KR100582553B1 - Connection authentication method of public wireless-LAN and mobile internet using cipher key generated in 3G authentication - Google Patents

Abstract

A method of authenticating a user connection in a public wireless LAN and a portable Internet is disclosed. A method for authenticating access of a public wireless LAN and a portable Internet, the method comprising the steps of: (a) receiving a network access identifier (NAI) stored in a universal subscriber identity module (USIM) of a mobile phone; And attempting to access the public wireless LAN or the portable Internet using the wireless LAN; (b) delivering the NAI to a 3G authentication server in a public wireless LAN authentication server or a portable Internet authentication server; (c) a user corresponding to the NAI is confirmed in the 3G authentication server, and the encryption key for the user is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, An authentication performing step of performing authentication of the Internet; (d) when the encryption key is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, performing a separate authentication using the encryption key at the corresponding server, And a cryptographic key delivery step of delivering the key.

Description

[0001] The present invention relates to a method for authenticating a public wireless LAN and a portable Internet using a cryptographic key generated by a 3G authentication method,

1 is a network configuration diagram of a public wireless LAN according to the prior art,

FIG. 2 is a system configuration diagram in which a connection authentication method of a public wireless LAN and a portable Internet according to the present invention is implemented;

3 is a flowchart of a connection authentication method of a public wireless LAN and a portable Internet according to the present invention,

FIG. 4 and FIG. 5 are operation flowcharts of a public wireless LAN and a connection authentication method of a portable Internet according to the present invention.

Description of the Related Art

100 ... wireless terminals (eg notebook, PDA)

200 ... 3G mobile phone

300 ... 3G authentication server

400 ... Public WLAN authentication server

500 ... Portable Internet Authentication Server

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a public wireless LAN (WLAN) and a portable Internet access authentication method for authenticating a user's connection in a public wireless LAN or a 3G mobile communication network and a portable Internet using a 3G mobile communication network.

As is well known to those skilled in the art, unlike a wired network, a public wireless LAN and a portable Internet are broadcation-type networks. Since a transmission medium is shared by all users, an attacker's access is easier than a wired network, Because there are many elements that can attack, a higher level of security mechanism than the wired network is required.

Meanwhile, the public wireless LAN as described above is data communication that can be implemented by the concept of expansion or replacement of a wired LAN. In the construction of a network system, a wired LAN, which uses a conventional twist pay cable, coaxial cable, Instead, it is a network system that uses the atmosphere as a communication channel by using high-frequency radio waves (RF) or infrared rays.

FIG. 1 shows a schematic configuration of a conventional public wireless LAN network system.

1, a conventional public wireless LAN network system includes a wireless terminal 1 equipped with a wireless LAN, an access point (AP) 2, and an authentication server 3. The wireless terminal 1 equipped with a wireless LAN performs actual data communication and transmits a connection authentication application message for accessing the network system of the public wireless LAN to the access point 2. [ The access point 2 receives the connection authentication request message of the wireless terminal 1 equipped with the wireless LAN and determines whether or not the connection is authenticated or notifies the authentication server 3 and transmits an authentication success or failure message to the authentication server 3 And informs whether or not the connection of the wireless terminal 1 equipped with the wireless LAN is permitted or not. The authentication server 3 receives and analyzes the connection request message of the wireless terminal 1 equipped with the wireless LAN from the access point 2 and transmits the connection request message to the wireless LAN terminal 1 .

An embodiment of the connection authentication method of the network system of the public wireless LAN configured as described above will be described as follows.

The user of the wireless terminal 1 equipped with the wireless LAN inputs the same SSID (Sub System IDentification) or WEP (Wired Equivalent Privacy) key as that of the access point 2 to request the connection authentication of the network system of the public wireless LAN. The access point 2 analyzes the SSID or WEP transmitted from the wireless terminal 1 equipped with the wireless LAN and permits the network connection if it is the same as the SSID or WEP of the access point 2. [ Here, the SSID is a unique identifier having a predetermined length of a predetermined length that is added to each header of packets transmitted through a wireless LAN, and is used as a password when wireless devices connect to a BSS (Basic Service Set). BSS is a LAN environment consisting of basic wireless devices in a limited space where wireless service is available. Because SSID distinguishes one wireless LAN from other wireless LAN, all access points or wireless devices that access a specific wireless LAN must use the same SSID. Any device that does not know the unique SSID of a particular BSS can not connect to that BSS. Since the SSID is ordinary text data added to the packet, there is no guarantee for the network system because there is a possibility of data leakage sufficiently.

WEP is a security protocol defined in the Wi-Fi standard to provide wireless LAN with similar level of security and confidentiality to that provided by wired LAN. While wired LANs can be protected by physical security procedures, such as controlling access to buildings in general, wireless LANs can not limit the wireless wavelengths used by a particular network to physical space, not valid. WEP seeks to establish protection similar to that provided by physical security measures in wired networks by encrypting the data transmitted over the WLAN. Data encryption protects the weak wireless link between the client and the access point, and other common LAN security procedures such as password protection, global encryption, virtual private network (VPN), and authentication to ensure confidentiality once this method is taken Can be implemented.

Another embodiment of a connection authentication method of a conventional public wireless LAN network system will be described as follows.

The user of the wireless terminal 1 equipped with the wireless LAN transmits an access request application to the access point 2. [ The access point 2 requests the wireless terminal 1 equipped with the wireless LAN to input the subscriber ID (subscriber identity information) in order to authenticate the registered user, and the registered user inputs the subscriber ID and the password. The access point 2 transmits the subscriber ID and password transmitted from the wireless terminal 1 equipped with the wireless LAN to the authentication server 3. The authentication server 3 analyzes the subscriber ID and password transmitted from the access point 2 and transmits an authentication success message if the user is a registered user and an authentication failure message to the access point 2 if the user is not a registered user. If the transmitted message is an authentication success message, the access point 2 transmits the encrypted key to the wireless terminal 1 equipped with the wireless LAN to allow access to the network system of the public wireless LAN.

In the case of the connection authentication method of the network system of the public wireless LAN using the authentication server, the wireless section between the authentication server and the access point is kept secure, while the wireless section between the access point and the wireless terminal equipped with the wireless LAN Due to the nature of the media sharing that the wireless LAN has, there is room for data leakage.

In addition, the SSID is a name of a network for performing a logical division in a wireless LAN, and provides only a basic level of access control function. Therefore, it is dangerous to configure the network system of the public wireless LAN solely because the access authentication method of the network system of the public wireless LAN using the SSID is not generally high.

It is the protection of the initial authentication data that is problematic in the authentication method of the wireless LAN or the portable Internet. After the recent research and development, the wireless data can be protected by using the encryption key, but the initial authentication data in the step of performing authentication is hard to be protected, and various attack methods using it are disclosed. For this reason, a specific session key is required to protect the authentication data.

Meanwhile, research on interworking between 3G, public wireless LAN, and portable Internet has been actively carried out. In such interworking, it is important to unify the security and authentication of each manganese data. At present, 3G performs mutual authentication using AKA (Authentication and Key Agreement) and applies enhanced security policy such as protecting data of wireless section and updating key periodically by using encryption / decryption key generated in authentication have. On the other hand, even though the authentication methods of public wireless LAN are various, the security policies that are mainly used are weak, and in the case of portable internet, it is similar to the authentication method of public wireless LAN as an initial development step.

According to an aspect of the present invention, there is provided a method for protecting wireless data of a public wireless LAN or a portable Internet using a cryptographic key generated in a 3G authentication process, The present invention provides a connection authentication method of a public wireless LAN and a portable Internet that can provide a convenience for a session setting by using the session key for authentication of the public wireless LAN and the portable Internet, I have to.

According to another aspect of the present invention, there is provided a method of authenticating a public wireless LAN or a portable Internet using a cryptographic key already generated in a mobile phone or a Universal Subscriber Identity Module (USIM) connected to a 3G mobile communication network, And a method for authenticating access of a public wireless LAN and a portable Internet that can provide a high level of security by protecting authentication data.                         

It is another object of the present invention to provide a method and system for enabling a user who is subscribed to a 3G mobile communication network to use the public wireless LAN or the portable Internet without having to go through a separate public wireless LAN or a mobile Internet subscription procedure, The present invention provides a method of authenticating access to a public wireless LAN and a portable Internet.

According to another aspect of the present invention, there is provided a method for authenticating access to a public wireless LAN and a portable Internet, the method comprising the steps of: (a) receiving a network access identifier (NAI) stored in a Universal Subscriber Identity Module (USIM) An attempt to access the public wireless LAN or the portable Internet with the encryption key; (b) delivering the NAI to a 3G authentication server in a public wireless LAN authentication server or a portable Internet authentication server; (c) a user corresponding to the NAI is confirmed in the 3G authentication server, and a cryptographic key for the verified user is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, An authentication performing step of performing connection authentication of the Internet; (d) when the encryption key is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, performing a separate authentication using the encryption key at the corresponding server, And a cipher key transmitting step of transmitting the cipher key to the public wireless LAN and the portable Internet.

In a preferred embodiment of the present invention, the step (c) includes performing connection authentication of the public wireless LAN or the portable Internet of the wireless terminal using the encryption key as a session key.

In a preferred embodiment of the present invention, the step of protecting wireless data transmitted and received through the public wireless LAN or the portable Internet using the 3G encryption key generated in the 3G authentication server and the mobile phone; Using the 3G cipher key as a session key for protecting authentication data of the public wireless LAN or the portable Internet; Providing the cipher key of the public wireless LAN or the portable Internet in the 3G mobile communication network of the 3G authentication server; And the public wireless LAN authentication server or the portable Internet authentication server connected to the 3G mobile communication network may use the 3G encryption key for encryption and / or decryption of the wireless data.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Reference will now be made in detail to the preferred embodiments of the present invention, examples of which are illustrated in the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and may be changed according to the intention or custom of the user, the operator, and the like. Therefore, the definition should be based on the contents throughout this specification.

In the following description, when the constituent members according to the prior art and the constituent members according to the present invention are the same, reference numerals used in the prior art are used as they are, and a detailed description thereof will be omitted.

FIG. 2 is a system configuration diagram of a public wireless LAN according to the present invention and a connection authentication method of the portable Internet. FIG. 3 is a flowchart of a connection authentication method of a public wireless LAN and a portable Internet according to the present invention. 4 and 5 are operation flowcharts of a connection authentication method according to the present invention.

2, the public wireless LAN authentication server 400 and the portable Internet authentication server 500 are respectively connected to the authentication server 300 of the 3G mobile communication network and the 3G authentication server 300 Is connected to a 3G mobile phone 200 incorporating a Universal Subscriber Identity Module (USIM) 250. In the system of the present invention, when the mobile telephone 200 or the USIM 250 succeeds in mutual authentication with the network according to the authentication procedure of the 3G mobile communication network, a cryptographic key is generated for protecting the communication data, The authentication server 300 has the same encryption key as the mobile phone 200. [

The 3G authentication server 300 is a component of 3G mobile communication that performs authentication for a user who wishes to access a 3G mobile communication network and the public wireless LAN authentication server 400 and the portable Internet authentication server 500 are a service And performs connection authentication for the user who wants to use the service.

3, a method for authenticating a connection between a public wireless LAN and a portable Internet according to the present invention is a method in which a wireless terminal 100 (FIG. 2) such as a notebook PC or PDA is connected to a NAI And attempting to access the public wireless LAN or the portable Internet with the encryption key (S100); An NAI delivery step (S200) of delivering the NAI to the 3G authentication server (300) in the public wireless LAN authentication server (400) or the portable Internet authentication server (500); The 3G authentication server 300 confirms the user corresponding to the NAI and transmits the encryption key for the verified user to the public wireless LAN authentication server 400 or the portable Internet authentication server 500, (S300) of performing connection authentication of the public wireless LAN of the wireless terminal 100 or the portable Internet using the key. When the encryption key is transmitted to the public wireless LAN authentication server 400 or the portable Internet authentication server 500, the server performs separate authentication using the encryption key or transmits the authentication to the corresponding access point 450 or 550 A cryptographic key delivery step (400) for delivering the cryptographic key; And a step S500 of using the public wireless LAN or the portable Internet through the access point 450 and the wireless terminal 100 in the connection authenticated state as described above.

The operation of the connection authentication method and system of the public wireless LAN and the portable Internet according to the present invention will be described with reference to FIGS. 2 to 5. FIG.

The Network Access Identifier (NAI) used in the present invention is an ID generated using International Mobile Subscriber Identity (IMSI) of 3G mobile communication or other information.

4, the 3G mobile phone 200 attempts to connect to an access point (AP) 450 (550) of a public wireless LAN or a portable Internet through a wireless terminal (e.g., notebook computer, PDA, etc.) And transmits data such as an encryption key and an NAI to the wireless terminal 100.

The wireless terminal 100 tries to connect through the access points 450 and 550 and the access points 450 and 550 transmit the temporary ID of the user to the authentication server 400 and 500. The public wireless LAN authentication server 400 or the portable Internet authentication server 500 transmits the temporary ID of the user to the 3G authentication server 300 and the 3G authentication server 300 identifies the user corresponding to the NAI.

The 3G authentication server 300 transmits the encryption key to the corresponding authentication server 400 and the corresponding authentication server 400 and 500 transmits the encryption key to the corresponding access point 450 550). ≪ / RTI > In FIG. 4, a session interval may vary depending on the role of each component. If the 3G authentication server 300 directly handles authentication of the public wireless LAN or the portable Internet, the session is initiated by the 3G authentication server 300. Otherwise, the authentication server 400 (500) Lt; / RTI > Also, the session setting range of the terminal portion may be a terminal or a USIM card.

5 illustrates a process of using the cryptographic key as an encryption / decryption key for protecting wireless data of a public wireless LAN or a portable Internet. The cryptographic key is generated in the authentication process illustrated in FIG. 4 An authentication key (CK) is used. Since the encryption key (CK) is updated at the time of 3G authentication as shown in FIG. 4, an attack against the encryption key can be prevented.

Accordingly, the present invention can protect the data of the wireless zone with high security level by using the encryption key already generated in the mobile phone or the USIM connected to the 3G mobile communication network.

As described above, according to the present invention, there is provided a method and system for authenticating a connection between a public wireless LAN and a portable Internet, comprising the steps of: protecting wireless data using a cryptographic key generated in an authentication process of a public wireless LAN or a portable Internet; The present invention provides an advantage of providing a convenience of setting a session by utilizing the session key for authentication of the network and further ensuring a high security level network by allowing the encryption key to be updated arbitrarily.

In addition, the present invention can improve the convenience of network use by allowing a user who is subscribed to a 3G mobile communication network to use the public wireless LAN or the portable Internet without going through a subscription procedure of a separate public wireless LAN or a portable Internet This provides the advantage.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims. It will be understood that the invention may be embodied in other forms without departing from the spirit or scope of the invention. Therefore, modifications of the embodiments of the present invention will not depart from the scope of the present invention.

Claims (5)

A method for authenticating access of a public wireless LAN and a portable Internet, (a) a wireless terminal attempts to access the public wireless LAN or the portable Internet using a network access identifier (NAI) and a cipher key (CK) stored in a Universal Subscriber Identity Module (USIM) of a 3G mobile phone step; (b) an NAI delivery step of delivering the NAI to a 3G authentication server in a public wireless LAN authentication server or a portable Internet authentication server; (c) a user corresponding to the NAI is confirmed in the 3G authentication server, and a cryptographic key for the verified user is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, An authentication performing step of performing connection authentication of the Internet; (d) when the encryption key is transmitted to the public wireless LAN authentication server or the portable Internet authentication server, performing a separate authentication using the encryption key at the corresponding server, And transmitting the encrypted key to the public wireless LAN and the portable Internet using the encryption key generated in the 3G authentication. The method according to claim 1, And protecting the wireless data transmitted and received via the public wireless LAN or the portable Internet using the 3G encryption key generated by the 3G authentication server. And a connection authentication method of a portable Internet. 3. The method according to claim 1 or 2, Using the 3G cipher key as a session key for protecting the authentication data of the public wireless LAN or the portable Internet, and authenticating the public wireless LAN and the portable Internet using the cipher key generated in the 3G authentication . 3. The method according to claim 1 or 2, And the 3G authentication server providing the 3G encryption key to the public wireless LAN or the authentication server of the portable Internet in the 3G mobile communication network. Connection authentication method. 3. The method according to claim 1 or 2, And the public wireless LAN authentication server or the portable Internet authentication server connected to the 3G mobile communication network uses the 3G encryption key for encryption and / or decryption of the wireless data. Authentication method of public wireless LAN and portable internet using cryptographic key.

Images