KR20050066636A - System and method for user authentication of ad-hoc node in ad-hoc network - Google Patents

Abstract

The present invention relates to a user authentication system and a method in a terminal of an Ad-hoc network.

In a terminal of an ad-hoc network, a user authentication system and method thereof, when receiving a message from a terminal or an ad-hoc gateway, the main controller interprets the message, and if the message is an Extensible Authentication Protocol (EAP) message, By checking whether the user authentication is completed, if the EAP message is a user authentication completion message, the upper layer is notified of the authentication completion, and if the EAP message is not the user authentication completion message, the user authentication function is performed.

In this way, in the Ad-hoc network where user authentication in the wireless section is weak, the user side can perform user authentication to enhance stability and security, maintain compatibility with existing wireless LAN, and support exchange of session keys. By providing encryption information required by the Medium Access Control (MAC) layer, secure communication may be enabled.

Description

System and method for user authentication in a terminal of the AED-ｈｏｃ network {SYSTEM AND METHOD FOR USER AUTHENTICATION OF AD-HOC NODE IN AD-HOC NETWORK}

The present invention relates to a user authentication system and a method thereof in a terminal of an Ad-hoc network, and more particularly, to a user authentication system and a method thereof in a terminal of an Ad-hoc network which performs a user authentication control operation in terms of an Ad-hoc terminal. will be.

Security centered around Bluetooth and wireless LAN is being actively researched around the Internet Engineering Task Force (IETF).

In particular, the security that supports Ad-hoc mode in wireless LAN is the standard when using AP (Access Point), but the security in Ad-hoc mode that WLAN card supports is very weak.

The IEEE 802.11i Working Group, which establishes wireless LAN security standards, recently proposed a new type of security architecture (Robust Security Network, RSN) that can be applied to WLAN infrastructure networks and Ad-Hoc networks. Standardization is in progress.

RSN is used to enhance wireless access area security through network access control, secure session management, per-packet key management, and the introduction of new cryptographic algorithms through 802.1x-based subscriber authentication at multiple access points (APs).

The IEEE 802.11 Working Group has recently been working to combine 802.1x (Portbased Network Access Control) with 802.11i, and is expected to solve many of the security issues so far.

IEEE 802.1x is a standard that defines a method of mutually authenticating wireless LAN subscribers and a method for dynamically distributing a master session key required for wireless access section security. The IEEE 802.1x allows authentication at the application layer to allow wireless LAN access only to legitimate subscribers. Provides access control standard specifications.

The terminal and the authentication server distribute a key from the authentication server to the access point (AP) from the master session key generated dynamically during the authentication process. The distributed key is later used as a primary key for providing data privacy in a wireless access section on a packet basis.

Therefore, 802.1x has a structure in which an authentication subject (authentication server) and an access control subject (AP) are dualized. This dualized structure has an advantage of easily supporting global roaming of subscribers.

The user (Supplicant) is a terminal requesting a network connection, the AP (Authenticator) relays the authentication process between the terminal and the authentication server, and becomes a subject (Port Access Entity: PAE) to perform the access control according to the authentication result.

The AP, the access control subject, controls the access of the subscriber by using a logical port such as an association ID, which allows only data transmitted and received to the authenticated port through packet filtering.

802.1x uses Extensible Authentication Protocol (EAP) as a standard protocol for transmitting subscriber authentication data.

As described above, in the related art, user authentication information is managed by an authentication server of a terminal and a network. In particular, a recent research trend is a trend of performing user authentication with the support of AAA (Authentication, Authorization and Accounting) server as an authentication structure. .

Ad-hoc networks are very vulnerable to security because they operate in a wireless environment, and it is difficult to maintain confidentiality of personal information. In other words, a malicious user can enter the communication area newly and extract information, forgery, or tampering with the contents of the communication. Therefore, a high level of permission and encryption for the Ad-hoc network resource is required.

 Although EAP authentication provides a strong and efficient user authentication method, it has not yet been applied in ad-hoc networks.

The present invention provides a user authentication system in a terminal of an Ad-hoc network capable of supporting a user authentication method in a terminal to solve a vulnerability of user authentication in a wireless section and also maintain compatibility with an existing wireless LAN. To provide a way.

In order to solve this problem, the present invention is to apply the authentication control using the EAP method and the authentication method using the Transport Layer Security (TLS) method to support the user authentication method in the terminal side in the Ad-hoc network.

A user authentication system in a terminal of an Ad-hoc network according to a first aspect of the present invention is a user authentication system in a terminal of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through a gateway. Message handling unit for managing messages transmitted to and received from the outside; A main control unit which performs various control operations for performing a user authentication function, checks whether a received message exists in the message processing unit, analyzes the received message, examines a transmission destination, and checks whether the received message has been authenticated; A key manager which manages a key required for user authentication by a control operation of the main controller; And an authentication processing unit for performing a calculation required for user authentication by applying a security algorithm by a control operation of the main controller.

In a terminal of an ad-hoc network, the user authentication system operates the initialization unit which initializes by loading initialization information when the main controller starts the user authentication control function.

When the destination of the received message is the terminal or the gateway, the main controller analyzes the received message and checks whether the user authentication is completed if the EAP message, and if not the EAP message, performs an error report.

If the received message is an EAP message, the main controller notifies the upper layer of the authentication completion result if the EAP message is a user authentication completion message, and if the EAP message is not a user authentication completion message, the key management unit or authentication processing unit. It is preferable to perform a user authentication function through.

When the destination of the received message is a higher layer in the terminal, the main controller analyzes the received message and performs a processing operation according to the result of the analysis.

A user authentication method in a terminal of an Ad-hoc network according to a second aspect of the present invention is a user authentication method in a terminal of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through a gateway. When receiving a message from a terminal or a gateway, interpreting the received message and confirming a message type; b) when the received message is an EAP message in step a), confirming whether the user authentication of the EAP message is completed; And c) notifying the upper layer of authentication completion if the EAP message is a user authentication completion message, and performing a user authentication function if the EAP message is not a user authentication completion message. do.

In a terminal of an ad-hoc network, a user authentication method includes: d) interpreting the received message and performing a processing operation according to the result of the analysis when the received message is a message transmitted from a higher layer of the terminal in step a). It further comprises the step.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

First, FIG. 1 illustrates the structure of an Ad-hoc network to which the present invention is applied.

As shown in FIG. 1, the Ad-hoc network supports the connection with the Internet when the Ad-hoc communication is possible but requires interworking with the Internet, and the Ad-hoc gateway 10 is connected to the Ad-hoc network and the Internet. The AAA server 20 is responsible for authentication, authorization, and billing in a stable backbone network.

In addition, the Ad-hoc terminals A, B, and C all communicate wirelessly, and communicate with the AAA 20 with the support of the Ad-hoc gateway 10 to perform user authentication. These terminals may form an ad-hoc network capable of communicating independently.

A user authentication system in a terminal of an Ad-hoc network according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

2 illustrates a configuration of a user authentication system in a terminal of an ad-hoc network according to an embodiment of the present invention.

As shown in FIG. 2, a user authentication system in a terminal of an Ad-hoc network according to an embodiment of the present invention includes a main control unit 110, an initialization unit 120, a message processing unit 130, a key management unit 140, An authentication processing unit 150 is included.

The main controller 110 checks whether the user is authenticated with respect to the received message while controlling each unit, and performs a user authentication control operation according to the confirmation result.

When the user authentication control function is started, the initialization unit 120 is operated by the main control unit 110 to read information necessary for initialization and perform an initialization operation.

The message processing unit 130 manages messages transmitted and received from the terminal or the gateway.

The key manager 140 manages a session key necessary for performing a user authentication function by a control operation of the main controller 110. The authentication processing unit 150 performs operations required for user authentication by applying security algorithms such as message digest (MD-5) as well as functions such as hash function and random number generation by the control operation of the main control unit 110. .

Next, the operation of the user authentication system in the terminal of the Ad-hoc network according to an embodiment of the present invention will be described in detail with reference to FIG. 3.

3 is a flowchart illustrating a user authentication method in a terminal of an Ad-hoc network according to an embodiment of the present invention.

As shown in FIG. 3, the user authentication method in a terminal of an Ad-hoc network according to an embodiment of the present invention, when the terminal is powered on and the user uses the Ad-hoc network, the network is eligible for the user to use network resources. Will be authenticated.

In order for a terminal to perform an authentication procedure with an AAA server in a wired backbone network, the protocols of the terminal, Ad-hoc gateway, and AAA server must be correct and must be capable of performing different authentication procedures. That is, the terminal determines whether to authenticate with the user's information, and if authentication is required, the terminal initiates the authentication procedure to AAA, which is an authentication server in the backbone network.

However, since the message transmitted from the terminal to the AAA server does not go directly, but is transmitted through the Ad-hoc gateway, the wireless section is authenticated between the terminal and the Ad-hoc gateway and the wired section is authenticated between the Ad-hoc gateway and AAA server This is used.

The wireless section authentication between the terminal and the Ad-hoc gate is performed in the terminal. That is, when a user authentication control function is started by a request of a higher layer, the main controller 110 operates the initialization unit 120 to perform system initialization. (S1)

When the initialization process is completed, the main controller 110 checks whether there is a received message in the message buffer through the message processor 240 (S2).

If there is a received message, the main controller 110 analyzes the received message and checks whether the sender of the message is a terminal or an Ad-hoc gateway (GW). (S3, S4)

When the received message is transmitted from the terminal or the gateway, the main control unit 110 analyzes the received message and checks whether it is an EAP message. (S5, S6)

At this time, if the result of analyzing the received message is the EAP message, the main controller 110 checks whether the EAP message is an authentication completion message (S6, S7).

When the EAP message is the authentication completion message, the main controller 110 notifies the authentication completion to the upper layer that has requested the authentication because the user authentication process is normally processed. (S8, S9) where the upper layer starts authentication in the terminal. Instructs to receive and report the authentication result.

However, when the EAP message is not an authentication completion message, it is determined that the authentication control procedure is not finished, and the main controller 110 performs a user authentication function through the authentication processing unit 150 or the key management unit 140 and then performs high authentication. The message continues to be received until the completion message is received (S10).

The main controller 110 reports an error to a higher layer when the received message is not an EAP message (S11).

On the other hand, if the destination of the received message is data from a higher layer inside the terminal, the main control unit 110 interprets the received message and performs a processing operation according to the result of the analysis to continue the message until an authentication completion message is received. (S12, S13, S14)

As described above, the embodiment of the present invention uses the EAP method, which is an authentication protocol according to international standards, while considering compatibility with the existing wireless LAN, and uses a certificate for the authentication layer, and uses a TLS (Transport Layer Security) method having excellent safety. Apply.

In addition, since the EAP-TLS scheme is applied to the embodiment of the present invention, session key exchange is supported to provide secure encryption by providing necessary encryption information in the MAC layer.

In addition, the Ad-hoc gateway connected to the Internet uses the EAP-TLS method to perform user authentication with the AAA server in the backbone network and the Diameter protocol with the AAA server.

 Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, the user authentication system and the method in the terminal of the Ad-hoc network according to the present invention can enhance the stability and security by performing the user authentication on the terminal side in the Ad-hoc network where the user authentication of the wireless section is weak, Compatibility with existing wireless LANs can also be maintained, and the exchange of session keys is supported to provide secure encryption by providing the necessary encryption information in the MAC layer.

1 shows the structure of an Ad-hoc network to which the present invention is applied.

2 illustrates a configuration of a user authentication system in a terminal of an ad-hoc network according to an embodiment of the present invention.

 3 is a flowchart illustrating a user authentication method in a terminal of an Ad-hoc network according to an embodiment of the present invention.

Claims (10)

In a user authentication system in a terminal of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through a gateway, The terminal, A message processor for managing messages transmitted to and received from the outside; A main control unit which performs various control operations for performing a user authentication function, checks whether a received message exists in the message processing unit, analyzes the received message, examines a transmission destination, and checks whether the received message has been authenticated; A key manager which manages a key required for user authentication by a control operation of the main controller; And An authentication processing unit for performing operations required for user authentication by applying a security algorithm by the control operation of the main control unit User authentication system in the terminal of the ad-hoc network comprising a. The method of claim 1, The main control unit is a user authentication system in the terminal of the Ad-hoc network to operate the initialization unit to perform the initialization by loading the initialization information when the user authentication control function is started. The method of claim 1, The main control unit, When the destination of the received message is the terminal or the gateway, if the received message is interpreted and the EAP message is checked, user authentication is completed. If the received message is not the EAP message, the terminal of the Ad-hoc network performs an error report. system. The method of claim 3, The main control unit, When the received message is an EAP message, if the EAP message is a user authentication completion message, an authentication completion result is notified to a higher layer that is notified of the initiation and authentication result of the user authentication, and if the EAP message is not a user authentication completion message. User authentication system in the terminal of the Ad-hoc network performing a user authentication function through the key management unit or the authentication processing unit. The method of claim 1, The main control unit, When the destination of the received message is a higher layer that is notified of the start of the user authentication and the authentication result in the terminal, the user authentication in the terminal of the Ad-hoc network that interprets the received message and performs a processing operation according to the result of the analysis system. A user authentication method in a terminal of an ad-hoc network in which a terminal in an ad-hoc network is connected to the Internet through a gateway, a) when receiving a message from the terminal or the gateway, interpreting the received message and confirming a message type; b) when the received message is an EAP message in step a), confirming whether the user authentication of the EAP message is completed; And c) if the check result of step b) indicates that the EAP message is a user authentication completion message, notifying the completion of authentication to a higher layer that is notified of the user authentication start and authentication result, and the user if the EAP message is not a user authentication completion message; Steps to Perform the Authentication Function User authentication method in the terminal of the ad-hoc network comprising a. The method of claim 6, B), User authentication method in the terminal of the Ad-hoc network to report the error to the upper layer when the received message is not the EAP message. The method of claim 1, d) if the received message is a message transmitted from a higher layer of the terminal in step a), further comprising interpreting the received message and performing a processing operation according to a result of the interpretation of the Ad-hoc network; User authentication method on the terminal. The method of claim 6, C), User authentication method in a terminal of an Ad-hoc network to apply a security algorithm to perform the user authentication function. The method of claim 6, C), A user authentication method in a terminal of an Ad-hoc network which supports exchange of session keys to perform the user authentication function and provides encryption information required by an upper layer.