KR100863644B1 - Authenticating System Between Devices And Creating System Of Secret Key And Method Thereof - Google Patents

Abstract

Power Line Communication A system and method for authentication and secret key generation between devices in a MAC layer, and more specifically, PLC devices are authorized by performing individual authentication procedures. In addition to confirming whether the device is a device, authentication and security between devices that can generate mutual security keys by using the values generated through the authentication procedure again as input values of a key generation function (KGF). Key generation system and method thereof.

PLC, device authentication, security key generation

Description

 Device-to-device authentication and security key generation system and method thereof. {Authenticating System Between Devices And Creating System Of Secret Key And Method Thereof}

1 is a system configuration diagram schematically showing an inter-device authentication system according to a preferred embodiment of the present invention.

2 is a diagram schematically illustrating a method for authentication between devices according to a preferred embodiment of the present invention.

3 is a frame diagram illustrating a frame for transmitting authentication data according to an embodiment of the present invention.

4 is a frame diagram illustrating an authentication success frame according to a preferred embodiment of the present invention.

5 is a frame diagram illustrating an authentication failure frame according to a preferred embodiment of the present invention.

6 is a system configuration diagram schematically showing a security key generation system according to a preferred embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

10: authentication device 110: authentication device authentication module

20: device 220: device authentication module

30: security key generation module

The present invention relates to an inter-device authentication and secret key generation system and method thereof in a Power Line Communication (MAC) layer, and more particularly, PLC devices perform individual authentication procedures. Not only whether the device is authorized or not, but also between devices that can generate mutual security keys by using the values generated through the authentication procedure as input values of a key generation function (KGF). Authentication and security key generation system and method thereof.

In the current KS X 4600-1 standard, 56-bit DES encryption is used for data communication in a PLC network for security. It is a 46-bit long GID that distinguishes cells that coexist on the same physical network, which means that infinite number of different cells can coexist in the same physical network. Communication between stations is allowed only if the GIDs are identical.

As such, stations belonging to the same cell share an encryption key, and 56-bit DES encryption ensures stronger security for data communication. However, using this method, if a new PLC network is configured, modification by the administrator is required for all devices, and if all devices in the same group use the same security key, they may be easily exposed to attacks from the outside. Can be. When encrypting using the DES algorithm, the data is encrypted and transmitted using an encryption module at the front of the transmitter.

In the case of the DES algorithm, when the 64-bit value is input and the operation is performed using the actual key, the 56-bit operation is performed. However, when the encryption / decryption process is performed using the DES algorithm, the authorized device uses the 64-bit security key. Must share

In addition, despite the need to allow only authorized devices to form a network and transmit data using PLC technology through the device-to-device authentication process, the PLC technology to date does not present any method for device-to-device authentication.

In order to solve the above problems, an object of the present invention is to verify whether or not the PLC device is an authorized device by performing the authentication procedure individually, and the key generation function ( The present invention provides a system for authentication and security key generation between devices that can generate unique security keys by using them again as input values for KGF (Key Generation Function) and methods.

In order to achieve the above object, the inter-device authentication system according to the present invention is a system for performing authentication between various devices, wherein the shared value (initial value: modulo p) is shared between the authentication device and the device, and a random value x {1 , 2, ..., p-1} to calculate a ^x and send the calculated value to the device, and calculate (a ^y ) ^x from the a ^y value sent from the device to send (a ^x ) The shared value (initial value: modulo p) is shared between the authentication device authentication module and the authentication device and the device performing authentication by checking whether or not it matches ^y value, and the random value y {1,2, ..., p- 1} to calculate the a ^y to transmit the calculated value to the authentication device, characterized in that it comprises a device authentication module for calculating (a ^x ) ^y from the a ^x value transmitted from the authentication device to transmit to the authentication device do.

In this case, the authentication device authentication module transmits an authentication success frame including an authentication success separator when it matches, and verifies authentication by transmitting an authentication failure frame including an authentication failure separator to the device. .

On the other hand, the security key generation system according to the present invention is a security that generates a 64-bit security key by converting the eight values according to the equation (1) of the sequential calculation values performed by the authentication system of claim 1 or 8 to 8 bits Characterized in that it comprises a key generation module.

<Equation 1>

a ¹ (modulo p), a ² (modulo p), a ³ (modulo p), a ⁴ (modulo p), a ⁵ (modulo p), a ⁶ (modulo p), a ⁷ (modulo p), a ⁸ (modulo p)

On the other hand, the authentication method between devices according to the present invention comprises the steps of sharing a shared value (initial value a modulo p) between the authentication device and the device and the authentication device authentication module selects a random value ^x and calculates a ^x and sends it to the device; The device authentication module selects a random value y to calculate a ^y and sends it to the authentication device. The device authentication module calculates (a ^x ) ^y from a ^x transmitted from the authentication device and sends it to the authentication device. characterized by comprising the steps of: from a ^y transmitted from the authentication device, the authentication module unit to calculate ^x (a ^y) determine the (a ^{x) y} values match transmitted from the device to authenticate .

Here, in the performing of the authentication, if the (a ^x ) ^y value and the (a ^y ) ^x value transmitted from the device match, generate an authentication success frame including an authentication success delimiter and transmit it to the device, and if there is a mismatch And generating an authentication failure frame including an authentication failure identifier and transmitting the same to the device.

In addition, the security key generation method according to the present invention comprises the steps of extracting the eight values corresponding to Equation 1 of the security key generation module of the sequential calculation values through the authentication method of claim 4 or claim 5 and the extracted 8 Converts the values into 8 bits to generate a 64-bit security key.

 <Equation 1>

a ¹ (modulo p), a ² (modulo p), a ³ (modulo p), a ⁴ (modulo p), a ⁵ (modulo p), a ⁶ (modulo p), a ⁷ (modulo p), a ⁸ (modulo p)

Hereinafter, the specific configuration and operation of the present invention will be described in detail with reference to the drawings and the embodiments.

1 is a system configuration diagram schematically showing an inter-device authentication system according to a preferred embodiment of the present invention.

Referring to FIG. 1, the inter-device authentication system according to the present invention includes an authentication device authentication module 110 and a device authentication module 210 for performing authentication between the device 10 and the authentication device 20.

The authentication module has a shared value (initial value a, modulo p), and has a program for generating a random number and performing an operation according to the present invention. The value generated as a factor is transmitted to the external device, and the value is compared to perform an authentication function.

2 is a diagram schematically showing a method for authentication between devices according to a preferred embodiment of the present invention, Figure 3 is a frame configuration frame for the authentication data transmission in accordance with a preferred embodiment of the present invention.

 Although device-to-device authentication is not limited to a specific device, FIG. 2 illustrates an example between an authenticator and a PLC device.

2 and 3, in the designed mechanism, all devices authorized must share the same two element values (initial value a, modulo p). The procedure for authentication between devices is as follows.

For example, if authorized devices share a modulo p, a ⁱ (modulo p) {where i = 1,2, ...., p-1} according to the initial value a is given in the following table. 1> result.

Here, the modulo operation is an arithmetic operation that results in the remainder when the first operation is divided by the second operation. For example, in the case of 7 modulo 5, the operation value is 2.

a a ¹ a ² a ³ a ⁴ a ⁵ a ⁶ a ⁷ a ⁸ a ⁹ One One One One One One One One One One 2 4 8 5 10 9 7 3 6 One 3 9 5 4 One 3 9 5 4 One 4 5 9 3 One 4 5 9 3 One 5 3 4 9 One 5 3 4 9 One 6 3 7 9 10 5 8 4 2 One 7 5 2 3 10 4 6 9 8 One 8 9 6 4 10 3 2 5 7 One 9 4 3 5 One 9 4 3 5 One 10 One 10 One 10 One 10 One 10 One

Thereafter, the authentication device authentication module 110 selects a random value x and the device authentication module 210 selects a random value y within a predetermined range 1,2, ..., p -1.

For example, the authentication device and the device share initial values a = 2, p = 11, and if the authentication device authentication module selects x = 2 and the device authentication module randomly selects y = 4.

Using the selected random value, the authentication device authentication module 110 calculates a ^x and the device authentication module 210 calculates a ^y and transmits it to the authentication device. In the above example, the authentication device authentication module 110 calculates a ^x = 4, and the device authentication module 210 calculates a ^y = 16 and mutually transmit the result.

Subsequently, the authentication device authentication module 110 receives ( a ^y ) ^x through the values generated by itself and the value received from the device 20, and the device authentication module 210 receives the value received from the authentication device 10. Is generated by calculating ( a ^x ) ^y .

The calculation process according to the above example is shown in Table 2 below.

The authentication device authentication module 110 receives the a ^y value 8 from the device 20 and calculates (a ^y ) ^x = (16) ² by modulo operation (256 modulo 11) = 3. On the other hand, if the device authentication module 210 receives the a ^x value 16 from the authentication device 10 and calculates ( a ^x ) ^y = (4) ⁴ by modulo operation (256 modulo 11) = 3 .

When the device 20 transmits ( a ^x ) ^y value to the authentication device 10, the authentication device authentication module 110 compares the ( a ^y ) ^x value generated by the device 20 with a value of 3 to verify the authentication. If the message does not match, 'Authentication failed' message is transmitted to the device 10 to perform authentication.

Since the present invention is based on the MAC layer standard of Korean Industrial Standard KS X 4600-1, it should indicate that the transmitted frame is a frame for authentication, and also a frame capable of transmitting authentication success and authentication failure should be defined. Therefore, a new delimiter is defined as shown in Table 3 below.

Separator type Justice PSDU length 000 Unicast data Long PSDU 010 management Long PSDU 011 Broadcast data Long PSDU 101 answer Short PSDU 001 Authentication data Long PSDU 100 Authentication success Short PSDU 110 Authentication failed Short PSDU

In Table 3, the three delimiters processed by the thick line are newly defined frames, and the part not processed by the thick line is the delimiter used in the existing standard. The delimiter of the newly added frame uses the part described as the delimiter available in the existing standard.

As shown in <Table 3>, the separator '001' is a frame exchanged for authentication between devices. Therefore, since the authentication value must be delivered, the PSDU must be a Long PSDU. Details of the frame newly defined in this manner are the same as in FIG. 3, and thus a detailed description thereof will be omitted.

Based on the Table 3, the authentication device authentication module 110 compares ( a ^x ) ^y values with ( a ^y ) ^x values in the authentication process to determine whether the authentication succeeds or fails to authenticate to the PLC network. The result of whether or not to be included should be transmitted, and if this is the case, if the authentication success frame does not match, an authentication failure frame is generated and transmitted to the device 20.

4 is a frame diagram showing an authentication success frame according to a preferred embodiment of the present invention, Figure 5 is a frame diagram showing an authentication failure frame according to a preferred embodiment of the present invention.

4 and 5, the authentication success frame includes an authentication success identifier (control frame 100) and is transmitted to the device 20 as a short PSDU to confirm the authentication success. Meanwhile, the authentication failure frame includes an authentication failure identifier (control frame 110) and is transmitted to the device 20 as a short PSDU to confirm the authentication failure.

6 is a system configuration diagram schematically showing a security key generation system according to a preferred embodiment of the present invention.

Referring to FIG. 6, the security key generation system according to the present invention includes a security key generation module having a key generation function for generating a shared key between two devices using a value generated during the authentication process as an input value ( 30). The generated security key is used as a key for encrypting data.

More specifically, the foregoing has described a mechanism for performing authentication process based on a result of calculating and exchanging random values through two devices for authentication between devices. In this mechanism, both devices have sequential calculations. Therefore, when the first eight values, such as Equation 1, among these sequential values are converted into 8-bit values, a unique 64-bit security key can be generated as shown in FIG.

<Equation 1>

a ¹ (modulo p ), a ² (modulo p ), a ³ (modulo p ), a ⁴ (modulo p ),

a ⁵ (modulo p ), a ⁶ (modulo p ), a ⁷ (modulo p ), a ⁸ (modulo p )

Device-to-device authentication in a PLC network refers to a procedure for checking an authorized PLC device. The most important part of device-to-device authentication is that a user must perform a proactive procedure between devices without having to perform a specific procedure.

The authentication method used in most technologies up to now is a limited method of authenticating by inputting an access control list in advance for manual authentication by an administrator or access. However, the authentication method proposed in the present invention can be said to be a safe and efficient method for constructing a PLC network since it is active and extensible.

In addition, in the security key generation system proposed in the present invention, since all PLC devices in the group do not use the same security key but use randomly generated values during initial device authentication, unique security keys of the two devices are generated. It allows you to build a secure network.

Although the detailed description of the present invention described above has been described with reference to the preferred embodiment of the present invention, the protection scope of the present invention is not limited to the above embodiment, and those skilled in the art will appreciate It will be understood that various modifications and changes can be made in the present invention without departing from the spirit and scope of the invention.

Claims (6)

In the authentication system between various devices, The initial value (a, modulo p) is shared between the authentication device and the device.The random value x is selected from the specified range {1,2, ..., p-1}, and then calculated by calculating a ^x (modulo p). Transmits the value to the device, calculates (a ^y ) ^x (modulo p) from the a ^y (modulo p) value sent from the device, and confirms whether it matches the (a ^x ) ^y (modulo p) value sent from the device. An authentication device authentication module for verifying and performing authentication; The initial value (a, modulo p) is shared between the authentication device and the device, the random value y is selected from the predetermined range {1,2, ..., p-1}, and then a ^y (modulo p) is calculated. And a device authentication module for transmitting the calculated value to the authentication device, calculating (a ^x ) ^y (modulo p) from the a ^x (modulo p) value transmitted from the authentication device, and transmitting the calculated value to the authentication device. And a security key generation module for generating a 64-bit security key by converting eight values according to Equation 1 into 8 bits among sequential calculation values performed by the authentication system. <Equation 1> a ¹ (modulo p), a ² (modulo p), a ³ (modulo p), a ⁴ (modulo p), a ⁵ (modulo p), a ⁶ (modulo p), a ⁷ (modulo p), a ⁸ (modulo p) The method of claim 1, The authentication device authentication module If it matches, the authentication success frame including the authentication success delimiter is transmitted, and if it does not match, the authentication device between the device characterized in that the authentication by sending an authentication failure frame containing the authentication failure delimiter to the device to verify the authentication. delete Sharing an initial value (a, modulo p) between the authentication device and the device, and the authentication device authentication module selects a random value x, calculates a ^x (modulo p), and sends it to the device; Selecting, by the device authentication module, a random value y, calculating a ^y (modulo p), and transmitting the calculated mod ^y to the authentication device; Calculating, by the device authentication module, (a ^x ) ^y (modulo p) from a ^x (modulo p) transmitted from the authentication device and transmitting the calculated to the authentication device; To make the authentication device, the authentication module, the value by calculating ^{(a y) x (modulo p} ) from a ^y (modulo p) transmitted from the device A ^{(a x) y (modulo p} ) transmitted from the device and match A device-to-device authentication method comprising performing authentication, Extracting, by the security key generation module, eight values corresponding to Equation 1 from the sequentially calculated values through the authentication method; And converting the extracted eight values into 8 bits to generate a 64-bit security key. <Equation 1> a ¹ (modulo p), a ² (modulo p), a ³ (modulo p), a ⁴ (modulo p), a ⁵ (modulo p), a ⁶ (modulo p), a ⁷ (modulo p), a ⁸ (modulo p) The method of claim 4, wherein Performing the authentication When the (a ^x ) ^y (modulo p) value and the (a ^y ) ^x (modulo p) value transmitted from the device are matched, an authentication success frame including an authentication success identifier is generated and transmitted to the device. The authentication method between devices, characterized in that for generating an authentication failure frame including an authentication failure identifier to transmit to the device. delete

Images