KR100423153B1 - Method for terminal authentication in network - Google Patents

Abstract

The present invention relates to a terminal authentication method in a communication network to prevent the AAA server from being hacked by encrypting the CHAP password included in the access request message transmitted from the FA to the AAA server according to the packet data service initiation request. will be.

Conventionally, only the wireless terminal and the AAA server are authenticated by encrypting a password and an arbitrary challenge value. The FA does not have a shared password shared between the wireless terminal and the AAA server. If the cracker hacks a message between the wireless terminal and the FA, the AAA server is hacked because the access request message sent from the FA to the AAA server can be normally created even if the cracker does not know the shared password.

The present invention provides a CHAP password included in an access request message transmitted from a FA to an AAA server according to a packet data service initiation request of a wireless terminal, with a NAS secret key shared between the FA and AAA and a request authentication value arbitrarily generated. By encrypting and transmitting, it is possible to prevent the AAA server from being hacked.

Description

Method for terminal authentication in network

The present invention relates to a terminal authentication method in a communication network, and more particularly, to a NAS secret key sharing a CHAP password included in an access request message transmitted from a FA to an AAA server according to a packet data service initiation request. By encrypting, it relates to a terminal authentication method in a communication network to prevent the AAA server from being hacked.

In general, AAA (Authentication, Authorization and Accounting) server uses the Remote Authentication Dial In User Service (RADIUS) protocol to authenticate a wireless terminal registered with a Foreign Agent (FA). When the service is requested to start, the FA sends an access request message to the AAA server as a procedure for checking whether the registered wireless terminal is normal, and the AAA server authenticates the wireless terminal using the received access request message. .

The packet data service is set to Simple IP or Mobile IP. If the packet data service is set to Simple IP, it is a Challenge Handshake Authentication Protocol (CHAP) authentication method. If set to, only the case where authentication is performed using the Foreign Agent Challenge (FAC) authentication method will be described.

1 and 2 are roads for explaining a conventional simple IP CHAP authentication method, when the user of the wireless terminal requests the start of the wireless packet data service using the wireless terminal 10 (S10), the FA 20 is an arbitrary A challenge value (Challenge) is generated (S12), and the generated challenge value (Challenge) is included in a CHAP challenge (CHAP_CHALLENGE) message and transmitted to the wireless terminal 10 (S14).

In step S14, the wireless terminal 10 that receives the CHAP challenge (CHAP_CHALLENGE) message from the FA 20 in step S14 uses the first byte of the challenge value (Challenge) included in the received CHAP challenge (CHAP_CHALLENGE) message. (ChapId), the shared secret key (MN-AAA SharedSecret) known only by the AAA server 30 and the wireless terminal 10, and the challenge value (Challenge) by encrypting the message Digest (MD) 5 algorithm to the CHAP response {ChapResponse = MD5 (ChapId + MN-AAA SharedSecret + Challenge)}, and send the CHAP response (ChapResponse) to the FA (20) by including it in a CHAP response (CHAP_RESPONSE) message, which is a response to the CHAP challenge (CHAP_CHALLENGE) message ( S16).

The FA 20 receiving the CHAP response (CHAP_RESPONSE) message from the wireless terminal 10 in step S16 uses the first byte of a challenge value randomly generated according to the wireless packet data service request of the wireless terminal in step S12. The CHAP identifier (ChapId) and the CHAP response (ChapResponse) received from the wireless terminal 10 are combined to create a CHAP password (ChapPassword), and the challenge value (Challenge) randomly generated in the process S12 described above is a CHAP challenge (ChapChallenge). ) Into (S18).

Subsequently, an access-request message including a CHAP password (ChapPassword) and a CHAP challenge (ChapChallenge), etc. created in step S18 is created and transmitted to the AAA server 30 (S20).

The AAA server 30 receiving the access request message from the FA 20 in step S20 extracts a CHAP identifier (ChapId) and a CHAP response (ChapResponse) from the CHAP password (ChapPassword) included in the access request message. (S22).

Thereafter, the CHAP identifier (ChapId) extracted in step S22, the shared secret key (MN-AAA SharedSecret) only known by the wireless terminal 10 and the AAA server 30, and the access request received in step S20. The CHAP challenge (ChapChallenge) included in the message is encrypted using the MD5 algorithm to generate a temporary value {Temp = MD5 (ChapId + MN-AAA SharedSecret + ChapChallenge)} (S24), and the temporary value (Temp) is the process S22 described above. It is determined whether or not the extracted CHAP response (ChapResponse) is the same (S26).

If the result of the determination in step S26 is the same as the temporary value (Temp) and the CHAP response (ChapResponse), it is determined that the authentication is successful, and transmits an access-accept message for the access request to the FA 20 (S28). If the temporary value (Temp) and the CHAP response (ChapResponse) are not the same, it is determined that the authentication has failed and transmits an access rejection message (Access-Reject) message to the access request to the FA 20 (S30).

Meanwhile, FIGS. 3 and 4 are roads for explaining a conventional method of FAC authentication of mobile IP. When a wireless terminal user requests to start a wireless packet data service using the wireless terminal 10 (S40), the FA 20 An arbitrary challenge value is generated (S42), and the generated challenge value (Challenge) is included in an agent advertisement message and transmitted to the wireless terminal 10 (S44).

The wireless terminal 10 receiving the agent advertisement message from the FA 20 in step S44 is received from the FA 20 in step S44 to register its location with the HA (Home Agent) 40. Generate a Mobile IP Registration Request (hereinafter referred to as MIP RRQ) packet including a challenge value (Challenge) and an authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30. (S46).

The authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 included in the MIP RRQ packet generated in step S46 is a challenge value received from the FA 20 in step S44. CHAP Identifier (ChapId) using the first byte of the CDMA, a shared secret key (MN-AAA SharedSecret) known only to the wireless terminal 10 and the AAA server 30, the challenge value, and the first encryption value. Is a value encrypted by the MD5 algorithm, and the first encryption value is a wireless terminal 10 and an AAA server (10) to be currently generated in a MIP RRQ packet currently generated to register the position of the wireless terminal 10 with the HA 40. 30) The MIP RRQ packet information located before the MN-AAA Authenticator is encrypted using the MD5 algorithm.

Thereafter, the MIP RRQ packet generated in step S46 is transmitted to the FA 20 (S48), and the FA 20 receiving the MIP RRQ packet from the wireless terminal 10 receives the challenge value generated in step S42. CHAP identifier (ChapId) using the first byte of the (Challenge) and CHAP password (ChapPassword) as an authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 received from the wireless terminal 10 ), The challenge value (Challenge) generated in the above-described process S42 and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 among the MIP RRQ packets received from the wireless terminal 10 The MIP RRQ packet information, which has been previously located, is combined with the MD5 algorithm, and the CHAP challenge (Shap) is added.

Subsequently, an access-request message including a CHAP password (ChapPassword) and a CHAP challenge (ChapChallenge), which are created in step S50, is created and transmitted to the AAA server 30 (S52).

The AAA server 30 receiving the access request message from the FA 20 in step S52 described above, the CHAP identifier (ChapId) and the wireless terminal 10 and the AAA server in the CHAP password (ChapPassword) included in the access request message. The authentication value (MN-AAA Authenticator) between the 30 is extracted (S54).

After that, the CHAP identifier (ChapId) extracted in step S54, the shared secret key (MN-AAA SharedSecret) known only to the wireless terminal 10 and the AAA server 30, and the access request message received in step S52. The temporary value {Temp = MD5 (ChapId + MN-AAA SharedSecret + ChapChallenge)} is generated by encrypting the CHAP challenge (ChapChallenge) included in the MD5 algorithm (S56), and the temporary value (Temp) is described in step S54. It is determined whether the authentication value (MN-AAA Authenticator) between the extracted wireless terminal 10 and the AAA server 30 is the same (S58).

If the temporary value (Temp) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 are the same as the determination result of step S58, it is determined that the authentication is successful and the access request is made to the FA 20. If the access-accept message is transmitted (S60), and the temporary value (Temp) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 are not the same, the authentication fails. In response to the determination, the FA 20 transmits an access rejection message (Access-Reject) message for the access request (S62).

The FA 20 receiving the access permission message from the AAA server 30 in step S60 transmits a MIP RRQ packet to the HA 40 (S64), and the HA 40 responds with a mobile IP registration response (Mobile). IP Registration Response (hereinafter referred to as MIP RRP) packet is transmitted to the FA 20 (S66).

The FA 20 receiving the MIP RRP from the HA 40 transmits the MIP RRP received from the HA 40 to the wireless terminal 10 (S68).

As described above, in the related art, whether the authentication method is a simple IP CHAP authentication method or a mobile IP FAC authentication method, the MD5 algorithm generates a password and an arbitrary challenge value shared only by the wireless terminal 10 and the AAA server 30. Although the FA 20 does not have a shared password shared between the wireless terminal 10 and the AAA server 30, the wireless terminal 10 and the FA 20 do not have a shared password. If a cracker hacks a message between them (the shared password itself is not transmitted over the network, it is difficult to hack and only the message itself can be hacked), even if the shared password is unknown, as if the FA 20 created the message. A password (ChapPassword) and a CHAP Challenge (ChapChallenge) can be created, and an access request message sent from the FA 20 to the AAA server 30 can be normally created. Therefore, if a normal access request message is made and transmitted to the AAA server 30, there is a problem that the resources of the AAA server 30 are depleted.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-mentioned problem, and randomly generates a CHAP password included in an access request message transmitted from a FA to an AAA server and a NAS secret key, which are difficult to be hacked, in response to a packet data service initiation request of a wireless terminal. It is an object of the present invention to provide a terminal authentication method in a communication network that prevents the AAA server from being hacked by preventing the cracker from making a message sent to the AAA server by encrypting and transmitting it with one request authentication value.

1 and 2 are diagrams for explaining a CHAP authentication method of a conventional simple IP.

3 and 4 are diagrams for explaining a FAC authentication method of a conventional mobile IP.

5 and 6 are diagrams for explaining a CHAP authentication method of a simple IP according to the present invention.

7 and 8 are diagrams for explaining a FAC authentication method of mobile IP according to the present invention.

*** Explanation of symbols for the main parts of the drawing ***

10. terminal, 20. FA,

30.AAA server, 40.HA

In the present invention for achieving the above object, a terminal authentication method in a communication network, the access request message transmitted from the FA (Foreign Agent) to the Authentication, Authorization and Accounting (AAA) server according to the packet data service start request of the wireless terminal Encrypting a Challenge-Handshake Authentication Protocol (CHAP) password to be included in a Network Access Server (NAS) secret key and a request authentication value randomly generated by the FA; Transmitting the encrypted CHAP password and the request authentication value in the access request message to the AAA server; Encrypting the received encrypted CHAP password with the NAS secret key and the request authentication value to obtain a plain text CHAP password; And performing authentication based on the CHAP password of the plain text.

Here, when the packet data service is set by a simple IP method, transmitting a challenge value arbitrarily generated by the FA to the wireless terminal according to a wireless packet data service start request of the wireless terminal; A CHAP identifier using the first byte of the received challenge value, a shared secret key known only to the AAA server and the wireless terminal, and the challenge value are encrypted to generate a CHAP response, and the generated CHAP response is converted into the FA. Transmitting to; Encrypts the received CHAP response, the CHAP identifier with the NAS secret key and a randomly generated request authentication value to generate an encrypted CHAP password, the encrypted CHAP password, the challenge value, and the request authentication. Transmitting a value to the AAA server by including a value in an access request message; Re-encrypting the received encrypted CHAP password with the received request authentication value and NAS secret key to generate a plain text CHAP password, and extracting a CHAP identifier and a CHAP response from the plain text CHAP password; Determining whether a temporary value generated by encrypting the extracted CHAP identifier, the shared secret key, and the received challenge value matches the extracted CHAP response; If it is determined that the temporary value and the CHAP response match, it is determined that the authentication success, and further comprising the step of transmitting an access permission message for the access request to the FA.

And, if the packet data service is set to a mobile IP method, transmitting a challenge value arbitrarily generated by the FA to the wireless terminal in response to a wireless packet data service start request of the wireless terminal; Generating a MIP RRQ (Mobile IP Registration Request) packet with the received challenge value and an authentication value between the wireless terminal and the AAA server and transmitting the generated MIP RRQ packet to the FA; An authentication value between the received wireless terminal and the AAA server, an encrypted CHAP password generated by encrypting a CHAP identifier with a NAS secret key and a request authentication value randomly generated, the challenge value, and the wireless terminal among the MIP RRQ packets. Transmitting a CHAP challenge value generated by encrypting packet information positioned before an authentication value between the AAA server and the AAA server, and including the request authentication value in an access request message to the AAA server; The encrypted CHAP password is encrypted again using the received request authentication value and the NAS secret key to generate a plain text CHAP password, and the CHAP identifier and the authentication value between the wireless terminal and the AAA server in the plain text CHAP password. Extracting; Generating a temporary value by encrypting the extracted CHAP identifier, the shared secret key, and the received CHAP challenge, and determining whether the temporary value matches an authentication value between the extracted wireless terminal and an AAA server; ; If it is determined that the temporary value coincides with the authentication value between the wireless terminal and the AAA server, determining that the authentication is successful and transmitting the access permission message for the access request to the FA.

Hereinafter, with reference to the accompanying drawings will be described in detail a terminal authentication method in a communication network according to an embodiment of the present invention.

5 and 6 are roads for explaining a simple IP CHAP authentication method according to the present invention, when a wireless terminal user requests to start a wireless packet data service using the wireless terminal 10 (S70), FA 20 Generates a random challenge value (S72), and includes the generated challenge value (Challenge) in the CHAP challenge (CHAP_CHALLENGE) message and transmits it to the wireless terminal 10 (S74).

In step S74, the wireless terminal 10 having received the CHAP challenge (CHAP_CHALLENGE) message from the FA 20 transmits a CHAP identifier using the first byte of the challenge value included in the received CHAP challenge message. (ChapId), the shared secret key (MN-AAA SharedSecret) known only by the AAA server 30 and the wireless terminal 10, and the challenge value (Challenge) by encrypting the message Digest (MD) 5 algorithm to the CHAP response {ChapResponse = MD5 (ChapId + MN-AAA SharedSecret + Challenge)} and include the generated CHAP response (ChapResponse) in the CHAP response (CHAP_RESPONSE) message, which is a response to the CHAP challenge (CHAP_CHALLENGE) message, to the FA (20). It transmits (S76).

The FA 20 receiving the CHAP response (CHAP_RESPONSE) message from the wireless terminal 10 in step S76 uses the first byte of a challenge value randomly generated according to the wireless packet data service request of the wireless terminal in step S72. A CHAP identifier (ChapId) and a CHAP response (ChapResponse) included in the CHAP response message received from the wireless terminal 10 may be a network access server between the FA 20 and the AAA server 30. NAS) encrypted with a secret key and a request authentication value (RequestAuthenticator) arbitrarily generated by the FA 20 to create an encrypted CHAPPassword (ChapPassword), CHAP challenge challenge (Challenge) randomly generated in the above step S72 In the challenge (ChapChallenge) (S78).

The CHAP password encrypted in step S78 is obtained by Equation 1, where P1, P2,... Pi is a CHAP identifier (ChapId) and a CHAP response (ChapResponse) in 16-byte units, S is a NAS secret key, RA is a request authentication value arbitrarily generated by the FA 20, b1, b2, … , bi are intermediate calculations, c (1), c (2),... c (i) is the fragments of an encrypted message. Here, if the length of the last piece of the fragment is not 16 bytes, the value is appended with a null value to make 16 bytes.

b1 = MD5 (S + RA) c (1) = P1 xor b1

b2 = MD5 (S + c (1)) c (2) = P2 xor b2

::

bi = MD5 (S + c (i-1) c (i) = Pi xor bi

As described above, c (1), c (2),... Generated by equation (1). , c (i) is summed up to generate an encrypted CHAP password (ChapPassword = c (1) + c (2) +… + c (i)).

Subsequently, an access request including an encrypted CHAP password (ChapPassword), a CHAP challenge (ChapChallenge), and a request authentication value (RequestAuthenticator) arbitrarily generated in the process S78 described above. Create a message and transmit it to the AAA server (30) (S80).

The AAA server 30 that receives the access request message from the FA 20 in step S80 may request a request authentication value (RequestAuthenticator) and a NAS secret key that receive an encrypted CHAP password (ChapPassword) included in the access request message. By encrypting again, the plain text CHAP password (PlainTextChapPassword) is made (S82).

Thereafter, the CHAP identifier (ChapId) and the CHAP response (ChapResponse) are extracted from the plaintext CHAP password (PlainTextChapPassword) of the plain text created in step S82 (S84), the extracted CHAP identifier (ChapId), the wireless terminal 10, and the AAA. The shared secret key (MN-AAA SharedSecret) only known to the server 30 and the CHAP Challenge (ChapChallenge) included in the access request message received in step S80 are encrypted using the MD5 algorithm to generate a temporary value {Temp = MD5 ( ChapId + MN-AAA SharedSecret + ChapChallenge)} (S86), and determines whether the generated temporary value (Temp) is the same as the CHAP response (ChapResponse) extracted in step S84 (S88).

If the result of the determination of step S88 is the same as the temporary value (Temp) and the CHAP response (ChapResponse), it is determined that the authentication is successful, and transmits an access-accept message for the access request to the FA 20 (S90). If the temporary value (Temp) and the CHAP response (ChapResponse) is not the same, it is determined that the authentication failed, and transmits an access-reject message for the access request to the FA 20 (S92).

On the other hand, Figures 7 and 8 are roads for explaining the FAC authentication method of the mobile IP according to the present invention, if the wireless terminal user requests to start the wireless packet data service using the wireless terminal 10 (S100), FA ( 20 generates a random challenge value (S102), and includes the generated challenge value (Challenge) in the agent advertisement message (Agent Advertisement) message and transmits it to the wireless terminal 10 (S104).

In step S104, the wireless terminal 10 receiving the agent advertisement message from the FA 20 transmits a challenge value (Challenge) received from the FA 20 in step S104 to register its location with the HA 40. ) And a mobile IP registration request (hereinafter referred to as MIP RRQ) packet including an authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 (S106).

The authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 included in the MIP RRQ packet generated in step S106 is a challenge value received from the FA 20 in step S104. CHAP Identifier (ChapId) using the first byte of the CDMA, a shared secret key (MN-AAA SharedSecret) known only to the wireless terminal 10 and the AAA server 30, the challenge value, and the first encryption value. Is a value encrypted by the MD5 algorithm, and the first encryption value is a wireless terminal 10 and an AAA server (10) to be currently generated in a MIP RRQ packet currently generated to register the position of the wireless terminal 10 with the HA 40. 30) The MIP RRQ packet information located before the MN-AAA Authenticator is encrypted using the MD5 algorithm.

Thereafter, the MIP RRQ packet generated in step S106 is transmitted to the FA 20 (S108), and the FA 20 receiving the MIP RRQ packet from the wireless terminal 10 transmits the challenge value generated in step S102. CHAP identifier (ChapId) using the first byte of the (Challenge) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 received from the wireless terminal 10 and the FA (20) Encrypt with a NAS secret key between the AAA server 30 and a request authentication value (RequestAuthenticator) randomly generated by the FA 20 to create an encrypted CHAP password (ChapPassword), the challenge value (Challenge) generated in the above step S102 And MIP RRQ packet information located before the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 among the MIP RRQ packets received from the wireless terminal 10 using MD5 algorithm. Combine to create a CHAP challenge (ChapChallenge) (S110).

Since the process of creating an encrypted CHAP password (ChapPassword) in the process S110 is the same as the CHAP authentication method of a simple IP, a detailed description thereof will be omitted.

Subsequently, an access request including an encrypted CHAP password (ChapPassword), a CHAP challenge (ChapChallenge), a request authentication value (RequestAuthenticator) arbitrarily generated in the process S110, and the like. The message is created and transmitted to the AAA server 30 (S112).

The AAA server 30 that receives the access request message from the FA 20 in step S114 described above and the NAS secret key and the request authentication value (RequestAuthenticator) receiving the encrypted CHAP password (ChapPassword) included in the access request message. By encrypting again, the plain text CHAP password (PlainTextChapPassword) is made (114).

Thereafter, the CHAP identifier (ChapId) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 are extracted from the plaintext CHAP password (PlainTextChapPassword) generated in the process S114 (S116). , The extracted CHAP identifier (ChapId), the shared secret key (MN-AAA SharedSecret) that only the wireless terminal 10 and the AAA server 30 know, and the CHAP challenge included in the access request message received in the above-mentioned process S112. (ChapChallenge) is encrypted using the MD5 algorithm to generate a temporary value {Temp = MD5 (ChapId + MN-AAA SharedSecret + ChapChallenge)} (S118), and the temporary value (Temp) is extracted from the above-mentioned process S116. It is determined whether the same as the authentication value (MN-AAA Authenticator) between the AAA server 30 (S120).

If the temporary value (Temp) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 are the same as the determination result of the process S120, it is determined that the authentication is successful and the access request is made to the FA 20. If the access permission (Access-Accept) message is transmitted (S122), if the temporary value (Temp) and the authentication value (MN-AAA Authenticator) between the wireless terminal 10 and the AAA server 30 is not the same as authentication failure In response to the determination, the access request message (Access-Reject) for the access request is transmitted to the FA 20 (S124).

In step S122, the FA 20, which receives the access permission message from the AAA server 30, transmits a MIP RRQ packet to the HA 40 (S126), and the HA 40 responds with a mobile IP registration response (Mobile). IP Registration Response (hereinafter referred to as MIP RRP) packet is transmitted to the FA 20 (S128).

The FA 20 receiving the MIP RRP from the HA 40 transmits the MIP RRP received from the HA 40 to the wireless terminal 10 (S130).

The terminal authentication method in the communication network of the present invention is not limited to the above-described embodiments, and may be variously modified and implemented within the range allowed by the technical idea of the present invention.

According to the terminal authentication method in the communication network of the present invention as described above, since the shared secret key (MN-AAA shared secret key, NAS secret key) is not transmitted over the network, it is difficult to be hacked, but the message itself can be hacked. Therefore, the cracker encrypts and transmits the CHAP password included in the access request message transmitted from the FA to the AAA server according to the wireless terminal's packet data service initiation request with a NAS secret key that is difficult to be hacked and a randomly generated request authentication value. Since we can't get the NAS secret key, we won't be able to create a message to the AAA server. This has the effect of preventing the AAA server from being hacked.

Claims (3)

Network Access Server (NAS) provides a Challenge-Handshake Authentication Protocol (CHAP) password to be included in an access request message sent from a foreign agent (FA) to an authentication, authorization and accounting (AAA) server in response to a packet data service initiation request from a wireless terminal. Encrypting with a secret key and a request authentication value randomly generated by the FA; Transmitting the encrypted CHAP password and the request authentication value in the access request message to the AAA server; Encrypting the received encrypted CHAP password with the NAS secret key and the request authentication value to obtain a plain text CHAP password; And a step of performing authentication based on the plain text CHAP password. The method of claim 1, wherein the packet data service is set in a simple IP scheme. Transmitting, to the wireless terminal, a challenge value arbitrarily generated by the FA in response to a wireless packet data service start request of the wireless terminal; A CHAP identifier using the first byte of the received challenge value, a shared secret key known only to the AAA server and the wireless terminal, and the challenge value are encrypted to generate a CHAP response, and the generated CHAP response is converted into the FA. Transmitting to; Encrypts the received CHAP response, the CHAP identifier with the NAS secret key and a randomly generated request authentication value to generate an encrypted CHAP password, the encrypted CHAP password, the challenge value, and the request authentication. Transmitting a value to the AAA server by including a value in an access request message; Re-encrypting the received encrypted CHAP password with the received request authentication value and NAS secret key to generate a plain text CHAP password, and extracting a CHAP identifier and a CHAP response from the plain text CHAP password; Determining whether a temporary value generated by encrypting the extracted CHAP identifier, the shared secret key, and the received challenge value matches the extracted CHAP response; And if the temporary value and the CHAP response match, as the result of the determination, determining that the authentication is successful and transmitting the access permission message for the access request to the FA. The method of claim 1, wherein when the packet data service is set to a mobile IP scheme, Transmitting, to the wireless terminal, a challenge value arbitrarily generated by the FA in response to a wireless packet data service start request of the wireless terminal; Generating a MIP RRQ (Mobile IP Registration Request) packet based on the received challenge value and an authentication value between the wireless terminal and the AAA server and transmitting the MIP RRQ packet to the FA; An authentication value between the received wireless terminal and the AAA server, an encrypted CHAP password generated by encrypting a CHAP identifier with a NAS secret key and a request authentication value randomly generated, the challenge value, and the wireless terminal among the MIP RRQ packets. Transmitting a CHAP challenge value generated by encrypting packet information positioned before an authentication value between the AAA server and the AAA server, and including the request authentication value in an access request message to the AAA server; The encrypted CHAP password is encrypted again using the received request authentication value and the NAS secret key to generate a plain text CHAP password, and the CHAP identifier and the authentication value between the wireless terminal and the AAA server in the plain text CHAP password. Extracting; Generating a temporary value by encrypting the extracted CHAP identifier, the shared secret key, and the received CHAP challenge, and determining whether the temporary value matches an authentication value between the extracted wireless terminal and an AAA server; ; And if the temporary value matches the authentication value between the wireless terminal and the AAA server, determining that the authentication is successful and transmitting an access permission message for the access request to the FA. Terminal authentication method in the network.