KR20050045203A - Method for secure mobile ip authentication against replay attack - Google Patents

Abstract

The present invention relates to a method for authenticating a mobile IP secured against a replay attack. The method for authenticating a mobile IP is based on the identification protocol of a mobile node (MN) during a home agent (HA) registration process. Agents (FAs) are able to prove their identity, and HA's identity can also be proved to the FA. As a result, it is possible to prevent replay attacks, which are pointed out as a weak point in the existing mobile IP authentication, thereby enhancing the security of the mobile IP authentication process.

Description

Method for secure mobile IP authentication against replay attack}

The present invention relates to the security of mobile IP, and more particularly to a secure authentication method for mobile IP users.

1 is a diagram illustrating a mobile IP authentication process according to the prior art, and follows the mobile IP authentication protocol defined in RFC3344, a standardization document of the Internet Engineering Task Force (IETF), an international standardization organization.

FIG. 1 illustrates a mobile node 11 (hereinafter referred to as MN), an external agent 12 (hereinafter referred to as FA) and a home agent 13 (hereinafter referred to as HA). have.

The MN 11 refers to a mobile terminal / device that supports mobility, such as a mobile phone, a personal digital assistant (PDA), a notebook computer, and the like.

The FA 12 is an entity located in a visited network of the mobile IP protocol. When the MN 11 moves to the visited network, the FA 12 provides a temporary IP address, a care-of-address (CoA), to the MN 11. And delivers the mobile IP registration message to the HA 13 of the home network. As a result, if the mobile IP authentication succeeds, the MN 11 can use the network resources of the visited network through the FA 12.

The HA 13 is an entity located in the home network of the mobile IP protocol. The HA 13 receives a registration request from the MN 11 to authenticate the MN 11, and stores binding information between the temporary IP address and the home address of the MN 11. After that, the MN 11 tunnels a packet coming to the home address of the MN 11 to a location where the MN 11 is currently located, thereby enabling the MN 11 to perform communication without interruption.

Looking at the mobile IP authentication process performed between the MN 11, FA 12, and HA 13 with reference to FIG.

First, the MN 11 transmits a registration request message M ₁ and a message authentication code (MAC) authentication value (<M ₁ > K _MN-HA ) of the message to the FA 12 (arrow 1) for mobile IP authentication. Reference). K _MN-HA means a long-term shared secret for authentication between the MN 11 and the HA 13.

The FA 12 then forwards the request message M ₁ sent from the MN 11 and its MAC authentication value (<M ₁ > K _MN-HA ) to the HA 13 (see arrow 2).

The HA 13, which has received the request message M ₁ transmitted from the MN 11 through the FA 12 and its MAC authentication value (<M ₁ > K _MN-HA ), has its own long-term shared key ( calculate a MAC value using the K _MN-HA), and the calculated MAC value received from the MN (11) MAC authentication value (<M _1> to verify that match the K _MN-HA) authenticate the MN (11) do. After processing the received registration request message M ₁ , the registration response message M ₂ and its MAC authentication value (<M ₂ > K _MN-HA ) are transmitted to the MN 11 (see arrow 3).

The FA 12 forwards the registration response message M ₂ and the MAC authentication value (<M ₂ > K _MN-HA ) received from the HA 13 to the MN 11 (see arrow 4).

The MN 11 that has received the registration response message M ₂ and its MAC authentication value (<M ₂ > K _MN-HA ) sent from the HA 13 through the FA 12 has a long-term shared key ( _H ) that it has. calculate a MAC value using the K _MN-HA), and to verify that the calculated MAC value matches the MAC authentication value received from the _{HA (13) (<M 2} > K MN-HA) to authenticate the HA (13) do.

However, such a mobile IP authentication protocol has a disadvantage in that it is vulnerable to a replay attack by an attacker who acquired a previous message. Therefore, there is a need for a new method for effectively defending against message reuse attacks that cannot be prevented with existing mobile IP authentication protocols.

An object of the present invention is to provide a mobile IP authentication method that can protect against a message reuse attack.

Another technical problem to be achieved by the present invention is to provide a mobile IP authentication method that can minimize the computational burden of the mobile terminal.

Another object of the present invention is to provide a computer-readable recording medium having recorded thereon a program for executing the method on a computer.

In order to achieve the above object, the mobile IP authentication method that is secure against the reuse attack according to the present invention includes: (a) a foreign agent (Foreign Agent) sends an advertisement message and an arbitrary integer i (0 <i <t) to a mobile node; Advertising); (b) the mobile terminal registers a registration request message, a MAC authentication value of the registration request message, and a predetermined authentication parameter ( ) Is sent to the external agent, where F is a one-way function); (c) the external agent After verifying whether the mobile terminal is authenticated by the identity of the mobile terminal, the registration request message, MAC authentication value of the registration request message, the authentication parameter, and any integer j (0 <j <t, j ≠ i) Transmitting to a home agent; (d) after the home agent verifies the MAC authentication value of the registration request message to authenticate the mobile terminal, Calculating, processing the registration request message, and transmitting a registration response message and an authentication value for the registration response message, and the authentication parameter to the external agent; (e) verifying the home agent by the external agent, and transmitting the registration response message and the MAC authentication value of the registration response message to the mobile terminal; (f) the mobile terminal authenticating the home agent by verifying a MAC authentication value of the registration response message; And (g) the home agent calculating and publishing the public key of the new mobile terminal using the newly generated nonce data during the authentication process of the IP.

Hereinafter, with reference to the accompanying drawings will be described in detail a preferred embodiment of the present invention.

2 is a diagram illustrating a mobile IP authentication process according to a preferred embodiment of the present invention. In order to perform the mobile IP authentication protocol, the following conditions are premised.

(1) MN 110 and HA 130 share a long-term shared secret (K).

(2) The one-way function f and the hash function h are open.

(3) The previous nonce data (N _HA ) of the _HA 130 is shared with each other in advance. Here, the nonce data means a random value inserted in the message to prevent reproduction.

(4) The public key (pk) of the MN 110 is to be. here T is a moderately large integer.

In the mobile IP authentication method according to the present invention, the one-way property of the one-way function f is used for individual authentication. A one-way function means that the function value f (x) for a given x is easy to calculate, but the inverse function value f ^-1 (y) for a given y means a function that cannot be calculated. In the present invention, a response value using a one-way function is presented to the challenge value presented by the FA 120 when authenticating the mobile IP, and the FA 120 verifies this, thereby making the MN 110 normal. MN can be confirmed. Looking at the mobile IP authentication method in detail as follows.

Referring to FIG. 2, the FA 120 selects a random integer i (0 <i <t) and advertises to the MN 110 along with an Advertisement message Adv of the FA 120. (See arrow 10).

The MN 110 sends a registration request message (M ₁ ) and its MAC authentication value (<M ₁ > K), and Is sent to the FA 120 (see arrow 11). here, to be.

Registration request message (M ₁ ) from MN (110), MAC authentication value (<M ₁ > K), and The FA 120 receiving the By confirming whether or not (see reference numeral 12 in FIG. 2), after authenticating the identity of the MN 110 that has received its advertisement and requested registration, a random integer j (0 <j <t, j ≠ i). Then, the registration request message (M ₁ ) and its MAC authentication value (<M ₁ > K), , And any integer j is sent to HA 130 (see arrow 13).

Registration request message (M ₁ ) from FA 120 and its MAC authentication value (<M ₁ > K), HA and 130, having received a random integer j, authenticate the MN 110 by verifying the MAC authentication value <M ₁ > K of the registration request message M ₁ . That is, the HA 130 calculates the MAC value using the long-term shared key K, and verifies whether the calculated MAC value matches the received MAC authentication value (<M ₁ > K) to authenticate the MN 110. do.

Subsequently, the HA 130 After calculating and processing the registration request message (M ₁ ), the registration response message (M ₂ ) and its authentication value (<M ₂ > K), and Is sent to the FA 120 (see arrow 14).

Registration response message (M ₁ ) for registration request message (M ₁ ) from HA 130, and authentication value (<M ₂ > K) for it, and The FA 120 receiving the Is checked (if j <i Verify), and verify that the HA 130 currently undergoing the registration process is the correct HA of the MN 110 (see reference numeral 15 of FIG. 2).

Subsequently, the FA 120 transmits a registration response message M ₂ and an authentication value thereof (<M ₂ > K) to the MN 110, and the received MN 110 receives the authentication value <M ₂ > K. Verify the HA 130 by verifying. That is, the MN 110 calculates the MAC value using the long-term shared key K, and verifies whether the calculated MAC value matches the received MAC authentication value (<M ₂ > K) to authenticate the HA 130. (See arrow 16).

After the mobile IP authentication process as described above, the HA (130) uses a new MN public key (pk) using the newly generated Nonce data (N ' _HA ) during the authentication process as shown in Equation 1 below. Calculate and disclose it (see reference numeral 17 in FIG. 2).

In this case, a Certificate Authority (CA) (not shown) is requested to renew the certificate of the MN 110 and the CA renews the certificate, thereby revealing a new public key pk of the MN 110. Certificate Authorities (CAs) are networks on the network that issue and manage security credentials and public keys for encrypting and restoring messages. The certification body checks for safety with the Registrar (RA), which verifies the information provided by the digital certificate requester. If the registrar proves the claimant's information, the certification body can issue a certificate. Although slightly different depending on the implementation of the public key infrastructure, the certificate usually contains the owner's public key, the validity of the certificate, the owner's name, and other information about the owner of the public key.

As described above, the mobile IP authentication method according to the present invention checks the identity of the MN 110 through a response to the value queried by the FA 120 whenever the MN 110 authenticates a user. In response to the value queried by the FA 120, the correct relationship with respect to the MN 110 of the HA 130 is confirmed. Therefore, it is possible to defend against the reuse attack of the attacker who acquired the previous message.

In addition, the mobile IP authentication method according to the present invention, unlike the conventional mobile IP authentication method using a public key cryptography system, because it uses a one-way function with a very small amount of calculation without performing a public key operation, the calculation amount is reduced, authentication speed Is improved.

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical data storage, and the like, and may also be implemented in the form of a carrier wave (for example, transmission over the Internet). Include. The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion.

As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, according to the mobile IP authentication method according to the present invention, whenever the MN authenticates the user, the identity of the MN is confirmed through the response to the value queried by the FA, and the response to the value queried by the FA. This confirms the correct relationship of HA to MN. Therefore, it is possible to defend against the reuse attack of the attacker who acquired the previous message. In addition, since a one-way function having a very small amount of calculation is used without performing a public key operation, the amount of calculation is reduced compared to a mobile IP authentication method using a conventional public key cryptosystem, and the authentication speed is improved.

1 is a view showing a mobile IP authentication process according to the prior art.

2 illustrates a mobile IP authentication process according to a preferred embodiment of the present invention.

<Description of Symbols for Main Parts of Drawings>

11, 110: mobile node (MN) 12, 120: foreign agent (FA)

13, 130 home agent (HA)

Claims (6)

(a) a foreign agent advertising an advertisement message and an arbitrary integer i (0 <i <t) to a mobile node; (b) the mobile terminal registers a registration request message, a MAC authentication value of the registration request message, and a predetermined authentication parameter ( ) Is sent to the external agent, where F is a one-way function); (c) the external agent After verifying whether the mobile terminal is authenticated by the identity of the mobile terminal, the registration request message, MAC authentication value of the registration request message, the authentication parameter, and any integer j (0 <j <t, j ≠ i) Transmitting to a home agent; (d) after the home agent verifies the MAC authentication value of the registration request message to authenticate the mobile terminal, Calculating, processing the registration request message, and transmitting a registration response message and an authentication value for the registration response message, and the authentication parameter to the external agent; (e) verifying the home agent by the external agent, and transmitting the registration response message and the MAC authentication value of the registration response message to the mobile terminal; (f) the mobile terminal authenticating the home agent by verifying a MAC authentication value of the registration response message; And and (g) calculating, by the home agent, a public key of the new mobile terminal using the newly generated nonce data during the authentication process of the IP. The method of claim 1, In step (d), the home agent calculates a MAC value using a long-term shared key, verifies whether the calculated MAC value matches the MAC authentication value of the received registration request message, Mobile IP authentication method characterized in that the authentication. The method of claim 1, In step (e), the external agent (when j> i) or verifying (when j <i), and verifying that the home agent is a correct home agent of the mobile terminal. The method of claim 1, In step (f), the MAC value is calculated using a long-term shared key, and the home agent is authenticated by verifying whether the calculated MAC value matches the MAC authentication value of the received registration response message. Mobile IP authentication method. The method of claim 1, In the step (g), when the newly generated nonce data is N ' _HA , K is a long-term shared key, h (·) is a hash function, and f (·) is a one-way function, a new mobile terminal 'S public key is Mobile IP authentication method characterized in that. A computer-readable recording medium having recorded thereon a program for executing the method of claim 1 on a computer.