KR100729729B1 - authentication device and method of access point in wireless portable internet system - Google Patents

Abstract

The present invention relates to an apparatus and method for authenticating an access point of a wireless portable Internet system.

In a wireless portable Internet system, an access point establishes a matching scheme for sending and receiving messages with a router providing a connection with an authentication server. In particular, one of a user datagram protocol (UDP) or a stream control transmission protocol (SCTP) may be set in a matching manner with the packet access router. Subsequently, RSA (Rivest Shamir Adleman) based device authentication is performed by transmitting and receiving a message with the terminal in response to a request from the terminal. In response to a user authentication request from a terminal, a message is transmitted and received with the packet access router according to an established matching scheme, and an EAP (Extensible Authentication Protocol) based user authentication is performed through the authentication authentication server.

Therefore, in the access point of the wireless portable Internet system, user authentication and device authentication can be effectively performed by interworking with the packet access router in various ways.

Wireless Mobile Internet, Access Points, Authentication, RSA, EAP, Packet Access Routers

Description

Authentication device and method of access point in wireless portable internet system

1 is a schematic diagram showing the structure of a wireless portable Internet system according to an embodiment of the present invention.

2 is a structural diagram of an access point according to an embodiment of the present invention.

3 is a flowchart illustrating an authentication method according to an embodiment of the present invention.

4 is a flowchart illustrating a process of exchanging security related information in an authentication method according to an embodiment of the present invention.

The present invention relates to an authentication technology in a wireless portable internet system, and more particularly, to an authentication apparatus and method for performing device authentication and user authentication in an access point of a wireless portable internet system.

In the mobile communication system, the wireless portable Internet is a next-generation communication method that further supports mobility to a short-range data communication method using a fixed access point like a conventional wireless LAN. Various standards have been proposed for the wireless portable Internet, and international standardization of the portable internet has been actively conducted in IEEE 802.16. Here, IEEE 802.16 is basically a standard that supports Metropolitan Area Network (MAN), and refers to an information communication network covering an intermediate area between a local area network (LAN) and a wide area network (WAN).

In order to securely provide various traffic data services in a wireless portable Internet system, an authentication and authority verification procedure for a terminal should be performed. These functions are emerging as the basic requirements for the safety of the wireless mobile Internet service and the network stability.

The subscriber station may receive a wireless portable Internet service through a wireless access device such as an access point (AP). In this case, the wireless access device performs user authentication for the subscriber station through an authentication server. In authentication, the wireless access device communicates with an authentication server via a packet access router to perform user authentication. However, although this authentication method is effective, there is no provision for an authenticated subscriber requesting service with an inappropriate device. In addition, there is a problem that the method of distributing, storing and maintaining the authentication related key in real time is not efficient.

Therefore, the technical problem to be achieved by the present invention is to solve the conventional problems as described above, by performing the user authentication as well as the user authentication in the access point of the wireless mobile Internet system efficiently, a more stable and strong authentication function To provide an apparatus and a method for the same.

Another object of the present invention is to enable an access point of a wireless portable Internet system to perform an authentication function by accessing a packet access router for connection with a backbone network through various methods.

In order to achieve this technical problem, an authentication method according to an aspect of the present invention, in a wireless portable Internet system, a packet access router for providing a connection with the authentication server, and a method for performing authentication in an access point connected to the terminal A) performing mutual authentication by transmitting and receiving a RSA (Rivest Shamir Adleman) based authentication related message with the terminal according to a device authentication request from the terminal; b) transmitting and receiving an EAP (Extensible Authentication Protocol) based authentication message with the terminal according to a user authentication request from the terminal and performing user authentication; And c) when the device authentication and the user authentication are completed, transmitting and receiving a security related message with the terminal, and performing an authentication algorithm and SA (Security Association) information exchange between the terminals, wherein the step b) includes: Establishing a matching scheme with the packet access router; And transmitting and receiving a message to and from the packet access router according to the set matching scheme, and performing authentication of the user of the terminal through the authentication server.

In addition, the authentication apparatus according to another aspect of the present invention, in a wireless portable Internet system, a packet access router that provides a connection to the authentication server, and the authentication device of the access point connected to the terminal, the message transmission and reception with the terminal A traffic processing unit to perform; A matching processor configured to transmit and receive a message according to a matching scheme established with the packet access router; An authentication processing unit for performing device authentication according to an authentication request from the terminal provided through the traffic processing unit, and performing user authentication with respect to the terminal in association with the authentication server through the packet access router; And a message processing unit for processing the message provided from the authentication processing unit in a form that can be transmitted to the traffic processing unit, and processing the message authorized from the traffic processing unit in a form that can be processed by the authentication processing unit and providing the message to the authentication processing unit. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention.

In addition, when a part is said to "include" a certain component, this means that it may further include other components, except to exclude other components unless otherwise stated.

In addition, the term module described herein refers to a unit for processing a specific function or operation, which may be implemented in hardware or software, or a combination of hardware and software.

1 is a view schematically showing the structure of a wireless portable Internet system according to an embodiment of the present invention.

The wireless mobile Internet system basically includes a subscriber station (Subscribe Station) 100, an access point (AP: 200, 210, optionally assigns "200" as a representative number for convenience of description), and packet access connected with the access point. An authentication server (AAA: Authentication Authorization and Accounting) 400 connected to the routers 300 and 310 and the packet access routers 300 and 310 to authenticate the subscriber station 100. It includes. In addition, a home agent (HA) 500 may be further included.

The access point is installed in, for example, a dense urban area, and manages multiple terminals, and the packet access router manages a plurality of access points to form a hierarchical structure.

In such a wireless portable Internet system, a wireless link connection, basic function negotiation, authentication, registration, handoff, traffic connection setting function, etc. may be performed according to the interworking of the subscriber station 100, the access point 200, and the packet access router 300. Is performed. In this case, the access point 200 processes a signal transmitted from the terminal 100 or the packet access router 300 and transmits the signal to the packet access router 300 or the terminal 100, respectively, and the packet access router 300 includes a plurality of packets. It manages the access point 200 to perform handoff control and mobile IP functions.

Meanwhile, the subscriber station 100 and the access points 200 and 210 start communication to negotiate an authentication mode for authentication of the subscriber terminal 100 and perform an authentication procedure of a selected method according to the negotiation result. According to an embodiment of the present invention, device authentication is performed in a media access control (MAC) layer of a terminal and an access point, and user authentication is performed by an upper layer (eg, an EAP (Extensible Authentication Protocol) layer) of the MAC layer of the terminal and the authentication server. Is done in

The MAC layer performs overall control to enable wireless communication, and the MAC layer for each function includes a MAC common part that performs functions related to system access, bandwidth allocation, traffic connection establishment and maintenance, and QoS management. It may be divided into a common part sublayer, and a service specific convergence sublayer that is responsible for payload header suppression and QoS mapping functions. In this hierarchical structure, a security sublayer that performs security functions including device authentication, security key exchange, and encryption functions for a terminal or an access point may be defined in a service specific convergence sublayer, but is not limited thereto. It doesn't work.

2 is a diagram illustrating the structure of an access point according to an embodiment of the present invention in such a wireless portable Internet system.

As shown in FIG. 2, an access point 200 according to an embodiment of the present invention may include a message processor 210, an authentication processor 220, a traffic processor 240, and a packet access router matching processor 230. Include.

The traffic processor 240 processes the traffic with the terminal and interworks with the message processor 210 when the corresponding traffic is a message.

The message processor 210 processes the message from the terminal provided from the traffic processor 240 to the authentication processor 220, processes the message provided from the authentication processor 220, and provides the message to the traffic processor 240. . In particular, it determines the type of the message from the terminal, that is, the MAC message, and if the authentication-related message is converted to an internal message and transmitted to the authentication processing unit 220. In addition, the message from the authentication processing unit 220 is converted into a MAC message and transferred to the traffic processing unit 240 to be provided to the terminal 100.

The authentication processor 220 analyzes a message from the terminal transmitted from the message processor 210 and performs a predetermined authentication function. To this end, the authentication processing unit 220 includes a device authentication module 221 for performing mutual authentication with the terminal, a user authentication module 222 for performing user authentication, and a key management module 223 for managing a plurality of keys related to authentication. It includes.

The device authentication module 221 performs device authentication according to a message from the terminal, and in particular, performs RSA based authentication with the terminal. Specifically, the terminal authenticates the terminal according to the authentication request from the terminal, and if the authentication is successful, requesting the terminal to authenticate itself, that is, the authentication of the access point. Let this be done.

The user authentication module 222 performs user authentication according to a message from the terminal. In particular, the user authentication module 222 performs EAP-based user authentication by performing message transmission and reception between the terminal and the authentication server through the matching processor 230.

The key management module 223 generates or generates authentication related information including various keys (for example, public key, secret key, authentication key, encryption key, etc.) generated according to the device authentication and user authentication. Store and manage.

When the matching processing unit 230 receives a packet access router related message transmission request from the authentication processing unit 220, the matching processing unit 230 processes the message according to a protocol corresponding to a predetermined matching method, and transmits the message to the packet access router 300, and also the packet access router. Receives a message from the 300 according to the protocol and delivers it to the authentication processing unit 220. To this end, the matching processor 230 is a UDP matching module 231 for transmitting and receiving a message with a packet access router according to a User Datagram protocol (UDP), and an SCTP matching for transmitting and receiving a message with a packet access router according to a Stream Control Transmission Protocol (SCTP). Module 232.

By such a component, an authentication apparatus for authentication of the access point 200 may be implemented. In addition, it will be apparent to those skilled in the art that the access point 200 may be implemented in a form that further includes components for performing other functions of the access point in addition to the above-described components, and thus, the additional components may be described in detail. Omit.

Next, an authentication method according to an embodiment of the present invention will be described based on this structure.

3 is a flowchart illustrating an authentication method according to an embodiment of the present invention.

In an embodiment of the present invention, the terminal and the access point exchange messages, and perform authentication based on IEEE 802.16e PKMv2. That is, the message is processed as a MAC message called Privacy Key Management (PKM), and is transmitted and received between the terminal and the access point.

Downlink synchronization is established between the terminal 100 and the access point 200, and after a ranging procedure is performed, an authentication method of a predetermined method is selected while negotiation about the basic function of the terminal for connection establishment is performed. Can be.

In addition, the access point 200 stores a protocol for transmitting and receiving a message with the packet access router 300 in a database when the initial shape is determined in advance, and a predetermined protocol, that is, UDP or SCTP is set accordingly.

When the authentication scheme is negotiated between the terminal and the access point as described above, an authentication procedure as shown in FIG. 3 is performed.

As shown in FIG. 3, the terminal 100 transmits the subscriber digital certificate to the access point 200 through a PKM message which is an authentication message among MAC messages. In more detail, a PKMv2 RSA-Request message (also referred to as an RSA authentication request message) is transmitted by including a certificate (eg, an X.509 CA certificate) including the public key of the terminal (S100 to S110).

This message is provided to the message processing unit 210 through the traffic processing unit 240 of the access point 200. The message processor 210 processes the transmitted message in the form of an internal message and provides the message to the authentication processor 220. Therefore, a predetermined module of the authentication processing unit 220 performs authentication processing based on the message.

Specifically, upon receiving the PKMv2 RSA-Request message from the terminal 100, the device authentication module 221 of the access point 200 performs device authentication for the terminal based on the certificate included in the message.

If authentication of the terminal 100 is successful, the device authentication module 221 may include a PKMv2 RSA-Reply message (aka RSA authentication response message) including a pre-PAK encrypted with a certificate of an access point and a public key of the terminal 100. And transmits the request to the terminal 100 for authentication of the access point (S120). Here, pre-PAK (Primary Authentication Key) is the primary key for generating the authentication key, PKMv2 RSA-Reply message in addition to the pre-PAK, and any value for access point authentication, key validity time, message authentication (for example, CMAC-Digest or HMAC-Digest, etc.) may be included.

On the other hand, if authentication of the terminal fails, the device authentication module 221 transmits a PKMv2 RSA-Reject message including an error code indicating the cause of the failure of the RSA-based authentication to the terminal 100, and notifies that the authentication has failed. .

Upon receiving the PKMv2 RSA-Reply message from the access point 200 in the above step, the terminal 100 verifies the certificate of the access point included in the message, performs authority verification for the access point, and includes the result. The PKMv2 RSA-Acknowledgement message (also called "RSA authentication success message") is transmitted to the access point 200 (S130). As described above, RSA-based authentication is performed in the terminal side, and when the verification of the access point is successful, the terminal 100 transmits a PKMv2 RSA-Acknowledgement message including the result of the success to the access point 200, thereby providing RSA-based authentication. The mutual authentication procedure is completed. If the authentication fails, the PKMv2 RSA-Acknowledgement message includes information on the reason for the failure, etc. In this case, the access point 200 requests the basic call processing to terminate the access control procedure and perform the connection release process.

As described above, if the authentication procedure for the RSA-based authentication device is successfully completed, user authentication is performed as follows. On the other hand, if device authentication is not required, the user authentication described below may be performed.

Specifically, as shown in FIG. 3, the terminal 100 transmits a PKMv2 EAP-start message (aka, "EAP authentication start message") to the access point 200 to notify the EAP authentication protocol of the network to start the EAP-based authentication procedure. Is called) (S140). Upon receiving this message, the user authentication module 222 of the access point 200 notifies the upper authentication protocol layer of the start of the EAP based authentication procedure. That is, the message is sent to the packet access router matching processor 230 to notify the authentication server 400 that the EAP-based authentication procedure has been started through the higher authentication protocol layer. The matching processor 230 processes the message according to a predetermined matching method. For example, when the UDP matching method is set, the matching processing unit 230 delivers the message to the UDP matching module 231. Transfer to SCTP matching module 232. Therefore, the PKMv2 EAP-start message is processed and transmitted to the packet access router 300 according to the set matching scheme, and the packet access router 300 transmits the message to the authentication server 400 (S150).

Subsequently, when an EAP-Request / Identify message including EAP data for authentication is transmitted from the authentication server 400 as a response to the PKMv2 EAP-start message, the packet access router 300 processes the packet access router 300 according to the set matching scheme. The response message is transmitted to the access point 200 (S160).

The UDP matching module 231 or the SCTP matching module 232 of the access point 200 receives the response message and provides the response message to the authentication processing unit 220. The user authentication module 222 of the authentication processing unit 220 performs EAP authentication. Whenever a response message including EAP data is received from a higher authentication protocol layer according to a protocol procedure, the data is referred to as a terminal through a PKMv2 EAP-Transfer message (aka, "EAP data transmission message"). Transmit to (S170). That is, the user authentication module 222 provides the response message to the message processing unit 210, and the message processing unit 210 stores the authentication information of the subscriber included in the response message--where the authentication information is secured on the EAP. Data such as TLS or TTLS, which is a protocol, for example, the information contained in the EAP data payload is included in the PKMv2 EAP-transfer message and transmitted to the terminal 100 through the traffic processor 240.

On the other hand, when the terminal 100 receiving the PKMv2 EAP-transfer message is also provided with EAP data transmitted from the upper protocol layer of the terminal, the terminal 100 transmits the PKMv2 EAP-transfer message including the EAP data to the access point 200. (S180). According to the procedure of the EAP authentication protocol, a plurality of PKMv2 EAP-Transfer messages are transferred between the terminal 100 and the access point 200, converted into EAP-Transfer messages, and then converted to an EAP-Transfer message via the packet access router 300 to the authentication server 400. In this case, user authentication is performed in the EAP authentication protocol layer existing in the terminal and the authentication server. Here, the number of PKMv2 EAP-Transfer messages transmitted between the terminal and the access point is different according to the higher authentication protocol.

When the user authentication is successfully performed through the higher authentication protocol, upon receiving the EAP authentication success message from the authentication server 400, the packet access router 300 processes the message according to the set matching method to access point 200. Transfer to (S190). The user authentication module 222 of the access point 200 transmits a PKMv2 EAP-Transfer-Sucess message (also referred to as an "EAP authentication success message") to notify that the EAP-based authentication procedure has been completed successfully. Through the terminal 100). Accordingly, the EAP-based authentication procedure is completed (S200).

When the EAP-based authentication procedure is successfully completed, the terminal 100 and the access point 200 share an authentication key (AAA key) according to higher authentication protocol characteristics. In more detail, the user authentication module 222 of the access point 200 provides the authentication key information included in the EAP authentication success message provided from the authentication server 400 to the key management module 223. The key management module 223 stores the authentication key information, and then performs a procedure for exchanging authentication related information including the authentication key information, for example, authentication algorithm and SA (Security Association) information. This procedure is called the SA-TEK procedure.

4 is a flowchart illustrating a process of exchanging authentication related information in an authentication method according to an exemplary embodiment of the present invention.

Specifically, after authentication is performed, as shown in FIG. 4, the key management module 223 of the access point 200 transmits a PKMv2 SA-TEK-Challenge message (also called "SA procedure start message") to the terminal ( By transmitting to 100), the SA-TEK procedure is started (S300). The PKMv2 SA-TEK-Challenge message includes information such as an authentication key identifier and a key valid time indicating the valid time of the authentication key.

The terminal 100 performs authentication on the PKMv2 SA-TEK-Challenge message and determines whether the authentication is identical to the authentication key identifier included in the PKMv2 SA-TEK-Challenge message and the authentication key identifier generated by the terminal itself. If it is determined, the message authentication is treated as successful.

If the message authentication is successful, the terminal 100 transmits a PKMv2 SA-TEK-Request message (also called "SA request message") including all security related algorithms supported by the terminal to the access point 200. (S310) While the user owns the authentication key and proves that the authentication key is valid, the terminal requests information related to the authentication capability.

Accordingly, the key management module 223 of the access point 200 performs authentication of the PKMv2 SA-TEK-Request message, and upon successful authentication, the key management module 223 of the key management module 223 is provided to the primary SA and the plurality of static SAs that can be provided through the message processing unit 210. The corresponding SA-ID and algorithm are informed to the terminal 100 through a PKMv2 SA-TEK-Response message (also called "SA response message"). Specifically, SA-TEK update information, SA type, SA service type, and encryption group information used in the SA for easily updating the active SA used in the previous access point after the UE is handed over to a new access point are included. The SA descriptor and the security negotiation parameters for improving the authentication performance are included in the PKMv2 SA-TEK-Response message and transmitted to the terminal (S320).

Accordingly, when the terminal 100 receives the PKMv2 SA-TEK-Response message, the SA-TEK procedure is completed, and all authentication procedures are finished.

According to this embodiment, a reliable information exchange is achieved by exchanging terminal authentication algorithm and SA information through an SA-TEK procedure including a message authentication function in an RSA-based authentication procedure.

On the other hand, when the RSA-based authentication procedure is successfully performed and the terminal and the access point share the authentication key, a traffic encryption key (TEK) is generated to encrypt the traffic data transmitted between the terminal and the access point. And distribute it. Through this process, traffic data can be safely transmitted between the terminal and the access point.

After authentication, the terminal 100, as shown in Figure 4, the PKMv2 Key-Request message (also called "encryption key request message"), which is a key request message for requesting an encryption key for traffic security, the access point ( 200) (S330). The key management module 223 of the access point 200 receiving the message performs message authentication to confirm whether the message is received from a legitimate terminal, and if the authentication is successful, the SA included in the PKMv2 Key-Request message. Generates a traffic encryption key corresponding to the PKMv2 key-reply message (also referred to as "encryption response message") that is a key response message containing the traffic encryption key to the terminal 100. In addition to the encryption key, the PKMv2 Key-Reply message may further include a valid time of the key, a serial number of the corresponding key, and a cipher block chaining (CBC) initialization vector. Accordingly, the traffic encryption key generation and distribution procedure is completed (S340).

However, in step S330, when the message authentication fails, if the traffic encryption key generation fails, such as discarding the received PKMv2 Key-Request message, there is no SA corresponding to the traffic encryption key requested by the terminal, The key management module 223 of the access point 200 transmits a PKMv2 Key-Reject message to the terminal to reject the traffic encryption key request of the terminal.

Through this process, the terminal and the access point share a traffic encryption key, and stable traffic data transmission is performed based on the shared traffic encryption key.

Although the preferred embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements of those skilled in the art using the basic concepts of the present invention defined in the following claims are also provided. It belongs to the scope of rights.

According to the embodiment of the present invention described above, in the access point of the wireless portable Internet system, authentication that supports both the RSA authentication algorithm-based device authentication, EAP-based user authentication, and SA-TEK procedures required by the IEEE 802.16e standard An apparatus and method can be provided. In addition, when a terminal requests a new key, it can maintain more stable and stronger security. In addition, the packet access router can be connected to various packet access routers by enabling not only UDP but also SCTP.

Claims (10)

In a wireless portable Internet system, in a packet access router providing a connection with an authentication server, and a method for performing authentication at an access point connected with a terminal, a) performing mutual authentication by transmitting and receiving a RSA-based authentication related message with the terminal according to a device authentication request from the terminal; b) the access point determining a matching scheme with the packet access router from configuration information stored in a database; c) in response to a user authentication request from the terminal, process a message provided from the terminal according to the determined matching scheme and transmit it to a packet access router connected to the authentication server, and from the packet access router according to the matching scheme Receiving the provided message and processing it as an EAP (Extensible Authentication Protocol) based authentication-related message and transmitting to the terminal, and performing the authentication of the user of the terminal through the authentication server d) when the device authentication and user authentication is completed, transmitting and receiving a security-related message with the terminal, performing an authentication algorithm and SA (Security Association) information exchange between the terminals; Including, The matching method is one of a user datagram protocol (UDP) or a stream control transmission protocol (SCTP). delete The method of claim 1 Step a) Performing device authentication on the terminal based on the RSA according to the RSA authentication request message transmitted from the terminal and including the terminal certificate; If authentication is successful for the terminal, requesting authentication by transmitting an RSA authentication response message including a certificate of an access point to the terminal; And When the RSA authentication success message for the authentication request is received from the terminal, determining that the authentication of the access point of the terminal is successful, and completing mutual authentication with the terminal Authentication method comprising a. The method of claim 1 Step c) c-1) when the EAP authentication start message is received from the terminal, notifying the authentication start by transmitting the message to the packet access router according to the set matching method; c-2) if a message including authentication-related data is transmitted through the packet access router according to the set matching scheme, processing the message in the form of an EAP data transmission message and transmitting the message to a terminal; c-3) processing the EAP data transmission message provided from the terminal according to a set matching scheme and transmitting the same to the authentication server through the packet access router; And c-4) when the message indicating the successful user authentication from the authentication server is transmitted through the packet access router, sending an EAP authentication success message to the terminal to notify the authentication success. Including; The c-3) and c-4) step is repeated a plurality of times depending on the characteristics of the authentication protocol. The method of claim 1 Step d) Starting a SA-TEK procedure by transmitting an SA procedure start message to the terminal; And Receiving an SA request message including all security related algorithms supported by the terminal from the terminal, transmitting an SA response message including an available SA and a security related algorithm to the terminal; Authentication method comprising a. The method of claim 1 And sharing the traffic encryption key between the access point and the terminal. The step is Performing authentication on an encryption key request message provided from the terminal; If authentication is successful, generating a traffic encryption key corresponding to the SA; And Transmitting an encryption key response message including the traffic encryption key to the terminal; Authentication method comprising a. In a wireless portable Internet system, in a packet access router providing a connection with an authentication server, and an authentication device of an access point connected with a terminal, A traffic processing unit which transmits and receives a message with the terminal; A matching processing unit including a database in which a matching method set with the packet access router is stored, and performing message transmission / reception with the packet access router according to the matching method; An authentication processing unit for performing device authentication according to an authentication request from the terminal provided through the traffic processing unit, and performing user authentication with respect to the terminal in association with the authentication server through the packet access router; And A message processing unit for processing the message provided from the authentication processing unit in a form that can be transmitted to the traffic processing unit, or processing the message authorized from the traffic processing unit in a form that can be processed by the authentication processing unit to provide to the authentication processing unit. Including, The matching processing unit processes a message provided from the terminal according to a matching scheme stored in the database according to a user authentication request from the terminal and transmits the message to a packet access router connected to the authentication server, and transmits the packet according to the matching scheme. Receives a message provided from an access router, processes and provides the message to the authentication processing unit, wherein the matching method is one of a user datagram protocol (UDP) or a stream control transmission protocol (SCTP). The method of claim 7, wherein The matching processing unit sets a predetermined matching method with the packet access router, A UDP matching module for transmitting and receiving a message with the packet access router according to UDP; And SCTP matching module for sending and receiving messages with the packet access router according to SCTP Authentication device comprising a. The method according to claim 7 or 8, The authentication processing unit A device authentication module configured to perform mutual authentication by transmitting and receiving an RSA-based authentication related message with the terminal according to a device authentication request from the terminal; A user authentication module that transmits and receives a message according to a matching scheme with the packet access router according to a user authentication request from the terminal, and performs EAP-based user authentication through the authentication server; And Key management module for storing and managing information generated by performing the authentication Authentication device comprising a. The method of claim 9, When the device authentication and user authentication is completed, the key management module transmits and receives a security related message with the terminal, and exchanges an authentication algorithm and SA information and exchanges an encryption key for traffic data between the terminals.

Images