KR100533003B1 - Protocol improvement method for user authentication - Google Patents

Abstract

The present invention relates to a technique for improving a specific protocol (802.1x) for user authentication in UPnP networks. The present invention includes a first step of generating a predetermined state machine and periodically transmitting an EAP-Request / Ack message when a connection is made to a port; When a packet having a MAC address different from the MAC ID stored in the existing MAC entry table is received, storing a new MAC address in the MAC entry table and creating a new logical port; If the newly received packet is not an EAP-Response / Acknowledgment packet, send an EAP-Request / Acknowledgment packet to start a new 802.1x authentication process, wait for a response message to be sent, and again if the response does not arrive, try again. A third process of repeating the process of transmitting the confirmation message; If the newly received packet is an EAP-Response / Acknowledgment packet or if the response arrives correctly, send an EAP-Request / MD5 Challenge or TLS message to the MAC address to obtain the user ID and password, and the EAP-Request / MD5 Challenge or TLS message. Waiting for a response message to arrive; Compare the received user ID and password with the ID and password stored in the server and set the result value of the MAC entry table to ON according to the comparison result, and wait for a new packet to come in, or the result of the MAC entry table. This is accomplished by a fifth process that sets the value to off and waits for new packets to come in.

Description

 How to improve the protocol for user authentication {PROTOCOL IMPROVEMENT METHOD FOR USER AUTHENTICATION}

The present invention relates to a technology for improving a specific protocol (802.1x) for user authentication in a UPnP network. In particular, the present invention relates to a MAC that is not logical port blocking (MAC) to a user's MAC (Media Access Control) address. The present invention relates to a method for improving a protocol for authenticating a user through filtering.

In the Universal Plug and Play (UPnP) network, there is a standard communication method for an access point (AP), which is widely used recently. In addition, the AP uses the 802.1x protocol for Ethernet user authentication, which enables encrypted user authentication using an Extensible Authentication Protocol (EAP) message. The 802.1x, as can be seen in the name of Port-based Network Access Control, generally focuses mainly on switched ethernet networks. The switch Ethernet network is a network connected only by two ports, and refers to a network when a shared media device such as a hub does not exist. Therefore, the conventional 802.1x implementation cannot be applied to the shared media network. To solve this problem, the concept of logical port exists, but the exact range of this logical port is not defined yet.

The AP that can be used in the UPnP network uses the 802.1x protocol for user authentication. The 802.1x is a port-based network access control protocol that restricts access of unauthorized users by blocking ports of AP equipment. If multiple users are connected to the port via a shared media Ethernet network instead of only one user, their access rights are limited at the same time.

As such, the 802.1x protocol used in the conventional UPnP network blocks the access of an unauthorized user by blocking the port of the AP device. When multiple users are connected to the port through a shared media Ethernet network, not only one user. There was a problem that their access rights are limited at the same time.

Accordingly, it is an object of the present invention to manage user authentication through MAC filtering rather than logical port blocking with user MAC addresses, respectively.

According to an aspect of the present invention, there is provided a method of improving a protocol for authenticating a user, comprising: a first process of generating a predetermined state machine and periodically transmitting an EAP-request / confirmation message if it is determined that the connection is generated at a port; When a packet having the same MAC address as the MAC ID stored in the existing MAC entry table is received, passing the packet to a logical port having the existing MAC ID to perform an operation of the 802.1x state machine there; When a packet having a MAC address different from the MAC ID stored in the existing MAC entry table is received, storing a new MAC address in the MAC entry table and creating a new logical port; If the newly received packet is not an EAP-Response / Ack packet, send an EAP-Request / Ack packet to start a new 802.1x authentication process, wait for the EAP-Response / Ack message to be sent, and if it does not arrive. A fourth step of repeating the process of transmitting the EAP-Request / Ack message again; If the newly received packet is an EAP-Response / Acknowledgment packet or if the response arrives correctly, send an EAP-Request / MD5 Challenge or TLS message to the MAC address to obtain an encrypted User ID and Password, and to obtain the EAP-Request / MD5 Challenge or A fifth step of waiting for an EAP-response / MD challenge or TLS message to arrive in response to the TLS message; Decode the received data, detect the user ID and password, and if the value is found to be the same as the ID and password stored in the server, set the result value in the MAC entry table to ON and then enter a new packet. 1 to 6 attached to the protocol improvement method of the present invention, which consists of a sixth process of waiting for a new packet and setting the result value of the MAC entry table to off if it is found to be different, and waiting for a new packet to enter. When described in detail with reference to as follows.

802.11b wireless LAN is a network protocol based on Ethernet, and a standard for its application has been made in UPnP. The UPnP AP adopts the 802.1x protocol as a solution to the recently increasing security problem. The 802.1x has a strength that can be used in any Ethernet based protocol, not only in 802.11b. However, 802.1x is inherently intended for port-based network access control, which makes it unsuitable for shared media networks that include equipment such as hubs. The reason for this is as follows.

1 shows a basic operation of 802.1x. Here, the terminal (Supplicant) means a user terminal (Windows XP), the authenticator (Authenticator) means a device such as a switch or an AP. The first Encapsulation over LANs (EAPoL) start message is sent by the user terminal, which may or may not be sent. In other words, the dotted line means that this message may not exist. In this case, the authenticator checks the state of his physical port and then checks the state that the port is connected to another system to perform the next procedure.

As a result, a process of tracking the state change of the physical port is required. Therefore, the operation of 802.1x becomes dependent on the change of state of the physical port. In the case of having a network topology as shown in FIG. 2, no problem occurs even in the conventional method. This is because one user terminal is connected to one physical port. In this case, the 802.1x protocol engine only needs to check the state of one physical port. Then, even if the EAPoL start is not transmitted from the user terminal, it can proceed to the next procedure with the confirmed port state.

However, the above scheme cannot be applied to a shared media network as shown in FIG. 3. This is because the connection process is complicated because several ports are connected to one physical port through a hub.

Accordingly, in order to solve the above problem, the present invention proposes the following processing method by dividing the EAPoL start message from the user terminal and the other case.

First, a description will be given of the processing in the case where the EAPoL start message is transmitted from the user terminal.

When a user terminal transmits an EAPoL start message, a new logical port is created using the MAC address of the message as an ID. This creates a new state machine for each logical port, enabling individual operations. In this case, even if the login fails, the physical port should not be blocked, and filtering to selectively filter only packets having the MAC address is required. For this purpose, a MAC ID entry storing each MAC address ID is required. This MAC ID entry should include the MAC IDs of the currently created logical ports and information on each success / fail.

However, a description will be given of the processing when the EAPoL start message is not transmitted from the user terminal.

In this case, although one logical port should be created, the logical port cannot be created because the existence of the logical port cannot be determined. In order to solve this problem, an EAP-Request / Identify Message must be sent periodically. When this message is transmitted, the EAP-Response / Identify Message can be sent to the next procedure even if the EAPoL start message is not transmitted from the user terminal. That is, a structure for periodically transmitting the EAP-Request / Ack message must be defined.

4 shows a structure for periodically sending an EAP-Request / Ack message. In the initial state where the physical port is opened, a state machine with an arbitrary MAC ID value (here: 00: 00: 00: 00: 00: 00) has been created. This state machine exists for sending EAP-Request / Ack messages periodically. Since no Ethernet packets will come in with a MAC address of 00: 00: 00: 00: 00: 00, this state machine will always stay in an initialized state and only send EAP-Request / Ack messages.

In contrast, FIG. 5 illustrates logical ports generated in consideration of the two cases, that is, both cases where the EAPoL start message is transmitted or not transmitted from the user terminal. Each logical port has a state machine for 802.1x operation. Even in the initial state, as shown in FIG. 4, a logical port having a MAC ID of 00: 00: 00: 00: 00: 00 is created. Then, it may be determined whether the current user terminal accesses to create a logical port regardless of whether the user terminal transmits the EAPoL start message.

Because, as can be seen in the process when the EAPoL start message is not transmitted from the user terminal, this state machine will periodically send an EAP-Request / acknowledge message, and if the user terminal is connected, send a response to it. Because it is.

Whether the user terminal transmits the EAPoL start message as in the case of the EAPoL start message transmitted from the user terminal or the EAP-response as the process in the case of the EAPoL start message is not transmitted from the user terminal. Send a confirmation message, or check the MAC Entry Table once a response from the user terminal is received.

The MAC entry table is empty in the initial state. If a response message is received from the new user MAC address, the MAC address is stored in the MAC entry table, and a new logical port is created with the MAC address as the ID. This logical port will be equipped with an 802.1x state machine to perform user authentication. If the user terminal is found to be valid through the user authentication process, the MAC ID of the MAC entry table is found and its value is set to an on state, and if it is not valid, it is set to an off state.

When the MAC ID value of the MAC entry table is set to the ON state, all packets having the MAC address are forwarded, but when set to the OFF state, all data packets except the control message are filtered. FIG. 5 shows a case where two logical ports are created with MAC addresses of 12: 34: 56: 78: 9A: BC and 23: 45: 67: 89: AB: CD, respectively.

That is, in FIG. 5, the total number of logical ports connected to one physical port is 3 (note that the number of actual user terminals is 2). Referring to the MAC entry table 12: 34: 56: 78: 9A: BC: It can be seen that the logical port having the MAC ID can forward the packet upon successful authentication. On the other hand, it can be seen that a logical port having a 23: 45: 67: 89: AB: CD MAC ID fails to authenticate and cannot forward a data packet.

Meanwhile, the signal processing of MAC-based 802.1x when a new logical port is added to a physical port will be described in detail with reference to FIG. 6.

First, if it is recognized that a connection has been made by checking whether a connection has been made to a port, that is, if a port is recognized, a state machine with a MAC ID of 00: 00: 00: 00: 00: 00 is created to request an EAP-request. / Confirm message is sent periodically (S1, S2).

Thereafter, it is checked whether a packet having a MAC address different from the MAC ID stored in the existing MAC entry table is received. If the check result indicates that the MAC address of the incoming packet is the same as the existing stored MAC ID, the packet is passed to the logical port having the existing MAC ID to perform the operation of the 802.1x state machine there. In other words, there is nothing special to do here (S3, S4).

However, if the check result indicates that the MAC address of the incoming packet is different from the existing packets, the new MAC address is stored in the MAC entry table and a new logical port is created. The logical port has an 802.1x state machine. The state machine must be created as a thread so that it does not interfere with the state machine operation of other logical ports (S5, S6).

Then, if the newly received packet is an EAP-response / acknowledgment packet and it is determined to be the EAP-response / acknowledgement packet, the next procedure (e.g., to transmit the next procedure, EAP-Request / MD5 Challenge or TLS packet) is performed. S10) (see FIG. 1), if the newly received packet is found to be not an EAP-Response / Ack packet, the EAP-Request / Ack packet is transmitted to start a new 802.1x authentication process, and then the EAP- If the response is not received because the response / acknowledgement message is not received, the process of transmitting the EAP-request / acknowledgement message is repeated (S7-S9).

However, if the response arrives correctly, send an EAP-Request / MD5 Challenge or TLS message to the MAC address to obtain an encrypted User ID and Password. Here, MD5 challenge or TLS means a specific encryption algorithm (S10).

Thereafter, similar to the tenth step (S10), it waits for the EAP-Response / MD Challenge or TLS message, which is a response to the EAP-Request / MD5 Challenge or TLS message, to arrive. Here, the received EAP-Response / MD5 Challenge or TLS message contains an encrypted user ID and password value (S11).

Subsequently, the received data is decoded to find a user ID and a password, and check whether the values are the same as the ID and password stored in the server. Decoding the data and comparing the obtained values with the values stored in the server are beyond the scope of the present invention and will not be described in detail. Typically, this happens through an AAA server such as RADIUS (S12).

If it is determined that the values are the same as the ID and password values stored in the server, that is, successes, the result value of the MAC entry table is set to ON, and a new packet is waited for. )

However, if the result of the check indicates that the values are different from the ID and password values stored in the server, that is, if the value is found to be a failure, the result value of the MAC entry table is set to off and wait for a new packet to come in. (S14)

As described in detail above, the present invention manages user authentication through MAC filtering rather than logical port blocking with a user's MAC address, thereby increasing the number of acceptable user terminals of one AP or switch equipment. have.

1 is an operational signal flow diagram of the 802.1x protocol.

2 is a configuration diagram of a switch network.

3 is a block diagram of a shared media network.

4 is a configuration diagram of an 802.1x state machine in an initial state.

5 is a configuration diagram of an 802.1x logical port when several user terminals access a single physical port.

6A and 6B are signal flow diagrams illustrating a process of a protocol improvement method for user authentication according to the present invention.

Claims (5)

Generating a predetermined state machine and periodically transmitting an EAP-Request / Ack message when a connection is made to the port; When a packet having a MAC address different from the MAC ID stored in the existing MAC entry table is received, storing a new MAC address in the MAC entry table and creating a new logical port; If the newly received packet is not an EAP-Response / Acknowledgment packet, send an EAP-Request / Acknowledgment packet to start a new 802.1x authentication process, wait for a response message to be sent, and again if the response does not arrive, try again. A third process of repeating the process of transmitting the confirmation message; If the newly received packet is an EAP-Response / Acknowledgment packet or if the response arrives correctly, send an EAP-Request / MD5 Challenge or TLS message to the MAC address to obtain the user ID and password, and the EAP-Request / MD5 Challenge or TLS message. Waiting for a response message to arrive; Compare the received user ID and password with the ID and password stored in the server and set the result value of the MAC entry table to ON according to the comparison result, and wait for a new packet to come in, or the result of the MAC entry table. And a fifth step of setting the value to off and waiting for a new packet to be received. 2. The process of claim 1, wherein the second step is to forward a packet to a logical port with an existing MAC ID when a packet with a MAC address that is different from the MAC ID stored in the existing MAC entry table enters the operation of the 802.1x state machine there. Method for improving the protocol for user authentication, characterized in that further comprising the step of performing. The protocol improvement for user authentication according to claim 1, wherein the logical port of the second process is equipped with an 802.1x state machine, and the state machine is created as a thread so that it does not interfere with the state machine operation of another logical port. Way. The method of claim 1, wherein the user ID and password of the fourth process are obtained in an encrypted form. The method of claim 1, wherein if the received user ID and the password are the same as the ID and password stored in the server, the fifth process waits for a new packet to come in after setting the result value of the MAC entry table to on. And setting a result value of the MAC entry table to off and waiting for a new packet to come in.