KR20050066637A - System and method for user authentication of ad-hoc gateway in ad-hoc network - Google Patents

Abstract

The present invention relates to a user authentication system and a method thereof in a gateway of an Ad-hoc network.

In the gateway of the Ad-hoc network, a user authentication system and method thereof include an Extensible Authentication Protocol (EAP) when a message arrives from a terminal at an Ad-hoc gateway that supports the connection between the Internet and the Ad-hoc network. The user authentication control operation is performed by checking whether the message is completed and determining whether the corresponding message has been authenticated. When the message arrives from the authentication server, the message is interpreted, the EAP message is generated, and transmitted to the terminal. In this way, user authentication control can be performed at the gateway to enhance security and stability, compatibility with existing wireless LANs can be maintained, and MAC (Medium) can be provided by providing a master session key to legitimate users through user authentication. Secure communication can be enabled by providing necessary encryption information in Access Control) layer.

Description

SYSTEM AND METHOD FOR USER AUTHENTICATION OF AD-HOC GATEWAY IN AD-HOC NETWORK}

The present invention relates to a user authentication system and method in a gateway of an Ad-hoc network, and more particularly, to a user authentication system and a method in a gateway of an Ad-hoc network that supports user authentication control in a gateway.

Security centered around Bluetooth and wireless LAN is being actively researched around the Internet Engineering Task Force (IETF).

Especially, the security that supports Ad-hoc mode in wireless LAN is the standard when using AP (Access Point, AP), but the security in Ad-hoc mode supported by WLAN card is very weak. to be.

The IEEE 802.11i Working Group, which establishes wireless LAN security standards, recently proposed a new type of security architecture (Robust Security Network, RSN) that can be applied to WLAN infrastructure networks and Ad-Hoc networks. Standardization is in progress.

RSN is used to enhance wireless access area security through network access control, secure session management, per-packet key management, and the introduction of new cryptographic algorithms through 802.1x-based subscriber authentication at multiple access points (APs).

The IEEE 802.11 Working Group has recently been working to combine 802.1x (Portbased Network Access Control) with 802.11i, and is expected to solve many of the security issues so far.

IEEE 802.1x is a standard that defines a method for mutually authenticating wireless LAN subscribers and a method for dynamically distributing master session keys required for wireless access section security. Provides access control standard specification.

The subscriber and the authentication server distribute the key from the authentication server to the access point (AP), which is generated dynamically during the authentication process. The distributed key is later used as a primary key for providing data privacy in a wireless access section on a packet basis.

Therefore, 802.1x has a structure in which an authentication subject (authentication server) and an access control subject (access point) are dualized. This dualized structure has an advantage of easily supporting global roaming of subscribers.

The user (Supplicant) is a terminal requesting a network connection, the AP (authenticator) relays the authentication process between the terminal and the authentication server, and becomes a subject (Port Access Entity: PAE) to perform the access control according to the authentication result.

The access point, which is the access control subject, controls the access of the subscriber by using a logical port such as an ASSOCIATION ID, which allows only data transmitted and received to the authenticated port through packet filtering.

802.1x uses EAP as a standard protocol for transmitting subscriber authentication data.

As described above, in the related art, user authentication information is managed by an authentication server of a terminal and a network, and a recent research trend is a trend of performing user authentication with the support of an AAA (Authentication, Authorization and Accounting) server as an authentication structure. .

Ad-hoc networks are very vulnerable to security because they operate in a wireless environment, and it is difficult to maintain confidentiality of personal information. In other words, a malicious user can enter the communication area newly and extract information, forgery, or tampering with the contents of the communication. Therefore, a high level of permission and encryption for the Ad-hoc network resource is required.

An object of the present invention is to provide a user authentication system and method in the gateway of the Ad-hoc network to enhance the security of the Ad-hoc network vulnerable to security in a wireless environment by performing a user authentication control in the gateway. .

In order to solve this problem, the present invention allows a gateway that supports connection between the Internet and an Ad-hoc network to perform a user authentication control operation between a terminal and an AAA server.

A user authentication system in a gateway of an Ad-hoc network according to the first aspect of the present invention is a user authentication system in a gateway of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through a gateway and communicates with an authentication server. The gateway comprises: an authentication message processing unit configured to manage the transmitted and received messages while transmitting and receiving messages with the terminal or authentication server; An authentication control unit which analyzes the message received by the authentication message processing unit, checks whether the corresponding message is completed, performs user authentication control, and transmits a message generated through the user authentication control to the authentication message processing unit; A diameter processor configured to generate and interpret a diameter protocol message used between the gateway and the authentication server by a control operation of the authentication controller; And an authentication protocol message processing unit for generating and interpreting an authentication protocol message used between the gateway and the terminal by a control operation of the authentication control unit.

When the received message is transmitted from the terminal, the authentication controller generates a master session key and transmits the received message to the terminal if the received message is an authentication protocol message and an authenticated message, but the received message is an authentication protocol message. If the message is not authenticated, it is preferable to generate a Diameter protocol message and transmit the message to the authentication server.

When the received message is transmitted from the authentication server, the authentication controller may interpret the received message to generate an authentication protocol message and then transmit the generated message to the terminal.

A user authentication method in a gateway of an Ad-hoc network according to a second aspect of the present invention is a user authentication method in a gateway of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through a gateway and communicates with an authentication server. A) when the message arrives from the terminal, checking whether the message is an authentication protocol message and determining whether the message has been authenticated to perform a user authentication control operation; And b) when the gateway arrives from the authentication server, interpreting the message to generate an authentication protocol message, and transmitting the authentication protocol message to the terminal.

In step a), when the authentication protocol message is authenticated, it is preferable to generate a master session key for communication and transmit the master session key to the terminal.

In the step a), when the authentication protocol message is not authenticated, the message is interpreted to generate a diameter protocol message, and then the diameter protocol message is transmitted to the authentication server. .

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art may easily implement the present invention. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the spirit or scope of the present invention. In the drawings, parts irrelevant to the description are omitted in order to clearly describe the present invention. Like parts are designated by like reference numerals throughout the specification.

First, FIG. 1 illustrates the structure of an Ad-hoc network to which the present invention is applied.

As shown in FIG. 1, the Ad-hoc network is capable of ad-hoc communication and supports connection with the Internet. The Ad-hoc gateway 10 is in charge of connecting the Ad-hoc network with the Internet. The server 20 is responsible for authentication, authorization, and billing in a stable backbone network.

In addition, the Ad-hoc terminals A, B, and C all communicate wirelessly, and communicate with the AAA 20 with the support of the Ad-hoc gateway 10 to perform user authentication. These terminals may form an ad-hoc network capable of communicating independently.

A user authentication system in a gateway of an Ad-hoc network according to an embodiment of the present invention will be described in detail with reference to FIG. 2.

2 illustrates a configuration of a user authentication system in a gateway of an ad-hoc network according to an embodiment of the present invention.

As shown in FIG. 2, the user authentication system in the gateway of the Ad-hoc network according to the embodiment of the present invention includes an authentication controller 110, an initialization unit 120, an EAP processing unit 150, and an input / output message processing unit 130. ,

The authentication control unit 110 controls each unit when the authentication control function starts.

The initialization unit 120 is operated by the control in the authentication control unit 110 to read the information necessary for initialization to perform the initialization operation.

The authentication message processor 130 informs whether the message transmitted / received to the authentication controller 110 exists.

The diameter processor 140 generates and interprets a Diameter message used between the Ad-hoc gateway 10 and the AAA server 20 to perform a user authentication function.

The authentication message processing unit 130 not only checks the existence of the transmitted / received message, but also completes the basic message transmitted by the EAP processing unit 150 or the diameter processing unit 140 or the diametric message or the EAP-TLS. It generates a message and transmits it to the AAA server 20 or the terminal.

Next, the operation of the user authentication system in the gateway of the Ad-hoc network according to an embodiment of the present invention will be described in detail with reference to FIG. 3.

3 is a flowchart illustrating a user authentication method in a gateway of an ad-hoc network according to an embodiment of the present invention.

As shown in FIG. 3, when the user authentication control operation is started, the authentication control unit 110 operates the initialization unit 120 to perform system initialization and informs the terminal of the start of the EAP. (S1, S2)

The authentication controller 110 checks the message buffer through the authentication message processor 130 and checks whether a received message exists (S3 and S4).

If there is a received message, the authentication controller 110 checks the message header and checks whether the message is transmitted from the terminal, that is, whether the message received by the authentication message processor 130 is the terminal (S5).

The authentication control unit 110 interprets the message content and initiates user authentication in the gateway if it is not an EAP message and performs an error report to a higher layer that is notified of the authentication failure (S6, S7). (S7, S9)

At this time, in the case of the authentication completion message, the authentication control unit 110 determines that the user authentication process is normally processed and generates a master session key to use for communication (S10).

The ad-hoc gateway 10 transmits the master session key to the terminal for use as information for encryption in the medium access control (MAC) layer. The ad-hoc gateway 10 initiates authentication and reports the authentication result to a higher function that is notified of the authentication result. (S11, S12)

In the case where the EAP message is not the authentication completion message, the authentication control unit 110 must process the EAP-TLS message transmitted from the terminal, so that the AAA server 20 through the diameter processing unit 140 with the corresponding EAP message. In step S13, the authentication message processing unit 130 completes the diameter message and transmits it to the AAA server 20, and when the authentication completion message is received. Continue to receive the message until (S14).

On the other hand, when the message received by the authentication message processing unit 130 is not a message transmitted from the terminal but a diameter message transmitted from the AAA server 20, the authentication control unit 110 interprets the message, After generating the EAP message for transmission to the terminal through the EAP processing unit 150 and transmitting the EAP message to the terminal, the message continues to be received until an authentication completion message is received (S15, S16, S17).

As described above, in the embodiment of the present invention, the Ad-hoc gateway wirelessly communicates with the terminal for the user authentication control function while supporting the interworking of the Ad-hoc network and the Internet, and operates between the terminal and the AAA server.

The Ad-hoc gateway uses the EAP (Extensible Authentication Protocol) -TLS (Transport Layer Security) method, an authentication method proposed by the terminal and the IETF, to control user authentication, and sends an EAP message transmitted from the terminal to the AAA server. It is responsible for the conversion and generation of diameter messages from EAP messages.

In this way, the Ad-hoc gateway determines the legitimate user through two-way mutual authentication between the terminal and the AAA server, and provides the authorized user with the master session key information for encryption.

Although the preferred embodiments of the present invention have been described in detail above, the present invention is not limited thereto, and various other changes and modifications are possible.

As described above, the user authentication system and its method in the gateway of the Ad-hoc network according to the present invention can enhance the security and stability by performing user authentication control in the Ad-hoc gateway that supports interworking of the Ad-hoc network and the Internet. And, there is an effect that can maintain compatibility with the existing WLAN.

And the user authentication system and method in the gateway of the Ad-hoc network according to the present invention by providing the master session key to the legitimate user through the user authentication has the effect that can provide secure encryption by providing the necessary encryption information in the MAC layer have.

1 shows the structure of an Ad-hoc network to which the present invention is applied.

 2 illustrates a configuration of a user authentication sub system in an Ad-hoc gateway system in an Ad-hoc network according to an embodiment of the present invention.

3 is a flowchart illustrating a user authentication method in an Ad-hoc gateway system in an Ad-hoc network according to an embodiment of the present invention.

Claims (8)

In a user authentication system in a gateway of an Ad-hoc network in which a terminal in an Ad-hoc network is connected to the Internet through an Ad-hoc gateway and communicates with an authentication server, The Ad-hoc gateway, An authentication message processing unit which manages the transmitted and received messages while transmitting and receiving messages with the terminal or authentication server; An authentication control unit which analyzes the message received by the authentication message processing unit, checks whether the corresponding message is completed, performs user authentication control, and transmits a message generated through the user authentication control to the authentication message processing unit; A diameter processor configured to generate and interpret a diameter message used between the Ad-hoc gateway and an authentication server by a control operation of the authentication controller; And An authentication protocol message processing unit for generating and interpreting an authentication protocol message used between the Ad-hoc gateway and the terminal by a control operation of the authentication controller. User authentication system at the gateway of the ad-hoc network comprising a. The method of claim 1, The authentication control unit, When the received message is transmitted from the terminal, if the received message is an authentication protocol message and an authenticated message, a master session key is generated and transmitted to the terminal. If the received message is an authentication protocol message but not an authentication completed message, User authentication system at the gateway of the Ad-hoc network to generate a message (diameter) and then send to the authentication server. The method of claim 2, If the received message is not an authentication protocol message, the authentication control unit initiates user authentication in the Ad-hoc gateway and performs an error report to an upper layer receiving an authentication result. . The method of claim 1, The authentication control unit, If the received message is transmitted from the authentication server, the user authentication system at the gateway of the Ad-hoc network to interpret the received message to generate an authentication protocol message and to be transmitted to the terminal. In the method of user authentication at the gateway of the Ad-hoc network that the terminal in the ad-hoc network is connected to the Internet through the Ad-hoc gateway, and can communicate with the authentication server, a) when the Ad-hoc gateway receives a message from the terminal, checking whether the message is an authentication protocol message and determining whether the message has been authenticated to perform a user authentication control operation; And b) when the Ad-hoc gateway receives a message from the authentication server, interpreting the message to generate an authentication protocol message, and transmitting the authentication protocol message to the terminal. User authentication method in the gateway of the ad-hoc network comprising a. The method of claim 5, Step a) is The user authentication method in the gateway of the Ad-hoc network for generating a master session key for communication when the authentication protocol message is authenticated and transmits the master session key to the terminal. The method of claim 5, Step a) is If the authentication protocol message is not authenticated, the user authentication method in the gateway of the Ad-hoc network that interprets the message to generate a diameter message and transmits the diameter message to the authentication server . The method of claim 5, Step a) is User authentication at the gateway of the ad-hoc network performing an error report if the message is not an authentication protocol message.