KR101314435B1 - Method for security roaming of mobile node and foreign agent apparatus thereof and security roaming system - Google Patents

Abstract

PURPOSE: A security roaming method about a mobile node, a foreign agent apparatus for the same and a security roaming system for the same are provided to provide integrity and authentication related to transmission of a mobile management message in mobile management transaction by making a symmetrical key to use for a mobile management transaction session period. CONSTITUTION: A registration request message receiving unit (121) receives a registration request message from a mobile node. A roaming request message transmitting unit (122) transmits a roaming message about the mobile node to a home agent. A roaming response message receiving unit (123) receives a roaming response message about the mobile node from the home agent. A roaming authentication message transmitting unit (124) authenticates roaming using the roaming response message. The roaming authentication message transmitting unit transmits a roaming authentication message to the mobile node. [Reference numerals] (121) Registration request message receiving unit; (122) Roaming request message transmitting unit; (123) Roaming response message receiving unit; (124) Roaming authentication message transmitting unit

Description

Method for security roaming of mobile node and foreign agent apparatus and security roaming system

The present invention relates to a secure roaming method for a mobile node, a visit agent device thereof, and a secure roaming system. More particularly, the present invention relates to a secure roaming method for a mobile node capable of secure mobile management of a mobile node in a mobile IP system and a visit thereof. An agent device and a secure roaming system.

In general, the main concerns for security considerations in mobile IP are the registration processing of mobile nodes in the mobile visiting area and the exchange of data for mobility management between the Home Agent (HA) and the Foreign Agent (FA). Do not allow the enemy to attack.

Most of the related technologies to date are based on IPSec technology, which is an optimal method for solving the security problem of mobile IP. This IPSec technology has been developed as an IPv6 protocol to improve the IP protocol developed at the beginning of the Internet, and IPv6 defines IP security to enforce IPSec. The IPSec technology created at this time is more complex than the IP protocol because it is not easy to manage the secret keys used. In other words, since the IPSec technology is defined to use many secret keys in IPSec, the key management problem is a factor that reduces the convenience of using the protocol. Background art of the agent method using the IPSec technology is disclosed in Korean Patent Publication No. 2007-0034019.

Since the IPSec technology was developed with the intention of protecting the datagram at the IP layer regardless of the application and the transport layer protocols, the IPSec technology is not an effective method for securing the mobility management datagram with mobility management. In other words, there is a need to approach in a completely new way without using the IPSec protocol to increase the security of mobile IP. Of course, the core of IPSec is the Security Association (SA) database management technology, and the core of this SA management is the management (exchange) technology of the secret keys used. The core technology used for the exchange of secret keys is the Diffie-Hellman technology. The existing approach has a hierarchy of [integer theory → Diffie-Hellman key exchange application technology → IPSec technology → secure mobile IP] technology. Here, there is a need for an agent method for secure mobile IP operation in a state in which complex IPSec technology is excluded.

The present invention provides the integrity and authentication associated with the transmission of mobility management messages in a mobility management transaction as the visiting agent negotiates with the home agent to create a symmetric key for use during the mobility management transaction session during roaming of the mobile node. An object of the present invention is to provide a secure roaming method for a mobile node, a visited agent device thereof, and a secure roaming system, which can be provided.

According to an aspect of the present invention, there is provided a method for secure roaming of a visited agent from a home agent to a visited agent, the method comprising: receiving a registration request message from the mobile node, and a roaming request message for the mobile node; Transmitting a message to the home agent, receiving a roaming response message for the mobile node from the home agent, and authenticating roaming using the roaming response message, and transmitting a roaming authentication message to the mobile node. It provides a secure roaming method for a mobile node comprising the step.

Here, the home agent A stores the home secret value X (A, i) and domain information for the mobile node A, i in a DB, and the mobile node stores the home secret value X (A). i), a home blind key (Y (A, i) = α ^{X (A, i)} mod q) generated using prime (q) and primitive root (α), The registration request message may include the home blind key Y (A, i) and resource record information.

And, the step of transmitting a roaming request message for the mobile node to the home agent, the visit agent (B) generates a visit secret value X (B, A, i) for the mobile node (A, i) And using the visit secret value X (B, A, i), the prime number q and the primitive root α, the visit blind key Y (B, A, i) = α ^{X (B, A, i)} generating mod q) and using a symmetric key K (B, A, i) using the home blind key Y (A, i) and the visit secret value X (B, A, i) Calculating Y (A, i) ^{X (B, A, i)} mod q) and using the symmetric key K (B, A, i), the visited blind key Y (B, A, i) ), and by encrypting a roaming when the visiting agent (B) is assigned a temporary IP address is added to the resource record (RR) of the mobile node, the resource record of the registration request message, the encrypted information (E _{K (B, a , i) [Y (B,} a, i) + RR]) generating, and the blind visit key Y (B, a, i), wherein Im IP address is added to the resource record (RR) information, the encrypted information _{(E K (B, A,} i) [Y (B, A, i) + RR]) wherein the roaming request message including a home agent It may include transmitting to.

Further, in the step of receiving a roaming response message for the mobile node from the home agent, the home agent, the home secret value of the mobile node corresponding to the resource record (RR) information included in the received roaming request message Extracts X (A, i) from the DB and uses the visited blind key Y (B, A, i) included in the roaming request message and the extracted home secret value X (A, i) Obtain (K (B, A, i) = Y (B, A, i) ^{X (A, i)} mod q) and use the obtained symmetric key K (B, A, i) to encrypt the Information (E _{K (B, A, i)} [Y (B, A, i) + RR]) is decoded and the decoded value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (B, A, i) + RR]]) is compared with the visited blind key Y (B, A, i) and resource record (RR) information in the roaming request message, and then the comparison results coincide with each other. Encrypt the home blind key Y (A, i) and the home blind key Y (A, i). Value may send the roaming response message to the visiting agent containing _{(E K (B, A,} i) [Y (A, i)]).

In addition, authenticating roaming using the roaming response message and transmitting a roaming authentication message to the mobile node may include extracting the home blind key Y (A, i) from the roaming response message and performing the home blind key Y. Extracting the symmetric key K (B, A, i) corresponding to (A, i) and the encryption value E _{K (B, A, i)} [Y (A, i)]) using the symmetric key K (B, A, i) and then decrypted value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (A comparing the home blind key Y (A, i) included in the roaming response message, and transmitting the roaming authentication message to the mobile node when the comparison result matches each other. It may include a step.

In addition, the present invention provides a visit agent device for secure roaming of a mobile node moved from a home agent to a visit agent, comprising: a registration request message receiver configured to receive a registration request message from the mobile node, and roaming for the mobile node; Roaming request message transmission unit for transmitting a request message to the home agent, a roaming response message receiving unit for receiving a roaming response message for the mobile node from the home agent, and using the roaming response message to authenticate roaming, roaming It provides a visited agent device including a roaming authentication message transmission unit for transmitting an authentication message to the mobile node.

Here, the roaming request message transmission unit, the visit agent (B) generates a visit secret value X (B, A, i) for the mobile node, the visit secret value X (B, A, i), the Using prime number (q) and primitive root (α), generate visit blind key (Y (B, A, i) = α ^{X (B, A, i)} mod q), and generate the home blind key Y (A i) and compute the symmetric key (K (B, A, i) = Y (A, i) ^{X (B, A, i)} mod q) using the visit secret value X (B, A, i) And using the symmetric key K (B, A, i), the visited blind key Y (B, A, i) and the visiting agent B when roaming the mobile node in the resource record of the registration request message. ) is (encrypts RR), the encrypted information (E _{K (B, a, i),} the temporary IP address is added to the resource record given that generated the [Y (B, a, i) + RR]), then the Visit blind key Y (B, A, i), resource record (RR) information with the temporary IP address added, the encrypted information (E _{K (B, A, i)} [Y (B, A, i) + R R]) may include the roaming request message to the home agent.

The roaming authentication unit extracts the home blind key Y (A, i) from the roaming response message and selects the symmetric key K (B, A, i) corresponding to the home blind key Y (A, i). Extract and decrypt the encryption value E _{K (B, A, i)} [Y (A, i)] included in the roaming response message using the symmetric key K (B, A, i). And the home blind key Y (A, included in the roaming response message with a decrypted value D _{K (B, A, i)} [E _{K (B, A, i)} [Y (A, i)]]. After comparing with i), if the comparison result matches each other, the roaming authentication message may be transmitted to the mobile node.

The present invention provides a secure roaming system, comprising: a home agent corresponding to a home network of a mobile node, and a visiting agent performing secure roaming of the mobile node moved from the home agent; When a registration request message is received from a mobile node, a roaming request message for the mobile node is transmitted to the home agent, and when a roaming response message for the mobile node is received from the home agent, the roaming response message is used to authenticate roaming. It provides a secure roaming system for transmitting a roaming authentication message to the mobile node.

According to the secure roaming method and mobile agent roaming method and mobile roaming system for a mobile node according to the present invention, the roaming agent negotiates with the home agent during roaming of the mobile node to create a symmetric key for use during the mobile management transaction session. Accordingly, there is an advantage of providing completeness and authentication related to the transmission of the mobility management message in the mobility management transaction.

1 is a block diagram of a secure roaming system for an embodiment of the present invention.
2 is a block diagram of a visit agent device according to an embodiment of the present invention.
3 is a flowchart of a secure roaming method for a mobile node using FIG. 2.
4 is a flowchart corresponding to FIG. 3.
5 is an exemplary diagram of a unit entry managed by the home agent of FIG. 1.
6 is an exemplary diagram of a unit entry managed by the visit agent of FIG. 1.

DETAILED DESCRIPTION Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention.

1 is a block diagram of a secure roaming system for an embodiment of the present invention. Such a system includes a home agent 110 and a visit agent 120. The visit agent 120 cooperates with the home agent 110 to perform secure roaming for the mobile node 10 moved from the home agent 110 to the visit agent 120.

The abbreviations represented in FIG. 1 are arranged as shown in Table 1 below.

MN Mobile node HA Home agent FA Foreign agent MN (A, i) Mobile node i with home network MANET A DN (A, i) Domain name of MN (A, i). In the present invention, a domain name or a mobile phone number or an e-mail address are all applicable. Hadd (A, i) Home IP address of MN (A, i) Tadd (A, i) Temporary IP Address of MN (A, i) T (A, i) The time when the MN (A, i) roams and is registered with the visiting agent FA RRQ Register request RRP Registration reply FHRQ FA agents roam to HA (Foreign agent-Home agent Roaming Request) HFRA HA roams to FA (Home agent-Foreign agent Roaming Answer)
RR Abbreviation for resource record. In the present invention, a data unit for one mobile node that maps IP address information about a domain name or a mobile phone number or an email address. The RR information included in the FHRQ message adds the Tadd (A, i) and T (A, i) information fields.

The secure roaming operation using the above system is as follows.

First, the mobile node 10 moves to another area, and the visited agent 120 of the moved place periodically sends an advertisement beacon signal indicating its existence.

After receiving the advertisement beacon signal, the mobile node 10 sends a message (RRQ message) requesting new registration to the visiting agent 120 (①). The visited agent 120 requesting a new registration transmits a roaming request message (FHRQ message) to the home agent 110 of the mobile node 10 (②).

Upon receiving the roaming request message, the home agent 110 updates and updates the corresponding Resource Record entry (③). Initially, home agent 110 constructs an entry that includes DN (A, i) and Hadd (A, i) of mobile node 10. After receiving FHRQ message, Tadd (A , i) and T (A, i) are updated.

Thereafter, the home agent 110 confirms the roaming response by transmitting a roaming response message (HFRA message) to the visited agent 120 (④). Then, the visiting agent 120 registers the corresponding RR information in the entry (⑤), and then transmits a roaming authentication message (RRP message) to the mobile node 10 to confirm the registration (⑥).

In general, mobile IP can be exposed to an enemy (attack) while processing a series of transactions consisting of a registration request (RRQ), a registration response (RRP), a roaming request (FHRQ), and a roaming response (HFRA). There is a vulnerability. As an example, an attacker can trick the visit agent 120 sending the roaming request message or use a man-in-the-middle attacks (MIMA) to alter the roaming request message in transit. In addition, the RR information stored in the home agent 110 and the visited agent 120 may be changed.

In the present invention, the mobile IP is secured by undergoing an additional authentication process in the processing of the registration request (RRQ), registration response (RRP), roaming request (FHRQ), roaming response (HFRA). This invention is based on the Diffie-Hellman key exchange technology. The Diffie-Hellman algorithm defines prime numbers (q) and primitive roots (q) of q. In the present invention, the value (q, α) used in the session uses a value previously promised.

2 is a block diagram of a visit agent device according to an embodiment of the present invention. In the present invention, the subject performing security roaming is the visit agent device 120, which corresponds to the visit agent of FIG.

The visit agent device 120 (hereinafter referred to as a visit agent) includes a registration request message receiver 121, a roaming request message transmitter 122, a roaming response message receiver 123, and a roaming authentication message transmitter 124. do.

The registration request message receiving unit 121 receives a registration request message from the mobile node 10. The roaming request message transmitter 122 transmits a roaming request message for the mobile node 10 to the home agent 110.

The roaming response message receiving unit 123 receives a roaming response message for the mobile node 10 from the home agent 110. Then, the roaming authentication message transmitter 124 authenticates roaming using the roaming response message and transmits a roaming authentication message to the mobile node 10. This series of steps corresponds to the description of FIG. 1 above.

3 is a flowchart of a secure roaming method for a mobile node using FIG. 2. 4 is a flowchart corresponding to FIG. 3. Hereinafter, a security roaming method for a mobile node according to an embodiment of the present invention will be described in detail with reference to the visit agent 120.

First, the registration request message receiving unit 121 receives a registration request message, that is, an RRQ message from the mobile node 10 moved to the visit agent 120 (S310).

Here, the registration request message includes home blind key Y (A, i) and resource record information for the mobile node 10. The background will be described below.

The home agent 110 (A) stores the home secret value X (A, i) and domain information for the mobile node A, i under its control in a DB in advance (see S311 in FIG. 4). . This DB corresponds to an HSR database that stores home secret records. That is, the home agent 110 manages secret value related information of all mobile nodes belonging to the home network.

5 is an exemplary diagram of a unit entry managed by the home agent of FIG. 1. FIG. 5A is an HSR entry when the mobile node 10 stays in the home network, and is initially composed of [DN (A, i), X (A, i)]. If roaming is performed and the visited blind key Y (B, A, i) is received from the visited agent 120, the entry is represented as [DN (A, i), X (A, i) as shown in FIG. ), Y (B, A, i)]. Details of the visit blind key included in the entry will be described later.

Then, the mobile node 10 generates the home blind key (Y (A, i) = α ^{X (A, which is} generated using the home secret value X (A, i), prime number q) and the primitive root α) ^{. i)} Always carry mod q) (see S312 in FIG. 4). When the mobile node 10 moves to the visited area, the mobile node 10 holds the home blind key Y (A, i) corresponding to its home secret value X (A, i) and moves to the visited agent 120 of the visited area. The home blind key Y (A, i) is notified in the process of requesting registration. Therefore, the registration request message (401 in FIG. 4) transmitted by the mobile node 10 to the visited agent 120 includes home blind key Y (A, i) and RR information for the mobile node 10. Doing.

After receiving the registration request message from the mobile node 10, the roaming request message for the mobile node 10 is transmitted to the home agent (S320). This step S320 is performed by the roaming request message transmitter 122 and the detailed process is as follows.

First, the roaming request message transmitter 122 of the visited agent 120 (B) generates a visit secret value X (B, A, i) for the mobile node 10. X (B, A, i) corresponds to a secret value generated by the visit agent 120 itself for MN (A, i), which is the visited mobile node 10. The use of this secret value belongs to the important point that shows the features of the present invention.

Then, using the visit secret value X (B, A, i), the prime number (q) and the primitive root (α), the visit blind key (Y (B, A, i) = α ^{X (B, A, i)} generate mod q)

And using the home blind key Y (A, i) and the visit secret value X (B, A, i), the symmetric key (K (B, A, i) = Y (A, i) to be used during a mobility management transaction. Calculate ^{X (B, A, i)} mod q). In other words, this symmetric key is used for mobile IP transaction processing.

Next, the visited blind key Y (B, A, i) and the resource record RR added with the temporary IP address are encrypted using the symmetric key K (B, A, i), thereby encrypting the encrypted information _{EK. (B, A, i)} [Y (B, A, i) + RR]).

Here, the resource record RR to which the temporary IP address is added indicates information including the temporary IP address assigned by the visited agent B when roaming the mobile node together with the resource record information included in the registration request message.

In other words, the resource record (RR) information used for encryption is the domain name DN (A, i), the home IP address Hadd (A, i), so that the roaming location can be identified for the domain name, mobile phone number or e-mail address. This information corresponds to unit information for one mobile node including a temporary IP address Tadd (A, i) and roaming time T (A, i) information.

Next, the visited blind key Y (B, A, i), the resource record (RR) information to which the temporary IP address is added, and the encrypted information E _{K (B, A, i)} [Y (B, A, i) + RR]) to transmit the roaming request message 402 of FIG. 4 to the home agent 110. That is, the roaming request message 402 transmitted is a temporary IP address Tadd (A, i) newly assigned by [Y (B, A, i), RR (RR information extracted from the RRQ message + a visit agent) B, and roaming. Time T (A, i) information), E _{K (B, A, i)} [Y (B, A, i), RR]].

The important point here is that the enemy (hacker) cannot change the Y (B, A, i) and RR information included in the roaming request message. if. If the enemy has intercepted and changed this information, the home agent 110 decodes E _{K (B, A, i)} [Y (B, A, i), RR] to immediately determine whether or not this information has changed. You can check it.

6 is an exemplary diagram of a unit entry managed by the visit agent of FIG. 1. The visit agent 120 also manages entries through its DB. At this time, the DB corresponds to a VSR database storing the visiting secret records. Visit agent 120 makes a VSR entry associated with the visited mobile node 10, which includes [DN (A, i), X (B, A, i), Y (A, i)]. .

As described above, after the roaming request message is transmitted, a roaming response message for the mobile node is received from the home agent (S330). This step S330 is performed by the roaming response message receiving unit 123, and a detailed process thereof is as follows.

When the roaming request message transmitted in step S320 is transmitted to the home agent 110, the home agent 110 performs the following processing. The home agent 110 first stores the home secret value X (A, i) of the mobile node 10 corresponding to the resource record (RR) information included in the received roaming request message in its DB (HSR database). Extract from. Thereafter, the home agent 110 uses the visited blind key Y (B, A, i) included in the roaming request message and the extracted home secret value X (A, i) to convert the symmetric key to K (B, A, i) = Y (B, A, i) Obtained as ^{X (A, i)} mod q.

Thereafter, the home agent 110 uses the obtained symmetric key K (B, A, i) to encrypt the encrypted information E _{K (B, A, i)} [Y (B, A, i) + RR]. ) And the decrypted value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (B, A, i) + RR]]) is not encrypted within the roaming request message. Is compared with the visited blind key Y (B, A, i) and resource record (RR) information, i.

If the two pieces of information compare with each other, the information of the roaming request (FHRQ) message sent by the visited agent 120 is complete, that is, the information has not been changed from the enemy attack, and the information is transmitted. The place is authenticating that the visiting agent 120 visited by the mobile node MN (A, i) must be visited. Accordingly, the home agent 110 RR RR entry based on the temporary IP address Tadd (A, i) and roaming time T (A, i) information sent by the visiting agent 120 (B) included in the RR = DN (A, i), Hadd (A, i), Tadd (A, i), T (A, i)

That is, when the comparison results match each other, the home agent 110 encrypts the home blind key Y (A, i) and the home blind key Y (A, i) (E _{K (B, A). i)} send a roaming response message (see 403 of FIG. 4) including [Y (A, i)]) to the visiting agent.

Thereafter, the roaming authentication message transmitter 124 authenticates roaming using the roaming response message, and transmits a roaming authentication message to the mobile node 10 (S340).

This step S340 is as follows. First, the home blind key Y (A, i) is extracted from the roaming response message received from the home agent 110, and then the symmetric key K (corresponding to the home blind key Y (A, i) is used. Extract B, A, i). The extraction of the symmetric key K (B, A, i) may use a VSR database that records information related to the visit secret value. In the VSR database, a secret value, a blind key, and a symmetric key generated for the mobile node 10 may be managed in association with each other.

Next, the encryption value E _{K (B, A, i)} [Y (A, i)] included in the roaming response message is decrypted using the extracted symmetric key K (B, A, i). Next, the home blind key Y (A) included in the decoded value D _{K (B, A, i)} [E _{K (B, A, i)} [Y (A, i)]] is included in the roaming response message. , i).

If the two pieces of information are the same, it is interpreted that the home agent 110 processes the roaming request (FHRQ) message requested by the visiting agent 120 well. In addition, this proves that the contents of the roaming response (HFRA) message are also unchanged from the enemy attack, and at the same time, the home agent 110 where the information is transmitted corresponds to the home network of the mobile node MN (A, i). Is to certify.

If the comparison result is matched, the visit agent 120 selects a new RR entry of the visited mobile node 10, MN (A, i), where RR = DN (A, i), Hadd (A, i), and Tadd (A , i) and T (A, i). The roaming authentication message transmitter 124 also transmits a roaming authentication (RRP) message to the mobile node 10. That is, a roaming authentication message including a newly added temporary IP address is transmitted to the mobile node 10. This corresponds to a message indicating that the registration and roaming processing of the mobile node 10 is completed in the visited agent 120.

In general, an enemy attack is easily performed while a mobile management transaction is processed between a visited agent of a visited network visited by a mobile node and a home agent belonging to a home network of the mobile node. If a roaming request message is forged or changed by an enemy attack, the mobile management system is destroyed so that the resource record information of the home agent that determines roaming of the mobile node cannot perform its original function.

However, the present invention creates a symmetric key to be used for the duration of the mobile management transaction session through negotiation between the home agent and the visiting agent, thereby ensuring completeness and authentication of the mobile management transaction when roaming the mobile node. In addition, according to the present invention, roaming of the mobile node is possible by using a domain name, a mobile phone number or an e-mail address as a unique ID of the mobile node. In other words, the present invention has the advantage of providing completeness and authentication associated with the transmission of the mobility management message in a transaction for mobility management if the visited agent at the location visited by the mobile node is running.

While the present invention has been described with reference to exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims. Accordingly, the true scope of the present invention should be determined by the technical idea of the appended claims.

10: mobile node 110: home agent
120: visit agent 121: registration request message receiving unit
122: roaming request message transmitter 123: roaming response message receiver
124: roaming authentication message transmission unit

Claims (12)

In the method for the roaming agent performs secure roaming for the mobile node moved from the home agent to the visited agent,
Receiving a registration request message from the mobile node;
Sending a roaming request message for the mobile node to the home agent;
Receiving a roaming response message for the mobile node from the home agent; And
Authenticating roaming using the roaming response message, and transmitting a roaming authentication message to the mobile node;
The home agent A stores a home secret value X (A, i) and domain information for the mobile node A, i in a DB,
The mobile node generates a home blind key (Y (A, i) = α ^{X (A, i)} mod q ⁾ generated using the home secret value X (A, i), prime number (q) and primitive root (α). ),
And a registration request message for the mobile node includes the home blind key Y (A, i) and resource record information. delete The method according to claim 1,
Sending a roaming request message for the mobile node to the home agent,
The visiting agent (B) generating a visit secret value X (B, A, i) for the mobile node (A, i);
Visit blind key (Y (B, A, i) = α ^{X (B, A, i)} using the visit secret value X (B, A, i), the prime number (q) and the primitive root (α ⁾ generating mod q);
Using the home blind key Y (A, i) and the visit secret value X (B, A, i) the symmetric key (K (B, A, i) = Y (A, i) ^{X (B, A, i)} calculating mod q);
Using the symmetric key K (B, A, i), the visiting agent B when roaming the mobile node in the resource record of the visit blind key Y (B, A, i) and the registration request message Encrypting the resource record (RR) to which the assigned temporary IP address is added to generate encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]); And
The visited blind key Y (B, A, i), the resource record (RR) information to which the temporary IP address is added, the encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]), wherein the method comprises the step of sending the roaming request message to the home agent. The method according to claim 3,
Receiving a roaming response message for the mobile node from the home agent;
The home agent,
Extracts the home secret value X (A, i) of the mobile node corresponding to the resource record (RR) information included in the received roaming request message from the DB, and visits the blind key Y (included in the roaming request message) The symmetric key (K (B, A, i) = Y (B, A, i) ^{X (A, i)} mod using B, A, i) and the extracted home secret value X (A, i) q),
The encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]) is decrypted using the obtained symmetric key K (B, A, i) to decrypt the decrypted information. Value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (B, A, i) + RR]]) to the visit blind key Y (B, A, i) and resource history (RR) information,
If the comparison results coincide with each other, the home blind key Y (A, i) and the home blind key Y (A, i) are encrypted (E _{K (B, A, i)} [Y (A, i) ]) Transmitting the roaming response message to the visited agent. The method of claim 4,
Authenticating roaming using the roaming response message, and transmitting a roaming authentication message to the mobile node,
Extracting the home blind key Y (A, i) from the roaming response message and extracting the symmetric key K (B, A, i) corresponding to the home blind key Y (A, i);
The encryption value E _{K (B, A, i)} [Y (A, i)] included in the roaming response message is decrypted using the symmetric key K (B, A, i) and then decrypted. A value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (A, i)]]) is associated with the home blind key Y (A, i) included in the roaming response message. Comparing; And
And transmitting the roaming authentication message to the mobile node if the comparison results match each other. A visit agent device performing secure roaming of a mobile node moved from a home agent to a visit agent,
A registration request message receiving unit which receives a registration request message from the mobile node;
A roaming request message transmitter configured to transmit a roaming request message for the mobile node to the home agent;
A roaming response message receiver configured to receive a roaming response message for the mobile node from the home agent; And
Roaming authentication message using the roaming response message, and roaming authentication message transmission unit for transmitting a roaming authentication message to the mobile node,
The home agent A stores a home secret value X (A, i) and domain information for the mobile node A, i in a DB,
The mobile node generates a home blind key (Y (A, i) = α ^{X (A, i)} mod q ⁾ generated using the home secret value X (A, i), prime number (q) and primitive root (α). ),
The registration request message for the mobile node includes the home blind key Y (A, i) and resource record information. delete The method of claim 6,
The roaming request message transmission unit,
The visit agent B generates a visit secret value X (B, A, i) for the mobile node,
Visit blind key (Y (B, A, i) = α ^{X (B, A, i)} using the visit secret value X (B, A, i), the prime number (q) and the primitive root (α ⁾ mod q),
Using the home blind key Y (A, i) and the visit secret value X (B, A, i) the symmetric key (K (B, A, i) = Y (A, i) ^{X (B, A, i)} calculate mod q),
Using the symmetric key K (B, A, i), the visiting agent B when roaming the mobile node in the resource record of the visit blind key Y (B, A, i) and the registration request message Encrypts the resource record (RR) with the temporary IP address assigned to it to generate encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]),
The visited blind key Y (B, A, i), the resource record (RR) information to which the temporary IP address is added, the encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]) to the roaming request message to the home agent. The method according to claim 8,
The home agent,
Extracts the home secret value X (A, i) of the mobile node corresponding to the resource record (RR) information included in the received roaming request message from the DB, and visits the blind key Y (included in the roaming request message) The symmetric key (K (B, A, i) = Y (B, A, i) ^{X (A, i)} mod using B, A, i) and the extracted home secret value X (A, i) q),
The encrypted information (E _{K (B, A, i)} [Y (B, A, i) + RR]) is decrypted using the obtained symmetric key K (B, A, i) to decrypt the decrypted information. Value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (B, A, i) + RR]]) to the visit blind key Y (B, A, i) and resource history (RR) information,
If the comparison results coincide with each other, the home blind key Y (A, i) and the home blind key Y (A, i) are encrypted (E _{K (B, A, i)} [Y (A, i) Visit agent device for transmitting the roaming response message to the visit agent. The method according to claim 9,
The roaming authentication message transmission unit,
Extract the home blind key Y (A, i) from the roaming response message and extract the symmetric key K (B, A, i) corresponding to the home blind key Y (A, i),
The encryption value E _{K (B, A, i)} [Y (A, i)] included in the roaming response message is decrypted using the symmetric key K (B, A, i) and then decrypted. A value (D _{K (B, A, i)} [E _{K (B, A, i)} [Y (A, i)]]) is associated with the home blind key Y (A, i) included in the roaming response message. Then compare
And the roaming authentication message is transmitted to the mobile node when the comparison result matches each other. A home agent corresponding to the home network of the mobile node; And
A visit agent which performs secure roaming of the mobile node moved from the home agent,
The visit agent,
When the registration request message is received from the mobile node, a roaming request message for the mobile node is transmitted to the home agent.
When the roaming response message for the mobile node is received from the home agent, roaming authentication message is transmitted using the roaming response message to transmit a roaming authentication message to the mobile node.
The home agent A stores a home secret value X (A, i) and domain information for the mobile node A, i in a DB,
The mobile node generates a home blind key (Y (A, i) = α ^{X (A, i)} mod q ⁾ generated using the home secret value X (A, i), prime number (q) and primitive root (α). ),
The registration request message for the mobile node includes the home blind key Y (A, i) and resource record (RR) information. delete

Images