KR20060057435A - System and method for authentication in network - Google Patents

Abstract

In a network authentication method according to an aspect of the present invention, a MAC for retrieving whether the MAC address of the terminal is a MAC address permitted to access the network is received by the access point receiving the MAC address value of the terminal attempting to access the access point. (Media Access Control) address filtering step and when the terminal is determined to have a MAC address allowed to access the network in the step, and the connection to the access point is approved, the authentication server connects through the access point. The authentication information confirmation step of confirming the authentication information of the terminal.

Description

System and Method for Authentication in Network             

1 is a diagram showing the configuration of an entire network to which the present invention is applied.

2 is a diagram illustrating a processing flow according to the present invention when an unauthorized terminal attempts to connect.

3 is a diagram illustrating a processing flow according to the present invention when an authentication terminal attempts to connect.

4 is a diagram illustrating a processing flow according to the present invention when the illegal copy terminal is connected.

5 is a block diagram of an access point according to the present invention;

6 is a view showing a preferred embodiment of the authentication confirmation method according to the present invention.

* Description of the symbols for the main parts of the drawings *

10-1: unauthorized terminal 10-2: authorized terminal

10-3: duplicated terminal 20: access point (AP)

201: processor 202: RF processing unit

203: PHY processing unit 204: MAC processing unit

205: RAM 206: MAC address storage

30: authentication server

The present invention relates to a network authentication system and a method thereof, and more specifically, to prevent the risk of infringement that may occur in the wireless section between the access point and the terminal by using the MAC address of the terminal and the encryption key of the CM program. The present invention relates to an authentication system and a method of a network for implementing enhanced authentication.

To use the current wireless LAN service, a mobile user simply subscribes to an ISP (Internet Service Provider) company and uses the user information (ID, Password) provided by the ISP company to establish an ISP CM (Connection Manager). If you go through the authentication process, you can simply connect to the Internet for a fee.

In order to use the Internet in this manner, a basic wireless LAN network must first be established, which is a wireless terminal having a wireless terminal environment (for example, a wireless LAN card, a wireless LAN USB, or a wireless PCI card). (Access Point: AP) that connects Mobile Station with wired network and wireless network should be implemented in hardware, so that this wireless terminal can be connected to internal or external wired network through AP through software. An authentication system (procedure according to the ISP company) that reviews the user's certification should be established.

A general authentication algorithm on a wireless LAN is a kind of port control, which follows the 802.1x standard in a manner of controlling a service only to an authorized terminal through a predetermined authentication procedure.

IEEE 802.1x is defined as an authenticated state (Controlled) and a non-authenticated state according to whether access control to an access point (AP) is possible. The IEEE 802.1x standard defines three types of entities. The first is the supplicant, the second is the authenticator, and the third is the authentication server.

The requestor is an entity that delivers user credentials when receiving an authentication request from an authenticator and corresponds to a terminal. The authenticator is an entity that requests authentication from the requester and requests authentication service from the authentication server by using the received user identification information, and is in charge of the access point. The authenticator also manages the access port status of the user to set the port to the authenticated or unauthenticated state according to the authentication result of the authentication server.

The authentication server is an entity that receives an authentication request for a user from an authenticator and provides an authentication service. The authentication server must have identification information of the user in advance. The authentication server is logically separate from the authenticator and the role, but it is not necessarily physically separate from the authenticator.

The IEEE 802.1x specification defines the overall authentication mechanism between the supplicant, authenticator, and authentication server, and the Extensible Authentication Protocol (EAP) is used between the supplicant and authenticator at the MAC layer. Doing.

The authentication process in the general wireless LAN standard is as follows.

The wireless terminal transmits the user's information to the access point, can be authenticated through the ISP company's authentication system, and can access the wired network environment or the Internet. The access point simply transmits the user's information to the authentication server of the authentication system, and connects the wireless terminal and the wired network which have been verified.

The authentication server of the authentication system reviews the user's information and decides whether to authenticate. As the main authentication method of the wireless LAN, various authentication methods such as an authentication method based on MAC (Medium Access Control) and an authentication method on 802.11b are used. However, in case of wireless LAN, RF (Radio Frequency) is used in wireless section, that is, access point and wireless terminal section, security vulnerability occurs due to eavesdropping and eavesdropping of unauthorized illegal users. Security measures are used.

As security measures, various methods such as Extended Service Set (ESS) ID, Wired Equivalent Privacy KEY (WEP KEY), and Dynamic Host Configuration Protocol (DHCP) IP settings are used.

However, in general authentication process, when a wireless terminal equipped with a terminal environment accesses an internal wired network or an external backbone network, the user always inputs the user's authentication information and authenticates the authentication server, and then authenticates only the user whose authentication has been verified. It is connected to a network or an external backbone network.

That is, despite the security measures of the wireless LAN as described above, the risk of exposing the ESS ID, cracking the WEP KEY, and the problem caused by unauthorized automatic IP assignment in case of automatic IP in the case of DHCP IP, etc. Has security vulnerabilities from compromise threats.

The present invention, in order to solve the above problems, in addition to the authentication method using the ID or password of the terminal user, wireless communication between the terminal and the access point using a MAC address assigned to the terminal itself or an encryption key installed in a software program installed in the terminal. An object of the present invention is to provide a network authentication system and a method for strengthening an authentication scheme in a section.

In a network authentication method according to an aspect of the present invention, a MAC for retrieving whether the MAC address of the terminal is a MAC address permitted to access the network is received by the access point receiving the MAC address value of the terminal attempting to access the access point. (Media Access Control) address filtering step and when the terminal is determined to have a MAC address allowed to access the network in the step, and the connection to the access point is approved, the authentication server connects through the access point. The authentication information confirmation step of confirming the authentication information of the terminal.

The authentication information may include at least one of user information of a terminal and a connection manager (CM) program encryption key of the terminal, and the user information of the terminal may include at least one of an ID or a password imposed on the terminal user. do.

The authentication information confirming step includes a user information confirmation step of the terminal received from the terminal and the encryption key confirmation step of the CM program received together when receiving the user information of the terminal, the user information of the terminal and the encryption of the CM program It is characterized in that the authentication check is determined to be successful only when the key is compared with the authentication information registered in the authentication server.

In addition, the authentication information confirming step, it is possible to determine whether to confirm the authentication by comparing the encryption code value generated by the combination of the user information of the terminal received from the terminal and the encryption key of the CM program.

When the authentication confirmation of the terminal is successful as a result of confirming the authentication information, the terminal accesses the internal wired network or an external backbone network and performs data transmission and reception.

In accordance with another aspect of the present invention, an authentication system includes an access point and a terminal for receiving a MAC address value of a terminal attempting to access an access point, and searching whether the MAC address of the terminal is a MAC address permitted to access the network. If it is determined that the access to the network has a MAC address allowed, includes an authentication server for confirming the authentication information of the terminal attempting the connection.

The access point may include a MAC address storage unit that stores a data list of a MAC address value of a terminal permitted to access the access point, and may be configured as at least one of a flash memory or a ROM.

The access point may further include an RF processor configured to process a radio signal received from at least one radio terminal connected to the access point; A PHY processing unit in charge of processing a physical layer; A MAC processor in charge of processing the MAC layer; RAM for storing data processed in the access point; And a processor that controls the signal flow between each processing unit and RAM and controls the storage of data and checks the MAC address of the terminal connecting to the access point to compare whether the same MAC address is registered in the MAC address storage. It may include.

The authentication server is characterized in that it is determined that the authentication confirmation of the terminal is successful only when the user information of the terminal received from the terminal and the encryption key of the CM program match with the previously registered authentication information.

Hereinafter, a preferred embodiment according to the present invention will be described in detail with reference to the drawings.

When building an existing home network or a small business network, it can be configured in parallel with wired and wireless. In particular, a number of invasion threats generated in the wireless section can be generated, which leads to information leakage and damages many users. Can be coated. Currently, various security countermeasures are used to prevent such damages, and in the present invention, a method for proactively coping with the risk of infringement and an authentication procedure complementing method for a wireless section between an access point and a terminal are proposed.

The basic building block of a WLAN network is a basic service set (BSS). This refers to a group of terminals communicating with each other. Communication takes place within a somewhat unclear area defined by the radio wave propagation characteristics called BSS. When the terminal is in the BSS area, communication with other devices is possible. The BSS may have two types of configurations.

The first is the configuration of an independent network.

A terminal in an independent BSS directly communicates with another device in a communication area. The IBSS consisting of two terminals will be an example of the smallest network. In general, the IBSS has a specific purpose and consists of several terminals configured for a specific period. IBSS is sometimes referred to as ad hoc BSSs or ad hoc networks because of their short duration, small scale, and specific purposes.

Second is the infrastructure network.

Infrastructure networks can be distinguished by the use of an access point. In other words, the infrastructure network uses the access point in all communication processes including the communication of the mobile terminal in the same service area. If a mobile terminal in an infrastructure BSS needs to communicate with another mobile terminal, this communication is a two-step process. The first is for the signal transmitting terminal to transmit the frame to the access point, and the second is for the access point to transmit the frame to the target station. Since all communication is transmitted by the access point, the corresponding basic service area in the infrastructure BSS is defined as an area capable of receiving a signal from the access point. This multi-stage transmission requires more transmission capacity than direct communication between sender and receiver, but has two main advantages.

Infrastructure BSS is defined as the distance from an access point. All mobile terminals should be within the distance accessible from the access point, but there is no limit to the distance between mobile terminals. Direct communication between mobile terminals has the advantage of reducing the transmission capacity, but the physical layer is more complicated because the mobile terminal needs to maintain relationship with other mobile terminals in the service area.

An access point in the infrastructure network can assist the mobile terminal in trying to save power. That is, the access point may record that the terminal enters the power saving mode and then buffer the frame for the terminal. Therefore, the terminal operated by the battery may turn off the wireless LAN card, supply power again when transmission is required, and receive a frame buffered by the access point.

As described above, an access point (AP) in a general infrastructure WLAN network serves as a hub to connect terminals having a wireless terminal environment to a wired network.

That is, the function of the access point can be said to serve as a bridge that can pass the user's information through the terminal to the authentication server existing in the internal wired network or the external backbone network to perform the authentication process of the authentication system. . After the authentication process of the authentication system, the authorized user can access the internal wired network or the external backbone network. However, in the case of the wireless LAN, the wireless section using the RF, that is, the AP and the terminal section can be easily intercepted and intercepted and had various problems.

In the present invention, in order to solve the security vulnerability problem on the wireless section, the CM program encryption key installed in the terminal in the authentication confirmation step of the authentication system undergoes a primary supplement, so that the function of the access point simply out of the bridge role, MAC address filtering Through the additional verification through the MAC address matching with the terminal so that the authentication system can be used safely.

1 shows a configuration of an entire network to which the present invention is applied.

We have seen above that the authentication system consists of the requestor, the authenticator and the authentication server.

In FIG. 1, a plurality of mobile terminals 10-1, 10-2, and 10-3 are located in a wireless section as an entity serving as a requestor. The terminal may include an authentication terminal 10-2 properly registered in the authentication system, an unauthenticated terminal 10-1 that is not authenticated, and illegally attempt to illegally attempt to access the system by duplicating the MAC address of the authenticated terminal. There will also be a duplicate terminal 10-3.

The role of the authenticator is in charge of the access point 20, requests authentication to the terminal 10, requests authentication service to the authentication server using the received user identification information, and manages the connection port state of the user authentication server Set the port to either authenticated or unauthenticated depending on the authentication result.

Since the authentication server 30 receives an authentication request for the user from the access point 20 and provides an authentication service, the authentication server 30 has identification information of the user in advance. After successfully authenticating through the authentication server, the terminal may access an internal wired network or an external backbone network connected to the access point 20.

2 shows a processing flow according to the present invention when an unauthorized terminal attempts to connect.

The unauthorized terminal 10 attempts to access an internal wired network or an external backbone network. When the terminal 10-1 attempts to communicate with the access point 20 through the ISP CM program (S201), the access point 20 sends a MAC address value in a unicast manner to the terminal 10-1 attempting to connect. Request (S202). When the terminal 10-1 responds with its own MAC address value (S203), the access point 20 compares the MAC address value of the received terminal 10-1 with the list of permitted MAC addresses. (MAC address filtering) to determine whether the address is registered (S204). Here, the MAC address list is a collection of MAC addresses of terminals allowed to access the AP when the wireless LAN network is established.

If the access point 20 is not the MAC address stored in the MAC address list, a connection reject message or a message requesting an inquiry to the AP manager is sent (S205).

3 shows a processing flow according to the present invention when an authorization terminal attempts to connect.

If the authorization terminal 10-2 attempts to connect to the access point 20 (S301), the access point 20 requests the MAC address value from the terminal 10-2 (302). Receiving the MAC address value of the terminal 10-2 from the terminal 10-2 (S303), the access point 20 performs a MAC address filtering step of confirming whether the connection is from a terminal registered in the MAC address list. Go through (S304).

After confirming whether the MAC address is registered in the access point 20, and if the registration is registered, the connection of the terminal 10-2 and the access point 20 is allowed, and the terminal 10-2 is authenticated by the terminal. The user requests information input for the procedure (S305).

Thereafter, the user inputs user information (ID, Password) through the CM program on the general terminal 10-2 (S306), and the inputted information is authorized through the authentication verification step (S307) of the authentication server 30. Alternatively, the denial is informed to the user of the terminal. In this embodiment, since the terminal is authorized to authenticate, the authentication server informs the user that the terminal and the user are allowed to access (S308). Since the authentication confirmation is successful, the terminal 10-2 can normally connect to the internal wired network or the external backbone network, and free data transmission and reception are possible (S309).

 In general, according to the IEEE802.11b / b / a std standard, a plurality of terminals 10-2 may be connected to one access point 20, but if a large number of terminals 10-2 are actually attached, The MAC algorithm according to CSMA / CA (Carrier Sense Multiple Access with Collision Avoidance), the remaining terminal 10-2 other than the terminal 10-2, which is actually used, waits in the dormant state. 20) Check periodically if it can be used. As the competition with other terminals becomes inevitable and it becomes difficult to connect to the network at a desired time point, the number of terminals 10-2 is actually limited in using the access point 20.

Of course, if there are a plurality of access points 20, the number of the limited terminal 10-2 may vary, but it is assumed in the present invention that only one designated access point 20 exists. The number of terminals 10-2 in one access point 20 may vary depending on the access point 20 used. This is because the specifications vary from manufacturer to manufacturer or can be controlled by the AP administrator.

In the authentication procedure, it is common to check the authentication information by checking the information of the user registered in the authentication server 30, but in the present invention, the encryption key of the CM program of the terminal 10-2 is additionally added thereto. The step of giving and confirming was added (S307). The unique encryption key of the terminal 10-2 CM program is automatically forwarded to the authentication server 30 when the user inputs user information, and the MAC address value of the terminal 10-2 previously verified and It is used to check if there is a match.

That is, if a genuine CM program is initially installed in the terminal 10-2, one terminal 10-2 has only one MAC address and a unique encryption key of one CM program. Therefore, the authentication server 30 finally grants permission for the terminal 10-2 to access the internal wired network or the external backbone network only when both the MAC address of the terminal 10-2 and the CM program encryption key match. It is.

If the CM program encryption key and the MAC address of the terminal 10-2 are disclosed or duplicated and other illegal intruders occur, it will be difficult to satisfy both values at the same time.

4 shows a processing flow according to the present invention when an illegal copy terminal is connected.

Assume that a case where an illegal unauthorized duplication terminal 10-3 attempts to connect by duplicating the MAC address of another terminal 10 registered in the access point 20.

The MAC address verification and filtering steps S401, S402, S403, and S404 between the duplicated terminal 10-3 and the access point 20 go through the same process as that of FIGS. 2 and 3.

Since the UE, which duplicates the MAC address of the normal terminal, has the same normal MAC address, general MAC address filtering cannot distinguish the illegal request from the authorized user. That is, the unauthorized terminal 10-3 that normally passes the MAC address filtering is allowed to connect to the access point 20.

However, when the authentication information is requested from the access point 20 (S405), even if the user's information (user ID and password) registered normally through the CM program is passed safely, the CM program encryption key verification step is safe. Hard. This is because the encryption key included in the CM program itself of the duplicated terminal 10 cannot be duplicated even if the terminal 10 duplicates the MAC address.

In this case, the authentication server 30 that has received the authentication information of the duplicated terminal 10-3 and has undergone the authentication confirmation (S407) will inform that the authentication confirmation has failed due to a mismatch in the CM program encryption key (S408). As a result, access to an internal wired network or an external backbone network becomes impossible.

5 shows a block configuration of an access point according to the present invention.

The access point 20 includes a processor 201, an RF processor 202, a PHY processor 203, a MAC processor 204, a RAM 205, and a MAC address storage 206.

The RF processor 202 processes radio signals received from a plurality of radio terminals to be connected to the access point. The PHY processing unit 203 for processing the physical layer and the MAC processing unit 204 for the MAC layer are basically provided. It also has a random access memory (RAM) 205 for storing data processed in the access point, the processor 201 is responsible for the signal flow and data storage between the processing unit as a whole.

It should be noted in the present invention that the MAC address storage unit 206, a flash memory or a ROM (Read Only Memory) may be used.

The MAC address storage unit 206 stores and manages the MAC address data list of the authorized terminal 10. When there is a terminal 10 requesting a connection to the access point 20, the processor 201 of the access point 20 checks the MAC address of the terminal 10 so that the same MAC address is the MAC address storage unit 206. ), It is compared and judged. If the same MAC address exists in the list, the access point 20 approves the connection request of the terminal 10 and requests authentication information for going through the authentication process of the authentication system.

The AP manager stores the MAC address list of the terminal 10 registered in the MAC address storage unit 206 of the access point 20 by presetting MAC address values of terminals allowed to access the corresponding access point 20. .

Figure 6 shows a preferred embodiment of the authentication confirmation method according to the present invention.

As described with reference to FIGS. 2 to 5, the authentication confirmation method according to the present invention confirms user information (user ID and password) using the terminal in the authentication server 30 and information necessary for terminal authentication (CM program encryption key). do. The CM program encryption key may be given from the beginning of production by the ISP company, and may be used later by the administrator of the terminal. It should be noted that the authentication server 30 should secure the information about the CM program encryption key of each terminal in any way.

6 shows a method of using a combination of the encryption key of the CM program installed in the terminal 10 and the MAC address of the corresponding terminal as a new cipher as information required for terminal authentication in addition to the authentication confirmation method. That is, the authentication server 30 may store the CM program encryption key matching the MAC address for each authentication terminal in the form of a table and use it as an encryption key when an authentication confirmation request is received from the terminal.

The encryption method can be thought of in various ways, from the simplest method of serially adding the MAC address and the CM program encryption key to the method using the MAC address plus the CM program encryption key as a password. .

The authentication system and method according to the present invention as described above, using the encryption key installed in the terminal itself, and furthermore, the software program installed in the terminal as an authentication tool, away from the method of using the user information of the terminal as an authentication tool. Thus, access to the internal or external system secured by the authentication system is possible only when the authenticated user uses the authenticated terminal.

Such an approach would certainly be a matter of excluding resource utilization and provide a strong security effect in terms of protecting critical systems.

The present invention further provides an authentication system and method that is further enhanced by verifying the MAC address of the terminal and granting an encryption key to the CM program installed in the user terminal. It produces the effect of reducing the threat of intrusion in the wireless section which could occur in the authentication system or the authentication method.

Claims (11)

In the authentication method of the authentication system to work with a network consisting of an internal wired network or an external backbone network, A media access control (MAC) address filtering step of searching for an access point receiving a MAC address value of a terminal attempting to access whether the MAC address of the terminal is a MAC address permitted to access the network; Wow In this step, if the terminal is determined to have a MAC address allowed to access the network, and the connection to the access point is approved, the authentication server to verify the authentication information of the terminal connecting through the access point A network authentication method comprising the step of verifying information. The method of claim 1, The authentication information, Network authentication method comprising at least one of the user information of the terminal, the CM (Connection Manager) program encryption key of the terminal. The method of claim 1, The user information of the terminal comprises at least one of the ID or password imposed on the terminal user. The method of claim 1, The authentication information confirmation step, Checking user information of the terminal received from the terminal; Wow When the user information of the terminal includes receiving the encryption key of the CM program received together, And comparing the user information of the terminal and the encryption key of the CM program with the authentication information registered in the authentication server, and determining that the authentication is successful. The method of claim 1, The authentication information confirmation step, And comparing the encryption code value generated by the combination of the user information of the terminal and the encryption key of the CM program received from the terminal to determine whether to confirm the authentication. The method of claim 1, When the authentication confirmation of the terminal is successful as a result of the authentication information check, The terminal is connected to the internal wired network or an external backbone network to perform data transmission and reception, characterized in that the network. In the authentication system that works with a network consisting of an internal wired network or an external backbone network, An access point that receives a MAC address value of a terminal attempting to access an access point, and searches whether the MAC address of the terminal is a MAC address permitted to access the network; Wow And an authentication server for verifying authentication information of a terminal accessing through the access point when it is determined that the terminal has a MAC address permitted to access the network and the access to the access point is approved. The method of claim 7, wherein The access point is, And a MAC address storage unit for storing a data list of MAC address values of the terminals permitted to access the access point. The method of claim 8, The MAC address storage unit is configured with at least one of a flash memory or a ROM. The method of claim 8, The access point is, An RF processor for processing a radio signal received from at least one radio terminal connected to the access point; A PHY processing unit in charge of processing a physical layer; A MAC processor in charge of processing the MAC layer; RAM for storing data processed in the access point; And The processor further controls the signal flow between the processing unit and the RAM and the storage of data, and checks the MAC address of the terminal connecting to the access point and compares whether the same MAC address is registered in the MAC address storage unit. Including authentication system. The method of claim 7, wherein The authentication server, And comparing the user information of the terminal received from the terminal and the encryption key of the CM program with pre-registered authentication information and determining that the authentication confirmation of the terminal is successful.

Images