KR100453826B1 - User node authentication method in mobile ad hoc networks using EAP - Google Patents

Abstract

A user node authentication method in a mobile ad hoc network using EAP is disclosed. The user node authentication method in a mobile ad hoc network according to the present invention comprises the steps of performing authentication and association according to the IEEE 802.11 protocol between a node to be authenticated and a neighboring node, and a beacon message between a node to be authenticated and a neighboring node. Using the EAP authentication to authenticate the node, and if the node to be authenticated has sent a beacon message indicating that the node has not been authenticated before, and wants to authenticate. If the node sends a beacon message that the node has been previously authenticated, the method includes checking whether the node to be authenticated is authenticated by the neighboring node. If the node in the neighbor of the node to be authenticated is not the master node, it can act as an agent to perform authentication, thereby improving user authentication. Especially, EAP is used in mobile ad hoc networks in military and 4G networks. By providing a user authentication function, the network can be blocked from unauthorized users.

Description

User node authentication method in mobile ad hoc networks using EAP

The present invention relates to the transmission of information, and more particularly, to a method of authenticating a user node in a mobile ad hoc network using Extensible Authentication Protocol (EAP).

The mobile ad hoc network is a network in which frequent movement and path setting between nodes occurs. Routing due to frequent movement of nodes is done by routing protocol. Ad-hoc On-demand Distance Vector (AODV), one of the representative ad hoc routing protocols, provides dynamic, self-starting, and multiple hops between mobile nodes maintaining an ad-Hoc network. Algorithm to enable routing. AODV is classified as a reactive routing protocol that does not constantly maintain routing information and performs routing procedures only on demand.

If the source node does not have a proper path to the destination node when trying to send a packet to the destination node, the source node establishes a path with the destination node through a path discovery process. After the route is established, a route maintenance process is performed to maintain the route. When the source node moves or intermediate nodes in the path move, the route discovery process is restarted to reset the route to the destination node.

Existing mobile ad hoc networks cannot be applied to IEEE 802.1x in general public wireless LAN due to the path setting due to frequent movement between nodes. This is because when applying the IEEE 802.1x structure that is divided into supplicant and authenticator for nodes of mobile ad hoc network, EAP section and Radius section cannot be set separately due to the network configuration by multi-hop.

An object of the present invention is to provide a user node authentication method for performing authentication within an EAP interval by applying the concept of IEEE 802.1x in a mobile ad hoc network.

Another object of the present invention is to provide a computer-readable recording medium having recorded thereon a program for executing the user node authentication method on a computer.

1 is a conceptual diagram illustrating a configuration of a mobile ad hoc network to which a node authentication method according to the present invention is applied.

2 is a signal flow diagram illustrating a procedure to which an embodiment of a user node authentication method according to the present invention is applied between a node that has not been previously authenticated and a master node.

3 is a signal flow diagram illustrating a procedure in which an embodiment of a user node authentication method according to the present invention is applied between a previously unauthenticated node and a previously authenticated node operating as an agent.

4 is a signal flow diagram illustrating a procedure to which an embodiment of a user node authentication method according to the present invention is applied when a previously authenticated node moves.

5 is a block diagram showing the format of an extended AODV message packet used to confirm whether a node has previously authenticated in the user authentication method according to the present invention.

6 is a block diagram showing the format of an extended EAP packet used for EAP authentication in the user authentication method according to the present invention.

According to an aspect of the present invention, there is provided a method for authenticating a user node in a mobile ad hoc network, the method comprising: performing authentication and association by an IEEE 802.11 protocol between a node to be authenticated and a neighboring node; Confirming whether a previous authentication has been performed by using a beacon message between the node to which the authentication is desired and the neighboring node; If the node to be authenticated sends a beacon message indicating that the node has not been previously authenticated, performing authentication to the node to be authenticated through EAP authentication; And if the node to be authenticated has sent a beacon message that the node has been previously authenticated, checking whether the node to be authenticated is authenticated by the neighboring node.

Hereinafter, a user node authentication method in a mobile ad hoc network according to the present invention will be described in detail with reference to the accompanying drawings.

1 is a conceptual diagram illustrating a configuration of a mobile ad hoc network to which a node authentication method according to the present invention is applied.

The present invention relates to a user security authentication method using EAP in a mobile ad hoc network, and relates to an authentication method through a user node through a master node having a master node for authentication management in a mobile ad hoc network.

Especially in the case of military or commercial service networks that require security, access to the mobile ad hoc network from an unauthorized illegal user will cause a fatal error. Therefore, the access itself must be blocked. Therefore, users in the mobile ad hoc network must be blocked. Security features are essential.

In a mobile Ad Hoc network, individual nodes 102 to 104 are authenticated through the master node 101 with a master node 101 for a user authentication server. The already authenticated nodes 102-104 perform authentication on behalf of the master node 101 of other nodes (e.g., node 105) to reduce network load, which is called an agent node. In the present invention, to improve the authentication function of the mobile Ad Hoc network through this agent process. In addition, the authentication mobile node 105 to reduce the authentication traffic caused by the frequent movement between the nodes by simplifying the procedure to be authenticated again when moving to another location after authentication through the agent node query process.

In the mobile ad hoc network, the mobile node 105 forms a link with the mobile node in its radio transmission range. In the network formation step, the mobile nodes recognize the existence of neighboring nodes through an authentication and association procedure based on the IEEE 802.11 Medium Access Control (MAC) protocol. In the mobile ad hoc network, since the authentication server role must exist at the initial stage of network formation, the master node 101 plays the role of authentication server and has authentication related information required for each authentication. In order to identify the master node 101 and other nodes, the master node transmits a Hello message, which is a beacon message by the higher AODV routing protocol, with information that it knows that it is a master node, and receives the corresponding node. 102-104 recognize that the other node is the master node and enter the authentication procedure.

2 is a signal flow diagram illustrating a procedure to which an embodiment of a user node authentication method according to the present invention is applied between a node that has not been previously authenticated and a master node.

First of all, between the two nodes, the authentication and association procedure 200 is performed by the IEEE 802.11 MAC protocol, and the AODV Beacon message, Hello message, is sent with information about its authentication. Since the master node does not need to be authenticated, it is set to TRUE (202), and an unauthenticated node is set to FALSE and sent (201). The unauthenticated node makes a network connection request with an EAPOL-START message as shown in FIG. 2 for its authentication (203). The master node receiving the connection request sends an EAP-Request / Identity message to the node in response to the EAPOL-START message (204), and the node responds to the master node with its node identifier (ID) as an EAP-Response / Identity message. (205). If a user ID exists, the master node creates an MD5-Challenge packet and sends it to the node for password verification (206). The node wishing to authenticate sends the master node a EAP-Response / MD5-Challenge message again with a hash result of the packet and the password for the MD5-Challenge request (207). If the passwords match, the master node sends a notification of authentication success to the node via an EAP-Success message that authentication is successful (208). If the passwords do not match, the master node sends a notification of authentication failure to the node via an EAP-Failure message indicating authentication failure (209). Through this process, security authentication is performed when the authentication server and the initial mobile Ad Hoc network are formed with another node.

3 is a signal flow diagram illustrating a procedure in which an embodiment of a user node authentication method according to the present invention is applied between a previously unauthenticated node and a previously authenticated node operating as an agent.

Referring to FIG. 3, when establishing a connection between an authenticated node and an unauthenticated node, an authentication procedure through an authentication server agent (Agent) operation of an authenticated node may be examined.

First, after going through the IEEE 802.11 Authentication and Association procedure (300), the authenticated node includes a TRUE flag indicating that it is an authorized node when exchanging AODV Beacon messages (302). The node wishing to include a FALSE flag indicating that the node has not been previously authenticated (301).

The unauthenticated node makes a network connection request to the neighbor node with an EAPOL-START message (303). At this time, the authenticated node performs the agent role of the authentication server. Thus, in response to this on behalf of the master node, the agent node sends an EAP-Request / Identity message to the node (304), and the unauthenticated node responds to the agent node with its identity as an EAP-Response / Identity message ( 305).

At this time, the agent node that receives the EAP-Response / Identity message from the unauthenticated node establishes a route with the master node using the routing protocol and loads the user ID in the EAP-Agent response (EAP-Type = Identity). Send to node (306). If the user ID of the unauthenticated node exists, the master node creates an MD5-Challenge packet in the EAP-Agent Request message and sends it to the agent node for password verification (307).

The agent node receiving the MD5-Challenge message from the master node converts it into an EAP-Request / MD5-Challenge message and transmits it to the unauthenticated node (308). Upon receipt of the MD5-Challenge request, the node generates a hash result with the password again as an EAP-Request / MD5-Challenge message and transmits the result to the agent node (309). The agent node transmits the MD-Challenge value in the EAP-Agent Response message to the master node (310). The master node compares the password for this user ID with the MD5 hashed result and determines whether the password matches. If the password matches, the master node sends an EAP-Agent / Success message to the agent node (311), and the receiving agent node processes the authentication success for this node and sends the node a successful authentication to the node via the EAP-Success message. Deliver the notification (312). If the password does not match, the master node sends an EAP-Failure message to the agent node (313), and the agent node sends a notification of the authentication failure to the node wishing to authenticate through the EAP-Failure message (314).

4 is a signal flow diagram illustrating a procedure to which an embodiment of a user node authentication method according to the present invention is applied when a previously authenticated node moves.

If a node that has already been authenticated through another node moves to another area, it is disconnected due to the difference in transmission area from the existing node, and is connected to another node. At this time, a new authentication procedure has to be performed. In the present invention, the agent node performs the Query process.

First, after an authentication and association procedure of IEEE 802.11 Medium Access Control (MAC) (400), a Hello message is transmitted and received by the AODV routing protocol (401). At this point, each node expands the Hello message to include a flag for its authentication.

Next, when the agent node registers a new node that has already been authenticated as its neighbor, the agent node transmits an EAP-Query / id message for the query process to the master node in order to recheck whether the node is authenticated (402). The master node receiving the Access Query message informs the user whether or not to authenticate as an EAP-Query Success message if the node has already been authenticated and has not passed TTL (Time To Live) (403). If authentication has not been performed previously, the authentication failure is notified by an EAP-Query Failure message (404). The reason for this process is to prevent any unauthenticated node from sending a Hello message as if it were an authorized node. The master node receiving the EAP-Query / id searches the ANL (Authenticated Node List) table to check if the current id has been successfully authenticated and has not exceeded its Timeout value. By sending the certificate, authentication can be strengthened and the procedure for authentication can be simplified.

5 is a block diagram showing the format of the extended AODV message packet used to confirm whether the node has previously authenticated in the user authentication method according to the present invention.

The AODV message is used as a beacon message to confirm authentication. Referring to FIG. 5, a beacon message packet used in the present invention includes a field indicating a type of a message, a field indicating a length of a message, a field indicating a message interval, and a node. It includes a field (Authenticated) indicating whether or not to be authenticated.

Each node broadcasts the Authenticated field of its Hello message to 1 if it is a master node or an authorized node and 0 if it is not.

6 is a block diagram showing the format of an extended EAP packet used for EAP authentication in the user authentication method according to the present invention.

In the conventional EAP packet format, the Code field is a connection request between a normal node and a master node, a node identifier forwarding request, a node identifier forwarding response, an MD5-Challenge packet processing request, an MD5-Challenge packet processing response, authentication success, or authentication failure. It has only values of REQUEST, RESPONSE, SUCCESS, and FAILURE.

However, in the present invention, an agent function and a query procedure can be performed by extending a value that a code field can have. That is, the node identifier transfer response between the agent node and the master node, MD5-Challenge packet processing request, MD5-Challenge by having more values of Agent Request, Agent Response, Agent Success, Agent Failure, Query, Query Success, Query Failure. It can indicate a packet processing response, authentication success, or authentication failure.

The present invention can be embodied as code that can be read by a computer (including all devices having an information processing function) in a computer-readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording devices include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like.

Although the present invention has been described with reference to the embodiments shown in the drawings, this is merely exemplary, and it will be understood by those skilled in the art that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the user node authentication method in a mobile ad hoc network according to the present invention, when a node adjacent to a node to be authenticated is not a master node, the user node can be operated as an agent to perform authentication, thereby improving user authentication. In particular, by providing a user authentication function using EAP in mobile ad hoc networks, particularly in military and 4G networks, it is possible to block access from unauthorized illegal users.

In addition, by using the Hello message, which is a beacon message of the existing AODV routing protocol, having different authentication procedures according to whether or not the neighbor node is authenticated, it is possible to reduce the time and network overhead due to the authentication process. By providing the authentication process through the Query process, unnecessary overhead of the network due to authentication can be reduced, and confidence in neighbor nodes can be increased through each authentication.

Claims (9)

(a) performing authentication and association according to the IEEE 802.11 protocol between a node to be authenticated and a neighboring node; (b) confirming whether a previous authentication has been performed by using a beacon message between the node to which the authentication is desired and the neighboring node; (c) if the node to be authenticated has sent a beacon message indicating that the node has not been previously authenticated, performing authentication with respect to the node to be authenticated through EAP authentication; And (d) in the mobile ad hoc network, if the node to be authenticated has sent a beacon message that the node has been previously authenticated, verifying whether the node to be authenticated is authenticated by the neighboring node; User node authentication method. The method of claim 1, wherein the beacon message, A field indicating the type of message; A field indicating the length of the message; A field indicating an interval of a message; And A user node authentication method in a mobile ad hoc network, characterized in that the transfer using a packet including a field indicating whether or not the node authentication. The method of claim 1, wherein step (c) comprises: (c1) when the neighboring node is a master node, directly authenticating the node requesting the authentication; And (c2) if the neighbor node is not the master node, the neighbor node acting as an agent for connecting the master node and the node requesting authentication with each other, and assisting the master node to perform authentication. User node authentication method in ad hoc network. The method of claim 3, wherein the step (c1), (c11) requesting the master node to access the master node for authentication; (c12) the master node receiving a node identifier from a node that wants to authenticate the node; (c13) generating an MD5-Challenge packet for password verification using the node identifier at the master node and sending the authentication to a desired node; (c14) processing the MD5-Challenge packet using its own password and sending it to the master node at the node to be authenticated; (c15) comparing, by the master node, a packet processed by the node that wants to be authenticated with a packet processed by the node to determine whether the password matches; And and (c16) transmitting, at the master node, an authentication success message or an authentication failure message to the node to be authenticated according to whether the password matches. The method of claim 3, wherein step (c2), (c21) requesting the node for the authentication to access the neighboring node for authentication; (c22) the neighbor node receiving a node identifier from a node that wants to authenticate the node; (c23) the neighbor node sending the node identifier to a master node; (c24) generating, at the master node, an MD5-Challenge packet for password verification using the node identifier and sending the generated MD5-Challenge packet to the neighboring node; (c25) sending the MD5-Challenge packet to the node to be authenticated by the neighboring node; (c26) processing the MD5-Challenge packet using its own password at the node to be authenticated and sending it to the neighboring node; (c27) sending the processed packet to the master node at the neighbor node; (c28) comparing, by the master node, a packet processed by the node that wants to be authenticated with a packet processed by the node to determine whether the password matches; (c29) sending, by the master node, an authentication success message or an authentication failure message to the neighbor node according to whether the password matches; And (c30) the neighbor node sending the authentication success message or the authentication failure message to the node for which the authentication is desired, wherein the user node authentication method in a mobile ad hoc network. The method of claim 1, wherein step (d) (d1) sending a node identifier of a node to be authenticated from the neighbor node to the master node; (d2) using the node identifier at the master node to determine whether the node to be authenticated was previously authenticated; And (d3) a method for authenticating a user node in a mobile ad hoc network, comprising: sending a message to the neighboring node about whether the node desired to be authenticated in the master node has been previously authenticated. The method of claim 1, wherein the message delivery in the steps (c) and (d), Connection request, node identifier delivery request, node identifier delivery response, MD5-Challenge packet processing request, MD5-Challenge packet processing response, authentication success or authentication failure, or And forwards the packet using a packet including a field indicating a node identifier transfer response, an MD5-Challenge packet processing request, an MD5-Challenge packet processing response, an authentication success, or an authentication failure between the neighboring node and the master node. User node authentication method in mobile ad hoc network. (a) performing authentication and association according to the IEEE 802.11 protocol for the node to be authenticated; (b) receiving a beacon message indicating whether or not a previous authentication has been received from the node to be authenticated; (c) if the node to be authenticated has sent a beacon message indicating that the node has not been previously authenticated, acting as an agent connecting the master node and the node requesting authentication with each other to help the master node perform authentication; And (d) If the node to be authenticated sends a beacon message that the node to be authenticated is a previously authenticated node, receiving a message indicating whether the node to be authenticated was previously authenticated from a master node to determine whether to authenticate the node to be authenticated. User node authentication method in a mobile ad hoc network comprising the step of identifying. (a) performing authentication and association according to the IEEE 802.11 protocol for the node to be authenticated; (b) receiving a beacon message indicating whether or not a previous authentication has been received from the node to be authenticated; (c) if the node to be authenticated has sent a beacon message indicating that the node has not been previously authenticated, acting as an agent connecting the master node and the node requesting authentication with each other to help the master node perform authentication; And (d) If the node to be authenticated sends a beacon message that the node to be authenticated is a previously authenticated node, receiving a message indicating whether the node to be authenticated was previously authenticated from a master node to determine whether to authenticate the node to be authenticated. A computer-readable recording medium having recorded thereon a program for executing the checking step on a computer.