JP2006054733A - Mobile object communication system and method for preventing home address from being pretended - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To prevent a user of a mobile node from generating a home address of a third person and pretending the other person to perform communication in an IPv6 mobile object communication system and a method for preventing the home address from being pretended. <P>SOLUTION: A mobile node 1-1 generates a home address setting user's inherent information (e.g. user account information) in a part of the home address and notifies a home agent of the home address in a key exchange protocol procedure (IKE Ph.1, XAUTH, IKE Ph.2) of IKE in order to establish security association of mobile IP controlling IPsec between the mobile node 1-1 and a home agent 1-2. The home agent 1-2 checks the notified home address, collates the user's inherent information set in the home address with the user account information, and upon recognizing illegality, interrupts the procedure. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to a mobile communication system and a home address spoofing prevention method, and in particular, a home agent server (hereinafter simply referred to as “home agent”) that provides a mobile communication service based on Mobile IPv6 (Mobile Internet Protocol version 6). In a mobile communication system including a user terminal as a mobile node, it is for enhancing the safety of user communication.

  FIG. 4 is a conceptual diagram showing the basic principle of the mobile IPv6 system. The mobile IPv6 system includes a mobile node 4-1 and a home agent 4-2. The mobile node 4-1 registers an IP (Internet Protocol) address issued from a network directly connected to the mobile node as a care-of address in the home agent 4-2. The home agent 4-2 manages the association between the care-of address and the home address of the mobile node 4-1.

  The home address is a semi-fixed IP address assigned to the mobile node 4-1, and even if the mobile node 4-1 moves across a plurality of networks and the care-of address is changed, the communication partner node 4-3 By continuing to present a fixed home address, the movement of the mobile node 4-1 is hidden from the communication partner.

  The packet 4-4 addressed to the home address of the mobile node 4-1 from the communication partner node 4-3 is routed to the home agent 4-2, and the home agent 4-2 manages the home address and care-of address managed by itself. Based on the correspondence table 4-21, the care-of address of the mobile node 4-1 is acquired, and the packet 4-5 encapsulated using the care-of address for the packet 4-4 addressed to the original home address is transferred to the care-of address. To do.

  The care-of address of the mobile node 4-1 is notified from the mobile node 4-1 to the home agent 4-2 by a procedure called “Binding Update”. At this time, the validity of the mobile node 4-1 is protected by an IPsec (IP Security Protocol) security association set between the home address of the mobile node 4-1 and the address of the home agent 4-2.

  In the mobile IPv6 system, the home address used by the mobile node (user terminal) 4-1 can be automatically generated by the mobile node (user terminal) 4-1, but according to the generated home address. In order to establish an IPsec security association, it is necessary to use a key exchange protocol such as IKE (Internet Key Exchange).

  FIG. 5 shows an example of a communication sequence for mobile IP control. In order to generate a home address in the mobile node (user terminal) and establish a security association of IPsec for mobile IP control between the home address and the home agent, the home agent is homed in the IKE key exchange protocol procedure. The address is notified (IKE Ph.1, XAUTH, IKE Ph.2).

  After this key exchange protocol procedure, a mobile IP registration process for registering the correspondence between the home address and the care-of address is performed between the mobile node (user terminal) and the home agent. After the completion of the mobile IP registration process, Mobile IP communication is performed.

As a prior art document related to mobile IP communication, a mobile IP address translation method in which a global address is dynamically assigned to a mobile terminal managed by a private address on a foreign network at a destination is described below. It is described in Document 1. In addition, when a home agent is composed of one or more servers, a mobile communication device and a mobile communication method that realize load distribution for location registration and packet transfer using an IPv6 anycast address are disclosed in Patent Document 2 below. It is described in.
JP 2002-94546 A JP 2004-120270 A

  In the mobile IPv6 system, since the generation of the home address used by the user terminal is entrusted to the user side, a user who has a legitimate account with respect to the home agent seizes communication using the home address used by another person. It becomes possible to end.

  In the IKE key exchange protocol procedure, the legitimacy of the user who is executing communication using the key exchange protocol can be authenticated, but the packet 4-5 encapsulated by using the care-of address described above is viewed by others. Even if the home address stored in the IKE key exchange protocol procedure is confirmed by the IKE key exchange protocol procedure, the user can use the home address stored in the home address. Because there is no way to confirm whether the designated home address has been specified, a user who is authenticated by the IKE key exchange protocol misrepresents the home address of another person by stealing the home address of the other person, I can't prevent being impersonated. An object of the present invention is to prevent a mobile node user from stealing another person's home address and impersonating another person to communicate.

  The mobile communication system of the present invention (1) generates a home address at a user terminal of a mobile node for a home agent that provides a mobile communication service based on Mobile IPv6, and between the home agent and the user terminal, In a mobile communication system that registers the home address with a home agent through the user terminal validity authentication procedure, the user terminal binds user-specific information to the home address when generating the home address. Home address generating means for generating a home address, wherein the home agent receives the home address generated by the user terminal and whether the home address is associated with information specific to the user. Home address check means to check In a case where the home address is determined not intended the user-specific, and further comprising a means for rejecting the execution of the steps of the protocol mobile communication service by a mobile IPv6 later.

  (2) The user-specific information generated based on the secret key information held in common between the user terminal and the home agent is used as the user-specific information linked to the home address. To do.

  (3) The user-specific information generated based on the user identification information exchanged in the IKE key exchange protocol procedure is used as the user-specific information tied to the home address.

  Further, (4) the user-specific information generated based on the user identification information used for XAUTH authentication in the IKE key exchange protocol procedure is used as the user-specific information tied to the home address.

  Further, (5) the home address spoofing prevention method of the present invention is (5) for a home agent that provides a mobile communication service based on Mobile IPv6, a home address is generated at a user terminal of a mobile node, and the home agent and user In a mobile communication system in which the home address is registered with a home agent through the authentication procedure for the validity of the user terminal with the terminal, when the user terminal generates the home address, the user terminal Generating a home address in which unique information is bundled, and the home agent receives the home address generated in the user terminal, and whether the home address is bundled with the user-specific information It is characterized by checking.

  According to the present invention, when generating a home address at a user terminal, a home address having a dependency relationship between the home address and user identification information is generated, and the home address generated at the user terminal in the home agent is generated. By checking the dependency relationship with the user's user identification information, it is possible to arbitrarily generate a home address on the user terminal so that communication is not possible, and the other person's home address is stolen and communication is intercepted. It is possible to prevent communication by impersonating the person and improve communication safety.

  FIG. 1 shows an example of a communication sequence for mobile IP control according to the present invention, and FIG. By generating a home address in the mobile node (user terminal) 1-1, and forcing the user-specific information to be set in a part of the home address generated in the mobile node (user terminal) 1-1, The home address is prohibited from being used by anyone other than you.

  The mobile node (user terminal) 1-1 generates a home address in which information specific to the user (eg, user account information) is set in a part of the home address, and mobile IP control with the home agent 1-2 In order to establish a security association for IPsec, the home address is notified to the home agent 1-2 in the IKE key exchange protocol procedure (IKE Ph.1, XAUTH, IKE Ph.2).

  The home agent 1-2 checks the home address generated by the mobile node (user terminal) 1-1 and checks the validity by comparing the user specific information set in the home address with the user account information. Judgment is made and the procedure is interrupted when it is recognized as illegal. This prohibits the use of home addresses other than the principal and prevents impersonation.

  2A shows a processing flow of mobile IP control on the mobile node side, and FIG. 2B shows a processing flow of mobile IP control on the home agent side. As shown in the figure, on the mobile node side, a home address in which user-specific information (eg, user account information) is set in a part of the home address is generated (step 2-1), and the mobile IP control IPsec is generated. A key exchange procedure is executed to notify the home agent of the home address (step 2-2).

  In the key exchange procedure with the home agent, the mobile node determines the normality of the result of the key exchange notified from the home agent (step 2-3). If it is not normal, the mobile node interrupts the procedure. The mobile IP control IPsec security association is established (step 2-4), and location registration is performed (step 2-5).

  On the other hand, on the home agent side, an IPsec key exchange procedure with the mobile node is started (step 2-6), and the home-specific user address information generated by the mobile node is compared with the user account information to determine the home agent side. The normality of the address is determined (step 2-7). If it is not normal, the procedure is interrupted. If it is normal, the IPsec key exchange procedure is continued (step 2-8). If it is not normal, the procedure is interrupted. If it is normal, an IPsec security association with the mobile node is established (step 2-10), and location registration is accepted. (Step 2-11).

(About home address generation)
FIG. 3 shows an example of home address generation. As shown in the figure, the home address generated by the mobile node is composed of three fields: “prefix”, “user-specific value”, and “arbitrary value”. Although the bit length of each field can be determined arbitrarily, the total bit length of the entire home address is 128 bits, which is the IPv6 address length.

  The “prefix” is a part indicating a network address, and is given by a designer at the time of network design. The “user unique value” is a part for setting information derived from unique information that can identify a user. For example, a hash (for user account information (user identification information (hereinafter referred to as “user ID”)) A value obtained by performing a calculation using a (Hash) function is stored. In the “arbitrary value” portion, for example, a random value, a sequence number, or the like can be given an appropriate value according to the operation mode.

(About home address check)
In the home agent, a user-specific value such as user account information is calculated using a hash function by a method similar to that of the mobile node, and a value corresponding to the user-specific value is obtained. Then, the “user unique value” field of the home address transmitted from the user terminal is compared with the value corresponding to the user unique value obtained by the home agent to confirm that the home address belongs to the user himself / herself. The home address check is performed in a key exchange protocol procedure such as IKE. If the result of the check indicates that it is illegal, the key exchange protocol procedure is interrupted.

(About user-specific values)
The method for generating the user-specific value is arbitrary, but it must be generated based on information on the home agent side that can confirm that the user is authentic. For example, when the IKE key exchange protocol procedure is executed, the user account information (user ID) notified from the mobile node to the home agent is authenticated by the IKE key exchange protocol procedure, and it is confirmed that it is the user's own. Is obtained.

  There is a dependency between the user account information (user ID) and the user specific value necessary for generating the home address, and the user who is authenticated in the key exchange protocol procedure is within the range permitted by the user. The home address is made available to the user himself / herself, but if a home address that is “out of range” is to be used, the home agent Deny use of home address.

  In addition to the user account information (user ID), the information that is the basis for generating the user unique value is the XAUTH authentication user ID executed during the IKE key exchange protocol procedure, and the secret authentication shared between the mobile node and the home agent Information (private key) can be used.

  Both the mobile node and the home agent are set to allow the home address to be dynamically generated. The mobile node generates a home address by binding user-specific information to the home address. As an example of this, it is possible to define a field having a prefix of 64 bits, followed by a 32-bit field in the IPv6 address 128 bits as a user-specific value setting field, and the remaining 32 bits as a random number setting field.

  Prior to executing the location registration procedure, the mobile node executes an IPsec key exchange protocol such as IKE and attempts to set up an IPsec security association using the generated home address. The home agent checks whether the home address obtained in the IPsec key exchange protocol procedure conforms to the rules agreed in advance between the mobile node and the home agent, and if not, interrupts the key exchange procedure and Reject the association setting.

  First, second, and third embodiments for generating user specific values are shown below. As a first embodiment, IPsec key exchange is performed between a mobile node and a home agent using an IKE key exchange protocol, and a shared secret key method is used as an authentication method of the IKE key exchange protocol procedure. . The mobile node and the home agent generate user-specific values by applying secret information (secret key) held in common between them to a hash function such as MD5.

  As a second embodiment, IPsec key exchange is performed between a mobile node and a home agent using an IKE key exchange protocol, and a shared secret key method is used as an authentication method of the IKE key exchange protocol procedure. . The mobile node and the home agent generate a user specific value by applying a user ID used in the IKE key exchange protocol procedure to a hash function such as MD5. When the authentication is completed in the procedure of phase 1 of the IKE key exchange protocol, the home agent determines that the user ID is valid, and thereafter checks the home address.

  As a third embodiment, an IPsec key exchange is performed between a mobile node and a home agent using an IKE key exchange protocol, and an XAUT based on a user ID and a password is used as an authentication method for the procedure of the IKE key exchange protocol. It is assumed that the authentication H method is used. Specifically, the mobile node and the home agent generate a user specific value by applying a user ID used for authentication in the XAUTH authentication method to a hash function such as MD5.

  When the validity is confirmed in combination with the password, the home agent determines that the user ID is valid, and thereafter checks the home address. According to the third embodiment, the home address can be checked in cooperation with the authentication server.

It is a figure which shows an example of the communication sequence for the mobile IP control by this invention. It is a figure which shows the processing flow of the mobile IP control by this invention. It is a figure which shows an example of the home address generation by this invention. It is a conceptual diagram which shows the basic principle of a mobile IPv6 system. It is a figure which shows an example of the communication sequence for mobile IP control.

Explanation of symbols

1-1 Mobile node (user terminal)
1-2 Home Agent

Claims (5)

For a home agent server that provides a mobile communication service based on Mobile IPv6 (Mobile Internet Protocol version 6), a home address is generated at the user terminal of the mobile node, and the user terminal is connected between the home agent server and the user terminal. In a mobile communication system in which the home address is registered in the home agent server through a validity authentication procedure,
The user terminal comprises a home address generating means for generating a home address in which user-specific information is bound to a home address when generating a home address,
The home agent server receives a home address generated by the user terminal, and checks whether the home address is a bundle of information unique to the user, and the home address A mobile communication system comprising: means for rejecting execution of a subsequent mobile communication service protocol procedure by Mobile IPv6 when it is determined that is not unique to the user.   The user-specific information generated based on secret key information held in common between the user terminal and the home agent server is used as the user-specific information to be bundled with the home address. The mobile communication system according to 1.   The user-specific information generated based on user identification information exchanged in an IKE (Internet Key Exchange) key exchange protocol procedure is used as the user-specific information linked to the home address. The mobile communication system described.   The user-specific information generated based on the user identification information used for XAUTH authentication in the IKE (Internet Key Exchange) key exchange protocol procedure is used as the user-specific information bundled with the home address. The mobile communication system according to 1. For a home agent server that provides a mobile communication service based on Mobile IPv6 (Mobile Internet Protocol version 6), a home address is generated at the user terminal of the mobile node, and the user terminal is connected between the home agent server and the user terminal. In a mobile communication system in which the home address is registered in the home agent server through a validity authentication procedure,
When generating the home address, the user terminal generates a home address in which user-specific information is bundled with the home address,
The home agent server receives a home address generated by the user terminal, and checks whether the home address is bound with information unique to the user, preventing home address impersonation Method.

Images