CN105119832A - MIPv6 security mobility management system based on identification cryptology and mobility authentication method - Google Patents

Abstract

The invention provides an MIPv6 security mobility management system based on identification cryptology and a mobility authentication method. The system comprises CA, a PKG server, MN, HA and CN. The method comprises the following steps: issuing and managing a certificate for the PKG server in an MIPv6 autonomous domain by the CA; generating system common parameters by the PKG server in the MIPv6 autonomous domain; detecting in real time the state of the MN by the PKG server in the MIPv6 autonomous domain, wherein if the MN is in an initial state, executing security management in the MIPv6 autonomous domain; if the MN is in a mobile state, executing security mobility registration; a security return path being reachable; applying a shared key obtained through negotiation into an IPSec protocol, and establishing credible channel protected data transmission therebetween. According to the invention, an encryption scheme based on identification and a signature scheme are combined with an RR protocol and the IPSec protocol, and the identity of the MN is verified during a key negotiation process, so that a security scheme is more widely applied to a mobile environment, and by applying the shared key obtained through the negotiation into the IPSec protocol, a credible channel is established.

Description

MIPv6 secure mobile management system and mobile authentication method based on identity cryptography

technical field

The invention belongs to the technical field of network security, in particular to an identity cryptography-based MIPv6 security mobile management system and a mobile authentication method.

Background technique

With the continuous improvement and development of the IPv6 protocol, the mobile IPv6 protocol has gradually received more and more attention. The Mobile IPv6 (MobileIPv6, MIPv6) protocol is a protocol that provides mobility support for the IPv6 protocol, and was standardized by the IETF (Internet Engineering Task Force) in June 2004. The importance of protocol security has been fully recognized at the beginning of the MIPv6 protocol design. The main security threats faced by MIPv6 come from the following aspects:

(1) Security threats related to binding update messages. The attacker pretends to be the victim mobile node (MobileNode, MN) by forging the binding update message and sending a false care-of address (Care-ofAddress, CoA) or claiming that it has the home address (HomeAddress, HoA) of the victim MN, so as to achieve The purpose of Man-in-the-Middle attack.

(2) The security threat of replay attack. The communication entity in the Mobile IPv6 protocol does not perform identity verification, and the attacker can mislead normal communication by repeatedly sending the binding update message sent by the victim before.

(3) The security threat of route optimization. In order to avoid the risk of triangular routing similar to that generated in the Mobile IPv4 (MIPv4) protocol, a routing optimization mechanism is used in the Mobile IPv6 protocol, so new extended data packet headers such as home address option datagrams and routing headers are defined in the IPv6 protocol. The attacker can launch a reflection attack on the third party by forging the home address option datagram; the attacker can make the third party have the right to obtain the relevant data packets of the mobile node by forging the routing header. It can be concluded that the threat to the MIPv6 protocol mainly comes from the lack of effective authentication means between communication entities in the process of message transmission, especially in the process of binding update message transmission.

The document "Security in MobileIPv6: Asurvey" points out that the MIPv6 protocol uses the IPSec (IPSecurity) protocol and the IKE (Internet Key Exchange) protocol to protect the mobility management signaling between the MN and the HA (HomeAgent), and uses the RR (Return Routability) protocol to protect the MN and the CN (Correspondentnode). ) between mobility management signaling. However, this method has great defects. The document "Designing the MobileIPv6 security protocol" pointed out that the first phase of IKE protocol negotiation based on the pre-shared key or certificate is not suitable for widespread use in the mobile environment. On the one hand, it is necessary to establish such an The infrastructure of the agreement is not realistic. On the other hand, using the IPSec agreement based on IKE will exceed the load of many mobile terminals. The RR protocol is unsatisfactory in terms of protocol security and quality of service (QoS). The document "Security in MobileIPv6: Asurvey" points out that RR cannot provide real authentication function. The document explains in detail that there are potential security threats in RR, such as attackers forge false binding update messages to deceive CN by stealing and other means. In view of the above situation, many scholars have proposed improved methods. The document "Mobilemulti-layeredIPsec" proposes to use multi-layer IPSec protocol in the MIPv6 protocol to protect mobile management security; the document "An Optimal Scheme for Establishing IPSec SA between MN and HA in Mobile IPv6" proposes that the MN pre-establishes the protection between the MN and the HA in the home network. The idea of security association between HA. But this modification is only an improvement to IPSec and IKE, and does not really eliminate the problems existing in the IKE protocol.

Contents of the invention

Aiming at the problems existing in the prior art, the present invention provides an identity cryptography-based MIPv6 secure mobile management system and a mobile authentication method.

Technical scheme of the present invention is:

A MIPv6 secure mobile management system based on identity cryptography, including:

CA: As a certification center, issue and manage certificates for PKG servers, providing security guarantees for cross-domain communication between PKG servers;

PKG server: Generate system public parameters, issue private keys for entities in the MIPv6 autonomous domain, detect the status of the MN in the MIPv6 autonomous domain in real time, negotiate shared keys for the MN and HA based on the identity cryptography scheme, and when the MN moves in the MIPv6 autonomous domain Prove to the PKG server in the foreign region that the claimed identity of the MN is its actual identity;

MN: The physical mobile node in the MIPv6 protocol; when the MN moves, it performs security registration with the PKG server in the outer region;

HA: The entity home agent in the MIPv6 protocol; when the MN performs security registration with the PKG server in the foreign area when the MN moves, the HA forwards the push message for identity verification sent by the MN to the PKG server in the home area, and sends it to the PKG server in the foreign area. The system parameters for the PKG server in the home domain and the private key of the MN are forwarded to the MN;

CN: The entity communication node in the MIPv6 protocol; maintain communication with the MN during the movement of the MN, and exchange mobile messages with the MN after the MN moves.

Utilize the described MIPv6 security mobile management system based on identity cryptography to carry out the method for MIPv6 security mobile authentication, comprising the following steps:

Step 1: CA issues and manages certificates for PKG servers in each MIPv6 autonomous domain;

Step 2: PKG servers in each MIPv6 autonomous domain generate system public parameters: cyclic group G ₁ and cyclic group G ₂ , bilinear pair e, base point P on cyclic group G ₁ , private key and public key of the PKG server, single To the hash functions H ₁ , H ₂ and H ₃ ;

Step 3: The PKG server in each MIPv6 autonomous domain detects the state of the MN in real time, if the MN is in the initial state, then perform step 4; if the MN is in the mobile state, then perform step 5;

The initial state is the state when the MN accesses the PKG server in the home domain;

The mobile state is the state when the MN moves and accesses the PKG server in a foreign region;

Step 4: Security management in the MIPv6 autonomous domain: Negotiate a shared key for the MN and the HA based on the identity cryptography scheme. If the MN moves, go to step 5; otherwise, go to step 7;

Step 5: Safe mobile registration: MN performs safe registration with the PKG server in the foreign region;

Step 6: The safe return path is reachable: based on the identity cryptography scheme, the shared key is negotiated between the MN and the CN;

Step 7: Apply the shared key obtained through negotiation to the IPSec protocol, and establish a trusted channel between the two parties to protect data transmission;

The IPSec protocol is a protocol used in the MIPv6 protocol to protect the security of mobility management signaling between the MN and the HA.

Described step 5 specifically comprises the following steps:

Step 5.1: MN sends a Care-ofIDPush push message to the PKG server in the foreign region;

The Care-ofIDPush push message is an identity push message generated by the MN and sent to the PKG server in the foreign region;

Step 5.2: MN sends HomeIDPush push message to HA;

The HomeIDPush push message is a push message sent by the MN and requesting its entity home agent HA to prove identity to the PKG server in the outer region;

Step 5.3: HA forwards the HomeIDPush push message to the home domain PKG server;

Step 5.4: The home domain PKG server sends a HomeIDPush push message to the foreign domain PKG server, proving that the claimed identity of the MN is its actual identity;

Step 5.5: The PKG server in the foreign region sends a ParamsPush push message to the PKG server in the home region, and the content of the message is the system parameters of the PKG server in the foreign region and the private key of the MN;

Step 5.6: The PKG server in the home domain sends a ParamsPush push message to the HA;

Step 5.7: The HA sends a ParamsPush message to the MN to complete the registration of the MN with the PKG server in the foreign region.

Described step 6 specifically comprises the following steps:

Step 6.1: The MN sends a ParamsRequest request message to the PKG server in the foreign region, and the content of the request is the system parameters of the PKG server in the domain where the CN is located;

The ParamsRequest message is a request message for the MN to request the system parameters of the PKG server in the domain where the CN is located, sent by the MN to the PKG server in the foreign area, and forwarded to the PKG server in the home area of the MN by the PKG server in the foreign area;

Step 6.2: The PKG server in the foreign region forwards the ParamsRequest request message to the PKG server in the domain where the CN is located;

Step 6.3: The PKG server in the domain where the CN is located sends a ParamsReply response message to the PKG server in the foreign region;

The ParamsReply response message is a message generated by the PKG server in the domain where the CN is located and sent to the PKG server in the foreign area, and finally delivered to the MN. Its load includes the system parameters of the PKG server in the domain where the CN is located and the private key of the MN;

Step 6.4: The PKG server in the foreign region forwards the ParamsReply response message to the MN;

Step 6.5: The MN sends the first message of the RR protocol, namely the CoTI message, to the CN, and the message load is the MN's shared key negotiation request;

The RR protocol is a protocol used to protect the security of mobility management signaling between the MN and the CN in the MIPv6 protocol;

Step 6.6: The MN sends the second message of the RR protocol, namely the HoTI message, to the HA, and the load of the message is the MN's home certification request message;

Step 6.7: The HA sends the third message of the RR protocol, namely the CoT message, to the CN, and the message load is the hometown certificate of the HA to the MN;

Step 6.8: The CN sends the fourth message of the RR protocol, namely the HoT message, to the MN, and the payload of the message is the CN's shared key negotiation message.

Beneficial effect:

The present invention combines the identity-based encryption scheme and signature scheme with the RR protocol and the IPSec protocol, and applies it in the mobile management process of the MIPv6 protocol, and verifies the identity of the MN in the process of key negotiation, and does not use a shared key based on Or a certificate-based mechanism, so that the security scheme has a wider application in the mobile environment, and finally the negotiated shared key is applied to the IPSec protocol to establish a trusted channel.

Description of drawings

Fig. 1 is the architecture diagram of the MIPv6 security mobile management system of the embodiment of the present invention;

FIG. 2 is a sequence diagram of the intra-domain security management process in a specific embodiment of the present invention;

FIG. 3 is a sequence diagram of a secure mobile registration process in a specific embodiment of the present invention;

FIG. 4 is a sequence diagram of a safe return route reachable process in a specific embodiment of the present invention;

Fig. 5 is a flow chart of the MIPv6 secure mobile authentication method according to the specific embodiment of the present invention.

Detailed ways

The specific implementation manners of the present invention will be described in detail below in conjunction with the accompanying drawings.

This embodiment uses the identity-based signature mechanism to authenticate the identity of both communication parties, and uses the identity-based encryption mechanism and signature mechanism to negotiate a shared key. In this process, the idea of the RR protocol is used for reference, and HA is introduced to prove the identity of the MN. , and finally apply the negotiated shared key to the IPSec protocol to establish a trusted channel.

A MIPv6 secure mobile management system based on identity cryptography, as shown in Figure 1, the entire system is divided into several autonomous domains according to the logical relationship, and the entities in the system include:

CA: As a certification center, issue and manage certificates for PKG servers, providing security guarantees for cross-domain communication between PKG servers;

PKG server: Generate system public parameters, issue private keys for entities in the MIPv6 autonomous domain, detect the status of the MN in the MIPv6 autonomous domain in real time, negotiate shared keys for the MN and HA based on the identity cryptography scheme, and when the MN moves in the MIPv6 autonomous domain Prove to the PKG server in the foreign region that the claimed identity of the MN is its actual identity;

MN: The physical mobile node in the MIPv6 protocol; when the MN moves, it performs security registration with the PKG server in the outer region;

HA: The entity home agent in the MIPv6 protocol; when the MN performs security registration with the PKG server in the foreign area when the MN moves, the HA forwards the push message for identity verification sent by the MN to the PKG server in the home area, and sends it to the PKG server in the foreign area. The system parameters for the PKG server in the home domain and the private key of the MN are forwarded to the MN;

CN: The entity communication node in the MIPv6 protocol; maintain communication with the MN during the movement of the MN, and exchange mobile messages with the MN after the MN moves.

The whole system is divided into four domains, namely a CA domain and three different MIPv6 autonomous domains, CA: as the certification center to issue and manage certificates for the PKG server; three MIPv6 autonomous domains (AutonomousSystem, AS) AS0, AS1 and AS2 , the PKG servers PKG0, PKG1 and PKG2 in the MIPv6 autonomous domain are respectively responsible for managing the security in the domain.

For the convenience of subsequent description, the identification and description shown in Table 1 are given.

Table 1 Identification and description

Utilize the MIPv6 safe mobile management system based on identity cryptography to carry out the method for MIPv6 safe mobile authentication, as shown in Figure 5, comprise the following steps:

Step 1: CA issues and manages certificates for PKG servers in each MIPv6 autonomous domain;

Step 2: PKG servers in each MIPv6 autonomous domain generate system public parameters: cyclic group G ₁ and cyclic group G ₂ , bilinear pair e, base point P on cyclic group G ₁ , private key and public key of the PKG server, single To the hash functions H ₁ , H ₂ and H ₃ ;

Generate a random prime number q, select two q-order groups G ₁ , G ₂ and a bilinear map e: G ₁ ×G ₁ →G ₂ . Choose a random number s, and set P _pub =sP. Choose a hash function The hash function H ₁ maps a bit string to the group G ₁ ; the hash function H ₂ :G ₂ →{0,1} ⁿ , the hash function maps the elements in the group G ₂ into a length A bit string of n; where n is the length of the prescribed plaintext/ciphertext space, the plaintext space M={0,1} ⁿ , the ciphertext space Through the above steps, the entire IBE (IdentityBasedEncryption) system generates system public parameters Params={q, G ₁ , G ₂ , e, n, P, P _pub , H ₁ , H ₂ }, and the master key of the PKG server is

Step 3: The PKG server in each MIPv6 autonomous domain detects the state of the MN in real time, if the MN is in the initial state, then perform step 4; if the MN is in the mobile state, then perform step 5;

The initial state is the state when the MN accesses the PKG server in the home domain;

The mobile state is the state when the MN moves and accesses the PKG server in a foreign region;

Step 4: Security management in the MIPv6 autonomous domain: Negotiate a shared key for the MN and the HA based on the identity cryptography scheme. If the MN moves, go to step 5; otherwise, go to step 7;

The specific process is shown in Figure 2:

Step 4.1: MN sends a key sharing request message to HA;

MN->HA: KeyExchangeRequest

Specific message format: Code||MN||HA||Enc(Sig(g ^mn )S _mn-0 )ID _HA ||Time.

The KeyExchangeRequest message is generated by the MN and sent to the HA. The message payload is the parameter g ^mn of the Diffie-Hellman key exchange, where g is the system parameter q in the domain, and the value of mn is the secret value owned by the entity mobile node MN.

Step 4.2: HA sends a key sharing response message to MN;

HA->MN: KeyExchangeReply

Specific message format: Code||MN||HA||Enc(Sig(g ^ha )S _ha-0 )ID _MN ||Time.

The KeyExchangeReply message is the HA's response to the Request from the MN. The message payload part is the parameter g ^ha of the Diffie-Hellman key exchange owned by the HA.

Step 5: Safe mobile registration: MN performs safe registration with the PKG server PKG2 in the foreign region;

The specific process is shown in Figure 3:

Step 5.1: MN sends a Care-ofIDPush push message to the foreign region PKG server PKG2;

The Care-ofIDPush push message is an identity push message generated by the MN and sent to the PKG server PKG2 in the foreign region;

Message format: Code||MN||PKG2||(ID _MN ,CoA)||Time.

The Care-ofIDPush message is an identity push message generated by the MN and sent to PKG2. The message type represented by the Code of this message indicates that the payload of the pushed Payload is the public key of the node and its Care-of address, that is, ID _MN , CoA. The mobile node MN requests the system parameters of PKG2 and the private key generated by PKG2 for the MN through this message. key.

Step 5.2: MN sends HomeIDPush push message to HA;

The HomeIDPush push message is a push message sent by the MN and requesting its entity home agent HA to prove identity to the PKG server in the outer region;

MN->HA:HomeIDPush

Message format: Code||MN||PKG2||Enc(ID _MN ,CoA)SK _mn-ha ||Time.

The HomeIDPush message draws on the idea of the HoTI message of the RR protocol. The MN sends it to its home agent HA, requesting the HA to prove its identity to PKG2. The actual content of the message load is the MN's identity public key ID _MN and its current care-of address CoA.

Step 5.3: HA forwards the HomeIDPush push message to the home domain PKG server PKG0;

HA->PKG0: HomeIDPush

Message format: Code||MN||PKG2||Enc(ID _MN ,CoA)ID _HA ||Time.

The HomeIDPush message is sent by HA to PKG0 in the home domain, requesting PKG0 to forward the HA's proof of MN's identity to PKG2, and the actual data loaded in the message is the binding of MN's identity public key ID _MN and MN's current care-of address CoA.

Step 5.4: The home domain PKG server PKG0 sends a HomeIDPush push message to the foreign domain PKG server PKG2, proving that the claimed identity of the MN is its actual identity;

PKG0->PKG2:HomeIDPush

Message format: Code||MN||PKG2||{ID _MN ,CoA}||Time.

The HomeIDPush message is sent from PKG0 to PKG2, which is the forwarding of the MN's identity certification request, and the message load is the proof of the MN's identity. The CA server has issued certificates for different PKG servers in advance, and the security of the PKG servers is guaranteed by the CA server.

Step 5.5: The PKG server PKG2 in the foreign region sends a ParamsPush push message to the PKG server PKG0 in the home region. The content of the message is the system parameter Params of the PKG server PKG2 in the foreign region and the private key of the MN;

PKG2->PKG0: ParamsPush

Message format: Code||PKG2||MN||{Params-2,S _mn-2 }||Time.

The ParamsPush message is a parameter push message sent by PKG2 after verifying the identity of the MN. The Source of the message is PKG2, and the Destination is MN; the Payload includes the system parameter Params-2 of PKG2 and the private key S _mn-2 generated by PKG2 for MN. its safe.

Step 5.6: Home domain PKG server PKG0 sends ParamsPush push message to HA;

PKG0->HA: ParamsPush

Message format: Code||PKG2||MN||Enc(Params-2,S _mn-2 )ID _HA ||Time.

The ParamsPush message is the forwarding of the message in step 4.5, and the message load part is the system parameter Params-2 of PKG2 and the private S _mn-2 key of the MN.

Step 5.7: The HA sends a ParamsPush message to the MN to complete the registration of the MN with the PKG server PKG2 in the foreign region.

HA->MN: ParamsPush

Message format: Code||PKG2||MN||Enc(Params-2,S _mn-2 )SK _mn-ha ||Time

The ParamsPush message is sent by the HA to the MN, which is essentially the forwarding of the message in step 5.5. The actual content of the message Payload is the system parameter Params-2 of PKG2 and the private key S _mn-2 generated by PKG2 according to the MN identity public key ID _MN .

Step 6: The safe return path is reachable: based on the identity cryptography scheme, the shared key is negotiated between the MN and the CN;

The specific process is shown in Figure 4:

Step 6.1: The MN sends a ParamsRequest request message to the PKG server PKG2 in the foreign region, and the content of the request is the system parameters of the PKG server PKG1 in the domain where the CN is located;

The ParamsRequest message is a request message for the MN to request the system parameters of the PKG server PKG1 in the domain where the CN is located, and is sent by the MN to the PKG server PKG2 in the foreign area, and forwarded to the PKG server PKG0 in the home domain of the MN by the PKG server PKG2 in the foreign area;

MN->PKG2: ParamsRequest

Message format: Code||MN||PKG1||Sig(ID _MN )S _mn-2 ||Time.

The ParamsRequest message is generated by _MN and sent to PKG2. This message is to request the system parameters of PKG1 from PKG1, the manager of the AS1 domain where CN is located. key to generate the corresponding private key, and the payload content needs to be signed by the private key S _mn-2 generated by PKG2 for the MN to prevent other nodes from impersonating the MN to initiate requests.

Step 6.2: The PKG server PKG2 in the foreign region forwards the ParamsRequest request message to the PKG server PKG1 in the domain where the CN is located;

PKG2->PKG1: ParamsRequest

Message format: Code||MN||PKG1||{ID _MN }||Time.

The ParamsRequest message is sent from PKG2 to PKG2, which is essentially the forwarding of the message in step 6.1, and the message payload is the identity public key ID MN of the _MN .

Step 6.3: The PKG server PKG1 in the domain where the CN is located sends a ParamsReply response message to the PKG server PKG2 in the foreign region;

The ParamsReply response message is a message generated by the PKG server PKG1 in the domain where the CN is located and sent to the PKG server PKG2 in the foreign area and finally delivered to the MN, and its load includes the system parameters of the PKG server PKG1 in the domain where the CN is located and the private key of the MN;

PKG1->PKG2: ParamsReply

Message format: Code||PKG1||MN||{Params-1,S _mn-1 }||Time.

The ParamsReply message is generated by PKG1 and sent to PKG2, and finally to MN. The message load is the system parameter Params-1 of PKG1 and the private key S _mn-1 generated by PKG1 for MN.

Step 6.4: The foreign region PKG server PKG2 forwards the ParamsReply response message to the MN;

PKG2->MN:ParamsReply

Message format: Code||PKG1||MN||Enc(Params-1,S _mn-1 )ID _MN ||Time.

The ParamsReply message is sent to the MN by PKG2, which is essentially the forwarding of the message in step 6.3. The message payload is the system parameter Params-1 of PKG1 and the private key S _mn-1 generated by PKG1 for the MN.

Step 6.5: The MN sends the first message of the RR protocol, namely the CoTI message, to the CN, and the message load is the MN's shared key negotiation request;

The RR protocol is a protocol used to protect the security of mobility management signaling between the MN and the CN in the MIPv6 protocol;

MN->CN:CoTI(KeyExchange)

Message format: Code||MN||CN||Enc(Sig(g ^mn ,ID _MN ,CoA)S _mn-1 )ID _CN ||Time.

The CoTI (KeyExchange) message is considered to be integrated with the RR protocol in this embodiment, and the KeyExchange is included in the CoTI message of the RR message. The message load is composed of three parts: the Diffie-Hellman key negotiation parameter g ^mn , the identity public key of the MN ID _MN and MN's current care-of address CoA, where g is a prime number q, one of the PKG1 system parameters, and mn is a secret value owned by the MN.

Step 6.6: The MN sends the second message of the RR protocol, namely the HoTI message, to the HA, and the load of the message is the MN's home certification request message;

MN->HA:HoTI(HomeVerifyRequest)

Message format: Code||MN||CN||Enc(ID _MN ,CoA)SK _mn-ha ||Time.

The HoTI (HomeVerifyRequest) message is the second message HoTI in the RR protocol. The message payload is the binding of the MN identity public key ID _MN and the MN care-of address CoA.

Step 6.7: The HA sends the third message of the RR protocol, namely the CoT message, to the CN, and the message load is the hometown certificate of the HA to the MN;

HA->CN: CoT(HomeVerify)

Message format: Code||MN||CN||(ID _MN ,CoA)||Time.

The CoT (HomeVerify) message is the third CoT message in the RR protocol, and its function is to provide the home certificate for the identity of the MN. The payload content of the message is the binding of the MN identity public key ID _MN and the MN care-of address CoA.

Step 6.8: The CN sends the fourth message of the RR protocol, namely the HoT message, to the MN, and the payload of the message is the CN's shared key negotiation message.

CN->MN:HoT(KeyExchange)

Message format: Code||CN||MN||Enc(Sig(g ^cn )S _cn-1 )ID _MN ||Time.

The HoT (KeyExchange) message is the last message HoT in the RR protocol. The message carries CN's Diffie-Hellman key negotiation g ^cn , where g is a prime number q, one of the PKG1 system parameters, and cn is a Diffie-Hellman secret value owned by CN.

Step 7: Apply the shared key obtained through negotiation to the IPSec protocol, and establish a trusted channel between the two parties to protect data transmission;

The IPSec protocol is a protocol used in the MIPv6 protocol to protect the security of mobility management signaling between the MN and the HA.

Claims (4)

1. A MIPv6 security mobile management system based on identity cryptography, characterized in that it comprises: CA: As a certification center, issue and manage certificates for PKG servers, providing security guarantees for cross-domain communication between PKG servers; PKG server: Generate system public parameters, issue private keys for entities in the MIPv6 autonomous domain, detect the status of the MN in the MIPv6 autonomous domain in real time, negotiate shared keys for the MN and HA based on the identity cryptography scheme, and when the MN moves in the MIPv6 autonomous domain Prove to the PKG server in the foreign region that the claimed identity of the MN is its actual identity; MN: The physical mobile node in the MIPv6 protocol; when the MN moves, it performs security registration with the PKG server in the outer region; HA: The entity home agent in the MIPv6 protocol; when the MN performs security registration with the PKG server in the foreign area when the MN moves, the HA forwards the push message for identity verification sent by the MN to the PKG server in the home area, and sends it to the PKG server in the foreign area. The system parameters for the PKG server in the home domain and the private key of the MN are forwarded to the MN; CN: The physical communication node in the MIPv6 protocol; maintain communication with the MN during the movement of the MN, and exchange mobile messages with the MN after the MN moves. 2. utilize the MIPv6 safe mobile management system described in claim 1 to carry out the method for MIPv6 safe mobile authentication, it is characterized in that, comprise the following steps: Step 1: CA issues and manages certificates for PKG servers in each MIPv6 autonomous domain; Step 2: PKG servers in each MIPv6 autonomous domain generate system public parameters: cyclic group G ₁ and cyclic group G ₂ , bilinear pair e, base point P on cyclic group G ₁ , private key and public key of the PKG server, single To the hash functions H ₁ , H ₂ and H ₃ ; Step 3: The PKG server in each MIPv6 autonomous domain detects the state of the MN in real time, if the MN is in the initial state, then perform step 4; if the MN is in the mobile state, then perform step 5; The initial state is the state when the MN accesses the PKG server in the home domain; The mobile state is the state when the MN moves and accesses a PKG server in a foreign region; Step 4: Security management in the MIPv6 autonomous domain: Negotiate a shared key for the MN and the HA based on the identity cryptography scheme. If the MN moves, go to step 5; otherwise, go to step 7; Step 5: Safe mobile registration: MN performs safe registration with the PKG server in the foreign region; Step 6: The safe return path is reachable: based on the identity cryptography scheme, the shared key is negotiated between the MN and the CN; Step 7: Apply the shared key obtained through negotiation to the IPSec protocol, and establish a trusted channel between the two parties to protect data transmission; The IPSec protocol is a protocol used in the MIPv6 protocol to protect the security of mobility management signaling between the MN and the HA. 3. MIPv6 security mobile authentication method according to claim 2, is characterized in that, described step 5 specifically comprises the steps: Step 5.1: MN sends a Care-ofIDPush push message to the PKG server in the foreign region; The Care-ofIDPush push message is an identity push message generated by the MN and sent to the PKG server in the foreign region; Step 5.2: MN sends HomeIDPush push message to HA; The HomeIDPush push message is a push message sent by the MN and requesting its entity home agent HA to prove identity to the PKG server in the outer region; Step 5.3: HA forwards the HomeIDPush push message to the home domain PKG server; Step 5.4: The home domain PKG server sends a HomeIDPush push message to the foreign domain PKG server, proving that the claimed identity of the MN is its actual identity; Step 5.5: The PKG server in the foreign region sends a ParamsPush push message to the PKG server in the home region, and the content of the message is the system parameters of the PKG server in the foreign region and the private key of the MN; Step 5.6: The PKG server in the home domain sends a ParamsPush push message to the HA; Step 5.7: The HA sends a ParamsPush message to the MN to complete the registration of the MN with the PKG server in the foreign region. 4. MIPv6 security mobile authentication method according to claim 2, is characterized in that, described step 6 specifically comprises the steps: Step 6.1: The MN sends a ParamsRequest request message to the PKG server in the foreign region, and the content of the request is the system parameters of the PKG server in the domain where the CN is located; The ParamsRequest message is a request message for the MN to request the system parameters of the PKG server in the domain where the CN is located, sent by the MN to the PKG server in the foreign area, and forwarded to the PKG server in the home area of the MN by the PKG server in the foreign area; Step 6.2: The PKG server in the foreign region forwards the ParamsRequest request message to the PKG server in the domain where the CN is located; Step 6.3: The PKG server in the domain where the CN is located sends a ParamsReply response message to the PKG server in the foreign region; The ParamsReply response message is a message generated by the PKG server in the domain where the CN is located and sent to the PKG server in the foreign area, and finally delivered to the MN. Its load includes the system parameters of the PKG server in the domain where the CN is located and the private key of the MN; Step 6.4: The PKG server in the foreign region forwards the ParamsReply response message to the MN; Step 6.5: The MN sends the first message of the RR protocol, namely the CoTI message, to the CN, and the message load is the MN's shared key negotiation request; The RR protocol is a protocol used to protect the security of mobility management signaling between the MN and the CN in the MIPv6 protocol; Step 6.6: The MN sends the second message of the RR protocol, namely the HoTI message, to the HA, and the load of the message is the MN's home certification request message; Step 6.7: The HA sends the third message of the RR protocol, namely the CoT message, to the CN, and the message load is the hometown certificate of the HA to the MN; Step 6.8: The CN sends the fourth message of the RR protocol, namely the HoT message, to the MN, and the payload of the message is the CN's shared key negotiation message.