JP2005080242A - Method of providing ip interface information, providing apparatus thereof, providing program thereof and access authenticating apparatus - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enable a terminal to confirm the validity of a message transmitted from a router or a DHCP server, even if the router or the DHCP used by the terminal dynamically change. <P>SOLUTION: An encryption key to be used for authentication which an authentication server uses to authenticate a terminal when the terminal requests communication is delivered to the router and the DHCP server as well as delivers to the terminal, thereby sharing the encryption key between the terminal and the router and between the terminal and the DHCP server, even if the router or the DHCP used by the terminal dynamically change. Also, in transmitting IP interface information from the router or the DHCP server to the terminal, the shared encryption key is used to generate message digest of the IP interface information or to perform challenge and response, thereby confirming the validity of the IP interface information or its transmission source. <P>COPYRIGHT: (C)2005,JPO&NCIPI

Description

  The present invention relates to a device in a communication network, a method for confirming the validity of communication data, a device and a program for the confirmation.

  In an IP network, when a terminal requests to start communication, IP interface information including at least one of an IP address, a network prefix, a DNS (Domain Name System) address, a SIP (Session Initiation Protocol) server address, and a host name is included. , May be dynamically assigned to the terminal. Typical protocols used at that time include Neighbor Discovery and DHCPv6 (Dynamic Host Configuration Protocol for IPv6).

  In Neighbor Discovery, a network prefix, which is a part of an IP address in IPv6, is assigned from a router to a terminal belonging to the router by using a Router Advertisement message. Usually, the Router Advertisement message is regularly notified from the router to each terminal using the multicast function, but the terminal sends a Router Solicitation message to the router to request a Router Advertisement message. It is also possible to do. In this case, since the terminal does not know the IP address of the router to be requested, it transmits a Router Solicitation message using the multicast function. At that time, an interface ID for specifying the terminal is generated from the MAC (Media Access Control) address of the terminal (see Non-Patent Documents 1 and 2).

In DHCPv6, IP interface information is assigned to a terminal using the following server-client type procedure. The terminal searches for a DHCP server that can be used in the IP network by using a DHCPSOLICIT message using the multicast function. When the DHCP server receives a DHCPSOLICIT message from the terminal, the DHCP server transmits a DHCPOFFER message to notify the terminal of the existence of the DHCP server. Next, a terminal requests | requires transmission of IP interface information using a DHCPREQUEST message, and a DHCP server provides IP interface information with respect to a terminal using a DHCPACK message (refer nonpatent literature 3).
T.A. Narten et al., “RFC 2461: Neighbor Discovery for IP Version 6 (IPv6)”, [online], December 1998, IETF, [searched on August 25, 2003], Internet <ftp: //ftp.rfc -ed itor.org/in-notes/rfc2461.txt> S. Thomson and others, "RFC 2462: IPv6 Stateless Address Autoconfiguration", [online], February 1998, IETF, [August 25, 2003 search], Internet <ftp://ftp.rfc-editor.org /in-notes/rfc2462.txt> R. 5 people from "Eroms", "RFC3315: Dynamic Host Configuration Protocol for IPv6 (DHCPv6)", [online], June 2003, IETF, [Search August 25, 2003], Internet <ftp: // ftp.rfc-editor.org/in-notes/rfc3315.txt>

  Although Neighbor Discovery and DHCPv6 have different procedures and message formats, it is common that a terminal uses a multicast function when searching for a router or DHCP server to which IP interface information is added.

  However, when the multicast function is used, in principle, it is possible for another terminal in the same network to receive a message requesting IP interface information transmitted from a certain terminal. In this case, there is a possibility that a malicious terminal existing in the same network or a terminal erroneously set as a router or a DHCP server may send illegal IP interface information to a terminal that has requested IP interface information. There is.

  On the other hand, by sharing the encryption key in advance between the terminal and a legitimate router or DHCP server, the terminal performs authentication, and the legitimacy of the router or DHCP server and the transmitted from them. It is possible to confirm the validity of the message.

  However, if the router or DHCP server used by the terminal changes dynamically, the method in which the encryption key is shared between the terminal and the router or DHCP server in advance will change every time the router or DHCP server changes. There was a problem that the encryption key had to be shared again, making it difficult to operate.

  Therefore, an object of the present invention is to facilitate sharing of an encryption key so that a terminal can confirm the validity of a router or a DHCP server and the validity of those transmitted messages.

  In order to solve the above-described problem, in the present invention, the encryption key of the terminal distributed by the authentication server when the terminal requests communication is also distributed to the router and the DHCP server at the same time. Even when the server dynamically changes, the encryption key can be shared between the terminal and the router or the DHCP server.

  In addition, when sending IP interface information from a router or DHCP server to a terminal, by using a shared encryption key to generate a message digest or challenge and response, discover the alteration of the IP interface information or impersonate the sender The validity of the router, the DHCP server, and the IP interface information can be confirmed.

  As described above, according to the first aspect of the present invention, the encryption key is distributed to the terminal, the router, and the DHCP server to realize sharing of the encryption key between the terminal, the router, and the DHCP server. .

  According to the second and third aspects of the invention, the validity of the router, the DHCP server, and the IP interface information can be confirmed by the message digest using the encryption key shared in the first aspect.

  According to the fourth and fifth aspects of the present invention, the validity of the router, the DHCP server, and the IP interface information can be confirmed by a challenge and response using the encryption key shared in the first aspect.

  According to the invention of claim 6, the access authentication device used in the invention of claim 1 can be realized.

  According to the seventh aspect of the present invention, the IP interface information providing apparatus used in the second and fourth aspects of the present invention can be realized.

  According to the invention of claim 8, the terminal program used in the inventions of claims 3 and 5 can be realized.

  Next, embodiments of the present invention will be described in detail with reference to the drawings as appropriate. FIG. 1 is a network configuration diagram showing an embodiment of the present invention. The network showing the embodiment includes a terminal 11, a network connection device 12, a packet transfer device 13, a communication network 14, an authentication client 15, an access authentication device 16, an IP interface information adding device 17, an encryption key management database 18, and a subnet 19 And is configured.

  In FIG. 1, a terminal 11 makes a request for communication start and a request for IP interface information. The network connection device 12 has a function of accepting a communication request from the terminal 11 and relaying communication between the terminal 11 and another device. The packet transfer device 13 has a function of transferring an IP packet transmitted from the terminal 11 to a terminal or device desired by the terminal 11, or vice versa. The communication network 14 includes a packet transfer device 13, an access authentication device 16, an IP interface information adding device 17, and an encryption key management database 18. The authentication client 15 is incorporated in the network connection device 12. The access authentication device 16 receives the authentication information including the user ID, password, and electronic certificate notified from the terminal 11 at the start of communication, and the terminal identifier including the MAC address. It has a function to notify. Whether the terminal 11 can use the network connection device 12 by comparing the authentication information of the terminal 11 notified from the authentication client 15 with the authentication information of the terminal 11 held in advance. It has the function to judge whether. Further, the access authentication device 16 distributes the encryption key to the terminal 11 when the access authentication device 16 determines that the access authentication device 16 can be used, and shares the encryption key between itself and the terminal 11, and the IP interface information providing device 17 On the other hand, it has a function of distributing the same encryption key together with the terminal identifier of the terminal 11 and sharing the encryption key between the terminal 11 and the IP interface information adding device 17. The IP interface information adding device 17 has a function of notifying the terminal 11 of IP interface information. The encryption key management database 18 stores encryption keys managed by the access authentication device 16. The subnet 19 includes a terminal 11, a network connection device 12, and an authentication client 15.

  FIG. 16 shows the configuration of the access authentication device 16. In FIG. 16, the reception unit 161 receives the authentication information of the terminal 11 from the authentication client 15 and confirms the validity of the terminal 11 based on the authentication information received by the processing unit 163, and then the transmission unit 162 performs encryption. The key is transmitted to the terminal 11. Further, the transmission unit also transmits the encryption key to the IP interface information adding device 17.

  FIG. 17 shows the configuration of the IP interface information adding device 17. In FIG. 17, the receiving unit 171 receives the encryption key of the terminal 11 from the access authentication device 16. In addition, the receiving unit 171 receives a signal for requesting addition of IP interface information from the terminal 11 and, if necessary, a random number. The processing unit 173 encrypts the IP interface information or the received random number using the received encryption key. The transmission unit 172 transmits the encrypted IP interface information or the encrypted random number together with the IP interface information.

  FIG. 18 shows the configuration of the terminal 11. In FIG. 18, the receiving unit 181 receives an encryption key from the access authentication device 16. The receiving unit 181 receives the IP interface information and the encrypted IP interface information or the encrypted random number from the IP interface information adding device. The processing unit 183 generates a random number as necessary. The processing unit 183 also encrypts the received IP interface information using the received encryption key, compares the encrypted IP interface information with the received encrypted IP interface information, and receives the received IP interface information and IP interface. The validity of the information adding device is confirmed. The processing unit 183 also encrypts the generated random number using the received encryption key, compares the encrypted random number with the received encrypted random number, and confirms the validity of the received IP interface information.

  FIG. 2 shows that when the terminal 11 is authenticated by the access authentication device 16 from the communication start request by the terminal 11 and the encryption key is distributed to the terminal 11, the encryption is also made to the IP interface information adding device 17. This shows the sequence until the key is distributed.

  The terminal 11 makes a communication request to the network connection device 12 (S201), and receives an authentication information request from the authentication client 15 in the network connection device 12 (S202). Thereafter, the terminal 11 transmits a terminal identifier to the access authentication device 16 via the authentication client 15 (S203), and receives an encryption key distribution when the access authentication device 16 determines that the terminal is a valid terminal (S204). ). As a result, the terminal 11 and the access authentication device 16 share the encryption key. Thereafter, the access authentication device 16 distributes the encryption key together with the terminal identifier of the terminal 11 to the IP interface information adding device 17 (S205). As a result, the terminal 11 and the IP interface information providing apparatus 17 share the encryption key. Thereafter, the access authentication device 16 notifies the terminal 11 that the authentication has succeeded via the authentication client 15 (S206). Here, the access authentication device 16 notifies the terminal 11 that the authentication has succeeded after distributing the encryption key of the terminal 11 to the IP interface information adding device 17. After notifying that the authentication is successful, the encryption key may be distributed to the IP interface information adding device 17. In the above description, the encryption key is distributed from the access authentication device 16 to the terminal 11. However, the encryption key is generated by generating the same encryption key based on the previously shared information. It is good also as a method of sharing. Hereinafter, in the description of each method, encryption key sharing can be realized by the same method.

  In FIG. 3, first, after a communication start request by the terminal 11, the terminal 11 is authenticated by the access authentication device 16 and an encryption key is distributed to the terminal 11. The sequence until the encryption key is distributed from the access authentication device 16 to the IP interface information adding device 17 is shown by the fact that it is performed.

  The terminal 11 makes a communication request to the network connection device 12 (S301), and receives an authentication information request from the authentication client 15 in the network connection device 12 (S302). Thereafter, the terminal 11 transmits a terminal identifier to the access authentication device 16 via the authentication client 15 (S303). When the access authentication device 16 determines that the terminal is a valid terminal, the terminal 11 receives distribution of the encryption key (S304). ). As a result, the terminal 11 and the access authentication device 16 share the encryption key. Thereafter, the access authentication device 16 notifies the terminal 11 that the authentication has succeeded via the authentication client 15 (S305). In response to the search for the IP interface information providing device 17 from the terminal 11 (S306), the IP interface information providing device 17 requests the access authentication device 16 for an encryption key (S307), and the access authentication device. 16 distributes the encryption key together with the terminal identifier of the terminal 11 to the IP interface information providing apparatus 17 (S308). As a result, the terminal 11 and the IP interface information providing apparatus 17 share the encryption key.

  FIG. 4 shows the state after the encryption key is distributed from the access authentication device 16 to the IP interface information adding device 17, and from the transmission of a message for requesting IP interface information addition by the terminal 11 to the IP interface information adding device 17. Shows a sequence in the case of using message digest authentication until IP interface information is transmitted.

  Using the multicast function in the IP network, the terminal 11 sends a message requesting the addition of IP interface information to the IP interface information adding device 17 with its own terminal identifier added (S401). Upon receiving this, the IP interface information adding device 17 selects the encryption key of the terminal 11 from the terminal identifier (S402), creates IP interface information to be assigned to the terminal 11 (S403), and uses the encryption key to create an IP interface information. A message digest (referred to as MD) of interface information is created (S404). Thereafter, the IP interface information and MD are transmitted to the terminal 11 as an IP interface information reply message using an IPsec authentication header (referred to as an AH header) that is an IPv6 security protocol (S405). The terminal 11 creates an MD from its encryption key and the sent IP interface information (S406), and compares whether or not the sent MD matches (S407). If they match, it can be confirmed that the IP interface information adding device 17 is correct and that the IP interface information has not been falsified. Thereafter, the terminal 11 uses the obtained IP interface information for future communication. Here, (S402) and (S403) may be reversed in order.

  When performing (S401) in the above, the IP interface information adding device 17 shares the IP interface information adding request message transmitted by the terminal 11 in order to prevent falsification or impersonation of other terminals. Using the encryption key, the terminal 11 can be authenticated in the same procedure as that performed from (S404) to (S407). At this time, arbitrary data is used as the data for creating the MD, and the arbitrary data and the created MD are sent to the IP interface information adding device 17.

  FIG. 5 shows the state after the encryption key is distributed from the access authentication device 16 to the IP interface information adding device 17, and from the transmission of a message for requesting IP interface information addition by the terminal 11 to the IP interface information adding device 17. Shows a sequence in the case of using challenge and response authentication until IP interface information is transmitted.

  The terminal 11 generates a random number as challenge data (S501), and then uses the multicast function in the IP network to send a message requesting the IP interface information adding device 17 to add IP interface information. A terminal identifier and challenge data are added and transmitted (S502). Upon receiving this, the IP interface information providing apparatus 17 selects the encryption key of the terminal 11 from the terminal identifier (S503), encrypts the challenge data with the selected encryption key, and generates response data (S504). Thereafter, the IP interface information adding device 17 creates IP interface information to be assigned to the terminal 11 (S505), and transmits it to the terminal 11 as an IP interface information reply message together with the response data (S506). The terminal 11 encrypts the challenge data with its own encryption key (S507), and compares the result with the response data sent from the IP interface information adding device 17 (S508). If they match, the terminal 11 confirms the validity of the IP interface information adding device 17. Thereafter, the terminal 11 uses the obtained IP interface information for future communication. Here, (S503), (S504), and (S505) may be reversed in order.

(Example 1)
Next, specific embodiments of the present invention will be described. (Embodiment 1) uses Neighbor Discovery as a protocol for acquiring IP interface information, and a wireless LAN access point that is a terminal and a network connection device is connected by a wireless LAN having an authentication function based on IEEE 802.1x. A case where the present invention is implemented in a network configuration in which a RADIUS server is used as the access authentication device and a router is used as the packet transfer device will be described with reference to FIGS.

  FIG. 6 is a network configuration diagram showing an embodiment of the present invention. The network according to this embodiment includes a terminal 61, a wireless LAN access point 62, a router 63, a RADIUS server 64, a communication network 65, and a subnetwork 66.

  In FIG. 6, the terminal 61 requests IP interface information when starting communication. The wireless LAN access point 62 corresponds to a network connection device. The wireless LAN access point 62 incorporates a RADIUS client 67 corresponding to an authentication client. The router 63 corresponds to a packet transfer device. The RADIUS server 64 corresponds to an access authentication device. A communication network 65, a RADIUS server 64, and a router 63 are included. The subnetwork 66 includes a terminal 61 and a wireless LAN access point 62.

  In FIG. 7, the terminal 61 is authenticated by the RADIUS server 64 from the communication start request by the terminal 61 and the encryption key is distributed to the terminal 61. At the same time, the encryption key is also distributed to the router 63. The sequence up to is shown. The authentication of the terminal 61 and the distribution of the encryption key by the RADIUS server 64 are performed using IEEE 802.1x which is a LAN authentication protocol.

  The terminal 61 makes a communication request to the wireless LAN access point 62 (S701), and receives an authentication information request from the RADIUS client 67 in the wireless LAN access point 62 (S702). Thereafter, the user ID, password, electronic certificate, and MAC address are notified from the terminal 61 to the RADIUS server 64 via the RADIUS client 67 (S703), and the validity of the terminal 61 is confirmed (S704). . When the RADIUS server 64 determines that the terminal 61 is valid, the RADIUS server 64 distributes the generated encryption key to the RADIUS client 67 and the terminal 61 (S705). As a result, the terminal 61 and the RADIUS server 64 share the encryption key. The RADIUS client 67 stores the encryption key in the wireless LAN access point 62 together with the MAC address of the terminal 61 (S706), and the encryption key is stored in the communication data of the wireless LAN section between the terminal 61 and the wireless LAN access point 62. Used for encryption. Thereafter, the RADIUS server 64 notifies the terminal 61 of successful authentication via the RADIUS client 67 (S707). Next, the RADIUS server 64 distributes the encryption key together with the MAC address of the terminal 61 to the router 63 (S708). As a result, the terminal 61 and the router 63 share the encryption key.

  In FIG. 8, when the terminal 61 is first authenticated by the RADIUS server 64 from the communication start request by the terminal 61, the encryption key is distributed to the terminal 61, and the IP interface information is requested from the terminal 61, the RADIUS is requested. The sequence in which the encryption key is distributed from the server 64 to the router 63 is shown.

  After the communication request from the terminal 61 to the authentication success is performed in the same manner as (S701) to (S707) shown in FIG. 7, the IP interface information is requested from the terminal 61 by the RouterSolution message (S801). The encryption key is requested from the router 63 to the RADIUS server 64 (S802), and then the encryption key is distributed from the RADIUS server 64 to the router 63 (S803). As a result, the terminal 61 and the router 63 share the encryption key.

  FIG. 9 shows the state after the encryption key is distributed from the RADIUS server 64 to the router 63, from the transmission of the IP interface information addition request message by the terminal 61 to the time when the terminal 61 verifies the validity of the IP interface information. The sequence in the case of using the authentication technology by IPsec is shown.

  The terminal 61 requests the router 63 to add IP interface information using the Router Advertisement message by transmitting the Router Solicitation message (S901). The router 63 that has received the RouterSolution message selects the encryption key of the terminal 61 based on the MAC address of the terminal 61 (S902). After creating the IP interface information (S903), the router 63 creates MD of the IP interface information using MD5 which is one method of message digest generation using the selected encryption key (S904). Is transmitted to the terminal 61 together with the IP interface information as a Router Advertisement message (S905). The terminal 61 extracts IP interface information from the received RouterAdvertisement message, and creates an MD using MD5 (Message Digest 5) using its own encryption key (S906). The terminal 61 compares whether the created MD matches the MD sent from the router 63 (S907). If they match, it is determined that the router 63 is a valid router and the IP interface information has not been tampered with. To do. Thereafter, the terminal 61 performs communication using the assigned IP interface information.

  FIG. 10 shows the state after the encryption key is distributed from the RADIUS server 64 to the router 63, from when the terminal 61 sends the IP interface information addition request message to when the terminal 61 verifies the validity of the IP interface information. The sequence in the case of using authentication technology by challenge and response is shown.

  The terminal 61 generates a random number as challenge data (S1001), and then uses a multicast function in the IP network to send a RouterSolution message for requesting the router 63 to add IP interface information to its own MAC address. Challenge data is added and transmitted (S1002). At that time, the challenge data is stored in the Option field of the RouterSolution message. Receiving this, the router 63 selects the encryption key of the terminal 61 from the MAC address (S1003), and encrypts the challenge data with the encryption key to generate response data (S1004). Thereafter, the router 63 creates IP interface information to be assigned to the terminal 61 (S1005), and transmits it to the terminal 61 as a Router Advertisement message together with the response data (S1006). The terminal 61 encrypts the challenge data using its own encryption key (S1007), and compares the result with the response data sent from the router 63 (S1008). If they match, the router 63 determines that it is valid. Thereafter, the terminal 61 uses the obtained IP interface information for future communication.

Embodiment 2
(Embodiment 2) uses DHCPv6 as a protocol for acquiring IP interface information, and shows the case where the present invention is implemented in the same network configuration as that of Embodiment 1 (however, the router becomes a DHCP server). 15 is used for explanation.

  FIG. 11 is a network configuration diagram showing an embodiment of the present invention. The network showing the embodiment includes a terminal 111, a wireless LAN access point 112, a router 113, a RADIUS server 114, a communication network 115, and a subnetwork 116.

  The terminal 111 requests IP interface information at the start of communication. The wireless LAN access point 112 corresponds to a network connection device. The wireless LAN access point 112 incorporates a RADIUS client 117 corresponding to an authentication client. The router 113 corresponds to a packet transfer device, and a DHCP server is incorporated. The RADIUS server 114 corresponds to an access authentication device. A communication network 115, a RADIUS server 114, and a router 113 are included. The subnetwork 116 includes a terminal 111 and a wireless LAN access point 112.

  FIGS. 12 and 13 are the same sequence as FIGS. 7 and 8 except that the router 113 has a DHCP server function.

  FIG. 14 shows the state after the encryption key is distributed from the RADIUS server 114 to the router 113, from the transmission of the IP interface information addition request message by the terminal 111 to the verification of the validity of the IP interface information by the terminal 111. The sequence in the case of using the authentication technology by IPsec is shown.

  The terminal 111 requests the router 113 to add IP interface information by transmitting a DHCPSOLICIT message (S1401). The router 113 that has received the DHCPSOLICIT message selects the encryption key of the terminal 111 based on the MAC address of the terminal 111 (S1402). After creating the IP interface information (S1403), the router 113 creates an MD of the IP interface information by MD5 using the selected encryption key (S1404), and adds it to the IPsec AH header to obtain the IP interface information. At the same time, a DHCPOFFER message is transmitted to the terminal 111 (S1405). The terminal 111 extracts IP interface information from the received DHCPOFFER message, and creates an MD using MD5 using its own encryption key (S1406). The terminal 111 compares whether or not the created MD matches the MD sent from the router 113 (S1407). If they match, it is determined that the router 113 is a valid router and the IP interface information has not been falsified. To do. Thereafter, the terminal 111 performs communication using the assigned IP interface information.

  FIG. 15 is after the encryption key is distributed from the RADIUS server 114 to the router 113, from the transmission of the IP interface information addition request message by the terminal 111 to the time when the terminal 111 verifies the validity of the IP interface information. The sequence in the case of using authentication technology by challenge and response is shown.

  The terminal 111 generates a random number serving as challenge data (S1501), and uses a multicast function in the IP network to send a DHCPSOLICIT message requesting the router 113 to add IP interface information to its own MAC address. The challenge data is added and transmitted (S1502). At that time, the challenge data is stored in the Option field of the DHCPSOLICIT message. Receiving this, the router 113 selects the encryption key of the terminal 111 from the MAC address (S1503), and encrypts the challenge data with the encryption key to generate response data (S1504). Thereafter, the router 113 creates IP interface information to be given to the terminal 111 (S1505), and transmits it to the terminal 111 as a DHCPOFFER message together with the response data (S1506). The terminal 111 encrypts the challenge data using its own encryption key (S1507), and compares the result with the response data sent from the router 113 (S1508). If they match, the router 113 determines that it is valid. Thereafter, the terminal 111 uses the obtained IP interface information for future communication.

The network configuration is shown. The sequence in the case of distributing the encryption key to the IP interface information adding apparatus at the same time as distributing the encryption key to the terminal is shown. A sequence in the case where an encryption key is distributed to an IP interface information providing apparatus after an IP interface information addition request is made from a terminal is shown. The sequence in the case where the terminal authenticates the IP interface information adding apparatus using authentication by the IPsec authentication header is shown. The sequence in the case where the terminal authenticates the IP interface information providing apparatus using authentication by challenge and response is shown. The network structure at the time of using NeighborDiscovery protocol is shown. In the network using the NeighborDiscovery protocol, a sequence when distributing the encryption key to the router at the same time as distributing the encryption key to the terminal is shown. A sequence in a case where an encryption key is distributed to a router after an IP interface information addition request is made from a terminal in a network using the Neighbor Discovery protocol is shown. A sequence when a terminal authenticates a router using authentication by an IPsec authentication header in a network using the NeighborDiscovery protocol is shown. A sequence in a case where a terminal authenticates a router using authentication by challenge and response in a network using the NeighborDiscovery protocol is shown. The network structure at the time of using DHCPv6 protocol is shown. In the network using the DHCPv6 protocol, the sequence in the case of distributing the encryption key to the router (DHCP server) simultaneously with the distribution of the encryption key to the terminal is shown. A sequence in a case where an encryption key is distributed to a router (DHCP server) after an IP interface information addition request is made from a terminal in a network using the DHCPv6 protocol. A sequence in a case where a terminal performs authentication of a router (DHCP server) using authentication by an IPsec authentication header in a network using the DHCPv6 protocol is shown. A sequence when a terminal authenticates a router (DHCP server) using challenge and response authentication in a network using the DHCPv6 protocol is shown. The structure of an access authentication apparatus is shown. The structure of an IP interface information provision apparatus is shown. The structure of a terminal is shown.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Terminal 12 Network connection apparatus 13 Packet transfer apparatus 14 Communication network 15 Authentication client 16 Access authentication apparatus 17 IP interface information provision apparatus 18 Encryption key management database 19 Subnet 61 Terminal 62 Wireless LAN access point 63 Router 64 RADIUS server 65 Communication network 66 Subnet 67 RADIUS client 111 Terminal 112 Wireless LAN access point 113 Router (DHCP server)
114 RADIUS Server 115 Communication Network 116 Subnet 117 RADIUS Client 161 Authentication Device Receiving Unit 162 Authentication Device Transmitting Unit 163 Authentication Device Processing Unit 164 Authentication Device Storage Unit 171 Giving Device Receiving Unit 172 Giving Device Transmitting Unit 173 Giving Device Processing Unit 174 Giving Device Storage Unit 181 terminal receiving unit 182 terminal transmitting unit 183 terminal processing unit 184 terminal storage unit

Claims (8)

A terminal using a communication service;
An access authentication device for authenticating the terminal;
In a communication network composed of an IP interface information giving device for giving IP interface information to the terminal,
Even when the IP address of the IP interface information assigning device changes dynamically,
In order to guarantee the validity of the IP interface information and the IP interface information adding device,
The access authentication device includes an authentication device receiver, an authentication device transmitter, and an authentication device processor.
This access authentication device
The authentication device receiving unit receiving a communication request signal from the terminal;
The authentication device processing unit generating or acquiring an encryption key;
And a step of transmitting the encryption key to the terminal and the IP interface information adding device. The IP interface information giving device includes a granting device receiving unit, a granting device transmitting unit, a granting device processing unit, and a granting device storage unit,
This IP interface information adding device
The granting device receiving unit receiving the encryption key from the access authentication device;
Storing the encryption key received by the assigning device storage unit;
The granting device receiving unit receiving a signal requesting the granting of the IP interface information from the terminal;
The granting device processing unit generating a message digest of the IP interface information using the encryption key;
The granting device sending unit sending the IP interface information and the message digest to the terminal;
The method for assigning IP interface information according to claim 1. The terminal includes a terminal receiving unit, a terminal storage unit, and a terminal processing unit,
This device
The terminal receiving unit receiving the encryption key from the access authentication device;
Storing the encryption key received by the terminal storage unit;
The terminal receiving unit receiving the IP interface information and the message digest from the IP interface information adding device;
The terminal processing unit generating a message digest of the IP interface information using the encryption key;
The terminal processing unit compares the generated message digest and the received message digest to determine the validity of the IP interface information and the IP interface information adding device;
The method for assigning IP interface information according to claim 2. The IP interface information giving device includes a granting device receiving unit, a granting device transmitting unit, a granting device processing unit, and a granting device storage unit,
This IP interface information adding device
The granting device receiving unit receiving the encryption key from the access authentication device;
Storing the encryption key received by the assigning device storage unit;
The granting device receiving unit receiving a signal requesting granting of IP interface information from the terminal together with challenge data;
The granting device processing unit generating response data of challenge data using the encryption key;
The granting device sending unit sending the IP interface information and the response data to the terminal;
The method for assigning IP interface information according to claim 1. The terminal includes a terminal receiving unit, a terminal storage unit, and a terminal processing unit,
This device
The terminal receiving unit receiving the encryption key from the access authentication device;
Storing the encryption key received by the terminal storage unit;
The terminal receiving unit receiving the IP interface information and the response data from the IP interface information providing device;
Generating response data from the challenge data stored in the terminal storage unit by the terminal processing unit using the encryption key;
The terminal processing unit comparing the generated response data and the received response data to determine the validity of the IP interface information providing device;
5. The method of assigning IP interface information according to claim 4, A terminal using a communication service;
An access authentication device for authenticating the terminal;
In a communication network composed of an IP interface information giving device for giving IP interface information to the terminal,
Even when the IP address of the IP interface information assigning device changes dynamically,
An access authentication device used to guarantee the validity of the IP interface information and the IP interface information providing device,
This access authentication device
An authentication device receiver for receiving a communication request signal from the terminal;
An authentication device processing unit for generating or acquiring an encryption key;
An access authentication apparatus for assigning IP interface information, comprising: an authentication apparatus transmitting unit that transmits the encryption key to the terminal and the IP interface information providing apparatus. A terminal using a communication service;
An access authentication device for authenticating the terminal;
In a communication network composed of an IP interface information giving device for giving IP interface information to the terminal,
Even when the IP address of the IP interface information assigning device changes dynamically,
An IP interface information giving device used for guaranteeing the validity of the IP interface information and the IP interface information giving device,
This IP interface information adding device
A granting device receiving unit that receives a signal requesting the granting of the encryption key and the IP interface information from the terminal from the access authentication device;
A granting device storage unit for storing an encryption key received from the access authentication device;
A granting device processing unit that encrypts the IP interface information using the encryption key;
An IP interface information assigning device for assigning IP interface information, comprising: an assigning device transmitting unit that transmits the IP interface information and the encrypted IP interface information to the terminal. A terminal using a communication service;
An access authentication device for authenticating the terminal;
In a communication network composed of an IP interface information giving device for giving IP interface information to the terminal,
Even when the IP address of the IP interface information assigning device changes dynamically,
A program for a terminal used to guarantee the validity of the IP interface information and the IP interface information adding device,
In the terminal processing unit of the terminal comprising a terminal receiving unit, a terminal storage unit, and a terminal processing unit,
A function of storing the encryption key received from the access authentication device by the terminal reception unit in the terminal storage unit;
A function of encrypting the IP interface information received from the IP interface information adding device by the terminal reception unit using the encryption key;
A function of comparing the encrypted IP interface information with the encrypted IP interface information received from the IP interface information providing device and determining the validity of the IP interface information and the IP interface information providing device;
A terminal program characterized by causing

Images