KR101588646B1 - System and method for authorizing in wireless communication system - Google Patents

Abstract

The present invention relates to a method and system for authenticating a Access Gateway in a Proxy Mobile IPv6 (PMIP) environment, and more particularly, to a method and system for authenticating a first token including authentication information with a home agent, And transmits the first token to the home agent when the first token included in the DHCP request message is authenticated by including the first token in a Binding Update message, And a home agent for authenticating a connection gateway that has transmitted the first token when the first token included in the binding update message is authenticated, thereby performing authentication for the connection gateway without performing a separate authentication process There is an advantage to be able to do.

Proxy Mobile IPv6 (PMIP), Authentication, MT-Token, Proxy Binding Update (PBU)

Description

[0001] SYSTEM AND METHOD FOR AUTHORIZING IN WIRELESS COMMUNICATION SYSTEM [0002]

The present invention relates to a wireless communication system, and more particularly, to a method and system for performing authentication for a connection gateway using authentication information of a terminal in a wireless communication system of a Proxy Mobile IPv6 (PMIP) environment.

In a wireless communication system using mobile IPv6, when a terminal moves to an external network, the external network generates a care of address (CoA), which is a temporary address for the terminal. At this time, the access gateway (AG) of the external network accesses the home agent (HA) assigned the home address (HOA) of the terminal through the proxy binding update, Home Agent).

In this case, the terminal and the access gateway must be authenticated by the home agent. At this time, the home agent performs the first authentication for authenticating the terminal and the second authentication for authenticating the access gateway.

When authentication of the home agent and the connection gateway is performed, the home agent and the connection gateway must establish a trust relationship for authentication before authentication. For example, when the provider managing the network of the home agent is different from the provider managing the network of the access gateway, the providers must share information for communication for the second authentication.

If the trust relationship between the network of the home agent and the network of the access gateway is not established, a problem that the second authentication can not be performed occurs.

Accordingly, it is an object of the present invention to provide an authentication method and system for a connection gateway in a wireless communication system of a PMIP (Proxy Mobile IPv6) environment.

It is another object of the present invention to provide a method and system for performing authentication for a connection gateway using authentication information of a terminal in a wireless communication system of a PMIP environment.

It is still another object of the present invention to provide a method and system for performing authentication of a connection gateway using a terminal's authentication information in a home agent (HA) in a PMIP environment.

It is still another object of the present invention to provide a method and system for transmitting authentication information of a terminal in a PMIP environment to a home agent through the access gateway in order to perform an authentication procedure for the access gateway.

According to a first aspect of the present invention, there is provided a system for authenticating a Access Gateway in a Proxy Mobile IPv6 (PMIP) environment, the system including authentication information with a home agent, A terminal that includes a first token in a Dynamic Host Configuration Protocol (DHCP) solicitation message and transmits the first token to a connection gateway; and, when the first token included in the DHCP request message is authenticated, And a home agent for authenticating a connection gateway that transmits the first token when the first token included in the binding update message is authenticated .

According to a second aspect of the present invention, a method for authenticating an access gateway in a home agent of a Proxy Mobile IPv6 (PMIP) environment includes the steps of: performing an authentication procedure with a terminal; Authenticating the first token if the first token including the authentication information of the terminal and the home agent is received from the terminal; and if the first token can be authenticated, And authenticating the transmitted gateway gateway.

As described above, in the wireless communication system of the PMIP (Proxy Mobile IPv6) environment, the authentication of the access gateway is performed using the authentication information of the terminal, so that authentication of the access gateway can be performed without a separate authentication process .

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear. The following terms are defined in consideration of the functions of the present invention, and these may be changed according to the intention of the user, the operator, or the like. Therefore, the definition should be based on the contents throughout this specification.

Hereinafter, a technique for performing authentication for an access gateway (AG) using authentication information of a terminal in a wireless communication system in a PMIP (Proxy Mobile IPv6) environment will be described. Here, the access gateway is referred to as a mobile access gateway (MAG), and the terminal may also be referred to as a mobile terminal (MT).

A home agent (HA) in the PMIP environment performs an authentication procedure for the access gateway using the authentication information of the terminal as shown in FIG. Here, the home agent may also be referred to as an LMA (Localized Mobility Anchor).

1 shows an authentication procedure for nodes in a wireless communication system according to the present invention.

As shown in FIG. 1, the wireless communication system includes a terminal 100, a connection gateway 110, and a home agent 120. At this time, it is assumed that the terminal 100 is authenticated by the home agent 120 and recognizes the roaming key for the home agent 120.

If the terminal 100 accesses the access gateway 110, the access terminal 100 performs a network entry procedure with the access gateway 110 (step 131).

In step 133, the MS 100 transmits a Router Solicitation message to the access gateway 110 in order to acquire the prefix information of the router. At this time, the terminal 100 requests prefix information to the connection gateway 110 for new IP address assignment and DNS registration.

The access gateway 110 allocates a prefix available to the terminal 100 when a router request message is received from the terminal 100 (step 135). For example, the connection gateway 110 transmits a Router Advertisement message including a prefix available to the terminal 100 to the terminal 100. At this time, the terminal 100 can generate a host ID using the prefix provided from the connection gateway 110 to generate an IP address.

In step 137, the terminal 100 transmits a DHCPv6 Solicit message to the access gateway 110 in order to find a Dynamic Host Configuration Protocol (DHCP) server. At this time, the terminal 100 transmits an MT-token including roaming key information for the home agent 120 to the connection gateway 110 together with the DHCP request message. For example, the MT-token is configured as shown in FIG. 2 below.

The connection gateway 110 confirms whether the MT-token provided together with the DHCP request message provided from the terminal 100 can be authenticated. For example, the connection gateway 110 compares the prefix information included in the MT-token with its prefix information to confirm that the MT-token can be authenticated. At this time, the connection gateway 110 determines that the MT-token can be authenticated when the prefix information included in the MT-token is the same as the prefix information of the MT-token.

If the MT-token is authenticated, the connection gateway 110 transmits a Proxy Binding Update (PBU) message including the MT-token to the home agent 120 (Step 139) .

The home agent 120 checks whether the MT-token included in the proxy binding update message provided from the connection gateway 110 can be authenticated. For example, the home agent 120 compares the source address of the proxy binding update message with the prefix included in the MT-token to verify that the MT-token can be authenticated. At this time, the home agent 120 determines that the MT-token can be authenticated if the source address of the proxy binding update message and the prefix included in the MT-token are the same.

Also, the home agent 120 checks whether the MT-token can be authenticated using the time stamp information of the MT-token. At this time, if the MT-token can not be authenticated using the time stamp information, the home agent 120 recognizes that it has received a replay attack.

The home agent 120 also verifies that the MT-token can be authenticated using the signature field of the MT-token. That is, the home agent 120 checks whether the signature field is generated by the roaming key authenticated by the home agent.

If the MT-token is authenticated, the home agent 120 recognizes that the access gateway 110 that transmitted the MT-token is authenticated.

The home agent 120 transmits a Proxy Binding ACK (PBA) message including an LMA-token to the connection gateway 110 (step 141). For example, the LMA-token is configured as shown in FIG.

The connection gateway 110 confirms whether the LMA-token included in the proxy binding ACK message provided from the home agent 120 can be authenticated. For example, the connection gateway 110 compares the address of the connection gateway included in the LMA-token with its own address to confirm that the LMA-token can be authenticated. At this time, the connection gateway 110 determines that the LMA-token can be authenticated if the address of the connection gateway included in the LMA-token is the same as the address of the connection gateway.

If the LMA-token is authenticated, the connection gateway 110 transmits a DHCPv6 Admission message including the LMA-token to the terminal 100 (step 143). At this time, the DHCP advertisement message includes the address of the DHCP server.

The terminal 100 determines whether the LMA-token included in the DHCP advertisement message provided from the connection gateway 110 can be authenticated. For example, the terminal 100 confirms whether the LMA-token can be authenticated using the time stamp information of the LMA-token. At this time, if the LMA-token can not be authenticated using the time stamp information, the terminal 100 recognizes that it has received a retransmission attack.

Also, the terminal 100 compares the address allocated from the DHCP server with the home address included in the LMA-token to confirm whether or not the LMA-token can be authenticated. At this time, the terminal 100 determines that the LMA-token can be authenticated if the address allocated by DHCP and the home address included in the LMA-token are the same.

Also, the terminal 100 confirms whether the LMA-token can be authenticated using the signature field of the LMA-token. That is, the terminal 100 confirms that the signature field is generated with the roaming key for the home agent 120. [

Then, the terminal 100 determines whether to use the address allocated from the connection gateway 110 and the DHCP server (steps 145 and 147).

FIG. 2 illustrates the structure of an MT-token according to an embodiment of the present invention.

2, the MT-token includes a Requested IPv6 HoA / HNP 200, a Prefix of MAG 210, an IPv6 Address of LMA 220, A time stamp field (Timpstamp) 230, a terminal identifier field (MTID) 240, and a signature field 250.

The requested home address field 200 includes a home address of the terminal transmitting the MT-token or a home network prefix (HNP) of the terminal. If the terminal is not assigned a home address, the home address field 200 may set all bits to zero.

The prefix field 210 includes prefix information provided from a connection gateway to which the terminal is connected.

The LMA address field 220 includes the address of the home agent that transmits the MT-token.

The time stamp field 230 includes information for preventing a retransmission attack.

The Terminal Identifier field 240 includes the identifier information of the terminal transmitting the MT-token.

The signature field 250 includes information generated by the terminal transmitting the MT-token with a roaming key allocated from the home agent. For example, the signature field 250 includes information generated by a terminal using a hash function obtained through authentication with a home agent.

FIG. 3 shows the structure of an LMA-token according to an embodiment of the present invention.

3, the LMA-token includes an Assigned IPv6 HoA / HNP 300, an IPv6 Address of MAG 310, a Timestamp field 320, And a signature field (Signature) 330.

The allocated home address field 300 includes a home address of the terminal that transmitted the MT-token or a home network prefix (HNP) of the terminal. If the MT-token is subject to a retransmission attack, the assigned home address field 300 sets all bits to zero.

The MAG address field 310 includes the address of the access gateway that transmitted the proxy binding update message including the MT-token.

The time stamp field 320 includes information for preventing a retransmission attack.

The signature field 330 includes information generated by a roaming key assigned by the home agent to the terminal transmitting the MT-token. For example, the signature field 330 includes information generated by a home agent using a hash function assigned through authentication with the terminal.

The following description describes a method for transmitting an MT-token in a terminal.

FIG. 4 illustrates a procedure for transmitting an MT-token in a terminal according to an embodiment of the present invention.

Referring to FIG. 4, in step 401, the terminal performs a network entry procedure with the access gateway.

Then, the MS proceeds to step 403 and checks available prefix information. For example, in step 401, the terminal receives prefix information of a connection gateway router that has performed a network entry procedure, and is allocated a usable prefix.

After confirming the available prefix information, the terminal proceeds to step 405 and adds an MT-token including roaming key information for the home agent to the DHCP request message to search for a DHCP server, and transmits the MT-token to the access gateway. At this time, it is assumed that the terminal is authenticated by the home agent and recognizes the roaming key for the home agent.

In step 407, the terminal determines whether a DHCP advertisement message including an LMA-token is received from the access gateway.

If the DHCP advertisement message including the LMA-token is received, the terminal determines in step 409 whether the LMA-token included in the DHCP advertisement message can be authenticated. For example, the terminal checks whether the LMA-token can be authenticated using the time stamp information of the LMA-token. At this time, if the LMA-token can not be authenticated using the time stamp information, the terminal recognizes that it has received a retransmission attack.

Also, the terminal compares the address allocated from the DHCP with the home address included in the LMA-token to confirm whether the LMA-token can be authenticated. At this time, if the address allocated from the DHCP and the home address included in the LMA-token are the same, the terminal determines that the LMA-token can be authenticated.

Also, the terminal verifies whether the LMA-token can be authenticated using the signature field of the LMA-token. That is, the terminal verifies that the signature field is generated with the roaming key for the home agent.

If the LMA-token is not authenticated in step 409, the terminal ends the algorithm.

If the LMA-token is authenticated in step 409, the terminal proceeds to step 411 and determines whether to use the address allocated from the DHCP server.

Thereafter, the terminal ends the algorithm.

When the terminal transmits authentication information to the home agent using the MT-token, the access gateway transmits the MT-token as shown in FIG. 5, as described above.

FIG. 5 illustrates a procedure for transmitting an MT-token in a connection gateway according to an embodiment of the present invention.

Referring to FIG. 5, in step 501, the access gateway performs a network entry procedure for a terminal accessing itself.

Thereafter, the access gateway proceeds to step 503 and transmits the available prefix information to the connected terminal. For example, when a router request message is received from a terminal, the connection gateway transmits a router advertisement message including a usable prefix of the terminal to the terminal.

After transmitting the Router Advertisement message, the access gateway checks in step 505 whether a DHCP request message including the MT-token is received.

If a DHCP request message including an MT-token is received, the access gateway checks in step 507 whether the MT-token included in the DHCP request message can be authenticated. For example, the connection gateway compares its prefix information with the prefix information included in the MT-token to confirm that the MT-token can be authenticated. At this time, the access gateway determines that the MT-token can be authenticated when the prefix information included in the MT-token is the same as the prefix information of the access gateway.

If the MT-token can not be authenticated in step 507, the connection gateway terminates the algorithm.

If the MT-token is authenticated in step 507, the access gateway proceeds to step 509 and transmits a proxy binding update message including the MT-token to the home agent.

In step 511, the access gateway checks whether a proxy binding ACK message including an LMA-token is received from the home agent.

If a proxy binding ACK message including the LMA-token is received, the access gateway checks in step 513 whether the LMA-token included in the proxy binding ACK message can be authenticated. For example, the connection gateway compares the address of the connection gateway included in the LMA-token with its own address to confirm that the LMA-token can be authenticated. At this time, the connection gateway determines that the LMA-token can be authenticated if the address of the connection gateway included in the LMA-token is the same as its own address.

If the LMA-token can not be authenticated in step 513, the connection gateway terminates the algorithm.

If the LMA-token is authenticated in step 513, the access gateway proceeds to step 515 and transmits a DHCP advertisement message including the LMA-token to the terminal. At this time, the DHCP advertisement message includes the address of the DHCP server.

Thereafter, the connection gateway terminates the present algorithm.

When the access network transmits the MT-token as described above, the home agent authenticates the access gateway using the MT-token provided from the access gateway as shown in FIG.

6 illustrates a procedure for authenticating nodes in a home agent according to an embodiment of the present invention.

Referring to FIG. 6, in step 601, the home agent checks whether a proxy binding update message including an MT-token is received from a connection gateway.

If a proxy binding update message including an MT-token is received, the home agent proceeds to step 603 and determines whether the MT-token included in the proxy binding update message can be authenticated. For example, the home agent compares the source address of the proxy binding update message with the prefix included in the MT-token to verify that the MT-token can be authenticated. At this time, the home agent determines that the MT-token can be authenticated if the source address of the proxy binding update message and the prefix included in the MT-token are the same.

Also, the home agent verifies that the MT-token can be authenticated using the time stamp information of the MT-token. At this time, if the MT-token can not be authenticated using the time stamp information, the home agent recognizes that it has received a retransmission attack.

The home agent also verifies that the MT-token can be authenticated using the signature field of the MT-token. That is, the home agent confirms whether the signature field is generated by the roaming key authenticated by the home agent.

If it is determined in step 603 that the MT-token can not be authenticated, the home agent proceeds to step 607 and generates an LMA-token in which all bits of the allocated home address field are set to '0'.

On the other hand, if the MT-token is authenticated in step 603, the home agent proceeds to step 605 and recognizes that the access gateway that transmitted the MT-token is authenticated.

Then, the home agent proceeds to step 607 and generates an LMA-token in which the assigned home address field is set as the home address of the terminal.

After generating the LMA-token, the home agent proceeds to step 609 and transmits a proxy binding ACK message including the LMA-token to the access gateway.

The home agent then terminates the algorithm.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. Therefore, the scope of the present invention should not be limited by the illustrated embodiments, but should be determined by the scope of the appended claims and equivalents thereof.

1 is a diagram illustrating an authentication procedure for nodes in a wireless communication system according to the present invention;

2 is a diagram illustrating the structure of an MT-token according to an embodiment of the present invention;

3 is a diagram illustrating the structure of an LMA-token according to an embodiment of the present invention;

FIG. 4 illustrates a procedure for transmitting an MT-token in a terminal according to an embodiment of the present invention; FIG.

5 is a diagram illustrating a procedure for transmitting an MT-token in a connection gateway according to an embodiment of the present invention; and

6 is a diagram illustrating a procedure for authenticating nodes in a home agent according to an embodiment of the present invention;

Claims (17)

In a wireless communication system, A terminal including a first token including authentication information with a home agent in a dynamic host configuration protocol (DHCP) solicitation message and transmitting the first token to a connection gateway; A connection gateway for transmitting the first token to a home agent when the terminal is authenticated through the first token, the first token being included in a proxy binding update message; And a home agent authenticating the access gateway that transmitted the first token by authenticating the first token included in the binding update message. The method according to claim 1, Wherein the terminal transmits the first token to a connection gateway that has performed a network entry. The method according to claim 1, The first token includes at least one of an address of the terminal that transmitted the first token or a home network profix information of the terminal, a prefix information of a connection gateway through which the terminal transmits the first token, The time stamp information, the identifier information of the terminal transmitting the first token, and the authentication information of the terminal and the home agent. The method according to claim 1, Wherein the gateway verifies whether the first token can be authenticated by comparing the prefix information included in the first token with its own proxies information. The method according to claim 1, Wherein the home agent verifies whether the first token can be authenticated by comparing the source address of the binding update message provided from the connection gateway with the prefix information included in the first token, Determining whether the first token can be authenticated using the time stamp information, and verifying whether the first token can be authenticated using the authentication information included in the first token. The method according to claim 1, Wherein the authentication information included in the first token includes information generated by the terminal using a predetermined hash function through authentication with the home agent. The method according to claim 1, Wherein the home agent receives the binding update message including the first token and then transmits a second token including authentication information with the terminal to the connection gateway by including the binding acknowledgment message in an ACK message, The connection gateway may include the second token in a DHCP advertisement message and transmit the second token to the terminal when receiving the second token included in the binding response message, Wherein the terminal verifies whether the second token included in the DHCP advertisement message can be authenticated. 8. The method of claim 7, The second token may include at least one of an address of a terminal that has transmitted the first token or home network proxies of the terminal, address information of a connection gateway that transmitted the first token, time stamp information, ≪ / RTI > 9. The method of claim 8, Wherein the gateway checks whether the second token can be authenticated by comparing the address information of the connection gateway included in the second token with the address information of the connection gateway itself. 9. The method of claim 8, The terminal checks whether the second token can be authenticated using the time stamp information included in the second token. The terminal checks whether the address assigned from the DHCP server, the address of the terminal included in the second token, Comparing the network proxies information to verify that the second token can be authenticated and verifying if the second token can be authenticated using the authentication information contained in the second token. 9. The method of claim 8, Wherein the authentication information included in the second token includes information generated by a home agent using a hash function assigned to the terminal through authentication with the terminal. A method of operating a home agent (LMA) in a wireless communication system, Performing an authentication procedure with the terminal, Receiving the first token including the authentication information of the terminal and the home agent from the access gateway when the first token is authenticated in the access gateway; Authenticating the access gateway that transmitted the first token by authenticating the first token. 13. The method of claim 12, Wherein the first token comprises: The method comprising receiving the binding update message. 13. The method of claim 12, Wherein the first token comprises: The address of the terminal that transmitted the first token or the home network profix information of the terminal, the prefix information of the connection gateway to which the terminal transmits the first token, the address information of the home agent for transmitting the first token, Information of the terminal transmitting the first token, and authentication information of the terminal and the home agent. 13. The method of claim 12, Wherein the authenticating the first token comprises: Checking whether the first token can be authenticated by comparing the source address of the binding update message provided from the connection gateway with the prefix information included in the first token; Checking whether the first token can be authenticated using time stamp information included in the first token; Determining whether the first token can be authenticated using the authentication information included in the first token. 13. The method of claim 12, Receiving a first token from the connection gateway, and transmitting a second token including authentication information with the terminal, to the connection gateway, in a binding response message. 17. The method of claim 16, Wherein the second token comprises: Wherein the first token includes at least one of an address of the terminal transmitting the first token or home network proxies of the terminal, address information of the access gateway that transmitted the first token, time stamp information, and authentication information of the terminal and the home agent Way.

Images