KR100609704B1 - Method for setting end-to-end security in mobile IP and Apparatus thereof - Google Patents

Abstract

The present invention relates to a method and setting device for end-to-end security in a mobile Internet Protocol (IP) environment, and more particularly, to a method for setting end-to-end security using an internal redirect. TECHNICAL FIELD The present invention relates to the field of communication security between authentication servers during user authentication in mobile Internet and mobile communication system environments.

In the end-to-end security setting method in the mobile IP environment disclosed herein, when the routing information on the user authentication request message sent from the NAS is redirected to AAAH, AAAF performs TLS (Transport Layer Security) setting and the AAAH is performed. Performing a redirect to the AAAH by sending an authentication request message; Generating, by the AAAH, an authentication response (permission) message for the authentication request message and transmitting the same to the AAAF; And the AAAF transmitting the response message to the NAS to achieve the object and technical problem of the present invention.

Description

Method for setting end-to-end security in mobile IP environment and setting device {Method for setting end-to-end security in mobile IP and Apparatus

1 is a diagram illustrating an information flow for user authentication in Diameter communication protocol in a mobile IP environment.

2 is a diagram illustrating a flow for providing a security service using a PKI in the Diameter communication protocol.

3 is a diagram illustrating a flow for end-to-end security in a mobile IP which is currently being standardized in Diameter WG.

4 is a diagram illustrating a flow for end-to-end security using redirect in Diameter EAP application.

FIG. 5A is a diagram illustrating a flow of a method for configuring end-to-end security in a mobile IP environment disclosed herein.

FIG. 5B is a diagram illustrating a configuration of an embodiment of an end-to-end security configuration apparatus in a mobile IP environment disclosed herein.

The present invention relates to a method and setting device for end-to-end security in a mobile Internet Protocol (IP) environment, and more particularly, to a method for setting end-to-end security using an internal redirect. TECHNICAL FIELD The present invention relates to the field of communication security between authentication servers during user authentication in mobile Internet and mobile communication systems (3rd generation IMT-2000 and later generations of mobile communication systems).

1 is a diagram illustrating a flow of information for user authentication in a mobile IP environment, in which the Diameter protocol is applied.

NAS (Network Access Server) 10 and AAAH (Authentication, Authorization and Accounting server in Home network, 13) are end nodes for participation in communication in a communication environment in which user traffic is transmitted and received. The intermediate nodes AAAF (Authentication, Authorization and Accounting server in Foreign network, 11) and AAAB (Authentication, Authorization and Accounting server in Broker network, 12) participate in the user authentication process, or NAS (10) and AAAH (13). It serves to pass messages between).

In this case, NAS, AAAF, AAAB, and AAAH nodes are nodes that are applied when the two concepts are mixed with nodes to which AAA (Authentication, Authorization and Accounting) protocol is applied in a mobile environment. The AAA server is the basic node of the Diameter protocol, but the roles are divided into AAAF, AAAB, and AAAH according to the mobile environment. NAS is also a basic node for mobile communication and a node directly connected to a user.

The Diameter protocol is a protocol for setting up security in a mobile IP environment. The Diameter CMS Security Application is used for end-to-end security and the (hop) hop for hop (hop by hop security). Apply TLS (Transport Layer Security) or IPsec (IP security).

When the user reaches the external network out of his registration network, and transmits the service request message to the NAS (10) (S11). The NAS 10 checks AAAH 13, which is a user's registration network, and transmits an authentication request message to the AAAF 11 (S12). In this process, the AAAF 11, which is an authentication server of an external network, may perform a task required by the mobile IP application in an authentication request message. The AAAB 12 is a broker network connecting the network of the AAAF 11 and the network of the AAAH 13, and performs a function of relaying messages between the two networks.

Authentication request messages (S13, S14) and response messages (S15 to S17) between the NAS 10 and AAAH 13 are transmitted and received through the AAAF 11 and AAAB 12, and the service is provided to the user when authentication is successful. (S18).

FIG. 2 is a diagram illustrating an information flow for providing a security service using a public key infrastructure (PKI) in a diameter communication protocol.

The information flow shown in FIG. 2 is by Diameter CMS Security Application of Diameter AAA Working Group (WG), and provides security between Diameter end nodes. In order to share end-to-end security information, the node NAS 10 and the AAAH 13 first establish a DSA (Diameter Security Association) (S21 to S26), and the processes S11 to S18 shown in FIG. do.

The DSA setting is set by transmitting and receiving a DSAR (Diameter Security Association Request) message (S21 to S23) and a DSAA (DSA Answer) message (S24 to S26). With the configuration of the DSA, the two end nodes NAS 10 and AAAH 13 can apply 3-DES (3-Data Encryption Standard) encryption and digital signature for future messages. For mobile IP or Extensible Authentication Protocol (EAP) applications, end-to-end security is applied through the DSA set in the user authentication request message.

However, the Diameter CMS Security Application was discontinued in 2003. Therefore, as an alternative to this, standardization work is underway to apply end-to-end security using TLS, which is used in the redirection scheme and inter-node security.

The present invention was devised to cope with such a movement, and an object of the present invention and the technical problem to be achieved is to establish an end-to-end security configuration using a redirect in a mobile IP environment between network nodes that must perform communication for user authentication. The present invention provides a method and apparatus for safer and more efficient operation.

End-to-end security configuration method in the mobile IP environment disclosed herein (a) when the routing information on the user authentication request message sent from the NAS is redirected to AAAH, AAAF performs a transport layer security (TLS) configuration, Transmitting the authentication request message to the AAAH to perform a redirect to the AAAH; (b) the AAAH generating an authentication response (permission) message for the authentication request message and transmitting it to the AAAF; And (c) the AAAF transmitting the response message to the NAS to achieve the object and technical problem of the present invention.

In the step (a), the AAAF is performed by directly performing a redirect to the AAAH without transmitting and receiving a redirect message with the intermediate node AAAB.

In addition, when the routing information of the user authentication request message received from the NAS is redirected to AAAH, the apparatus for end-to-end security setting in the mobile IP environment disclosed herein sets the redirect to the AAAH by transmitting the message to the AAAH. A redirect setting unit; And an authentication response message generation unit configured to receive the message from the setting unit and generate an authentication response (permission) message for the message and transmit the same to the NAS to achieve the object and technical problem of the present invention.

Hereinafter, in order to clarify the technical spirit of the present invention, the configuration and operation thereof will be described in detail with reference to the accompanying drawings based on the embodiments of the present invention. Although the same reference numerals have been given even in different drawings, it will be appreciated that components of other drawings may be cited when necessary in describing the drawings.

The core of the technical idea provided by the present invention is to set up a redirect configuration server (hereinafter referred to as a "redirect server") AAAF as a final node in a mobile IP application to provide end-to-end security in a mobile IP environment more efficiently and safely By setting it as a server, the AAAF performs the direct redirect to the AAAH without sending or receiving a message for the redirect with the intermediate node AAAB.

An end-to-end security configuration method that provides a basic concept of implementing the present invention will be described with reference to FIGS. 3 and 4.

3 is a diagram illustrating an information flow for end-to-end security configuration in a mobile IP environment in which standardization is performed in Diameter WG. The method shown in FIG. 3 is a method of communicating without passing through an intermediate transit node through a direct connection between end nodes using a TLS and a redirect technique used in the existing inter-node security.

In the security scheme shown in FIG. 3, it is assumed that the intermediate node AAAB 12 acts as a redirect server. The redirect server AAAB 12 has a function of providing the sender of the message with information capable of directly connecting to the destination server upon receipt of a message having specific application information in the host information in the routing table.

When the initial user requests the service (S31), the NAS 10 transmits a user authentication request message to the AAAF 11 (S32). The AAAF 11 performs a process for the mobile IP application corresponding to this message and then transmits a user authentication request message to the AAAB 12 according to the routing information (S33).

AAAB 12, acting as a redirect server, redirects direct connection information from AAAF 11 to AAAH 13 when the application of the authentication request message is a mobile IP and the routing information on the message is set to redirect. It inserts in the and inserts the redirect information in the authentication response message and transmits it to the sender of the authentication request message, that is, AAAF 11 (S34). Upon receiving this redirect information, the AAAF 11 performs a direct connection request and TLS setup to the AAAH 13 (S35) and directly sends and receives an authentication request message (S36) and a response message (S37).

Here, the actual end nodes in the mobile IP application are NAS 10 and AAAH 13, but because of the characteristics of the mobile IP application, AAAF 11 is also involved in the processing of the authentication request message and the response message. End-to-end security relationships should also be established between the AAAHs 13. After the step S37, the AAAF 11 transmits a response message to the NAS 10 (S38), and thereafter, a message for authentication is directly transmitted and received between the AAAF 11 and the AAAH 13 without passing through an intermediate node (R1 to R1 through). A2). If authentication is successful, a service is provided to the user (S39).

4 is a diagram illustrating an information flow for end-to-end security using redirect in Diameter EAP application.

In the EAP application, since the processing for the mobile IP application in the AAAF 11 is not necessary, the AAAF 11 can serve as a direct redirect server unlike the case of FIG. 3. Therefore, direct communication between the NAS 10 and the AAAH 13, which are actual end nodes, is possible.

When the initial user requests a service (S41), the NAS 10 transmits a user authentication request message to the AAAF 11 (S42). The AAAF 11 acting as a redirect server inserts direct connection information to the AAAH 13 into the redirect information elements when the application of the authentication request message is EAP and the routing information is set to redirect to the AAAH 13. The information is included in the authentication response message and transmitted to the sender of the authentication request message, that is, the NAS 10 (S43).

The NAS 10, upon receiving this redirect information, performs a direct connection request and TLS setup to the AAAH 13 (S44) and sends an authentication request and response message to the AAAH 13 without passing through the intermediate node AAAB 12. Send and receive directly (S45, S46). If authentication is successful, a service is provided to the user (S47).

The end-to-end security scheme using redirect in the mobile IP environment shown in FIG. 3 has several disadvantages compared to the EAP application scheme shown in FIG. 4. End-to-end security is to prevent illegal message modification, addition, exposure, etc. in the intermediate transit node, not the node that processes the message, and the security in the AAAB 12 acting as a redirect server may be a problem. There are more message interfaces than for an application. This reduces the safety and efficiency of the Diameter protocol. Also in the end-to-end security scheme shown in Figure 4, there is an inefficient side because the transmission and reception of the message for the redirect between the NAS 10 and AAAF (11) occurs.

In FIG. 5A, a redirect end-to-end security method in a mobile IP environment proposed by the present invention is presented, which is performed by a user authentication process using a Diameter protocol.

The end-to-end security configuration method in the mobile IP environment disclosed herein in FIG. 5A is based on the scheme shown in FIG. 3, but adds the concept of the scheme shown in FIG. 4 to solve the above disadvantages.

First, the user requests authentication to receive a service (S51). The NAS 10 generates an authentication request message and transmits it to the AAAF 11 (S52). At this time, the AAAF 11 plays the role of a redirect server as in the case of the EAP application shown in FIG. 4, and the AAAF 11 having received the authentication request message performs the necessary processing for the mobile IP application to perform the authentication request message. Correct it. In case of redirection to the AAAH 13 by checking the routing information on the request message, the lower connection setting and the TLS setting are performed (S53), and the user authentication request message is transmitted to the AAAH 13 (S54). Here, the lower connection means that diameter nodes such as NAS, AAAH, AAAB, and AAAF interconnect each other using any one of communication protocols such as Transmission Control Protocol (TCP) and Stream Control Transmission Protocol (SCTP).

The AAAH 13 generates an authentication response message for the authentication request and delivers it to the AAAF 11 (S55), and the AAAF 11 transmits it to the NAS 10 (S56). According to the authentication mechanism, additional user request and response messages may be transmitted and received (R1 to A2), and the contents of the message are the same as those transmitted and received through S52 to S56, and these additional messages are directly connected to each other through AAAF (11). ) And directly through the AAAH (13). Where R is 'Request' and A is 'Answer'. If authentication is successful, a desired service is provided to the user (S57).

5B shows a configuration of an example of a redirect end-to-end security device disclosed herein.

The NAS 10 generates a user authentication request message and transmits it to the AAAF 11. At this time, the AAAF 11 plays the role of a redirect server as in the case of the EAP application shown in FIG. Upon receiving the authentication request message, the redirect setting unit 111 in the AAAF 11 performs the necessary processing for the mobile IP application to modify the authentication request message. In case of the redirection to the AAAH 13 by checking the routing information on the request message, the lower connection setting and the TLS setting are performed, and the user authentication request message is transmitted to the AAAH 13.

The authentication response message generating unit 131 in the AAAH 13 generates an authentication response (permission) message for the authentication request and transmits the authentication response message transmitting / receiving unit 112 in the AAAF 11 to send the authentication response message transmitting / receiving unit. 112 transmits this to NAS 10, thereby establishing end-to-end security.

In the implementation of the present invention, protocol modification of RFC 3588 is unnecessary. Only, the AAAF 11 node internally performs the function of the redirect server so that the AAAF 11 node directly provides the redirect function without transmitting / receiving (S34) the redirect information with the intermediate node AAAB 12.

Compared with the mobile IP-based end-to-end security scheme shown in FIG. 3, the present invention does not go through AAAB 12, which is a node that does not directly participate in the user authentication process, thereby enabling more efficient communication, and the end-to-end security scheme shown in FIG. Compared with the above method, transmission and reception of messages for redirection are unnecessary, which is more efficient.

The invention can also be embodied as computer readable code on a computer readable recording medium. Computer-readable recording media include all types of recording devices that store data that can be read by a computer system. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

So far I looked at the center of the preferred embodiment for the present invention. Those skilled in the art will appreciate that the present invention can be implemented in a modified form without departing from the essential features of the present invention. Therefore, the disclosed embodiments should be considered in descriptive sense only and not for purposes of limitation. The scope of the present invention is shown in the claims rather than the foregoing description, and all differences within the equivalent scope will be construed as being included in the present invention.

According to the present invention, since the security is set without transmitting and receiving the redirect information with the intermediate node AAAB, it is possible to reduce the number of communication between the nodes and at the same time make more secure communication. Previously, an intermediate node not participating in the user authentication process could modify or directly view the initial authentication information of the user authentication message and transmit and receive the redirect information, thereby causing problems in terms of both safety and efficiency. Internal redirects can be performed directly at the end nodes participating in the SNS, reducing the interface between communication nodes and protecting user authentication information from other nodes.

Claims (4)

(a) When the routing information on the user authentication request message received from the NAS is redirected to AAAH, the AAAF performs a transport layer security (TLS) setting and sends the authentication request message to the AAAH to perform the redirect to the AAAH. Doing; (b) the AAAH generating an authentication response (permission) message for the authentication request message and transmitting it to the AAAF; And (c) the AAAF transmitting the response message to the user. The end-to-end in a mobile IP environment of claim 1, wherein step (a) is performed by the AAAF directly performing the redirect to the AAAH without transmitting and receiving a message for the intermediate node AAAB and the redirect. How to set up security. A redirect setting unit configured to set the redirect to the AAAH by transmitting the authentication request message to the AAAH when the routing information of the user authentication request message received from the NAS is redirected to the AAAH; And End-to-end security in a mobile IP environment, characterized in that for receiving the authentication request message from the setting unit and generates an authentication response (authorization) message for the authentication request message and transmits to the NAS Setting device. The end-to-end security setting device of claim 3, wherein the redirect setting unit directly sets the redirect to the AAAH without transmitting and receiving an intermediate node AAAB and a message for the redirect.

Images