KR101236894B1 - Mutuality Secure Authentication System in Wire-Wireless Communication Networks and Authentication Method of the Same - Google Patents

Abstract

Disclosed is a communication security technique of the present invention. That is, the mutual security authentication system and its authentication method on the wired and wireless communication network according to an embodiment of the present invention integrated management of the key guidance encryption algorithm mounted on each user mobile terminal, operation management server and intermediary server, the user mobile terminal, operation management server And by performing the mutual security authentication between the intermediary server on the wired and wireless communication network, to improve the strong security between the user mobile terminal, the operation management server and the intermediary server to prevent the leakage of personal information of the user possessing the user mobile terminal, The security of personal information is also protected through security re-authentication for handover user mobile terminals.
In addition, the present invention is sufficiently applicable to public and private networks, as well as wired and wireless communication network for any special purpose to increase the user satisfaction with a user mobile terminal that can protect their personal information, according to the wired and wireless communication network By increasing the utilization rate of the established mutual security authentication system, it is possible to maximize the profit of the company focused on the system construction.
In addition, the present invention proposes a new network model capable of security authentication and security re-authentication for traffic exchange between a user mobile terminal, an operation management server and an intermediary server on a wired / wireless communication network. It not only plays a role in the backbone network but also contributes greatly to industrial development.

Description

Mutuality Secure Authentication System in Wire-Wireless Communication Networks and Authentication Method of the Same}

The present invention relates to a communication security technology, and in particular to the integrated operation and management of the key derivation encryption algorithm installed in each user mobile terminal, operations management server and intermediary server wire-wireless communication network for mutual security authentication between the user mobile terminal, operations management server and intermediary server The present invention relates to a mutual security authentication system on a wired and wireless communication network and an authentication method thereof.

As communication services continue to explode and the information society arrives, transmission bandwidth and security are emerging as key issues. In particular, as the system structure requiring electronic authentication, signing, and identification, such as electronic commerce, electronic financial transactions, and network information services, increases, the importance of encryption becomes more important as the demand for protecting personal information increases. .

In cryptographic systems, data is encoded and decoded by algorithms available to any user, whether legal or illegal. Thus, the security of the system depends on the keys available only to legitimate users.

The key point is the installation, storage and management of the key used as the input of the encryption function for secure encryption.

In the conventional cryptographic communication, for secure communication, a key is required as an input variable of an encryption function that scrambles plain text. The transfer or consent of a secret key is performed using a private channel. However, even if the channel is physically robust, there is a risk of being compromised and exposed to external attacks such as eavesdropping.

The mutual security authentication system and its authentication method on the wired / wireless communication network of the present invention have been devised to solve the problems of the prior art. A first object of the present invention is a key mounted for each user mobile terminal, an operation management server, and an intermediate server. Integrated security management of guided encryption algorithms enables mutual security authentication between user mobile terminal, operation management server and intermediary server on wired / wireless communication network to enhance strong security between user mobile terminal, operation management server and intermediary server. In addition to preventing the leakage of personally identifiable information of the user possessing the personal information, it is also to protect the leakage of personally identifiable information through security reauthentication for the user mobile terminal to be handed over.

In addition, the second object of the present invention is to be sufficiently applicable not only wired and wireless communication networks, but also public or private networks created for any special purpose to increase user satisfaction with a user mobile terminal capable of protecting their personal information. This is to maximize the company's profits in building the system by improving the utilization rate of the mutual security authentication system built in the wired / wireless communication network.

In addition, a third object of the present invention is to propose a new network model capable of security authentication and security re-authentication for traffic exchange between a user mobile terminal, an operation management server and an intermediary server on a wired / wireless communication network. It is not only to play a role in the national backbone network but also to contribute greatly to industrial development.

The present invention for achieving the above object includes the following configuration.

That is, the mutual security authentication system on the wired and wireless communication network according to an embodiment of the present invention, the integrated operation management of the key derivation encryption algorithm mounted on each user mobile terminal, operation management server and intermediary server, the user mobile terminal, operation management server and intermediary A mutual security authentication system for wired / wireless communication networks that performs mutual security authentication between servers, wherein each second mutual authentication is performed by applying and processing a first random variable and a master shared key (K) to the key derivation encryption algorithm. Generate a routine operation value, a user side encryption key and a mutual authentication response value, and apply and process a second random variable and the user side encryption key received from the intermediary server to the key derivation encryption algorithm. Generating a first key matching session value received from the intermediary server. A user mobile terminal generating a second key agreement session value by applying and calculating the second random variable and the second traffic protection stable key to the key derivation encryption algorithm when the first verification is successful; The first random variable is generated by itself, and each user-side encryption key, mutual authentication expectation request, and first mutual authentication are generated by applying the first random variable and the master shared key K to the key derivation encryption algorithm. An operation management server for generating a routine operation value; And generating the second random variable by itself, comparing the mutual authentication response value with the mutual authentication expectation request value, and matching the second random variable with the user-side encryption key received from the operations management server. A first traffic protection stable key is generated according to an algorithm and is processed, and a first key agreement session value is generated by applying and computing the first traffic protection stable key and a second random variable to the key derivation encryption algorithm. The first key matching session value and the second random variable are transmitted to the user mobile terminal, and the second key matching session value received through the wired / wireless communication network is successfully verified. Permitting mutual security authentication for traffic exchange and notifying the operations management server to permit the mutual security authentication Includes four servers.

In addition, the mutual security authentication method according to an embodiment of the present invention, integrated operation management of the key derivation encryption algorithm mounted on each user mobile terminal, operations management server and intermediary server, the mutual communication between the user mobile terminal, operations management server and intermediary server A method of performing security authentication on a wired / wireless network, wherein the user mobile terminal applies a first random variable and a master shared key (K) to the key derivation encryption algorithm, and computes each second mutual authentication routine operation value. Generating a user-side encryption key and a mutual authentication response value; Generating, by the user mobile terminal, a second traffic protection stable key by applying and processing the second random variable and the user-side encryption key received from the intermediate server to the key derivation encryption algorithm; If the user mobile terminal succeeds in the first verification of the first matched session value received from the intermediary server, the second random variable and the second traffic protection stabilization key are applied to the key derivation encryption algorithm. Generating a second keymatch session value; The operation management server generates the first random variable by itself, and applies the first random variable and the master shared key (K) to the key derivation encryption algorithm and process the respective user-side encryption key and mutual authentication expectation value. And generating a first mutual authentication routine operation value; When the intermediate server generates the second random variable by itself, compares the mutual authentication response value with the plurality of mutual authentication expectation values, and matches each other, and encrypts the second random variable and the user side received from the operations management server. Generating a first traffic protection stable key as a key is applied to and operated on the key derivation encryption algorithm; Generating, by the intermediary server, a first key agreement session value as the first traffic protection stable key and the second random variable are applied to the key derivation encryption algorithm and processed; And transmitting the first key matching session value and the second random variable to the user mobile terminal by the intermediary server, and according to whether the second verification of the second key matching session value received through the wired / wireless communication network is successful. Authorizing mutual security authentication for traffic exchange of the mobile terminal, and notifying the operations management server that the mutual security authentication is permitted.

The mutual security authentication system and its authentication method on the wired / wireless communication network of the present invention are mutually secured between the user mobile terminal, the operation management server, and the intermediary server by integrating and managing the key derivation encryption algorithms installed for each user mobile terminal, the operation management server and the intermediate server. By performing authentication on a wired / wireless communication network, a strong security between the user mobile terminal, an operation management server and an intermediary server can be improved to prevent the leakage of personal information of a user possessing the user mobile terminal, as well as a user mobile terminal to be handed over. Security re-authentication also provides a first effect of protecting personal information leakage.

In addition, the present invention is sufficiently applicable to public and private networks, as well as wired and wireless communication network for any special purpose to increase the user satisfaction with a user mobile terminal that can protect their personal information, according to the wired and wireless communication network It improves the utilization rate of the established mutual security certification system, and has the second effect to maximize the corporate profit which was devoted to the system construction.

In addition, the present invention proposes a new network model capable of security authentication and security re-authentication for traffic exchange between a user mobile terminal, an operation management server and an intermediary server on a wired / wireless communication network, and can be widely applied to various applications based on this. Not only plays a role in the backbone network but also has a third effect that greatly contributes to industrial development.

1 is a diagram illustrating a mutual security authentication system on a wired or wireless communication network according to an embodiment of the present invention.
2 is a diagram illustrating a user-side encryption key being generated by the key derivation encryption algorithm logic 2000 (100-1) mounted on the user mobile terminal.
3 is a diagram illustrating that a mutual authentication response value is generated by the key derivation encryption algorithm logic 2000 (100-2) installed in a user mobile terminal.
4 is a diagram showing that a second mutual authentication routine operation value is generated by the key derivation encryption algorithm logic 2000 (100-3) mounted in the user mobile terminal.
FIG. 5 illustrates that a second traffic protection stable key is generated by the key derivation encryption algorithm logic 2000 (100-4) installed in the user mobile terminal.
FIG. 6 is a diagram illustrating a first 'key matching session key being generated by the key derivation encryption algorithm logic 2000 (100-5) installed in a user mobile terminal.
FIG. 7 illustrates that a second key matching session key is generated by the key derivation encryption algorithm logic 2000 (100-6) installed in the user mobile terminal.
FIG. 8 is a diagram illustrating a user-side encryption key being generated by the key derivation encryption algorithm logic 2000 (300-1) mounted in the operation management server.
9 is a diagram showing that a mutual authentication expectation value is generated by the key derivation encryption algorithm logic 2000 (300-2) mounted in the operation management server.
FIG. 10 is a diagram showing that a first mutual authentication routine operation value is generated by the key derivation encryption algorithm logic 2000 (300-3) mounted in the operation management server.
FIG. 11 is a diagram illustrating that a first traffic protection stable key is generated by the key derivation encryption algorithm 2000 (200-1) mounted on an intermediate server.
12 is a diagram showing that a first key agreement session value is generated by the key derivation encryption algorithm logic 2000 (200-2) mounted on an intermediate server.
FIG. 13 is a diagram showing that a second 'key matching session value is generated by the key derivation encryption algorithm 2000 (200-3) mounted on an intermediate server.
14 is a diagram illustrating a mutual security authentication system on a wired / wireless communication network according to another embodiment of the present invention.
FIG. 15 is a diagram illustrating a fourth traffic protection stable key being generated by the key derivation encryption algorithm logic 2000 (100-7) installed in the user mobile terminal.
FIG. 16 is a diagram illustrating a first 're-authentication key matching session value generated by the key derivation encryption algorithm logic 2000 (100-8) installed in the user mobile terminal.
FIG. 17 is a diagram illustrating a second re-authentication key matching session value generated by the key derivation encryption algorithm logic 2000 (100-9) installed in the user mobile terminal.
FIG. 18 is a diagram illustrating a third traffic protection stable key being generated by the key derivation encryption algorithm logic 2000 (200-4) mounted on an intermediate server.
19 is a diagram illustrating that a first re-authentication key matching session value is generated by the key derivation encryption algorithm logic 2000 (200-5) mounted on an intermediate server.
FIG. 20 is a diagram illustrating a second 're-authentication key matching session value generated by the key derivation encryption algorithm logic 2000 (200-6) mounted on an intermediate server.
21 is a flowchart illustrating a mutual security authentication method on a wired / wireless communication network according to an embodiment of the present invention.
22 is a flowchart illustrating a mutual security authentication method on a wired or wireless communication network according to another embodiment of the present invention.

[Example]

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a mutual security authentication system on a wired or wireless communication network according to an embodiment of the present invention.

Referring to FIG. 1, the mutual security authentication system 1000 on a wired / wireless communication network integrates and manages a key derivation encryption algorithm mounted on each user mobile terminal 100, an operation management server 300, and an intermediate server 200 to move a user. It is a system for performing mutual security authentication between the terminal 100, the operation management server 300 and the intermediate server 200 on the wired and wireless communication network 400, the user mobile terminal 100, the intermediate server 200 and the operation management server 300.

The user mobile terminal 100 transmits a pre-registered permanent ID or temporary ID to the intermediary server 200 in response to receiving a personal identification request signal through the wired / wireless communication network 400, and grasps the master shared key from the permanent ID. The comparison between the second mutual authentication routine operation value and the first mutual authentication routine operation value received through the intermediary server 200 is compared to allow communication connection of the intermediate server 200 when they match each other.

The user mobile terminal 100 generates each second mutual authentication routine operation value, a user side encryption key, and a mutual authentication response value by applying and processing the first random variable and the master shared key K to a key derivation encryption algorithm. .

More specifically, the description of the logic 2000 (100-1) of the key derivation encryption algorithm installed in the user mobile terminal 100 generates a user-side encryption key. As shown in FIG. It can be seen that it is generated based on the first to fourth rules.

First, the first rule sets a first random variable 2200 and a master shared key (K) 2110 as a variable to be inserted into a predetermined block cipher function (E) 2100, thereby resulting in a first operation. Generate a value 2300.

The second rule performs an XOR operation on the first system dependent constant (C1) 2400 having the first result value 2300 and the 128 bit value to generate an XORed second result value 2500.

The third rule sets the XORed second result 2500 and the master shared key 2110 as variables to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates an user-side encryption key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The mutual authentication response value 2800 is generated based on the first to fourth rules configured on the logic 2000 (100-2) of the key derivation encryption algorithm mounted in the user mobile terminal as shown in FIG. .

The mutual authentication response value 2800 replaces and inserts a second system dependent constant C2 2400 having a 128-bit value instead of the first system dependent constant C1 into the key derivation encryption algorithm 2000 (100-2). This is a value that can be obtained from the execution of the fourth rule under the assumption that

The second mutual authentication routine operation value 2800 is based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (100-3) mounted in the user mobile terminal as shown in FIG. Is generated.

The second mutual authentication routine operation value 2800 is a third system dependent constant C3 2400 having a 128-bit value in the key derivation encryption algorithm logic 2000 (100-3) instead of the first system dependent constant C1. Is a value that can be obtained from the execution of the fourth rule under the premise of inserting.

Subsequently, the user mobile terminal 100 generates the second traffic protection stable key by applying and processing the second random variable and the user-side encryption key received from the intermediate server 200 to the key derivation encryption algorithm. If the first verification of the first matched session value received from 200 is successful, the second matched session value is generated by applying and computing the second random variable and the second traffic protection stable key to the key derivation encryption algorithm. Let's do it.

More specifically, as a description of the logic 2000 (100-4) of the key derivation encryption algorithm mounted on the user mobile terminal 100 to generate the second traffic protection stabilization key, the second traffic protection stabilization key is shown in FIG. As shown in 5, it can be seen that it is generated based on the first to fourth rules.

First, the first rule sets the second random variable 2200 and the user-side encryption key 2110 as a variable to be inserted into a predetermined block cipher function (E) 2100, and thus the first result value (2300). )

The second rule generates an XORed second result 2500 by XORing a fourth system dependent constant C4 2400 having a 128-bit value with the first result 2300.

The third rule is to set the XORed second result 2500 and the user-side encryption key 2110 as a variable to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates a second traffic protection stable key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The first 'key matching session value 2800 is based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (100-5) mounted in the user mobile terminal as shown in FIG. Is generated.

The first 'key match session value 2800 replaces the second traffic protection stabilization key 2110 in place of the user-side encryption key in the key derivation encryption algorithm logic 2000 (100-5) and the first system dependent constant C1. Instead, it is a value that can be obtained from the execution of the fourth rule on the premise that an alternate insertion of a fifth system dependent constant (C5) 2400 having a 128-bit value is made.

In this case, the user mobile terminal 100 compares a match between the first key matching session value generated by the mediation server 200 and the first 'key matching session value, and confirms success of the first verification when they match each other. Please note.

As shown in FIG. 7, the second key matching session value is generated based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (100-6) mounted in the user mobile terminal.

The second key matching session value 2800 substitutes the second traffic protection stabilization key 2110 into the key derivation encryption algorithm logic 2000 (100-6) instead of the user-side encryption key, respectively, and replaces the first system dependent constant C1. Instead, it is a value that can be obtained from the execution of the fourth rule on the premise that an alternate insert of a sixth system dependent constant (C6) 2400 having a 128 bit value.

Here, the user-side encryption key, the mutual authentication response value, the second mutual authentication routine operation value, the second traffic protection stable key, and the second key agreement session value generated by the user mobile terminal 100, respectively, derive a key with an independent secret key value. Note that the encryption algorithm has different values.

Subsequently, the operation management server 300 inquires the permanent ID received through the intermediary server 200 and calls the master shared key that matches 1: 1 with the permanent ID.

The operation management server 300 generates the first random variable by itself, and applies the first random variable and the master shared key (K) to the key derivation encryption algorithm and processes the respective user-side encryption keys, mutual authentication expectations, and A plurality of first mutual authentication routine operation values are generated as many as the number of generations.

More specifically, as described with reference to the logic 2000 (300-1) of the key derivation encryption algorithm mounted on the operation management server 300 for generating the user-side encryption key, the user-side encryption key is shown in FIG. It can be seen that it is generated based on the first to fourth rules.

First, the first rule sets a first random variable 2200 and a master shared key (K) 2110 as a variable to be inserted into a predetermined block cipher function (E) 2100, thereby resulting in a first operation. Generate a value 2300.

The second rule performs an XOR operation on the first system dependent constant (C1) 2400 having the first result value 2300 and the 128 bit value to generate an XORed second result value 2500.

The third rule sets the XORed second result 2500 and the master shared key 2110 as variables to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates an user-side encryption key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The mutual authentication expectation request 2800 is generated based on the first to fourth rules configured on the logic 2000 (300-2) of the key derivation encryption algorithm mounted in the operation management server as shown in FIG. .

The mutual authentication expectation request 2800 alternately inserts a second system dependent constant C2 2400 having a 128 bit value in place of the first system dependent constant C1 into the key derivation encryption algorithm logic 2000 (300-2). This is a value that can be obtained from the execution of the fourth rule under the assumption that

The first mutual authentication routine operation value 2800 is generated based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (300-3) mounted on the operation management server as shown in FIG. do.

The first mutual authentication routine operation value 2800 supplies the key derivation encryption algorithm logic 2000 (300-3) with a third system dependent constant (C3) 2400 having a 128 bit value instead of the first system dependent constant (C1). It is a value that can be obtained from the execution of the fourth rule on the assumption that it is to be replaced.

Note that the user-side encryption key, mutual authentication expected request value, and first mutual authentication routine operation value generated by the operation management server 300 are independent secret key values, which are different from each other by operation of the key derivation encryption algorithm. do.

The mediation server 200 transmits a personal image request signal to the wired / wireless communication network 400 for requesting personal identification information about a user who owns the user mobile terminal 100, and receives the user side encryption key received from the operation management server 300. And temporarily store the mutual authentication expectation request value, and transmit the first random variable and the first mutual authentication routine operation value received from the operation management server 300 to the user mobile terminal 100.

The mediation server 200 generates the second random variable by itself, and compares the mutual authentication response value and the plurality of mutual authentication expectation requirements with each other, and if the same matches with each other, encrypts the second random variable with the user side received from the operation management server 300. The first traffic protection stable key is generated by applying the key to the key derivation encryption algorithm and processing the key.

In addition, the mediation server 200 generates a first key match session value by applying and processing the first traffic protection stable key and the second random variable to a key derivation encryption algorithm, and the first key match session value and the second random value. The variable is transmitted to the user mobile terminal 100, and the user according to the success or failure of the second verification of the second key matching session value (the additional description: the value generated by the user mobile terminal) received through the wired / wireless communication network 400. The mutual security authentication for the traffic exchange of the mobile terminal 100 is allowed, and the operation management server 300 is notified that the mutual security authentication is allowed.

More specifically, the logic 2000 (200-1) of the key derivation encryption algorithm mounted on the intermediate server 200 generates a first traffic protection stable key. As can be seen from the first rule to the fourth rule can be seen that the generated.

First, the first rule sets the second random variable 2200 and the user-side encryption key 2110 received from the operations management server as a variable to be inserted into a predetermined block cipher function (E) 2100, thereby processing the calculation. A first result value 2300 is generated.

The second rule generates an XORed second result 2500 by XORing a fourth system dependent constant C4 2400 having a 128-bit value with the first result 2300.

The third rule is to set the XORed second result 2500 and the user-side encryption key 2110 as a variable to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates a first traffic protection stable key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The first key match session value 2800 is generated based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (200-2) mounted on the intermediate server as shown in FIG. .

The first key agreement session value 2800 substitutes the first traffic protection stabilization key 2110 in place of the user-side encryption key in the key derivation encryption algorithm logic 2000 (200-2) and replaces the fourth system dependent constant C4. A value that can be obtained from the execution of the fourth rule on the premise of alternately inserting a fifth system dependent constant (C5) 2400 having a 128 bit value.

The second 'key match session value 2800 is generated based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (200-3) mounted on the intermediate server as shown in FIG. do.

The second 'key matching session value 2800 replaces the first traffic protection stabilization key 2110 instead of the user-side encryption key, and has a sixth system dependent constant C6 (128 having a 128-bit value instead of the fourth system dependent constant C4). Value obtained from the execution of the fourth rule under the premise of alternately inserting 2400).

Here, the intermediary server 200 compares the matching between the second key matching session value generated by the user mobile terminal 100 and the second 'key matching session value, and confirms success of the second verification when they match each other. Please note.

Here, it is noted that the first traffic protection stable key and the first key agreement session value generated by the intermediary server 200 are independent secret key values and have different values by arithmetic processing of the key derivation encryption algorithm.

The mutual security authentication system 1000 on the wired or wireless communication network according to another embodiment of the present invention is driven as shown in FIG.

First, the user mobile terminal 100 transmits a temporary ID to the mediation server 200 when handing over in the wired / wireless communication network, generates a fourth traffic protection stable key by applying the user side encryption key to a key derivation encryption algorithm, and mediates. Comparing the first re-authentication key matching session value received from the server 200 with the self-operated 1 're-authentication key matching session value, and when matched with each other, after confirming the success of the third verification, the fourth traffic protection stabilization key is keyed. The second re-authentication key matching session value is generated by applying the derived encryption algorithm.

More specifically, the description of the logic 2000 (100-7) of the key derivation encryption algorithm installed in the user mobile terminal 100 generates the fourth traffic protection stable key. As shown at 15, it can be seen that it is generated based on the first to fourth rules.

The first rule sets a third random variable 2200 and a user-side encryption key 2110 as a variable to be inserted into a predetermined block cipher function (E) 2100, thereby calculating a first result value 2300. Create

The second rule performs an XOR operation on the seventh system dependent constant (C7) 2400 having the first result value 2300 and the 128 bit value to generate an XORed second result value 2500.

The third rule is to set the XORed second result 2500 and the user-side encryption key 2110 as a variable to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates a fourth traffic protection stable key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The first 're-authentication key matching session value 2800 may be applied to the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (100-8) mounted in the user mobile terminal as shown in FIG. Generated based on

The first 're-authentication key match session value 2800 substitutes the fourth traffic protection stabilization key 2110 in place of the user-side encryption key in the key derivation encryption algorithm logic 2000 (100-8) and the seventh system dependent constant ( C7) is a value that can be obtained from the execution of the fourth rule on the premise of replacing and inserting the eighth system dependent constant (C8) 2400 having a 128-bit value instead.

The second re-authentication key matching session value 2800 is based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (100-9) mounted in the user mobile terminal as shown in FIG. Is generated.

The second re-authentication key matching session value 2800 replaces the fourth traffic protection stabilization key 2110 instead of the user-side encryption key and has a ninth system dependent constant C9 having a 128-bit value instead of the seventh system dependent constant C7. Is a value that can be obtained from the execution of the fourth rule under the premise of inserting () 2400.

Here, the fourth traffic protection stable key, the first 're-authentication key match session value and the second re-authentication key match session value generated by the user mobile terminal 100 are calculated as independent secret key values. Note that they have different values.

Subsequently, the intermediary server 200 generates a third traffic protection stable key by applying the user-side encryption key, which is recognized as a reference to the temporary ID and an inquiry about the permanent ID, to the key derivation encryption algorithm.

The mediation server 200 generates the first re-authentication key matching session value by applying the third traffic protection stable key and the third random variable to the key derivation encryption algorithm, and then the first re-authentication key matching session value and the third random variable. To the user mobile terminal 100 previously connected with the wired / wireless communication network.

In addition, the intermediary server 200 compares the second re-authentication key match session value received from the user mobile terminal 100 with the self-calculated second 're-authentication key match session value, and matches each other, and succeeds in the fourth verification. After confirming, the security re-authentication for traffic exchange of the user mobile terminal 100 is allowed.

More specifically, the description of the logic 2000 (200-4) of the key derivation encryption algorithm mounted on the intermediate server 200 generates the third traffic protection stable key. As can be seen from the first rule to the fourth rule can be seen that the generated.

First, the first rule sets the third random variable 2200 and the user-side encryption key 2110 received from the operation management server as a variable to be inserted into a predetermined block cipher function (E) 2100, thereby processing the calculation. A first result value 2300 is generated.

The second rule performs an XOR operation on the seventh system dependent constant (C7) 2400 having the first result value 2300 and the 128 bit value to generate an XORed second result value 2500.

The third rule is to set the XORed second result 2500 and the user-side encryption key 2110 as a variable to be inserted into the block cipher function E 2100, thereby causing the third result value 2600 to be processed. Create

The fourth rule generates a third traffic protection stable key 2800 by performing an XOR operation on the first result value 2700 and the third result value 2600.

The first re-authentication key matching session value 2800 is based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (200-5) mounted on the intermediate server as shown in FIG. Is generated.

The first re-authentication key matching session value 2800 replaces the third traffic protection stabilization key 2110 in place of the user-side encryption key in the key derivation encryption algorithm logic 2000 (200-5) and the seventh system dependent constant C7. Is a value that can be obtained from the execution of the fourth rule on the premise that an eighth system dependent constant (C8) 2400 having a 128-bit value is substituted instead.

The second 're-authentication key matching session value 2800 is based on the first to fourth rules configured on the key derivation encryption algorithm logic 2000 (200-6) mounted on the intermediate server as shown in FIG. 20. Is generated.

The second re-authentication key matching session value 2800 replaces the third traffic protection stabilization key 2110 in place of the user-side encryption key in the key derivation encryption algorithm logic 2000 (200-6). C7) is a value obtained from the execution of the fourth rule on the premise of replacing and inserting a ninth system dependent constant (C9) 2400 having a 128-bit value instead.

Here, the third traffic protection stable key, the first re-authentication key match session value, and the second 're-authentication key match session value generated by the mediation server 200 are independent secret key values, respectively. Note that they have different values.

21 is a diagram illustrating a mutual security authentication method on a wired or wireless communication network according to an embodiment of the present invention.

Referring to FIG. 21, in the mutual security authentication method on a wired / wireless communication network, a mutual security authentication between a user mobile terminal, an operation management server, and an intermediate server by integrated operation management of a key derivation encryption algorithm mounted for each user mobile terminal, an operation management server, and an intermediate server. This is a method to perform on a wired or wireless communication network.

First, the mediation server transmits a personal identification request signal for requesting personal identification information on a user having a user mobile terminal to a wired / wireless communication network (S10).

The user mobile terminal transmits a pre-registered permanent ID or temporary ID to the intermediary server in response to receiving the personal image request signal through the wired / wireless communication network (S20, S30).

The operation management server inquires the permanent ID received through the intermediary server (S40) and calls the master shared key matching 1: 1 with the permanent ID, and generates the first random variable (S50).

The operation management server applies the first random variable and the master shared key (K) to the key derivation encryption algorithm and processes them, so that each user-side encryption key, the mutual authentication expectation value, and the first mutual authentication routine operation value are determined by a predetermined number of generations. After generating it and transmitting to the intermediate server (S60, S70).

More specifically, the user-side encryption key is generated by the operation of the key derivation encryption algorithm integrated in the operation management server as described below.

That is, the first step in the operation of the key derivation encryption algorithm is to set the first random variable and the master shared key (K) as a variable to be inserted into the predetermined block cipher function (E), thereby resulting in a first result value. Creates.

The second step XOR-operates the first system dependent constant C1 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result and the master shared key as variables to be inserted into the block cipher function E, thereby generating a third result that is computed.

In the fourth step, the user-side encryption key is generated by performing an XOR operation on the first result value and the third result value.

Also, the mutual authentication expectation requirement is that after inserting a second system dependent constant (C2) having a 128-bit value instead of the first system dependent constant (C1) in the second step of the key derivation encryption algorithm integrated in the management server, It can be obtained only by implementing the fourth step.

Also, the first mutual authentication routine operation value substitutes and inserts a third system dependent constant C3 having a 128-bit value instead of the first system dependent constant C1 in the second step of the key derivation encryption algorithm integrated in the management server. After that, it can be obtained by the fourth step.

The intermediate server temporarily stores the user-side encryption key and the mutual authentication expected request value received from the operation management server, and transmits the first random variable and the first mutual authentication routine operation value to the user mobile terminal (S80 and S90).

After identifying the master shared key from the permanent ID, the user mobile terminal applies the first random variable and the master shared key (K) to the key derivation encryption algorithm and processes the respective second mutual authentication routine operation values and user side encryption keys. And generating a mutual authentication response value (S100, S110).

The user mobile terminal compares the match between the second mutual authentication routine operation value and the first mutual authentication routine operation value received through the intermediary server, and permits communication connection of the intermediary server when they match each other.

The user mobile terminal transmits a mutual authentication response value indicating that the communication connection is allowed (S120).

More specifically, the user-side encryption key is generated by the operation of the key derivation encryption algorithm integrated in the user mobile terminal as described below.

That is, the first step in the operation of the key derivation encryption algorithm is to set the first random variable and the master shared key (K) as a variable to be inserted into the predetermined block cipher function (E), thereby resulting in a first result value. Creates.

The second step XOR-operates the first system dependent constant C1 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result and the master shared key as variables to be inserted into the block cipher function E, thereby generating a third result that is computed.

In the fourth step, the user-side encryption key is generated by performing an XOR operation on the first result value and the third result value.

In addition, after the mutual authentication response value inserts a second system dependent constant (C2) having a 128-bit value instead of the first system dependent constant (C1) in the second step of the key derivation encryption algorithm integrated in the user mobile terminal, It can only be obtained by the fourth step.

Also, the second mutual authentication routine operation value substitutes and inserts a third system dependent constant C3 having a 128-bit value instead of the first system dependent constant C1 in the second step of the key derivation encryption algorithm integrated in the user mobile terminal. After that, it can be obtained by the fourth step.

The intermediary server generates the second random variable by itself, and compares the mutual authentication response value received from the user mobile terminal with a plurality of mutual authentication expectation requirements and matches each other (S130), and receives the second random variable from the operation management server. The first traffic protection stable key is generated by applying and calculating the user-side encryption key to the key derivation encryption algorithm (S140).

If the mutual authentication response value and the mutual authentication expectation value do not match, the intermediary server rejects the access of the user mobile terminal and transmits and notifies the user authentication rejection signal to the operation management server (S131).

The intermediary server generates the first key match session value by applying and processing the first traffic protection stable key and the second random variable to the key derivation encryption algorithm, and then moves the first key match session value and the second random variable to the user. Transmission to the terminal (S150, S160).

More specifically, the first traffic protection stable key is generated by the operation of the key derivation encryption algorithm integrated in the intermediary server as described below.

That is, the first step of the operation of the key derivation encryption algorithm is to set the second random variable and the user-side encryption key received from the operation management server as a variable to be inserted into the predetermined block cipher function (E) and thereby operate. 1 Generate the result.

The second step performs an XOR operation on the fourth system dependent constant C4 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E, thereby generating a third result value that is computed.

The fourth step generates an first traffic protection stable key by performing an XOR operation on the first result value and the third result value.

In addition, the first key matching session value is inserted into the first traffic protection stable key in place of the user-side encryption key in the first step of the key derivation encryption algorithm integrated in the intermediary server, and the fourth system dependent constant (C4) in the second step. Instead, it can be obtained through the fourth stage implementation only after the fifth system dependent constant C5 having a 128-bit value is inserted.

The user mobile terminal generates a second traffic protection stable key by applying and processing the second random variable and the user-side encryption key received from the intermediate server to the key derivation encryption algorithm (S170).

If the user mobile terminal succeeds in the first verification comparing the first generated key matching session value with the first key matching session value received from the intermediary server, the user terminal generates the second random variable and the second traffic protection stabilization key. The second key agreement session value is generated according to the application and operation of the key derivation encryption algorithm (S180 and S190).

If the first verification is not successful, the user mobile terminal re-requests retransmission of the first key agreement session value to the intermediate server (S181).

In this case, the user mobile terminal compares a match between a first key matching session value generated by an intermediary server and a first generated key matching session value, and confirms success of the first verification when they match each other. do.

More specifically, the second traffic protection stable key is generated by the operation of the key derivation encryption algorithm integrated in the user mobile terminal as described below.

That is, the first step during the operation of the key derivation encryption algorithm is to set the second random variable and the user-side encryption key as a variable to be inserted into the predetermined block cipher function (E), thereby generating a first result value that is processed. .

The second step performs an XOR operation on the fourth system dependent constant C4 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E, thereby generating a third result value that is computed.

In the fourth step, an XOR operation is performed on the first result value and the third result value to generate a second traffic protection stable key.

In addition, in the first step of the key derivation encryption algorithm integrated in the user mobile terminal, the first 'key matching session value replaces the second traffic protection stable key in place of the user's encryption key, and in the second step, the first system dependent constant ( Only after inserting the fifth system dependent constant C5 having a 128-bit value instead of C1) can it be obtained through the fourth step implementation.

Also, the second key matching session value substitutes and inserts a sixth system dependent constant C6 having a 128-bit value instead of the first system dependent constant C1 in the second step of the key derivation encryption algorithm integrated in the user mobile terminal. After that, it can be obtained through the fourth step.

The intermediary server grants the mutual security authentication for traffic exchange of the user mobile terminal according to the second verification success comparing the second generated key matching session value generated between the self-generated 2nd key matching session value and the second key matching session value received through the wired / wireless communication network. And notifies the operations management server that the mutual security authentication is allowed (S200, S210, S220, S230).

If the received second key agreement session value does not match, the mediation server repeats step S150.

Here, the intermediate server compares the match between the second key matching session value generated by the user mobile terminal and the second 'key matching session value generated by the user, and confirms the success of the second verification when they match each other. do.

More specifically, the second 'key matching session value substitutes the first traffic protection stable key instead of the user's encryption key in the first step of the key derivation encryption algorithm integrated in the user mobile terminal and relies on the fourth system in the second step. Only after inserting the sixth system dependent constant C6 having a 128 bit value instead of the constant C4 can it be obtained by the fourth step implementation.

22 is a diagram illustrating a mutual security authentication method on a wired or wireless communication network according to another embodiment of the present invention.

Referring to FIG. 22, the mutual security reauthentication method on a wired / wireless communication network is a mutual security between a user mobile terminal, an operation management server, and an intermediate server by integrated operation management of a key derivation encryption algorithm mounted for each user mobile terminal, an operation management server, and an intermediate server. Re-authentication is performed on a wired or wireless network.

First, when handing over a wired / wireless communication network, the user mobile terminal transmits a temporary ID to the intermediate server (S10 ').

The intermediate server generates the third traffic protection stable key by applying the user side encryption key recognized by the reference to the temporary ID and the inquiry about the permanent ID to the key derivation encryption algorithm (S20 ', S30').

The intermediate server generates the first re-authentication key matching session value by applying the third traffic protection stabilization key and the third random variable to the key derivation encryption algorithm, and then generates the first re-authentication key matching session value and the third random variable on the wired / wireless communication network. It transmits to the user mobile terminal connected to (S40 ', S50').

More specifically, the third traffic protection stable key is generated by the operation of the key derivation encryption algorithm integrated in the intermediate server, as described below.

That is, during the operation of the key derivation encryption algorithm, the first step is to set a third random variable and a user-side encryption key received from the operation management server as a variable to be inserted into a predetermined block cipher function (E), thereby performing arithmetic processing. Generate a first result.

The second step XORs the seventh system dependent constant C7 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E, thereby generating a third result value that is computed.

In a fourth step, a third traffic protection stable key is generated by performing an XOR operation on the first result value and the third result value.

In addition, the first re-authentication key matching session value inserts the third traffic protection stable key instead of the user-side encryption key in the first step, and the eighth system having a 128-bit value instead of the seventh system dependent constant C7 in the second step. Only after the dependency constant C8 has been inserted can it be obtained by the fourth step.

The user mobile terminal generates a fourth traffic protection stable key by applying the user-generated encryption key to the key derivation encryption algorithm (S60 ').

The user mobile terminal compares the first re-authentication key matching session value received from the intermediary server with the self-calculated first 're-authentication key matching session value and confirms the success of the third verification at step S70'.

The user mobile terminal generates a second re-authentication key matching session value by applying the fourth traffic protection stabilization key to the key derivation encryption algorithm (S80 ').

More specifically, the fourth traffic protection stable key is generated by the operation of the key derivation encryption algorithm integrated in the user mobile terminal as described below.

That is, the first step in the operation of the key derivation encryption algorithm is to set the third random variable and the user-side encryption key as a variable to be inserted into the predetermined block cipher function E, thereby generating a first result value that is processed. .

The second step XORs the seventh system dependent constant C7 having the first result value and the 128 bit value to generate an XORed second result value.

The third step sets the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E, thereby generating a third result value that is computed.

The fourth step generates an fourth traffic protection stable key by performing an XOR operation on the first result value and the third result value.

In addition, the first 're-authentication key matching session value substitutes the fourth traffic protection stable key instead of the user-side encryption key in the first step of the key derivation encryption algorithm integrated in the user mobile terminal, and the seventh system dependent constant ( Only after the eighth system dependent constant C8 having a 128 bit value has been inserted instead, can it be obtained by the fourth step implementation.

In addition, the second re-authentication key matching session value substitutes the fourth traffic protection stable key instead of the user-side encryption key in the first step of the key derivation encryption algorithm integrated in the user mobile terminal, and the seventh system dependent constant ( Only after the ninth system-dependent constant C9 having a 128-bit value is inserted instead of C7) can it be obtained by the fourth step implementation.

The intermediary server compares the second re-authentication key match session value received from the user mobile terminal with the self-calculated second 're-authentication key match session value and matches each other, and after verifying the success of the fourth verification, exchanges traffic of the user mobile terminal. Permit security re-authentication with respect to (S90 ', S100', S110 ').

If the second re-authentication key match session value and the second 're-authentication key match session value do not match with each other, the mediation server regenerates the third traffic protection stabilization key (S30').

More specifically, the second 're-authentication key matching session value replaces the third traffic protection stable key in place of the user-side encryption key in the first step of the key derivation encryption algorithm integrated in the intermediary server and the second step in the second step. Only after the ninth system dependent constant C9 having a 128-bit value is inserted instead of the seven system dependent constant C7, it can be obtained by the fourth step.

Although the above has been described with reference to a preferred embodiment of the present invention, those skilled in the art will be able to variously modify and change the present invention without departing from the spirit and scope of the invention as set forth in the claims below. Will understand.

1000: Mutual Security Authentication System
100: user mobile terminal 200: mediation server
300: operation management server 400: wired and wireless communication network

Claims (57)

A mutual security authentication system on a wired / wireless communication network that performs mutual security authentication between the user mobile terminal, the operation management server, and an intermediary server by integrating and managing a key derivation encryption algorithm installed in each user mobile terminal, an operation management server, and an intermediate server. to,
Generating a second mutual authentication routine operation value, a user-side encryption key, and a mutual authentication response value by applying and processing a first random variable and a master shared key K to the key derivation encryption algorithm, and receiving the first random variable and the master shared key K from the intermediate server. A second traffic protection stable key is generated by applying a random variable and the user-side encryption key to the key derivation encryption algorithm, and succeeding the first verification of the first key agreement session value received from the intermediary server. A user mobile terminal generating a second key matching session value by applying and calculating the second random variable and the second traffic protection stable key to the key derivation encryption algorithm;
Generating the first random variable by itself, and applying and processing the first random variable and the master shared key K to the key derivation encryption algorithm, the user side encryption key, mutual authentication expectation value, and first mutual authentication routine operation A management server for generating values; And
The second random variable is generated by itself, and if the mutual authentication response value and the mutual authentication expectation value are matched with each other, and the mutually matched, the key random encryption algorithm for the user-side encryption key received from the management server and the second random variable Generate a first traffic protection stable key according to the application and operation processing, and generate a first key agreement session value by applying and processing the first traffic protection stable key and the second random variable to the key derivation encryption algorithm. And transmitting the first key matching session value and the second random variable to the user mobile terminal, and according to whether or not the second verification of the second key matching session value received through the wired / wireless communication network is successful. Intermediation that permits mutual security authentication on the exchange and notifies the operations management server that the mutual security authentication is allowed Mutual security authentication system on a wired or wireless network including a server.
The method of claim 1, wherein the user mobile terminal,
Upon receiving the personal identification request signal through the wired / wireless communication network, a pre-registered permanent ID or temporary ID is transmitted to the intermediary server, the internal shared master shared key is determined, the second mutual authentication routine calculation value and the intermediary server are received. The mutual security authentication system of the wired / wireless communication network, characterized in that the communication between the intermediary server when the match between the first mutual authentication routine received by the comparison between the comparison to allow.
The method of claim 2, wherein the operation management server,
And querying the permanent ID received through the intermediary server and calling a master shared key that is matched 1: 1 with the permanent ID.
The method of claim 1, wherein the mediation server,
Transmitting a personal identification request signal for requesting personal identification information about a user possessing the user mobile terminal to the wired / wireless communication network, temporarily storing the user side encryption key and the mutual authentication expectation request received from the operations management server, And transmitting the first random variable and the first mutual authentication routine operation value received from the operations management server to the user mobile terminal.
The method of claim 1,
The logic of the key derivation encryption algorithm mounted on the user mobile terminal,
A first rule of setting the first random variable and the master shared key (K) as variables to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second rule for XORing a first system dependent constant (C1) having a 128 bit value with the first result value to produce a second result value XORed;
A third rule of setting the XORed second result value and the master shared key as variables to be inserted into the block cipher function E to thereby generate a third result value which is arithmetic; And
And a fourth rule for generating the user-side encryption key by performing an XOR operation on the first result value and the third result value.
The method of claim 5, wherein the user mobile terminal,
Generating a mutual authentication response value from the fourth rule when inserting a second system dependent constant C2 having a 128-bit value instead of the first system dependent constant C1 into the key derivation encryption algorithm logic; Mutual security authentication system on a wired or wireless communication network.
The method of claim 5, wherein the user mobile terminal,
Generating a second mutual authentication routine operation value from the fourth rule when inserting a third system dependent constant C3 having a 128 bit value instead of the first system dependent constant C1 into the key derivation encryption algorithm logic Mutual security authentication system on a wired or wireless communication network, characterized in that.
The method of claim 1,
The logic of the key derivation encryption algorithm mounted on the user mobile terminal,
A first rule of setting the second random variable and the user-side encryption key as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second rule for performing an XOR operation on a fourth system dependent constant (C4) having the 128 bit value and the first result value to generate an XORed second result value;
A third rule of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is computed; And
And a fourth rule for generating the second traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 8, wherein the user mobile terminal,
Inserting the second traffic protection stable key into the key derivation encryption algorithm instead of the user-side encryption key, and inserting a fifth system dependent constant C5 having a 128-bit value instead of the first system dependent constant C1. And generating a 1 'key matching session value from the fourth rule.
The method of claim 9, wherein the user mobile terminal,
Comparing the first key matching session value generated by the intermediary server with the first key matching session value and comparing the first key matching session value with each other to confirm success of the first verification. Security authentication system.
The method of claim 8, wherein the user mobile terminal,
Inserting the second traffic protection stable key into the key derivation encryption algorithm instead of the user-side encryption key, and inserting a sixth system dependent constant C6 having a 128-bit value instead of the first system dependent constant C1. And generating the second key matching session value from the fourth rule.
The method of claim 1,
The user-side encryption key, the mutual authentication response value, the second mutual authentication routine operation value, the second traffic protection stable key, and the second key agreement session value generated by the user mobile terminal, respectively, are independent key values. Mutual security authentication system on a wired or wireless communication network, characterized in that having a different value by the operation processing of.
The method of claim 1, wherein the user mobile terminal,
When handing over in the wired / wireless communication network, a temporary ID is transmitted to the intermediary server, and the user side encryption key is applied to the key derivation encryption algorithm to generate a fourth traffic protection stable key, and the first received from the intermediary server. When the re-authentication key matching session value and the self-calculated 1 're-authentication key matching session value are matched with each other, after confirming the success of the third verification, the fourth traffic protection stable key is applied to the key derivation encryption algorithm. And a second re-authentication key matching session value.
The method of claim 13,
The logic of the key derivation encryption algorithm mounted on the user mobile terminal,
A first rule for setting a third random variable and a user-side encryption key as a variable to be inserted into a predetermined block cipher function E to thereby generate a first result value which is arithmetic;
A second rule for performing an XOR operation on a seventh system dependent constant (C7) having the 128 bit value and the first result value to generate an XORed second result value;
A third rule of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is computed; And
And a fourth rule for generating the fourth traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 14, wherein the user mobile terminal,
Replace the fourth traffic protection stable key with the key derivation encryption algorithm instead of the user-side encryption key, and substitute an eighth system dependent constant C8 having a 128 bit value instead of the seventh system dependent constant C7. And, if the first 're-authentication key matching session value is generated from the fourth rule.
The method of claim 14, wherein the user mobile terminal,
Replace the fourth traffic protection stable key with the key derivation encryption algorithm instead of the user-side encryption key and substitute a ninth system dependent constant C9 having a 128-bit value instead of the seventh system dependent constant C7. The second re-authentication key matching session value is generated from the fourth rule.
The method of claim 13,
The fourth traffic protection stable key, the first 're-authentication key match session value and the second re-authentication key match session value generated by the user mobile terminal are respectively independent secret key values by the arithmetic processing of the key derivation encryption algorithm. A mutual security authentication system on a wired or wireless network, characterized by having different values.
The method of claim 13, wherein the mediation server,
Generating a third traffic protection stable key by applying the user-side encryption key, which is recognized as a reference to the temporary ID and a query for the permanent ID, to a key derivation encryption algorithm,
After applying the third traffic protection stable key and the third random variable to the key derivation encryption algorithm to generate a first re-authentication key matching session value, the first re-authentication key matching session value and the third random variable to the wired / wireless Transmits to a user mobile terminal connected to a communication network,
Comparing the second re-authentication key matching session value received from the user mobile terminal with the self-calculated second 're-authentication key matching session value and matching each other, and after confirming the success of the fourth verification, exchanging traffic of the user mobile terminal. Mutual security authentication system on a wired or wireless communication network, characterized in that further comprising permitting security re-authentication.
The method of claim 18,
The logic of the key derivation encryption algorithm mounted on the intermediate server,
A first rule of setting the third random variable and the user-side encryption key received from the operation management server as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second rule for performing an XOR operation on a seventh system dependent constant (C7) having the 128 bit value and the first result value to generate an XORed second result value;
A third rule of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is computed; And
And a fourth rule for generating the third traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 19, wherein the mediation server,
Replace the third traffic protection stable key with the key derivation encryption algorithm in place of the user-side encryption key and substitute an eighth system dependent constant C8 having a 128 bit value instead of the seventh system dependent constant C7. The first reauthentication key matching session value is generated from the fourth rule.
The method of claim 19, wherein the mediation server,
Replace the third traffic protection stable key with the key derivation encryption algorithm instead of the user-side encryption key and substitute a ninth system dependent constant C9 having a 128 bit value instead of the seventh system dependent constant C7. The second security key matching session value is generated from the fourth rule.
The method of claim 18,
The third traffic protection stable key, the first reauthentication key matching session value, and the second 'reauthentication key matching session value generated by the intermediary server are respectively independent secret key values, which are mutually determined by arithmetic processing of the key derivation encryption algorithm. A mutual security authentication system on a wired or wireless network, characterized by having different values.
The method of claim 1,
The logic of the key derivation encryption algorithm mounted on the intermediate server,
A first rule of setting the second random variable and the user-side encryption key received from the operation management server as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second rule for performing an XOR operation on a fourth system dependent constant (C4) having the 128 bit value and the first result value to generate an XORed second result value;
A third rule of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is computed; And
And a fourth rule for generating the first traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 23, wherein the mediation server,
Replace the first traffic protection stable key with the key derivation encryption algorithm instead of the user-side encryption key and substitute a fifth system dependent constant C5 having a 128 bit value instead of the fourth system dependent constant C4. The first key matching session value is generated from the fourth rule.
The method of claim 23, wherein the mediation server,
Replace the first traffic protection stable key with the key derivation encryption algorithm instead of the user-side encryption key and substitute a sixth system dependent constant C6 having a 128 bit value instead of the fourth system dependent constant C4. The second security key matching session value is generated from the fourth rule.
The method of claim 25, wherein the mediation server,
Comparing the second key matching session value generated by the user mobile terminal with the second key matching session value and comparing the two key matching session values with each other to confirm success of the second verification. Security authentication system.
The method of claim 1,
The first traffic protection stable key and the first key agreement session value generated by the intermediary server have independent values of different secret keys and have different values by arithmetic processing of the key derivation encryption algorithm. Security authentication system.
The method of claim 1,
The logic of the key derivation encryption algorithm mounted on the operation management server,
A first rule of setting the first random variable and the master shared key (K) as variables to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second rule for XORing a first system dependent constant (C1) having a 128 bit value with the first result value to produce a second result value XORed;
A third rule of setting the XORed second result value and the master shared key as variables to be inserted into the block cipher function E to thereby generate a third result value which is arithmetic; And
And a fourth rule for generating the user-side encryption key by performing an XOR operation on the first result value and the third result value.
The method of claim 28, wherein the operation management server,
Generating a mutual authentication expectation request from the fourth rule when inserting a second system dependent constant C2 having a 128-bit value instead of the first system dependent constant C1 into the key derivation encryption algorithm logic. A mutual security authentication system on a wired or wireless communication network.
The method of claim 28, wherein the operation management server,
Generating a first mutual authentication routine operation value from the fourth rule when inserting a third system dependent constant C3 having a 128-bit value instead of the first system dependent constant C1 into the key derivation encryption algorithm logic Mutual security authentication system on a wired or wireless communication network, characterized in that.
The method of claim 1,
The user-side encryption key, the mutual authentication expectation request value, and the first mutual authentication routine operation value generated by the operations management server are independent secret key values, and have different values by arithmetic processing of the key derivation encryption algorithm. Mutual security authentication system on wired and wireless communication networks.
A mutual security authentication method for performing mutual security authentication between the user mobile terminal, the operation management server and the intermediary server on a wired / wireless network by integrating and managing a key derivation encryption algorithm installed in each user mobile terminal, an operation management server, and an intermediate server.
Generating, by the user mobile terminal, a second mutual authentication routine operation value, a user side encryption key, and a mutual authentication response value as the first random variable and the master shared key (K) are applied to and operated on the key derivation encryption algorithm;
Generating, by the user mobile terminal, a second traffic protection stable key by applying and processing the second random variable and the user-side encryption key received from the intermediate server to the key derivation encryption algorithm;
If the user mobile terminal succeeds in the first verification of the first matched session value received from the intermediary server, the second random variable and the second traffic protection stabilization key are applied to the key derivation encryption algorithm. Generating a second keymatch session value;
The operation management server generates the first random variable by itself, and applies and computes the first random variable and the master shared key K to the key derivation encryption algorithm. Generating a mutual authentication routine operation value;
When the intermediate server generates the second random variable by itself, compares the mutual authentication response value and the plurality of mutual authentication expectation values with each other, and matches each other, the second random variable and the user-side encryption key received from the operations management server. Generating a first traffic protection stable key by applying and arithmetic to the key derivation encryption algorithm;
Generating, by the intermediary server, a first key agreement session value as the first traffic protection stable key and the second random variable are applied to the key derivation encryption algorithm and processed; And
The intermediate server transmits the first key matching session value and the second random variable to the user mobile terminal, and moves the user according to whether or not the second verification of the second key matching session value received through the wired / wireless communication network is successful. Authorizing mutual security authentication for traffic exchange of the terminal and notifying the operations management server that the mutual security authentication is allowed.
33. The method of claim 32, wherein the user mobile terminal,
Transmitting a pre-registered permanent ID or temporary ID to the intermediary server as a personal identification request signal is received through the wired / wireless communication network; And
The master shared key is identified from the permanent ID, and whether the second mutual authentication routine operation value and the first mutual authentication routine operation value received through the intermediary server are compared to match each other. Mutual security authentication method further comprising the step of allowing.
The method of claim 33, wherein the operation management server,
And querying the permanent ID received through the intermediary server and calling a master shared key that is matched 1: 1 with the permanent ID.
33. The method of claim 32, wherein the mediation server is
Transmitting a personal identification request signal for requesting personal identification information about a user possessing the user mobile terminal to the wired / wireless communication network, and temporarily storing the user side encryption key and the mutual authentication expectation request received from the operations management server; ; And
And transmitting the first random variable and the first mutual authentication routine operation value received from the operations management server to the user mobile terminal.
33. The method of claim 32,
The operation of the key derivation encryption algorithm integrated in the user mobile terminal,
A first step of setting the first random variable and the master shared key (K) as variables to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second step of performing an XOR operation on the first system dependent constant (C1) having the 128 bit value and the first result value to generate an XORed second result value;
A third step of setting the XORed second resultant value and the master shared key as a variable to be inserted into the block cipher function E to thereby generate a third resultant value that is arithmetic; And
And a fourth step of generating the user-side encryption key by performing an XOR operation on the first result value and the third result value.
The method of claim 36, wherein the user mobile terminal,
Alternatively inserting a second system dependent constant (C2) having a 128-bit value in place of the first system dependent constant (C1) in the second step; And
And generating the mutual authentication response value instead of the user-side encryption key as a result according to the fourth step.
The method of claim 36, wherein the user mobile terminal,
Alternatively inserting a third system dependent constant (C3) having a 128-bit value in place of the first system dependent constant (C1) in the second step; And
And generating the second mutual authentication routine operation value instead of the user-side encryption key as a result according to the fourth step.
33. The method of claim 32,
The operation of the key derivation encryption algorithm integrated in the user mobile terminal,
A first step of setting the second random variable and the user-side encryption key as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second step of generating an XORed second result by performing an XOR operation on a fourth system dependent constant (C4) having the first result and the 128-bit value;
A third step of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is arithmetic; And
And generating a second traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 39, wherein the user mobile terminal,
Substituting the second traffic protection stabilization key in place of the user-side encryption key in the first step;
Alternatively inserting a fifth system dependent constant (C5) having a 128-bit value in place of the first system dependent constant (C1) in the second step; And
And generating a first 'key match session value instead of the second traffic protection stable key as a result of executing the fourth step.
41. The method of claim 40, wherein the user mobile terminal,
And comparing the first key matching session value generated by the intermediary server with the first key matching session value and confirming success when the first key matching session value matches each other. Mutual security authentication method.
The method of claim 39, wherein the user mobile terminal,
Alternatively inserting a sixth system dependent constant (C6) having a 128 bit value in place of the first system dependent constant (C1) in the second step; And
And generating a second key match session value instead of the second traffic protection stable key as a result of executing the fourth step.
33. The method of claim 32, wherein the user mobile terminal,
When handing over the wired / wireless communication network, transmitting a temporary ID to the intermediary server and generating a fourth traffic protection stable key by applying the user side encryption key to the key derivation encryption algorithm;
Comparing the first re-authentication key matching session value received from the intermediary server with the self-operated first 're-authentication key matching session value and confirming success of the third verification when they match each other; And
And applying the fourth traffic protection stable key to the key derivation encryption algorithm to generate a second reauthentication key matching session value.
44. The method of claim 43,
The operation of the key derivation encryption algorithm integrated in the user mobile terminal,
A first step of setting a third random variable and a user-side encryption key as a variable to be inserted into a predetermined block cipher function E to thereby generate a first result value which is arithmetic;
A second step of performing an XOR operation on a seventh system dependent constant (C7) having the 128 bit value and the first result value to generate an XORed second result value;
A third step of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is arithmetic; And
And generating a fourth traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 44, wherein the user mobile terminal,
Substituting the fourth traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting an eighth system dependent constant (C8) having a 128-bit value instead of the seventh system dependent constant (C7) in the second step; And
And generating a first 're-authentication key matching session value instead of the fourth traffic protection stable key as a result of executing the fourth step.
The method of claim 44, wherein the user mobile terminal,
Substituting the fourth traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting a ninth system dependent constant (C9) having a 128-bit value instead of the seventh system dependent constant (C7) in the second step; And
And generating the second re-authentication key matching session value instead of the fourth traffic protection stabilization key as a result of executing the fourth step.
44. The method of claim 43, wherein the mediation server is
Generating a third traffic protection stable key by applying the user-side encryption key recognized by the reference to the temporary ID and the inquiry about the permanent ID, to a key derivation encryption algorithm;
After applying the third traffic protection stable key and the third random variable to the key derivation encryption algorithm to generate a first re-authentication key matching session value, the first re-authentication key matching session value and the third random variable to the wired / wireless Transmitting to a user mobile terminal previously connected with a communication network; And
Comparing the second re-authentication key matching session value received from the user mobile terminal with the self-calculated second 're-authentication key matching session value and matching each other, and after confirming the success of the fourth verification, exchanging traffic of the user mobile terminal. Mutual security authentication method further comprising the step of granting a security re-authentication for.
49. The method of claim 47,
The operation of the key derivation encryption algorithm integrated in the intermediary server,
A first step of setting the third random variable and the user-side encryption key received from the operation management server as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second step of performing an XOR operation on a seventh system dependent constant (C7) having the 128 bit value and the first result value to generate an XORed second result value;
A third step of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is arithmetic; And
And generating a third traffic protection stable key by performing an XOR operation on the first result value and the third result value.
49. The method of claim 48, wherein the mediation server,
Substituting the third traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting an eighth system dependent constant (C8) having a 128 bit value in place of the seventh system dependent constant (C7) in the second step; And
And generating the first re-authentication key matching session value instead of the third traffic protection stable key as a result of executing the fourth step.
49. The method of claim 48, wherein the mediation server,
Substituting the third traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting a ninth system dependent constant (C9) having a 128-bit value instead of the seventh system dependent constant (C7) in the second step; And
And generating the second 're-authentication key matching session value instead of the third traffic protection stabilization key as a result of executing the fourth step.
33. The method of claim 32,
The logic of the key derivation encryption algorithm integrated in the intermediary server,
A first step of setting the second random variable and the user-side encryption key received from the operation management server as a variable to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second step of generating an XORed second result by performing an XOR operation on a fourth system dependent constant (C4) having the first result and the 128-bit value;
A third step of setting the XORed second result value and the user-side encryption key as a variable to be inserted into the block cipher function E to thereby generate a third result value that is arithmetic; And
And a fourth step of generating the first traffic protection stable key by performing an XOR operation on the first result value and the third result value.
The method of claim 51, wherein the mediation server,
Substituting the first traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting a fifth system dependent constant (C5) having a 128-bit value instead of the fourth system dependent constant (C4) in the second step; And
And generating the first key agreement session value instead of the first traffic protection stable key as a result of executing the fourth step.
The method of claim 51, wherein the mediation server,
Substituting the first traffic protection stable key in place of the user-side encryption key in the first step;
Alternatively inserting a sixth system dependent constant (C6) having a 128 bit value in place of the fourth system dependent constant (C4) in the second step; And
And generating a second 'key match session value instead of the first traffic protection stable key as a result of executing the fourth step.
54. The method of claim 53, wherein the mediation server is
And comparing the second key matching session value generated by the user mobile terminal with the second key matching session value, and confirming success of the second verification when the second key matching session value matches. Mutual security authentication method.
33. The method of claim 32,
The operation of the key derivation encryption algorithm integrated in the operation management server,
A first step of setting the first random variable and the master shared key (K) as variables to be inserted into a predetermined block cipher function (E) to thereby generate a first result value which is arithmetic;
A second step of performing an XOR operation on the first system dependent constant (C1) having the 128 bit value and the first result value to generate an XORed second result value;
A third step of setting the XORed second resultant value and the master shared key as a variable to be inserted into the block cipher function E to thereby generate a third resultant value that is arithmetic; And
And a fourth step of generating the user-side encryption key by performing an XOR operation on the first result value and the third result value.
The method of claim 55, wherein the operations management server,
Alternatively inserting a second system dependent constant (C2) having a 128-bit value in place of the first system dependent constant (C1) in the second step; And
And generating the mutual authentication expectation request instead of the user-side encryption key as a result according to the fourth step.
The method of claim 55, wherein the operation management server,
Alternatively inserting a third system dependent constant (C3) having a 128-bit value in place of the first system dependent constant (C1) in the second step; And
And generating the first mutual authentication routine operation value instead of the user-side encryption key as a result according to the fourth step.

Images