5, the mobile device k (k ≥ 2) repeated network access needs to go through the following steps:

(1) The mobile device continuously monitors available channels in the network to obtain beacons sent by the network routing device or the gateway device;

(2) The mobile device selects one of the routing devices or the gateway device that sends the beacon as the cluster head, and completes the time synchronization according to the time information in the beacon;

(3) The mobile device sends a mobile device re-join request to the selected cluster head, and the mobile device joins the request command packet again for sending the join request when the mobile device repeatedly enters the network, and the mobile device joins the request command packet format definition as shown in Table 5:

Table 5 Mobile device joins the request command packet format again

The mobile device rejoins the requested command identifier 34. This command packet is a non-segmented packet, and the number of bytes in the network layer header is 14 bytes.

(4) After receiving the mobile device re-join request, the cluster head decrypts the ticket _net according to the Key in the ticket _mobile to obtain the authentication ID and compares it with the authentication ID in the ticket _mobile . If not, the network is rejected. If the same, the The link resource is allocated, the network is accessed, and the device re-authentication request is sent to the network administrator. The device re-authentication request command packet is used by the routing device to forward the device re-authentication request. The format of the device re-authentication request command packet is as shown in Table 6:

Table 6 Device re-authentication request command packet format

The command identifier of the device re-authentication request command packet is 32. The decrypted authentication ID is used for authentication by the security manager. This command packet is a non-segmented packet, and the number of bytes in the network layer header is 14 bytes.

(5) The network manager forwards the device re-authentication request to the security manager;

(6) The security manager obtains the authentication ID after receiving the device re-authentication request, and compares the authentication ID with the authentication ID stored by the network administrator. If the same, the network administrator is notified to read the UAO (User) by using the remote read attribute service. Requests for Application Object, User Application Objects, if they are different, do not respond.

(7) The cluster head waits for the network administrator to read the UAO (User Application Object) request by using the remote read attribute service, and if the request is not received after a certain period of time, the mobile device is actively disconnected; Upon receipt of the request after a period of time, the security manager assigns the appropriate permissions to the mobile device.

3. Analysis of packet overhead of mobile devices entering the network

The packet cost analysis of the mobile device accession process is divided into three parts: the first part is the WIA-PA standard mobile device incoming network packet overhead; the second part is the WIA-PA mobile device incoming network authentication mechanism message overhead in the technical solution; the third part For the comparison and analysis of message overhead.

(1) Mobile device network access packet overhead in the WIA-PA standard

Refer to the WIA-PA standard for Table 7:

Table 7 Number of packet bytes defined in the WIA-PA standard

包类型Package type	字节数(字节)Number of bytes (bytes)
加入请求命令包Join request command packet	2828
加入响应命令包Add response command packet	2626
ACKACK	55

The total packet traffic of the mobile device for the first time is A bytes. The number of join request command packets, join response command packets, and ACKs that are required to be added to the network during the request process is m ₁ times.

A=(28+5+26)×2+m ₁ (28+26+5+5)=118+64m ₁

The total number of packets received by the mobile device is 0 bytes. The number of packets exchanged in the configuration phase of the mobile device security in the WIA-PA standard is equal to the number of packets exchanged in the configuration phase of the first time in the network. Therefore, no calculation is made here. When the i-th network is accessed, the number of times the command packet is forwarded in the network is m _i , then

(2) Packet overhead of the mobile device access network authentication mechanism in the technical solution

Table 8 can be obtained according to the command package defined in the technical solution:

Table 8 Bytes of the command packet defined in this technical solution

命令包类型Command packet type	字节数(字节)Number of bytes (bytes)
移动设备再次加入请求命令包The mobile device joins the request command packet again	3939
设备再认证请求命令包Device re-authentication request command packet	23twenty three
加入成功响应命令包Join the successful response command packet	4242
Ticket_net转发命令包Ticket _net forwarding command package	23twenty three

In the technical solution, the mobile device join request and the mobile device re-join request are equal to the number of times the mobile device join request forwarding in the WIA-PA standard is forwarded in the network.

According to the network access process of the mobile device, as shown in FIG. 2 and FIG. 5, the total cost of the first network access packet of the mobile device in the technical solution is B bytes (the interaction of the mobile device in the WIA-PA standard in the configuration phase of the mobile network) The number of interaction packets in the configuration phase of the mobile device is equal to the first time in the network solution, so the calculation is not performed here. The number of times the request command packet, the success response command packet, and the ACK are forwarded in the mesh network are m _{1 .} Second, the number of routing devices on the network is n (where n is the number of routing devices in the network, and n is generally fixed after the network is deployed), then

B=(28+26+5)×2+(28+42+5×2)m ₁ =118+80m ₁

The ticket _net distributes the packet overhead C bytes. The Ticket _net distribution process can be used to distribute the ticket _net in the network for n times, then C=23n. In the technical solution, the packet cost of the second access of the mobile device to the network is D bytes, and D=39+23m ₂ .

In the technical solution, the total cost of the mobile device k times to re-enter the network packet is y bytes, and when the i-th network is accessed, the number of times the command packet is forwarded in the network is m _i , then

(3) Comparison and analysis of message expenses

In the technical solution, the mobile device network access authentication and the WIA-PA standard mobile device network access authentication packet overhead are shown in Table 9.

Table 9 Comparison of message costs

Let Y be the difference between the overhead of the mobile device's incoming message in the WIA-PA standard and the overhead of the mobile device's incoming message in the technical solution, that is, Y=x-y.

Since m _i ≥ 1 ( _i ≥ 2), we can get:

Let X = 120k-120-16m ₁ -23n, then Y ≥ X. When X ≥ 0, Y ≥ 0 is obtained, that is, the cost of the incoming message of the mobile device network authentication mechanism in the technical solution is less than that of the mobile device network authentication mechanism in the WIA-PA standard, that is, X=120k-120-16m ₁ - 23n ≥ 0, available

Ie

The cost of the incoming packet of the mobile device network authentication mechanism in this technical solution is less than that of the mobile device network authentication mechanism in the WIA-PA standard.

The network reference model of the mobile device moving in the WIA-PA network in FIG. 1 is analyzed. It can be obtained from FIG. 1 that the value of m ₁ is 2, and if the value of _mi is 1, then:

Because k is a natural number, when k≥3, Y>0, the packet overhead of the mobile device network authentication mechanism in the technical solution is less than the packet overhead of the mobile device network authentication mechanism in the WIA-PA standard. Y increases linearly with the increase of k, and as the value of k increases (that is, the number of repeated network accesses increases), the advantages of the mobile device network authentication mechanism in the technical solution relative to the WIA-PA standard mobile device network access authentication mechanism will further increase. .

It is to be understood that the above-described preferred embodiments are only illustrative of the technical solutions of the present invention, and are not intended to be limiting, although the present invention has been described in detail by the foregoing preferred embodiments, those skilled in the art Various changes are made in the details without departing from the scope of the invention as defined by the appended claims.

Claims

A mobile device network access authentication mechanism in a WIA-PA industrial wireless network, characterized in that: the WIA-PA industrial wireless network device involved in the authentication process comprises: a gateway device, a routing device, a field device and a mobile device;

The authentication mechanism includes the first network access authentication of mobile devices and the kth (k ≥ 2) repeated network access authentication of mobile devices; the first network access authentication of mobile devices includes Ticket net (tickets in the network) and Ticket mobile (in mobile devices). For the processing and network access authentication of the ticket, the kth (k ≥ 2) repeated network access authentication of the mobile device includes the kth (k ≥ 2) repeated network access authentication process and the network access authentication of the mobile device.
The network access authentication mechanism of the mobile device in the WIA-PA industrial wireless network according to claim 1, wherein the first network authentication of the mobile device comprises: the mobile device is authenticated at the gateway device, and after the authentication succeeds, the gateway device The network administrator saves the authentication ID of the mobile device; the security manager in the gateway device generates the ticket net and the ticket mobile , distributes the ticket net to all the routing devices on the network, and distributes the ticket mobile to the mobile device.
The mobile device network access authentication mechanism in the WIA-PA industrial wireless network according to claim 1, wherein the k (k≥2) repeated network access authentication of the mobile device comprises: the mobile device to be connected to the network sends the Ticket mobile. to the routing device, the routing device to decrypt the authentication information obtained Ticket net according Ticket mobile, than is consistent and authentication information, if the mobile device to obtain a consistent link resources, an access network, and then forwards the authentication information to the routing device decrypting The security manager in the gateway device authenticates the authentication information again; if the authentication fails, the mobile device is disconnected. If the authentication is successful, the network administrator in the gateway device allocates the corresponding authority to the mobile device.
The network access authentication mechanism of the mobile device in the WIA-PA industrial wireless network according to claim 2, wherein after the mobile device is successfully authenticated, the Ticket mobile is encapsulated into a successful response, and the mobile device successfully joins the network after receiving the successful response. And get Ticket mobile , join the successful response command packet format as follows:

14 bytes 1 byte 1 byte 2 bytes 24 bytes Network layer header Command identifier = 35 Results of the To be added to the device short address Ticket mobile

The command identifier of the success response command packet is 35. If the join succeeds, the execution result returns “SUCCESS”, the mobile device short address subfield value is to be added, and the ticket mobile is valid; if the join fails, the execution result returns “FAILURE”. , the mobile device short address subfield value to be added, Ticket mobile is invalid.
According to one WIA-PA industrial wireless network of claim 4 in a mobile network authentication mechanisms apparatus as claimed in claim wherein: said processing and Ticket mobile Ticket net comprises generating Ticket net and the Ticket mobile, and forwarding Ticket mobile Ticket net of , Ticket net and Ticket mobile storage and Ticket net and Ticket mobile updates.
The network access authentication mechanism for a mobile device in a WIA-PA industrial wireless network according to claim 5, wherein the encrypted ciphertext in the ticket net is a ciphertext encrypted with an authentication ID, and the length is 8 bytes, and Ticket mobile The key is the key of the encryption algorithm in the ticket net , and the length is 16 bytes; the ticket net and the ticket mobile are distributed. In the WIA-PA industrial wireless network, when the routing device enters the network at the gateway device, the gateway device acts as the parent node in the parent and child. The node relationship information table records that the routing device to be accessed is a child node; when the routing device enters the network at the network routing device, the network routing device records the device to be accessed as a child node in the parent-child relationship information table; the network manager queries the gateway. The parent-child relationship information table in the device sends the ticket net distribution command packet to all its child node routing devices according to the query information. After receiving the ticket net distribution command packet and saving the ticket net , the corresponding routing device continues to query the parent and child nodes stored in the device. information table, and based on the query information will be sent to all sub-Ticket net parent-child relationship information table Point routing device, in order to distribute the Ticket net; Ticket net distribution device command packets for routing / gateway device the distribution Ticket net, Ticket net dispensing command packet format is as follows:

14 bytes 1 byte 8 bytes Network layer header Command identifier = 33 Ticket net

The ticket net forwarding command packet command identifier is 33; the ticket net adopts a caching mechanism, which is cached on the network routing device and the gateway device, and the ticket mobile is fixedly stored in the mobile device; and the four update modes of the ticket net and the ticket mobile are provided, the user According to the actual situation, the update mode is 1. The update mode 1 is that the time when the mobile device leaves the network for the first time is t 1 . After a period of time t, the ticket net is automatically updated to the ticket net1 , and the ticket mobile is automatically updated to the corresponding ticket mobile1 . this process was repeated a subsequent update, the update mode mobile device 2 is repeated for subsequent network views g, g + 1 in the first sub-network, generating a new security manager and Ticket mobile Ticket net, and perform forwarding Ticket net Ticket mobile again, The update mode 3 is to set the maximum lifetime T of the ticket net and the ticket mobile. After the maximum survival time T, the routing device and the gateway device in the WIA-PA network automatically clear the ticket net in the cache, and the mobile device simultaneously clears the ticket mobile ; When using the mobile device for the first time into the network authentication process, update mode 4 is not updated for Ticket net and Ticket mobile .
The mobile device network access authentication mechanism in the WIA-PA industrial wireless network according to claim 3, characterized in that: in the k (k ≥ 2) repeated network access process of the mobile device, two command packets are defined, that is, mobile The device joins the request command packet and the device re-authentication request command packet again; the mobile device joins the request command packet again for the mobile device to send the re-join request, and the mobile device joins the request command packet format as follows:

14 bytes 1 byte 24 bytes Network layer header Command identifier = 34 Ticket mobile

The command identifier of the mobile device rejoining the request command packet is 34;

The device re-authentication request packet is used by the routing device to forward the device re-authentication request. The format of the device re-authentication request command packet is as follows:

14 bytes 1 byte 8 bytes Network layer header Command identifier = 32 Decrypted authentication ID

The command identifier of the device re-authentication request command packet is 32, and the decrypted authentication ID is used for authentication by the security manager.