KR100901279B1 - Wire/Wireless Network Access Authentication Method using Challenge Message based on CHAP and System thereof - Google Patents

Abstract

The present invention relates to a network access authentication method and system using a chap challenge message.

More specifically, in a network access authentication method in which a server authenticates a server from a client through a wired or wireless network, and then the server authenticates the client, (A) using a CHAP based challenge message from the client to the server. Transmitting a connection request message and generating a first authentication value by using the partial information and the client information of the connection request message; (B) the server receives the access request message, encrypts the partial information and the client information of the received access request message, generates a second authentication value, and includes a first response message including the second authentication value. Sending to the client; (C) The client compares the first authentication value with the second authentication value transmitted from the server, determines whether there is a match, and if so matches, authenticates the server, and the partial information of the received first response message and the client Encrypting the information to generate a third authentication value, and transmitting a second response message including the third authentication value to the server; And (D) the server receiving the second response message encrypts the partial information of the first response message and the client information to generate a fourth authentication value, and transmits the third authentication value sent from the client. Comparing the fourth authentication value with the fourth authentication value and authenticating the client; and authenticating the network access authentication method using the chapter challenge message.

In a network access authentication system in which a server authenticates a client through a wired / wireless network, and then the server authenticates the client, a connection request message is generated by using a CHAP-based challenge message to access the server. Request, generate a first authentication value using the partial information and the client information of the access request message, receive a first response message including the second authentication value from the server according to the access request, and receive the received first message. 1 If the second authentication value included in the response message and the generated first authentication value are determined and matched, the server authenticates the server and encrypts the partial information and the client information of the received first response message. Generate a third authentication value and send a second response message including the third authentication value to the server; A large number of clients; Upon receiving a connection request message from the client and receiving a connection request message, the first response message including the second authentication value is generated by encrypting the partial information of the received connection request message and the client information and generating a second authentication value to the client. And encrypting the partial information of the first response message and the client information to generate a fourth authentication value, wherein the third authentication value and the fourth authentication value included in the second response message received from the client are generated. And a plurality of servers for authenticating the client if it is determined to match or not. The present invention relates to a network access authentication system using a chapter challenge message.

CHAP, Challenge Response, Server Authentication, Challenge Message, Client Authentication

Description

Chapter 4 (Wire / Wireless Network Access Authentication Method using Challenge Message based on CHAP and System eg)

1 is a block diagram of a network access authentication system using a chapter challenge message according to an embodiment of the present invention.

2 is a detailed block diagram of a network access authentication system using a chapter challenge message according to an embodiment of the present invention.

3 is a flowchart illustrating a network access authentication method using a chapter challenge message according to an exemplary embodiment of the present invention.

*** Explanation of symbols for the main parts of the drawing ***

100: client 110: control unit

120: user interface unit 130: database connection unit

140: user information database 150: authentication tool management module

151: wired authentication module 152: mobile interface unit

153: wireless authentication module 200: wired and wireless network

300: web server 310: control unit

320: web page management unit 330: wired authentication module

340: wireless authentication module 350: communication unit

360: database connection 370: user information database

The present invention relates to a network access authentication method and system using a chap challenge message.

More specifically, the connection request is made by using a challenge message based on the challenge-handshake authentication protocol from the client when authenticating the network access between the client and the server through the wired / wireless network. A method and system for network access authentication using a chapter challenge message to be performed.

In general, the Challenge Handshake Authenication Protocol (CHAP) is one of the protocols for the Point-to-Point Communication Protocol (PPP) used for dial-up access IP, which uses dial-up access using PPP. Used to identify the user at the time. Chapter is more secure than other authentication protocol, Password Authentication Protocol (PAP) because password is transmitted among user ID and user password.

Recently, the authentication method that is generally performed, when a connection request is made to a server through a wired or wireless network using a wired / wireless client, the server requests an identifier (ID, etc.) from the client. When the response is made, the server authenticates the client and exchanges information. do.

In addition, the authentication mechanism is performed through the access point when a connection request is made through the wireless network.

Common authentication mechanisms over a wireless network are likely to be exposed to Rouge Access Points (RAPs), either software or physically illegal.

When RAP is set, it is difficult to distinguish the general public because it uses the same SSID and channel as Real access point.

By exploiting this, phishing sites that disguise legitimate websites (homepages of banks, public institutions, corporations, etc.) on the web have been activated.

In addition, there is a program that automatically connects to a phishing site when a specific URL is input through a malicious code removal program or spyware that is automatically installed from a phishing site in the form of Active-X.

SUMMARY OF THE INVENTION The present invention has been made to solve the above-described problem, and the client first authenticates the server through a connection request using a chap challenge message, thereby protecting the client from an illegal server or web page. Its purpose is to provide an authentication method and system.

The other purpose is to use the chapter challenge message that can effectively respond to phishing sites by authenticating the client and server using the user ID and user password, and reduce the delay of the authentication process by simplifying the process. Its purpose is to provide a network access authentication method and system.

Another object is to provide a network access authentication method and system using a chapter challenge message that can reduce the exposure of the password than the existing security model by performing the authentication process by applying the hash value based on the hash algorithm. There is this.

Network access authentication method and system using the chapter challenge message of the present invention for achieving the above object,

A network access authentication method in which a server authenticates a client through a wired / wireless network, and then the server authenticates the client, the method comprising: (A) receiving a connection request message from the client using a CHAP based challenge message Transmitting and generating a first authentication value using partial information and client information of the access request message; (B) the server receives the access request message, encrypts the partial information and the client information of the received access request message, generates a second authentication value, and includes a first response message including the second authentication value. Sending to the client; (C) The client compares the first authentication value with the second authentication value transmitted from the server, determines whether there is a match, and if so matches, authenticates the server, and the partial information of the received first response message and the client Encrypting the information to generate a third authentication value, and transmitting a second response message including the third authentication value to the server; And (D) the server receiving the second response message encrypts the partial information of the first response message and the client information to generate a fourth authentication value, and transmits the third authentication value sent from the client. Comparing the fourth authentication value with the fourth authentication value and authenticating the client; and authenticating the network access authentication method using the chapter challenge message.

In a network access authentication system in which a server authenticates a client through a wired / wireless network, and then the server authenticates the client, a connection request message is generated by using a CHAP-based challenge message to access the server. Request, generate a first authentication value using the partial information and the client information of the access request message, receive a first response message including the second authentication value from the server according to the access request, and receive the received first message. 1 If the second authentication value included in the response message and the generated first authentication value are determined and matched, the server authenticates the server and encrypts the partial information and the client information of the received first response message. Generate a third authentication value and send a second response message including the third authentication value to the server; A large number of clients; Upon receiving a connection request message from the client and receiving a connection request message, the first response message including the second authentication value is generated by encrypting partial information of the received connection request message and the client information and generating a second authentication value to the client. And encrypting the partial information of the first response message and the client information to generate a fourth authentication value, wherein the third authentication value and the fourth authentication value included in the second response message received from the client are generated. It is achieved by providing a network access authentication system using a chap challenge message, characterized in that it comprises a; a plurality of servers for authenticating the client if it determines to match.
Preferably, the access request message includes a user ID, a random number generated by a random process, and time stamp information. In addition, some information of the access request message may be random number and timestamp information generated by the random process.
Also preferably, the client information is a user password, and the first and second response messages may further include a random number and a timestamp generated by a random process when generating a message.

Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to the drawings.

1 is an overall configuration diagram of a network access authentication system using a chapter challenge message according to an embodiment of the present invention.

In detail with reference to Figure 1,

The present invention may be configured to include a client 100, a wired and wireless network 200, and a web server 300.

The client 100 requests to access the web server 300 through the wired / wireless network 200 to perform an authentication process. Generally, the present invention may be a desktop computer, a notebook computer, a personal digital assistant (PDA), a cellular phone, a PCS phone, a portable computer (UMPC), a portable multimedia computer (PMPC), and the like, but the present invention is not limited thereto.

Specifically, the client 100 transmits a challenge message to the web server 300 to request a connection, generates a first authentication value, preferably a first hash value using some information of the challenge message and client information, When a connection request is made to the web server 300 using a challenge message, a response message is received from the web server 300, and a second authentication value, preferably, a second hash value and the second hash value included in the received response message is received. 1 If the authentication value, preferably the first hash value is determined to match and match, it performs the function of authenticating the access request web server 300.

The wired / wireless network 200 refers to a wired network and / or a wireless network. The wired / wireless communication between the client 100 and the web server 300 is provided through the wired / wireless network 200.

The web server 300 performs a process of authenticating the client 100 when a connection request is made from the client 100 through the wired / wireless network 200.

Specifically, when the web server 300 receives a challenge message from the client 100 and receives a challenge message, the web server 300 generates a second authentication value, preferably a second hash value, and includes a first response message including the second hash value. The third authentication value included in the received second response message, preferably the third hash value and the first response, are transmitted to the client 100 and the second response message is received from the client 100. A process of authenticating the client 100 is performed if the fourth authentication value generated using the message information, preferably the fourth hash value, is determined and matched.

2 is a detailed configuration diagram of a network access authentication system using a chapter challenge message.

In detail with reference to Figure 2,

The client 100 may include a control unit 110, a user interface unit 120, a database connection unit 130, a user information database 140, and an authentication tool management module 150.

The controller 110 controls to perform an authentication process between the client 100 and the web server 300.

The user interface unit 120 receives user information, transmits the information to the control unit 110, and performs a connection request to the web server 300.

The user information may be a user ID, a user password, a certificate, a certificate password, and the like.

The database connection unit 130 serves as an interface for data communication between a database and the control unit 110. That is, the data transmitted from the controller 110 is transferred to the database, and when the data request is received from the controller 110, the data stored from the database is transmitted to the controller 110.

The user information database 140 receives and stores the user information transmitted from the control unit 110 through the database connection unit 130 and requests the user information from the control unit 110 to store the stored user information in the control unit ( 110).

The authentication tool management module 150 performs an authentication process between the web servers 300 through an authentication tool installed in the client 100.

The authentication tool management module 150 may include a wired authentication module 151, a mobile interface unit 152, and a wireless authentication module 153.

The wired authentication module 151 generates a challenge message and a hash value upon request to access the web server 300 through a wired network, and transmits a challenge message to request a connection.

The challenge message is based on CHAP (Challenge Handshake Authentication Protocol, CHAP), and may include a random number generated by a random process and a time stamp. have.

The hash value is generated by encrypting and hashing a user password, a random number generated by a random process, and a time stamp.

The timestamp is a time displacement parameter indicating the starting point of time with respect to a time commonly referred to as a time displayed at a specific position to prove that data existed at a certain point in time.

The mobile interface unit 152 controls access to an access point (AP) when a mobile communication terminal requests access through a wireless network.

The access point refers to a virtual point that is connected when the access request of the client 100 through a wireless network.

The wireless authentication module 153 generates a challenge message and a hash value when a connection request is made to the web server 300 through a wireless network, and accesses an access point to transmit a challenge message.

In addition, the client 100 may include only the controller 110, the user interface 120, and the authentication tool management module 150.

The authentication tool management module 150 includes a wired authentication module 151, a mobile interface unit 152, and a wireless authentication module 153.

The wired authentication module 151 generates a challenge message and a hash value when a connection request is made to the web server 300 through a wired network, and transmits a challenge message to request a connection.

In addition, the controller 110 may receive and store user information transmitted from the control unit 110 and request a user information from the control unit 110 to perform a buffer function for transmitting the user information to the control unit 110.

The mobile interface unit 152 controls access to an access point when a mobile communication terminal requests a connection through a wireless network.

The wireless authentication module 153 generates a challenge message and a hash value when a connection request is made to the web server 300 through a wireless network, and accesses an access point to transmit a challenge message.

In addition, as in the wired authentication module 151, the user information transmitted from the control unit 110 is received and stored, and when the user information is requested from the control unit 110, a buffer for transmitting the user information to the control unit 110 ( Buffer) function.

As shown in FIG. 2, the web server 300 includes a control unit 310, a web page management unit 320, a wired authentication module 330, a wireless authentication module 340, a communication unit 350, and a database connection unit ( 360, and a user information database 370.

The controller 310 controls the authentication process for the challenge message transmitted from the client 100 through the wired / wireless network 200.

The web page manager 320 constructs various web pages in the web server 300 and provides a web page requested to be accessed from the client 100.

When the wired authentication module 330 receives a challenge message from the client 100 through a wired network, the wired authentication module 330 performs an authentication process of generating a response message and a hash value and transmitting a response message.

When the wireless authentication module 340 receives a challenge message from an access point requested from the client 100 through a wireless network, the wireless authentication module 340 generates an response message and a hash value and performs an authentication process of transmitting a response message to the access point. do.

The communication unit 350 provides an interface for communication between the client 100 and the web server 300 through a wired or wireless network 200.

The database connection unit 360 receives the user information provided from the client 100 from the control unit 310 and transmits the received user information to the database, and provides the control unit 310 when a user information previously stored in the database is requested.

The user information database 370 stores the user information provided from the client 100 through the database connection unit 130 and provides the stored user information upon request from the controller 310.

3 is a flowchart illustrating a network access authentication method using a chapter challenge message according to an exemplary embodiment of the present invention.

Referring to Figure 3 in detail,

First, a request for access to a web page provided from the web server 300 or the web server 300 is performed from the client 100 (S300).

At the same time as the access request, the challenge message is transmitted to the access request web server 300 or web page. Simultaneously with the transmission, the client 100 generates a first authentication value, preferably a first hash value (S302).

The challenge message includes a user ID, a first random number generated in a random process, and a first timestamp indicating a data transmission time.

The first authentication value, preferably the first hash value, is generated by encrypting and hashing a user password, the first random number, and a first timestamp. Here, the time stamp is used to determine the valid time of the data by comparing the transmitted time stamps.

The web server 300 or the web page receiving the transmitted challenge message generates a corresponding first response message and a second authentication value, preferably a second hash value, and transmits the generated response message to the client 100 again ( S304).

The first response message comprises a second random number generated by a random process, a second authentication value, preferably a second hash value, and a second timestamp.

The second authentication value, preferably the second hash value, is generated by encrypting and hashing the first random number, the user password, and the first timestamp.

The client 100 receiving the transmitted first response message may include the first authentication value, preferably the first hash value and the second authentication value included in the received first response message, preferably the second hash. By comparing the values, it is determined whether they match (S306).

If the compared authentication values or hash values match, a second response message for authenticating the server from the client 100 and a third authentication value, preferably a third hash value, are generated to generate the second response message. The transmitted to the web server 300 or the web page (S312).

The second response message comprises a third authentication value, preferably a third hash value, a third timestamp, and a third random number.

The third authentication value, preferably the third hash value, is generated by encrypting and hashing a second random number, a second timestamp, and a user password received from the web server 300.

If the authentication value or hash value compared in step S306 does not match, it is determined whether to disconnect (S308).

If not, perform the reauthentication process.

The reauthentication process returns to the first step S300 to reauthenticate three times when the compared authentication value or hash value does not match.

Even if the reauthentication process is performed up to three times, if the compared authentication value or the hash value does not match, it is determined that the reauthentication process is completed and the authentication failure message is transmitted to the client 100 (S310).

If the connection is released in step S308, the connection failure message is transmitted to the client 100.

In step S312, the access requesting web server 300 or the web page receiving the second response message generates a fourth authentication value, preferably a fourth hash value (S314), and the second response. The third authentication value included in the message, preferably the third hash value and the generated fourth authentication value, preferably the fourth hash value is compared to determine whether the match (S316).

The fourth authentication value, preferably the fourth hash value, is generated by encrypting and hashing the second random number, the second timestamp when sending the first response message, and the user password. Although not shown, a fourth authentication value, preferably a fourth hash value, may be generated at the time of sending the first response message.

If the compared hash values match, the client 100 is authenticated from the access request web server 300 or web page, and a connection success message is transmitted to the client 100 (S320).

If the compared authentication value or hash value does not match, a reauthentication message is transmitted to the client 100 (S318).

The re-authentication message is a message transmitted to the client 100 when the client fails to authenticate the server after the client 100 authenticates the server, and includes a second random number included in the first response message and the re-authentication message. Include a third timestamp at the time of shipment.

If the hash values compared again in step S316 match, the client 100 is authenticated.

The best embodiments have been disclosed in the drawings and specification above. The specific terminology used herein is for the purpose of describing the present invention only and is not intended to be limiting of meaning or the scope of the invention as set forth in the claims. Therefore, those skilled in the art will understand from this that various modifications and equivalent other embodiments are possible. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the network access authentication method and system using the chapter challenge message of the present invention as described above,

When the connection between the client and the server is authenticated through the wired / wireless network, a challenge message is used to authenticate the client first, thereby preventing exposure to an illegal server or web page, thereby improving security and safety of network access.

Another effect is to efficiently respond to illegal servers or web pages by performing the authentication process using only the user ID and user password of the client when authenticating network access through the wired / wireless network. It is simpler than the procedure and can reduce the authentication delay time.

Another effect is to suppress the exposure of the user's password using encryption and hash value based on hash algorithm.

Claims (14)

A network access authentication method in which a server authenticates a client from a client over a wired or wireless network, and then the server authenticates the client, (A) transmits a connection request message using a CHAP based challenge message from the client, and generates random number and timestamp information and client information generated when generating a connection request message included in the connection request message. Generating a first authentication value using; (B) the server receives the access request message, encrypts the random number and timestamp information and the client information included in the received access request message, generates a second authentication value, and includes a second authentication value. 1 sending a response message to the client; (C) The client compares the first authentication value with the second authentication value transmitted from the server, determines whether there is a match, and if so matches, authenticates the server and generates a response message included in the received first response message. Generating a third authentication value by encrypting the random number and time stamp information generated at the time and the client information, and transmitting a second response message including the third authentication value to the server; And (D) the server receiving the second response message encrypts the random number and timestamp information included in the transmitted first response message and the client information to generate a fourth authentication value, and transmits the received authentication message from the client. And comparing the third authentication value with the fourth authentication value and authenticating the client, and authenticating the client. The method of claim 1, wherein the connection request message is User ID, random number and timestamp information generated by the random process, The random number and timestamp information included in the access request message are random number and timestamp information generated by the random process. The method of claim 1, The client information is a user password, And the first and second response messages include a random number and a timestamp generated by a random process when generating a message. The method according to any one of claims 1 to 3, And the first to fourth authentication values generate and use a hash value by a hash algorithm. The method according to any one of claims 1 to 3, And said server is a plurality of servers requested to access from said client. The method according to any one of claims 1 to 3, wherein step (A) (A-1) generating an access request message from the client and requesting an access to a server using a user ID; And (A-2) generating a first authentication value by encrypting the random number and time stamp information and the user password included in the access request message from the client; and a network access authentication method using a chapter challenge message. The method according to any one of claims 1 to 3, wherein step (C) (C-1) the client comparing the first authentication value with the second authentication value and determining whether to match and releasing a connection request if it does not match; network access authentication using a chapter challenge message, further comprising: Way. The method according to any one of claims 1 to 3, wherein step (D) (D-1) comparing the third authentication value transmitted from the client with the fourth authentication value and determining whether to match or not, if not, generating random number information and re-authentication message included in the first response message from the server; And transmitting a re-authentication message including a timestamp of the to the client. The method of claim 7, wherein step (C-1) (C-11) comparing, by the client, the first authentication value with the second authentication value to determine whether to match, and if not, performing a reauthentication process; And (C-12) performing the reauthentication process three times, and if not authenticated, releasing the access request; and a network access authentication method using a chapter challenge message. 10. The process of claim 9, wherein the reauthentication process is (C-11-a) A random number and timestamp generated when a connection request message using a challenge message based on CHAP is transmitted from the client to the server, and a connection request message included in the connection request message is generated. Generating a new first authentication value using the information and the client information; And (C-11-b) The server receives the access request message, encrypts and hashes the random number and timestamp information and the client information included in the received access request message, and generates a new second authentication value. And transmitting a new first response message including the newly generated second authentication value to the client. 2. In a network access authentication system in which a server authenticates a client through a wired or wireless network, and then the server authenticates the client, Generates a connection request message using a challenge message based on a chapter (CHAP) to access the server, and generates a connection request message. Generates a first authentication value, receives a first response message including a second authentication value from the server according to the access request, and generates the second authentication value and the second authentication value included in the received first response message. If the matched first authentication value is determined and matched, authentication is performed on the server, and the random number and timestamp information generated when generating a response message included in the received first response message and the client information are encrypted. A plurality of clients generating an authentication value and sending a second response message including a third authentication value to the server; A first response including a second authentication value by generating a second authentication value by encrypting the client information with the random number and timestamp information included in the received access request message when the access request message is received from each client; Transmitting a message to each of the clients, encrypting the random number and timestamp information included in the first response message and the client information to generate a fourth authentication value, and including the message in the second response message received from each client; And a plurality of servers for authenticating each client if it is determined whether the third authentication value and the generated fourth authentication value match the third authentication value. 12. The method of claim 11, wherein each said client A control unit which performs a control process required for the authentication process; A user interface unit which transmits user information provided by access request from a user to the controller; And It is equipped with an authentication tool installed inside the client, and generates a first and third authentication value, a connection request message and a second response message, and using the first authentication value and the first response message received from the server to the server. Authentication tool management module for performing authentication; Network access authentication system using a chapter challenge message comprising a. The method of claim 12, wherein the authentication tool management module When the connection request is sent to the server through the wired network, the connection request message is transmitted and the first authentication value is generated. Wired authentication module to perform; A mobile interface unit controlling access to an access point through a wireless network; And When a connection request is sent to the AP through a wireless network, an access request message is transmitted, a first authentication value is generated, and the first and second authentication values are sent using the first response message transmitted from the AP. Wireless authentication module for performing authentication by determining whether the comparison and matching; Network access authentication system using a chapter challenge message further comprises. 12. The server of claim 11, wherein each server is A control unit controlling to perform an authentication process between each client and server; When a connection request message is transmitted from each client through a wired network, a second authentication value is generated to transmit a first response message, and when a corresponding second response message is received from each client, a third authentication value is generated. A wired authentication module for authenticating each client by comparing and matching a fourth authentication value; When the access request message is transmitted from the AP through a wireless network, a second authentication value is generated and a first response message is generated. When a corresponding second response message is received from each client, the third authentication value and the third authentication value are transmitted. A wireless authentication module for authenticating each client by comparing and matching the generated fourth authentication values; A communication unit providing a communication interface to communicate with each client; A database connection unit receiving user information provided from each client and transmitting the received user information to a database; And And a user information database for storing user information provided from the database connection unit and providing user information when requested by the controller.

Images