KR100948405B1 - Secure and Portable EAP-AKA Authentication without UICC - Google Patents

Abstract

The present invention relates to an EAP-AKA authentication method for non-UICC terminals in an environment in which WLAN and WiBro networks are interworked with a 3GPP network, wherein the non-UICC terminals do not use UICC and have a user password and a light-weight Diffie. -Using the Hellman algorithm to provide enhanced security features such as PBS and PFS over the existing EAP-AKA authentication method using UICC, Diffie-Hellman public key to efficiently use the resources of the non-UICC terminal in the authentication method Delegating the exponential calculation to the HSS / HLR. According to the present invention, when WLAN or WiBro mobile terminals, which are existing non-UICC terminals, use the EAP-AKA authentication method, EAP-AKA is not equipped with UICC due to a cost problem of additional UICC hardware and structural problems of the terminal. It solves the safety and portability problems that occur when using the authentication method.

UICC, Non-UICC, EAP-AKA, Authentication, 3GPP, WLAN, WiBro

Description

EI-AK A authentication method that provides safe and convenient portability without using YUI YC {Secure and Portable EAP-AKA Authentication without UICC}

The present invention relates to a method for authentication interworking in an environment in which a 3rd generation partnership project (3GPP), a wireless local area network (WLAN), and a wireless broadband (WiBro) network interoperate. More specifically, the present invention relates to three wireless In an environment where WLANs and WiBro networks interwork with 3GPP systems, 3GPP standards organizations use EAP-AKA (Extensible Authentication Protocol-Authentication and Key Agreement) authentication method as an authentication interworking technology. (3GPP TS 33.234) On the other hand, it is a technology to compensate for the fact that WLAN and WiBro terminals, which are existing non-UICC terminals, do not define an appropriate authentication method. That is, the present invention is a technique for providing a safe and convenient portability, such as the EAP-AKA authentication method using the UICC in the existing non-UICC terminal using EAP-AKA without using the UICC.

3GPP, WLAN, WiBro networks that can use the wireless Internet has been a lot of research to interwork WLAN and WiBro network centered on 3GPP system. In this interworking network, research on authentication interworking between wireless networks is divided into EAP-AKA and non-EAP-AKA methods, but in the environment of WLAN and WiBro network interworking with 3GPP system, authentication structure of 3GPP system is also studied. It is advantageous to use an authentication structure. This is because 3GPP networks already have a large number of subscribers and operate well in billing, roaming, secure authentication and key exchange methods. In addition, the use of EAP-AKA authentication method in the 3GPP authentication structure, which is widely installed and operated, is applicable to 3GPP, WLAN, and WiBro network interworking at no cost.

In the prior art, the 3GPP standards organization first standardized the EAP-AKA using the UICC as the authentication interworking technology for authentication interworking with WLAN (ETSI 3GPP TS 33.234). Using the UICC, the 128-bit long-term secret key of the EAP-AKA is stored in the UICC separately from the mobile terminal so that it can be managed more securely. This is called safety according to the principle of media separation. In addition, since the UICC is mounted on the terminal in the form of a small chip, any user can easily change the mobile terminal by simply mounting the UICC chip when the user changes the mobile terminal. This is defined as the convenience of carrying. In other words, the UICC-based EAP-AKA method is secure because of the 128-bit long-term secret key stored in the UICC, and provides convenient portability with the UICC in the form of a chip.

Another conventional technology has proposed an authentication interworking technology between a Global System for Mobile communications / General Packet for Radio Service (GSM / GPRS) and a WLAN based on authentication based on a subscriber identity module (SIM) (Y. Tsai and C. Chang, SIM-based subscriber authentication mechanism for wireless local area networks, Computer Communications, Vol. 29, no. 10, pp. 1744-1753). Although the proposed technology is SIM based authentication between GSM and WLAN, it can be used as a basic principle for authentication interworking between 3GPP and WLAN using UICC. This prior art also requires a chip type SIM card in the terminal, provides high security due to the secret key stored in the SIM card, and provides convenience of portability with the chip type SIM card.

However, the conventional technologies are mobile terminals due to a cost burden of additionally mounting a UICC in hardware in order to apply EAP-AKA to existing non-UICC terminals such as WLAN and WiBro, or because of a problem in that the UICC cannot be structurally installed. When they use EAP-AKA without using UICC, non-UICC terminals store the 128-bit long-term secret key used for EAP-AKA in their terminal instead of UICC. When the terminal is changed and the terminal is changed, the inconvenience of carrying a mobile terminal that needs to move or newly assign a long-term secret key occurs.

In order to solve this problem, another conventional technology has proposed a non-UICC type EAP-AKA method (Domestic Patent Registration 10-2007-0041152, AP-AK authentication processing apparatus and method in a non-USB terminal) ). This conventional technique generates a key to encrypt a long-term secret key using a user's password and a random value to store a 128-bit long-term secret key in a non-UICC mobile terminal more securely on the terminal. The long-term secret key is encrypted using and stored in the terminal. To use a long-term secret key while running EAP-AKA, the user must enter the correct password. After the password is input, the terminal generates a key for decrypting the long-term secret key and performs EAP-AKA authentication using the long-term secret key. However, this conventional technique for non-UICC terminals can store the long-term secret key in the terminal more securely using the user's password, but does not provide convenient portability like the UICC method. In other words, this conventional technique stores a 128-bit long-term secret key in the terminal, so if a new terminal is changed, the user must move or copy the 128-bit long-term secret key to the new terminal. There is a hassle.

In addition, all of the above-described prior arts use the 128-bit long-term secret key (EAP-AKA method using UICC and non-UICC method), so if the long-term secret key is exposed, perfect forward PFS It does not provide enhanced security features such as Secrecy) and Perfect Backward Secrecy (PBS). In detail, EAP-AKA performs mutual authentication between the mobile terminal and the authentication server based on a long-term secret key, and after performing authentication, a data encryption key for protecting data between the mobile terminal and the wireless base station. Generate an integrity key. If a long-term secret key is compromised, an attacker can generate data encryption keys and integrity keys that are used in the user's previous and subsequent communications. Here, PFS and PBS are important elements in providing security services, and it is said that PFS is not provided that an attacker who has obtained a long-term secret key can recover the encryption key and the integrity key for previous communication. It is said that a PBS is not provided that can recover an encryption key and an integrity key.

In conclusion, although UIC EAP-AKA authentication and non-UICC EAP-AKA authentication method have been proposed for authentication interworking in WLAN and WiBro networks interworking with 3GPP system, safe and convenient portability considering non-UICC terminals There is no proposed EAP-AKA authentication method that provides the security.

The technical problem to be achieved in the present invention is to perform EAP-AKA authentication while having a safe and convenient portability in the terminal without using UICC in the existing mobile terminal such as WLAN or WiBro in the environment of WLAN and WiBro network interworking 3GPP system It is to suggest authentication method that can be done.

Another technical problem to be achieved in the present invention is to compensate for the problem of not providing an enhanced security function such as PFS and PBS in the conventional technology using a 128-bit long-term secret key, AKA when performing EAP-AKA authentication. When creating an Authentication Vector (AV), a new 128-bit short-term secret key is created to provide a way to provide PFS and PBS security.

Another technical problem to be achieved in the present invention is to propose a method for minimizing resource (power) consumption of a mobile terminal in using a cryptographic operation method to have safety and portability in a non-UICC terminal.

In order to solve the above technical problem, the EAP-AKA authentication method that provides a safe and convenient portability of the non-UICC method proposed in the present invention is a mobile terminal, 3GPP AAA (Authentication, Authorization, and Accounting) Server, HSS / HLR (Home Subscriber Server / Home Location Registrar) In server-to-server communication, (a) the mobile terminal generates authentication parameters for transmission to the 3GPP AAA server and the HSS / HLR server using the user's password and light-weight Diffie-Hellman (DH) algorithm. Generating authentication vectors for performing EAP-AKA authentication, (b) generating authentication vectors for EAP-AKA authentication using authentication parameters received from 3GPP AAA server in HSS / HLR, and user password and light- generating authentication parameters to be sent to the mobile terminal using weight Diffie-Hellman algorithm values, (c) between the mobile terminal and the 3GPP AAA server or the HSS / HLR server When EAP-AKA authentication message exchange is characterized in that it comprises the step of transmitting the authentication parameters proposed in the present invention.

In addition, the step (a) delegates the calculation of the Diffie-Hellman public key value index of the mobile terminal to the HSS / HLR, and uses the hash function of the session key generated after the Diffie-Hellman algorithm, using a 128-bit short- A term secret key is generated, and an EAP-AKA authentication vector is generated using this secret key.

In addition, the step (b) after the HSS / HLR server receives the authentication parameters of the mobile terminal from the 3GPP AAA server, performing the Diffie-Hellman public key value calculation of the mobile terminal instead, and after the Diffie-Hellman algorithm The generated session key is characterized by generating a 128-bit short-term secret key using a hash function and generating an EAP-AKA authentication vector using the secret key.

In addition, in step (c), the mobile terminal transmits the authentication parameters proposed by the present invention together with the IMSI (International Mobile Subscriber Identity) in the existing EAP-AKA authentication procedure to minimize the modification of the existing UICC-based EAP-AKA authentication procedure. And transmitting the authentication parameters proposed by the present invention when the 3GPP AAA server transmits the authentication vector received from the HSS / HLR server to the mobile terminal.

According to the present invention, in the 3GPP, WLAN, and WiBro interworking network, when the WLAN or WiBro mobile terminals, which are existing non-UICC terminals, use the EAP-AKA authentication method, a cost problem and a structural problem of the terminal must be additionally installed in hardware. It solves the safety and portability problems that occur when using EAP-AKA authentication method without installing UICC. That is, the present invention can use the EAP-AKA authentication method while being provided with high security and convenience in WLAN and WiBro terminals without a hardware device such as a smart card such as a UICC chip.

First, since the present invention uses a user's password and light-weight Diffie-Hellman algorithm instead of using UICC, the Diffie-Hellman key exchange does not store 128-bit long-term keys in the UICC and the terminal, unlike the prior art. When the algorithm performs the AKA authentication vector generation, it generates a new 128-bit short-term key. In performing the conventional EAP-AKA authentication method, the EAP-AKA authentication method can be safely performed without using the UICC. In addition, the present invention provides enhanced security features such as PFS and PBS that conventional technologies do not provide because of the use of short-term keys, unlike conventional technologies that use long-term keys.

Second, in the use of EAP-AKA, in the prior art, the user can carry the UICC chip at any time and can change the mobile terminal at any time. In the present invention, any user who memorizes the password without using the UICC chip can use the password. Provides the convenience of portability that can be used by changing the mobile terminal.

Third, the present invention minimizes the amount of cryptographic operations that occur when the Diffie-Hellman algorithm is performed in consideration of mobile terminals that are sensitive to power consumption. When the conventional Diffie-Hellman algorithm is performed in the mobile terminal, the mobile terminal must perform two exponential calculations, one for calculating the Diffie-Hellman public key index and one for calculating the Diffie-Hellman session key. However, since the present invention uses the light-weight Diffie-Hellman method which delegates the Diffie-Hellman public key index calculation of the mobile terminal to the HSS / HLR, the mobile terminal performs only one exponent calculation for generating the Diffie-Hellman session key. Just do it.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

First, the notation required to describe the present invention is as follows.

-H (): safe one-way hash function

pwd: user's password

-|| : Concatenated representation of two bit strings

-p: large prime number

mod: displays modulo operations

-Z ^* _p : multiplication group by modular p

r, x, y: any value belonging to Z ^* _p

-g: Z ^* _p constructor

In addition, when explaining the core of the present invention to aid in understanding of the present invention. First, in the EAP-AKA authentication procedure using UICC in the 3GPP standard shown in Figure 1, in order to obtain the effect of the present invention, the process of S115, S118, S119, S120, S122, S123, S124 of FIG. Correct and supplement with S215, S218, S219, S220, S222, S223, S224. In detail, the modified part of the authentication procedure of FIG. 1 is shown in FIG. 2 as blocks S250, S251, and S252. For other procedures, follow the procedures and methods defined in the 3GPP standard documents (3GPP TS 33.234 (3GPP / WLAN EAP-AKA Authentication Interworking Document), 3GPP TS 33.102 (3GPP AKA Authentication Method Standard Document)).

Next, a detailed description of the present invention will be described with reference to FIG. 2. A user equipment (UE) without a UICC chip 101 performs an authentication procedure while transmitting an S112 message in FIG. 2. In FIG. 2, the 3GPP AAA server receiving the ID IMSI of the UE through the S114 process 103 is different from the existing authentication procedure performed in S115 of FIG. 1. / HLR 104 Do not make authentication vector requests to the server. That is, in the present invention, the 3GPP AAA server checks only the IMSI of the user in step S215. The 3GPP AAA server transmits a user ID retransmission request message to the UE (S116 and S117). If the UE, which has received the message through the process S117 of FIG. 2, previously stored the Diffie-Hellman (DH) session key previously generated by performing EAP-AKA, validates the DH session key (FIG. 4). In step S410, S411 and S218, only the user ID IMSI is transmitted to the 3GPP AAA server (S412) to perform EAP-AKA authentication. If there is no previously generated DH session key (S410), the UE generates and stores g ^r and g ^{H ( pwd )} values (S413, S414), and also selects a random value x and the following expression Similarly, M ₁ and M ₂ values are generated and transmitted to the 3GPP AAA server through the S218 process together with the UE's IMSI (S416).

M ₁ = H (pwd) + r + x, M ₂ = g ^r mod p

In order to simplify the expression of the exponential calculation among the expressions used in the above expression, the mod p expression is omitted from the following description.

The WLAN / WiBro Access Network 102 simply transmits the message received from the UE 101 to the 3GPP AAA server 103 through S219.

When the 3GPP AAA server 103 receives the authentication request message from the UE 101 through S219, the 3GPP AAA server checks whether the received message includes the RES and MAC values (S502 in FIG. 5). . If there is a RES and MAC value in the received message, the 3GPP AAA server performs EAP-AKA authentication with the UE using an authentication vector corresponding to the UE (S503). In detail, the processes S502 and S503 are processes after the 3GPP AAA server receives the S126 message in FIG. 2. If there is no RES or MAC value in the received message and M ₁ and M ₂ values exist, the 3GPP AAA server requests an authentication vector from the HSS / HLR 104 server (S505). If the 3GPP AAA server does not receive the RES, MAC, M ₁ and M ₂ values from the UE through the S219 process, the 3GPP AAA server checks the existence of the authentication vector for the IMSI requesting the authentication (S506). If there is no authentication vector for the IMSI requesting authentication, the current authentication process is terminated, and the UE proceeds to the reauthentication process (S508). If the 3GPP AAA server has not received the M ₁ and M ₂ values through the S219 process, but if there is an authentication vector for the UE, one of the authentication vectors is selected and the RAND, AUTN, and MAC values are transmitted to the UE (S507). In detail, the process is a process for performing an EAP-AKA authentication procedure by delivering only the IMSI to the 3GPP AAA server since the UE stores a valid DH session key. For reference, RAND, AUTN, and MAC authentication vector values are defined in the 3GPP standard document (3GPP TS 33.102).

When the HSS / HLR receives an authentication vector generation request from the 3GPP AAA (103) with the IMSI, M ₁ , and M ₂ values in step S220 (S601 of FIG. 6), n authentication vectors are obtained through the procedure of FIG. 6. Create First, the HSS / HLR selects a g ^{H ( pwd )} value from a database where a user password value is stored using the user's ID IMSI (S602). Perform the calculation of g ^M1 on the value of M ₁ to calculate the value of M ₃ as shown below.

Formula: M ₃ = g ^M1 = g ^{H ( pwd ) + r + x}

In addition, the HSS / HLR calculates the DH public key value g ^x of the UE 101 by calculating the following equation using (104) g ^{H ( pwd )} and M ₂ values (S603). As such, the present invention minimizes the number of cryptographic operations performed by a power consumption-sensitive UE by deriving the exponent calculation to the HSS / HLR without calculating the DH public key value of the UE.

Formula: g ^x = (g ^{H ( pwd ) + r + x} ) / (g ^{H ( pwd ) + r} ) = M ₃ / (g ^{H ( pwd ) + r} ) = M ₃ / ((g ^{H ( pwd )} ) · (G ^r ))

In addition, the HSS / HLR 104 generates an arbitrary value y, calculates g ^y , and then calculates the M ₄ value g ^{H ( pwd ) + y} as shown in the following equation (S604).

M ₄ = g ^{H ( pwd ) + y} = (g ^{H ( pwd )} ) · (g ^y )

In addition, the HSS / HLR 104 exponentially multiplies the DH public key value g ^x of the UE 101 by the y value generated by the HSS / HLR to generate the DH session key g ^xy = (g ^x ) ^y . Similarly, M ₅ message is generated (S605).

Expression: M ₅ = H (g ^xy , g ^x || g ^y )

In addition, the HSS / HLR 104 generates n authentication vectors AV 316 as shown in FIG. 3 using the DH session key (S606). Herein, the present invention follows an authentication vector generation method generated by the existing 3GPP standard. However, it differentiates that the DH session key g ^xy generated in the present invention is used instead of the 128-bit long-term secret key shared for generating the authentication vector. In the present invention, the 128-bit short-term key used for generating the authentication vector uses (301) only the upper 128 bits of the generated value as the short-term key.

Expression: short-term key of upper 128 bits = H (g ^xy )

Finally, the HSS / HLR 104 transmits n authentication vectors 316 and M ₃ , M ₄ , and M ₅ values to the 3GPP AAA 103 server (S607).

When the 3GPP AAA server 103 receives n authentication vectors and M ₃ , M ₄ , and M ₅ values from the HSS / HLR 104, the 3GPP AAA server stores the received n authentication vectors (S509) and n One of the authentication vectors is selected (S510), and RAND, AUTN, and MAC values and M ₃ , M ₄ , and M ₅ values are transmitted to the UE through S222 and S223 (S511). In FIG. 2, the WLAN / WiBro Access Network 102 transmits the message received in step S222 to the UE through step S223.

When the UE 101 receives an authentication response message from the 3GPP AAA server 103 through S223, AKA authentication is performed as follows (S224). First, the UE checks whether an authentication vector (RAND, AUTN, MAC) value is included in the message (S420). If it does not include the authentication vector, the UE terminates the current authentication procedure and performs the reauthentication procedure (S428). If the message received through the process S223 includes an authentication vector and also includes M ₃ , M ₄ , and M ₅ values (S420, S421), the UE receives the received M ₃ value and the g ^r stored in the UE. Using the value and g ^{H ( pwd )} value to calculate the g ^x value as shown in the following equation (S422). Here the UE calculates g ^x , but it does not find g ^x through exponential calculation, but only add (+) and divide (/) operations.

Formula: g ^x = g ^{H ( pwd ) + r + x} / (g ^{H ( pwd ) + r} ) = M ₃ / (g ^{H ( pwd )} + g ^r )

In addition, the UE 101 calculates a g ^y value using the received M ₄ value and the g ^{H ( pwd )} value stored by the UE as shown in the following equation (S423).

Expression: g ^y = g ^{y + H ( pwd )} / g ^{H ( pwd )} = M ₄ / g ^{H ( pwd )}

In addition, the UE 101 generates a DH session key g ^xy using the g ^y value and the x value stored by the UE as shown in the following equation (S424).

Expression: g ^xy = (g ^y ) ^x

In addition, the UE 101 compares the received M ₅ value with a value calculated as in the following equation (S425). If the two values are not the same, the UE 101 terminates the current authentication procedure and performs a reauthentication procedure (S428). If the two values are the same, the UE generates a 128-bit short-term secret key 301 using the DH session key g ^xy and uses the RAND, AUTN, and MAC values received through the S223 process, as shown in FIG. 3. Create and perform AKA authentication (S426).

Thereafter, the EAP-AKA authentication procedure is performed from the process S125 of FIGS. 1 and 2, which is the same as the procedure defined in the 3GPP standard (3GPP TS 33.234).

FIG. 1 is a diagram illustrating a UICC-based EAP-AKA authentication procedure for authentication interworking between a 3GPP network and a WLAN network defined in a 3GPP standard document (3GPP TS 33.234).

2 is a diagram illustrating an EAP-AKA authentication procedure without using UICC as a representative diagram of the present invention.

3 is a diagram illustrating a structure in which a UE and an HSS / HLR server generate a DH session key and then generate an authentication vector defined in the 3GPP standard using the generated DH session key.

4 is a diagram illustrating a procedure when performing the present invention at the UE.

5 is a diagram illustrating a procedure when the present invention is performed in the 3GPP AAA server.

6 is a diagram illustrating a procedure when the present invention is performed in an HSS / HLR server.

Claims (3)

In using EAP-AKA authentication method without using UICC for authentication interworking in 3GPP network and WLAN and WiBro network interworking network, When non-UICC terminals generate a 128-bit short-term key using the Diffie-Hellman algorithm, g, the non-UICC terminals delegate their Diffie-Hellman public key value (g ^x ) exponent calculation to the HSS / HLR. Generating ^{H ( pwd )} and g ^r values and storing them in the UE; And after the non-UICC terminals receive the M ₃ , M ₄ , M ₅ values from the HSS / HLR, the non-UICC terminals use the M ₃ value and the g ^{H ( pwd )} and g ^r values to obtain a (g ^x ) value. Operation method of the non-UICC terminal for performing EAP-AKA authentication without using a UICC, characterized in that it comprises. In using EAP-AKA authentication method without using UICC for authentication interworking in 3GPP network and WLAN and WiBro network interworking network, After the HSS / HLR server receives the authentication parameters M ₁ and M ₂ of the non-UICC terminal, the M ₁ and M ₂ values received by the HSS / HLR server and g ^{H ( pwd )} values stored by the HSS / HLR server are stored. Calculating a Diffie-Hellman public key value g ^x of the non-UICC terminal by using; And generating, by the HSS / HLR, a 128-bit short-term secret key using the Diffie-Hellman public key g ^x value of the non-UICC terminal and the y value generated by the HSS / HLR in order to generate the EAP-AKA authentication vector. ; And generating, by the HSS / HLR server, M ₃ , M ₄ , and M ₅ values for delivery to the UE. 2. The method of operating HSS / HLR for performing EAP-AKA authentication without using UICC. In using EAP-AKA authentication method without using UICC for authentication interworking in 3GPP network and WLAN and WiBro network interworking network, Transmitting, by the non-UICC terminal, the authentication parameters M ₁ and M ₂ proposed by the present invention together with IMSI to the 3GPP AAA server in order to minimize modification of the existing UICC-based EAP-AKA authentication procedure; And When the 3GPP AAA server transmits the authentication vector received from the HSS / HLR server to the non-UICC terminal, transmitting to the non-UICC terminal with the authentication parameters M ₃ , M ₄ , M ₅ values devised in the present invention; Method for operating a non-UICC terminal, 3GPP AAA server, HSS / HLR for performing EAP-AKA authentication without using UICC.

Images