JP2004023365A - Authentication method in roaming - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an authentication method in roaming which prevents impersonation and leakage of information without the need for registering identification information of a user to a communication enterprise of a roaming destination. <P>SOLUTION: The authentication method in roaming includes: a step where a roaming source generates a first roaming key (K1) for each mobile user on the basis of identification information ID(U) unique to each mobile user and identification information ID(FS) known to the roaming destination, and informs each mobile user about the first roaming key in advance; a step where a mobile user who has moved into a service area of the roaming destination informs the roaming destination about the identification information ID(U) unique to the mobile user; a step where the roaming destination generates a second roaming key (K2) on the basis of the known identification information ID(FS) and the identification information ID(U) notified by the mobile user; and a step where the mobile user and the roaming destination compare the first roaming key with the second roaming key to mutually authenticate each other. <P>COPYRIGHT: (C)2004,JPO

Description

[0001]
TECHNICAL FIELD OF THE INVENTION
The present invention provides authentication in roaming in which a mobile user authenticates with another communication carrier within a service area of another communication carrier other than the contracted carrier to enjoy communication services. More particularly, the present invention relates to an authentication method to which a key sharing scheme is applied.
[0002]
[Prior art]
Wireless LAN is attracting attention as broadband access in mobile. As a service form of wireless LAN access, a form in which a wireless LAN base station called a hot spot is installed and network access is provided to users within a range of the radio wave is common. In this case, the user comes to the store with his / her mobile terminal, etc., pays a usage fee, obtains secret information (such as a password), and enters this information into his / her mobile terminal to use the service. . The following method has been proposed as a user authentication method in a conventional wireless LAN.
(1) "WEP" (Wired Equivalent Privacy)
Provide encryption and authentication. The user sets a password with five alphanumeric characters and encrypts the data using a 40-bit key. Recently, as a corporate wireless LAN, WEP using a 128-bit key standardized as an option of IEEE 802.11b has appeared.
(2) "Authentication by MAC address" (Media Access Control address filtering)
[0003]
By setting in advance the MAC address of the slave unit that can be connected to the master unit, unauthorized access from an unregistered slave unit terminal is prevented. When this method is used, even if “ANY” or “blank” is set in the SS-ID, communication is not possible unless the MAC address of the slave terminal is registered in the master.
(3) "MISP" (MIS Protocol)
[0004]
This is a user authentication and key exchange protocol for wireless LAN developed by Mobile Internet Services Company (MIS). When a user sends a session key encrypted with a user name and password from a mobile terminal to a base station, The base station requests the authentication server to decrypt the session key. When the session key is returned from the authentication server, thereafter, the mobile terminal and the base station perform encrypted communication using the session key.
[0005]
[Problems to be solved by the invention]
In the method using "WEP", users under the same wireless LAN base station basically use the same key, so it is possible to impersonate other users or to see information of other users It becomes. In the case of "authentication by MAC address", there is not only the same threat, but since all the MAC addresses of users must be registered in advance, providing services to users outside their own control Is difficult. According to "MISP", it is possible to authenticate individual users, but if there is access from a user, it is necessary to make inquiries in real time to the authentication server online, so multiple communication carriers Not suitable for roaming between. Further, it is difficult to take measures against spoofing on the server side in "MISP".
[0006]
SUMMARY OF THE INVENTION An object of the present invention is to solve the above-mentioned problems of the prior art and provide an authentication method in roaming that can effectively prevent impersonation and information leakage without registering user identification information with a roaming destination communication carrier. To provide.
[0007]
[Means for Solving the Problems]
In order to achieve the above-mentioned object, the present invention provides a mobile user in which a mobile user (a roaming destination) other than his / her contracted telecommunications carrier (a roaming source) communicates with a roaming destination within a service area of the roaming destination. In an authentication method in roaming in which authentication is performed between users to enjoy communication services,
(1) The roaming source sets a first roaming key (K1) for each mobile user based on the identification information ID (U) unique to the mobile user and the identification information ID (FS) known to the roaming destination. Procedure for generating and notifying each mobile user in advance (2) Procedure for the mobile user who has moved into the roaming destination service area to notify the roaming destination of the identification information ID (U) unique to the mobile user (3). A procedure in which the roaming destination generates a second roaming key (K2) based on the known identification information ID (FS) and the identification information ID (U) notified from the mobile user (4) the mobile user and the roaming destination Comprises a step of comparing the first roaming key (K1) and the second roaming key (K2) to mutually authenticate each other. That.
[0008]
According to the above-described feature, each roaming destination generates a roaming key unique to each mobile user based on the identification information provided by the mobile user and the registered identification information. There is no need to pre-register the roaming key. In addition, since the mobile user and the roaming destination can perform authentication by the key sharing scheme, impersonation to the user and the server and leakage of information can be effectively prevented.
[0009]
BEST MODE FOR CARRYING OUT THE INVENTION
Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the basic concept of an authentication method to which the present invention is applied, in which a mobile user is a communication carrier (roaming destination) other than the contracted carrier (roaming source). In this service area, authentication performed with the roaming destination is targeted.
[0010]
In FIG. 1, the roaming source is, for each mobile user, identification information ID (U) unique to the mobile user and identification information known to the roaming destination, for example, identification information ID (FS) unique to the roaming destination. The first roaming key K1 [ID (U), ID (FS)] is generated based on a predetermined function operation using ()) as a parameter, and this is notified to each mobile user in advance ((1)).
[0011]
Thereafter, the mobile user who has moved into the service area of the roaming destination notifies the roaming destination of the identification information ID (U) unique to the mobile user and requests authentication ((2)). The roaming destination for which authentication has been requested is a second roaming key K2 based on the predetermined function operation using the known identification information ID (FS) and the identification information ID (U) notified from the mobile user as parameters. [ID (U), ID (FS)] is generated ([3]). Next, the mobile user and the roaming destination mutually exchange the first roaming key K1 [ID (U), ID (FS)] and the second roaming key K2 [ID (U), ID (FS)]. To compare them (4).
[0012]
If the second roaming key K2 [ID (U), ID (FS)] received from the roaming destination matches the first roaming key K1 [ID (U), ID (FS)] of the mobile user, It can be authenticated that the roaming destination is a legitimate roaming destination corresponding to the identification information ID (FS). If the first roaming key K1 [ID (U), ID (FS)] received from the mobile user matches the own roaming key K2 [ID (U), ID (FS)] In this case, the mobile user can be authenticated as a mobile user having his / her own roaming destination.
[0013]
As described above, according to the present invention, the roaming destination generates a roaming key unique to each mobile user based on the identification information provided by the mobile user and the registered identification information. There is no need to pre-register the roaming key. In addition, since the mobile user and the roaming destination can perform authentication by the key sharing scheme, impersonation to the user and the server and leakage of information can be effectively prevented.
[0014]
FIG. 2 is a block diagram of the first embodiment of the present invention based on the above-described authentication procedure, and FIG. 3 is a sequence diagram showing the procedure.
[0015]
In FIG. 2, a roaming source home server HS is assigned an identification information ID (HS) unique to the home server HS. The home server FS at the roaming destination is assigned an identification information ID (FS) unique to the home server FS. The roaming source and the roaming destination share a predetermined secret function F. Each mobile user is assigned in advance a unique identification information ID (Ui) (i = 1 to n).
[0016]
In such a configuration, in step S1 of FIG. 3, the roaming source home server HS sends its own identification information ID (HS), the identification information ID (FS) unique to the roaming destination foreign server FS, and each mobile user. The unique roaming key K11 unique to each user is generated by applying the unique identification information ID (Ui) to the secret function F, and is distributed to each mobile user in advance in step S2. Each mobile user is notified in advance of the identification information ID (HS) of the home server HS.
[0017]
Thereafter, the mobile user who has visited the roaming destination wireless LAN environment generates a random number R in step S3. In step S4, the identification information ID (Ui) of itself, the identification information ID (HS) of the home server HS of the roaming source and the random number R are notified to the foreign server FS of the roaming destination to request authentication.
[0018]
In step S5, the foreign server FS applies the received identification information ID (Ui), ID (HS) and its own identification information ID (FS) to the secret function F, and performs the same function operation as in step S1. Execute. Further, a second roaming key K12 is generated based on the calculation result and the received random number R. In the present embodiment, the calculation result and the random number R are concatenated, and the hash value is obtained as the second roaming key K12. Further, a keyed hash value of the random number R is calculated using the second roaming key K12 to generate a message authentication code (MAC) MAC (K12‖R), and further a random number R ′ is generated. In step S6, the message authentication code MAC (K12 @ R) and the random number R 'are notified to the mobile user.
[0019]
In step S7, the mobile user independently generates the third roaming key K13 by applying a hash function to the combination of the first roaming key K11 and the random number R. Further, the keyed hash value of the random number R is calculated with the roaming key K13 to generate a message authentication code MAC (K13‖R). In step S8, the message authentication code MAC (K13 @ R) obtained by itself is compared with the message authentication code MAC (K12 @ R) notified from the foreign server FS.
[0020]
If they match, the identification information ID (FS) of the foreign server FS used when the home server HS generates the first roaming key K11 and the identification information ID registered in the foreign server FS of the roaming destination. Since (FS) is equal and the secret function F of the home server HS and the foreign server FS is proved to be the same, the mobile user can authenticate the foreign server FS as an authorized roaming destination.
[0021]
The mobile user further generates a fourth roaming key K14 by applying a hash function to the combination of the third roaming key K13 and the notified random number R 'in step S9. Further, the fourth roaming key K14 calculates a keyed hash value of the notified random number R 'to generate a message authentication code MAC (K14 @ R'). In step S10, this is sent to the foreign server FS. Notice.
[0022]
In step S11, the foreign server FS applies a hash function to the combination of the second roaming key K12 and the random number R 'to generate a fifth roaming key K15. Further, a keyed hash value of the random number R 'is calculated with the fifth roaming key K15 to generate a message authentication code MAC (K15‖R'). In step S12, the message authentication code MAC (K15 @ R ') obtained by the mobile user is compared with the message authentication code MAC (K14 @ R) notified from the mobile user, and if they match, the foreign server FS Authenticates mobile users as legitimate users.
FIG. 4 is a block diagram of a second embodiment of the present invention based on the above-described authentication procedure, and FIG. 5 is a sequence diagram showing the procedure. In the above-described first embodiment, the home server HS and the foreign server FS have been described as sharing the secret function F. However, in the present embodiment, the home server HS and the foreign server FS may share the secret roaming master key Km. There is a characteristic in that
[0023]
In step S21 in FIG. 5, the foreign server FS at the roaming destination generates a roaming master key Km. The roaming master key Km is generated for each roaming source home server HS, and is notified to each home server HS in advance in step S22. In step S23, the roaming source home server HS applies a hash function to the combination of the roaming master key Km and the identification information ID (Ui) of each mobile user for each mobile user who wants to roam, and performs the first roaming. A key K21 is generated and distributed in advance to each mobile user in step S24.
[0024]
Thereafter, the mobile user who has visited the roaming destination wireless LAN environment generates a random number R in step S25. In step S26, the identification information ID (Ui) and the random number R are notified to the roaming destination foreign server FS to request authentication.
[0025]
In step S27, the foreign server FS applies a hash function to the combination of the received identification information ID (Ui) and the roaming master key Km, and further applies a hash function to the combination of the received random number R and the second. A roaming key K22 is generated. Further, a keyed hash value of the random number R is calculated with the second roaming key K22, a message authentication code MAC (K22‖R) is generated, and a random number R ′ is generated. In step S28, the message authentication code MAC (K22 @ R) and the random number R 'are notified to the mobile user.
[0026]
In step S29, the mobile user independently generates a third roaming key K23 by applying a hash function to the combination of the first roaming key K21 and the random number R. Further, a keyed hash value of the random number R is calculated by using the roaming key K23 to obtain a message authentication code MAC (K23‖R). In step S30, the message authentication code MAC (K23 @ R) obtained by itself is compared with the message authentication code MAC (K22 @ R) notified from the foreign server FS.
[0027]
If they match, the roaming master key Km generated in the roaming destination foreign server FS and the roaming master key Km registered in the roaming home server HS are proved to be equal, so that the mobile user sets the foreign server FS as the roaming master key Km. Can be authenticated as a legitimate roaming destination.
[0028]
The mobile user further generates a fourth roaming key K24 by applying a hash function to the combination of the third roaming key K23 and the notified random number R 'in step S31. Further, the fourth roaming key K24 is used to calculate a keyed hash value of the random number R 'notified from the foreign server FS to generate a message authentication code MAC (K24 @ R'). Notify the foreign server FS.
[0029]
In step S33, the foreign server FS generates a fifth roaming key K25 by applying a hash function to the combination of the second roaming key K22 and the random number R '. Further, a keyed hash value of the random number R 'is calculated with the fifth roaming key K25 to obtain a message authentication code MAC (K25 @ R'). In step S34, the message authentication code MAC (K25 @ R ') generated by itself is compared with the message authentication code MAC (K24 @ R) notified from the mobile user, and if they match, the foreign server FS Authenticates mobile users as legitimate users.
[0030]
In each of the above-described embodiments, after the mobile user authenticates a roaming destination (steps S8 and S30), a fourth roaming key Kx4 is newly generated based on the third roaming key Kx3 (steps S9 and S31). Although the mobile terminal transmits the third roaming key Kx3 to the roaming destination, the mobile user transmits the third roaming key Kx3 to the roaming destination. The mobile user may be authenticated based on the comparison result with the roaming key Kx2.
[0031]
Furthermore, in the above-described second embodiment, it has been described that the foreign server FS of the roaming destination identifies each mobile user. However, in the third embodiment illustrated in FIG. 6, authentication is performed by omitting identification of the mobile user. The procedure has been simplified.
[0032]
In step S41 of FIG. 6, the foreign server FS of the roaming destination generates a roaming master key Km. The roaming master key Km is generated as a function of the home server HS of the roaming source, and is notified in advance to each home server HS in step S42. In step S43, the home server HS of the roaming source distributes the roaming master key Km in advance to mobile users who want to roam.
[0033]
Thereafter, the mobile user who has visited the roaming destination wireless LAN environment generates a random number R in step S44. In step S45, the roaming destination foreign server FS is notified of the random number R and the identification information ID (HS) of the home server HS, and requests authentication.
[0034]
In step S46, the foreign server FS generates a first roaming key K31 by applying a hash function to the combination of the received random number R and the roaming master key Km corresponding to the identification information ID (FS). Further, the keyed hash value of the random number R is calculated using the roaming key K31, a message authentication code MAC (K31ＫR) is generated, and a random number R ′ is further generated. In step S47, the MAC (K31 @ R) and the random number R 'are notified to the mobile user.
[0035]
In step S48, the mobile user independently generates a second roaming key K32 by applying a hash function to a combination of the roaming master key Km and the random number R. Further, the keyed hash value of the random number R is calculated using the roaming key K32 to generate the message authentication code MAC (K32‖R). In step S49, the message authentication code MAC (K32 @ R) obtained by itself is compared with the message authentication code MAC (K31 @ R) notified from the foreign server FS.
[0036]
If they match, the roaming master key Km generated in the roaming destination foreign server FS and the roaming master key Km registered in the roaming home server HS are proved to be equal, so that the mobile user sets the foreign server FS as the roaming master key Km. Can be authenticated as a legitimate roaming destination.
[0037]
The mobile user further generates a third roaming key K33 by applying a hash function to the combination of the second roaming key K32 and the notified random number R 'in step S50. Further, the third roaming key K33 is used to calculate a keyed hash value of the random number R 'notified from the foreign server FS to generate a message authentication code MAC (K33 @ R'). Notify the foreign server FS.
[0038]
In step S52, the foreign server FS generates a fourth roaming key K34 by applying a hash function to the combination of the first roaming key K31 and the random number R '. Further, a keyed hash value of the random number R 'is calculated with the fourth roaming key K34 to obtain a message authentication code MAC (K34 @ R'). In step S53, the message authentication code MAC (K34 @ R ') generated by the mobile user is compared with the message authentication code MAC (K33 @ R) notified from the mobile user, and if they match, the foreign server FS Authenticates mobile users as legitimate users.
[0039]
【The invention's effect】
According to the present invention, at the roaming destination, a roaming key unique to each mobile user is generated each time based on the identification information provided by the mobile user and the registered identification information. There is no need to register a roaming key in advance. In addition, since the mobile user and the roaming destination can perform authentication by the key sharing scheme, impersonation to the user and the server and leakage of information can be effectively prevented.
[Brief description of the drawings]
FIG. 1 is a block diagram showing a basic concept of an authentication method to which the present invention is applied.
FIG. 2 is a block diagram of the first embodiment.
FIG. 3 is a sequence diagram showing an authentication procedure according to the first embodiment.
FIG. 4 is a block diagram of a second embodiment.
FIG. 5 is a sequence diagram showing an authentication procedure according to the second embodiment.
FIG. 6 is a sequence diagram illustrating an authentication procedure according to a third embodiment.
[Description of Signs] HS: home server, FS: foreign server, K1 to K5: roaming key, Km: roaming master key

Claims (7)

In a roaming in which a mobile user authenticates with a roaming destination within a service area of another telecommunications carrier (roaming destination) other than the owning telecommunications carrier (roaming source) to enjoy a communication service. In the authentication method,
The roaming source generates a first roaming key (K1) for each mobile user based on the identification information ID (U) unique to the mobile user and the identification information ID (FS) known to the roaming destination; A procedure for notifying each mobile user in advance of this,
A procedure in which the mobile user who has moved into the roaming destination service area notifies the roaming destination of the identification information ID (U) unique to the mobile user;
A procedure in which the roaming destination generates a second roaming key (K2) based on the known identification information ID (FS) and the identification information ID (U) notified from the mobile user;
The mobile user and the roaming destination comparing the first roaming key (K1) and the second roaming key (K2) and mutually authenticating each other. The method further includes a procedure in which the roaming source and the roaming destination share a predetermined secret function F in advance,
The roaming authentication method according to claim 1, wherein the roaming source and the roaming destination generate each roaming key by applying the identification information to the secret function. The roaming destination further includes a step of generating a secret roaming master key (Km) and registering the secret roaming master key in advance with the roaming source;
The roaming source generates a first roaming key using the roaming master key as a parameter known to the roaming destination,
The roaming authentication method according to claim 1, wherein the roaming destination generates a second roaming key based on the roaming master key and identification information ID (U) notified from the mobile user. The mutual authentication procedure comprises:
The roaming destination performs a predetermined encryption process on a combination of the first random number (R) known to the mobile user and the second roaming key (K2) to generate a first encryption, Steps to notify mobile users,
A mobile user performing the encryption process on a combination of the first random number (R) and the first roaming key (K1) to generate a second encryption;
A mobile user authenticating a roaming destination by comparing the first and second ciphers;
A mobile user performs a predetermined encryption process on a combination of a second random number (R ′) known to the roaming destination and the first roaming key (K1) to generate a third encryption, Notification to the roaming destination,
A procedure in which a roaming destination performs the encryption process on a combination of the second random number (R ′) and the second roaming key (K2) to generate a fourth cipher;
The authentication method according to any one of claims 1 to 3, wherein the roaming destination includes a step of comparing the third and fourth ciphers to authenticate the mobile user. In a roaming in which a mobile user authenticates with a roaming destination within a service area of another telecommunications carrier (roaming destination) other than the owning telecommunications carrier (roaming source) to enjoy a communication service. In the authentication method,
A procedure in which the roaming source and the roaming destination share a predetermined secret function in advance,
The roaming source applies a roaming source ID unique to itself, a roaming destination ID unique to the roaming destination, and a user ID unique to each mobile user to the secret function, and a first roaming key (K11) unique to each mobile user. ) And notify each mobile user of this,
A procedure in which a mobile user who has moved into a roaming destination service area notifies a roaming destination of a first random number (R), a user ID unique to the mobile user, and the roaming source ID;
The roaming destination applies its own roaming destination ID, the notified roaming source ID, and the user ID to the secret function, and calculates a result of the function operation and the notified first random number (R). A one-way function is applied to the combination to generate a second roaming key (K12), and a predetermined encryption process is performed on the combination of the second roaming key and the first random number (R). Generating a first cipher (K12 @ R) and informing the mobile user of this together with a second random number (R ');
A mobile user generates a third roaming key (K13) by applying a one-way function to a combination of the first roaming key (K11) and the first random number (R); Performing the encryption process on a combination of the roaming key and the first random number to generate a second encryption (K13 @ R);
A step in which the mobile user authenticates a roaming destination by comparing the first and second ciphers;
The mobile user generates a fourth roaming key (K14) by applying a one-way function to a combination of the third roaming key and the second random number. Performing a predetermined encryption process on the combination with the second random number to generate a third encryption (K14‖R ′), and notifying the roaming destination of the third encryption;
The roaming destination generates a fifth roaming key (K15) by applying a one-way function to a combination of the second roaming key and the second random number, and further generates a fifth roaming key and a fifth roaming key. Performing a predetermined encryption process on the combination with the second random number to generate a fourth encryption (K15‖R ′);
Authenticating the mobile user by comparing the third and fourth ciphers with the roaming destination. In a roaming in which a mobile user authenticates with a roaming destination within a service area of another telecommunications carrier (roaming destination) other than the owning telecommunications carrier (roaming source) to enjoy a communication service. In the authentication method,
A procedure for notifying a roaming master key (Km) from a roaming destination to a roaming source;
A roaming source applies a one-way function to a combination of the notified roaming master key and a user ID unique to each mobile user for each mobile user, and a first roaming key (K21) unique to each mobile user. To generate and notify each mobile user of this,
A procedure in which the mobile user notifies the roaming destination of the first random number (R) and a user ID unique to the mobile user;
The roaming destination generates a second roaming key (K22) by applying a one-way function to a combination of the notified first random number (R), user ID, and roaming master key (Km); A predetermined encryption process is performed on the combination of the second roaming key (K22) and the first random number (R) to generate a first encryption (K22‖R), which is then converted to a second random number (R). ') And instructions to notify mobile users,
A mobile user applying a one-way function to a combination of the first roaming key (K21) and the first random number (R) to generate a third roaming key (K23); Performing the encryption process on the combination of the roaming key and the first random number to generate a second encryption (K23 @ R);
A step in which the mobile user authenticates a roaming destination by comparing the first and second ciphers;
The mobile user generates a fourth roaming key (K24) by applying a one-way function to a combination of the third roaming key (K23) and the second random number (R '); Performing a predetermined encryption process on the combination of the fourth roaming key and the second random number to generate a third encryption (K24 @ R '), and notifying the third encryption to a roaming destination;
The roaming destination generates a fifth roaming key (K25) by applying a one-way function to a combination of the second roaming key and the second random number. Performing a predetermined encryption process on the combination with the second random number to generate a fourth encryption (K25‖R ′);
Authenticating the mobile user by comparing the third and fourth ciphers with the roaming destination. In a roaming in which a mobile user authenticates with a roaming destination within a service area of another telecommunications carrier (roaming destination) other than the owning telecommunications carrier (roaming source) to enjoy a communication service. In the authentication method,
A procedure for notifying a roaming master key (Km) from a roaming destination to a roaming source;
A procedure in which a roaming source notifies each mobile user of the roaming master key,
A procedure in which a mobile user notifies a first random number (R) to a roaming destination;
The roaming destination generates a first roaming key (K31) by applying a one-way function to a combination of the first random number (R) and the roaming master key (Km). Procedure for performing a predetermined encryption process on the combination with the first random number (R) to generate a first encryption (K31‖R) and notifying the mobile user of this together with the second random number (R ′) When,
A mobile user generates a second roaming key (K32) by applying a one-way function to a combination of the roaming master key (Km) and the first random number (R); Performing the encryption process on the combination with the first random number to generate a second encryption (K32‖R);
A step in which the mobile user authenticates a roaming destination by comparing the first and second ciphers;
The mobile user generates a third roaming key (K33) by applying a one-way function to a combination of the second roaming key and the second random number (R ′); Performing a predetermined encryption process on a combination of the roaming key and the second random number to generate a third encryption code (K33 @ R ') and notifying the roaming destination of the third encryption code;
The roaming destination generates a fourth roaming key (K34) by applying a one-way function to a combination of the first roaming key (K31) and the second random number (R '); Performing a predetermined encryption process on a combination of the fourth roaming key and the second random number (R ′) to generate a fourth encryption (K34‖R ′);
Authenticating the mobile user by comparing the third and fourth ciphers with the roaming destination.

Images