KR20060108291A - Apparatus and method for controlling access to network - Google Patents

Abstract

The present invention relates to an apparatus and method for controlling a network connection, the apparatus for controlling a network connection comprising: a network access control apparatus in which one or more hosts share a key for authentication of a network connection, wherein the class of the host and the shared key A host list manager managing a list including the host list; A shared key generation unit for generating a new shared key when the lower level host is disconnected; And a shared key notification unit for notifying a host of a higher level of the generated shared key.

According to the present invention, a notebook carried by a guest in a wireless network environment in which wireless secure communication is performed as a key shared between one or more hosts and network servers, such as a Wi-Fi Protected Access Preshared Key (WPA-PSK) method. After the lower level host, such as the host, completes the use of the network, the wireless security function can be enhanced by preventing the user from reconnecting to the network as a previously shared key.

Description

Apparatus and method for controlling access to network

1 is a conceptual diagram illustrating a network access control method using a conventional Wi-Fi Protected Access Preshared Key (WPA-PSK) method.

2 is a block diagram showing the configuration of a network access control apparatus according to the present invention.

3 is a flowchart illustrating the flow of shared key management according to the present invention.

4A and 4B are conceptual views illustrating an embodiment of the present invention using a single PSK in a WPA-PSK wireless network environment.

5A and 5B are conceptual views illustrating an embodiment of the present invention using two PSKs in a WPA-PSK wireless network environment.

The present invention relates to an apparatus and method for controlling a network access, and more particularly, in a network system in which one or more hosts share a key for authentication of a network connection, such as a Wi-Fi Protected Access Preshared Key (WPA-PSK) scheme. A network access control apparatus and method for enhancing the security of wireless communication by ranking hosts on a network and updating and managing a key shared between the hosts.

 1 is a conceptual diagram illustrating a conventional network access control method of WPA-PSK.

Wi-Fi Protected Access (WPA), one of the security methods of WLAN, is an enterprise mode that requires an authentication server that supports Extensible Authentication Protocol (EAP) and a Home that uses PSK (Preshared Key) for the convenience of users. / SOHO Mode In Home / SOHO mode (also referred to as WPA-PSK method), the PSK is a network server (hereinafter referred to as an access point server) 100 that supports an access point function on a wireless network and a host such as a PC (110, 120). , 130, 140, 150). The PSK is a shared key for the host to authenticate before accessing the network server. The PSK uses a manually entered value or password and can be easily set by the home user. In FIG. 1, the PSK is set as aaa so that only a host having the PSK connects to the access point. In the WPA-PSK scheme, the PSK is used to authenticate a host to transmit and receive data using a Temporal Key Integrity Protocol (TKIP) scheme. That is, only a host having a PSK that matches the PSK of the access point server can access and transmit data.

An access point supporting the existing WPA-PSK scheme supports only one PSK. That is, all hosts using an access point can use only one PSK at the same time. Suppose a guest brings a wireless host 150 to a home using such an access point. In order to allow the visitor's wireless device 150 to access the wireless network in the home, the PSK used in the home must be informed. Since the leaked PSK cannot be recovered again, the visitor who revisits before changing the used PSK can access the wireless network in the home again. In order to prevent this, it is inconvenient to change the PSKs of the hosts 110, 120, 130, and 140 and the access point server 100 in the home where the leaked PSKs are set after the guest returns.

The technical problem to be achieved by the present invention is a wireless network environment in which wireless security communication is performed as a key shared between one or more hosts and network servers, such as a Wi-Fi Protected Access Preshared Key (WPA-PSK) scheme. It is to provide a network access control apparatus and method for enhancing a wireless security function by preventing a lower-class host such as a notebook possessing such a notebook from being able to reconnect to the network as a key previously shared again after completing use of the network.

The network access control apparatus according to the present invention for achieving the above technical problem is a network access control apparatus in which one or more hosts share a key for authentication of the network connection, the list including the class and the shared key of the host A host list manager for managing; Shared key generation unit for generating a new shared key when the connection with the lower class host is disconnected; And a shared key notification unit for notifying a host of a higher level of the generated shared key.

In the network access control apparatus according to the present invention for achieving the above technical problem, in a network access control apparatus in which one or more hosts share a key for authentication of the network connection, the key is shared between the class of the host and the host of the same class Host list management unit for managing a list including; A shared key generator for generating a new key shared between the hosts of the lower class when the connection with the lower class host is terminated; And a shared key notification unit for notifying a host of a lower level of the generated shared key.

The network access control method according to the present invention for achieving the above technical problem is a network access control method in which one or more hosts share a key for authentication of the network connection, the list including the class and the shared key of the host Registering; Generating a new shared key when the lower level host is disconnected; And notifying a host of a higher level of the generated shared key, and updating the list with the generated shared key.

In the network access control method according to the present invention for achieving the above technical problem, in a network access control method in which one or more hosts share a key for authentication of the network connection, a key shared between the class of the host and the host of the same class Registering a list including; Generating a new key shared between the lower-class hosts when the connection with the lower-class host is lost; And notifying the generated key to a lower level host, and updating the list with the generated shared key.

Hereinafter, a method and an apparatus according to the present invention will be described in detail with reference to the accompanying drawings.

2 is a block diagram showing a configuration of a network access control apparatus according to the present invention, which includes a network server 200 and a host 210, and includes a host list manager 220 in the network server 200. The shared key generation unit 230 and the shared key notification unit 240 are included. An example of the network may be a WPA-PSK wireless LAN. In this case, the shared key corresponds to a PSK (preshared key) in a WPA-PSK environment. Examples of the network server 200 may include a printer server supporting an access point function, and examples of the host 210 may include a notebook computer, a computer, a printer, and the like.

The host list manager 220 creates and manages a list of the host information such as a grade of the graded host and a shared key required for communication security with the host. The administrator of the network server may register a host using the network in the host list manager 220, and also input the initial shared key directly into the host list manager 220. In this case, the host may be managed in two or more grades according to the degree of access authority to the network server, in which case the grade for each host is also registered in the host list manager 220. For example, when managing in two classes, it can be managed by distinguishing between a registered host using the wireless network at all times and a temporary registered host temporarily used in a special visit or conference. For ease of description in the present invention, the registered host is classified as a host class 1 and the temporary registration host as a host class 2. Examples of host list information are shown in Table 1 below.

Hostname IP address Host ratings samsung.printer-lab.com 192.0.0.11 One laser.printer-lab.com 192.0.0.12 One network.printer-lab.com 192.0.0.13 One Next SW 192.0.0.201 2

There are two host management methods according to the present invention. When all classes of hosts have one shared key (hereinafter referred to as single shared key mode) and a shared key exists for each class to share the shared key among hosts of the same class (hereinafter referred to as multiple shared key mode). Is called). The host list manager 220 manages the shared key according to a single shared key mode or a plurality of shared key modes.

The shared key generation unit 230 generates a new shared key when a lower class host completes the use of a wireless network. That is, in the single shared key mode, the generated shared key is transmitted to the host 210 of the higher level, and the host list manager 220 replaces the existing shared key as the generated shared key. In addition, in the multi-shared key mode, the generated shared key is for a shared key for a lower class host, which is transmitted to the lower class host 210, and the host list manager 220 generates the newly generated shared key. This replaces the shared key for an existing lower class host.

The shared key notification unit 240 delivers the newly generated shared key to the host whose shared key should be changed. That is, the generated shared key is notified to the host 210 of the upper level in the single shared key mode and the host 210 of the lower level in the multiple shared key mode.

When the host 210 notified of the newly generated shared key is changed to the notified shared key, the host 210 may transmit / receive wireless security data through a predetermined authentication process.

3 is a flowchart illustrating a flow of management of a shared key according to the present invention.

The controller of the network server reads the list in the host list manager 220 (step 300).

In operation 310, the controller of the network server detects whether the connection time has been exceeded or the administrator of the network server directly disconnects. How to check.

If the connection is not disconnected (step 310), the process proceeds to step 300. If the connection is disconnected (step 310), the shared key generation unit 230 generates a new shared key (step 320).

The generated shared key is transmitted to the host 210 to which the shared key should be changed by the shared key notification unit 240 (step 330). In other words, in the single shared key mode, the shared key is shared with the host 210 of the higher level. In the key mode, the lower level host 210 is notified of the generated shared key.

4A and 4B are conceptual views illustrating an embodiment of the present invention using a single PSK in a WPA-PSK wireless network environment.

4A is a conceptual diagram illustrating a state in which data is transmitted / received by being connected to a network server 400 as well as a host of a first class. That is, a normal host, that is, a host 405, 410, 415, 420, 425 of a first class and a host possessed by a guest, that is, a host 430 of a second class. The normal host 405, 410, 415, 420, 425 is a host that always allows access to a network server. The hosts 405, 410, 415, 420, 425, and 430 share a PSK, which is aaa, and are connected to the network server 400 to transmit and receive data with wireless security.

If the second-class host 430 is disconnected, the shared key generator 230 of the network server 400 generates a new PSK. Assume that the generated PSK is abb.

FIG. 4B is a conceptual diagram illustrating data transmission / reception of wireless security by the network server and the remaining hosts when the second-class host 430 is disconnected from the network, and the network server 435 and the remaining network. The remaining normal hosts 440, 445, 450, 455, 460 are included. The shared key notification unit 240 of the network server 435 notifies only the hosts 440, 445, 450, 455, and 460 to the generated PSK, that is, abb. The host list manager 220 and the notified normal hosts 440, 445, 450, 455, and 460 in the network server 435 replace the generated PSK as a new PSK. After this process, only the network server 435 and the remaining normal hosts 440, 445, 450, 455, and 460 share abb, which is a newly generated PSK, to enable data transmission and reception of wireless security. That is, the guest host 430 that has already gone out cannot access the network server 435 with the existing PSK aaa.

5A and 5B are conceptual views illustrating an embodiment of the present invention using two PSKs in a WPA-PSK wireless network environment.

5A is a conceptual diagram illustrating a state in which data is transmitted and received by being connected to a network server 500 as well as a first class host as well as a second class host. That is, a normal host, that is, a first class host 505, 510, 515, 520, and a host possessed by a guest, that is, a second class host 525 are included.

The normal host 505, 510, 515, 520 is a host that always allows access to a network server. The normal hosts 505, 510, 515, and 520 share a PSK of aaa, while the guest host 525 has a PSK of bbb and is connected to the network server 500 to perform data transmission and reception of wireless security. That is, each host is connected to a network server as a normal PSK or a guest PSK corresponding to its class to perform wireless security data transmission and reception.

If the guest host 525 is disconnected, the shared key generator 230 of the network server 500 generates a new guest PSK. Assume that the generated guest PSK is ztk.

5B illustrates wireless security data transmission and reception by the network server 530 and the hosts 535, 540, 545, 550, and 555 when the second-class host 525 is disconnected from the network. Conceptual diagram. Hosts existing in the network include previously existing normal hosts (535, 540, 545, 550) and a new guest host (555). The shared key notification unit 240 of the network server 530 notifies only the new guest host 555 to the generated guest PSK, that is, ztk. In addition, the host list manager 220 and the notified guest host 555 in the network server 530 replace the generated guest PSK as a new guest PSK. After this process, the network server 530 and the normal host 535, 540, 545, 550 continue to transmit and receive data using the existing normal PSK, and the new guest host 555 and the network server ( The 530 may transmit and receive data with the PSK, which is a newly generated ztk. That is, the guest host 525 that has already gone out cannot access the network server 530 using the existing PSK bbb.

Such a method and apparatus of the present invention have been described with reference to the embodiments shown in the drawings for clarity, but these are merely exemplary, and various modifications and equivalent other embodiments are possible to those skilled in the art. Will understand. Therefore, the true technical protection scope of the present invention will be defined by the appended claims.

According to the present invention, a notebook carried by a guest in a wireless network environment in which wireless secure communication is performed as a key shared between one or more hosts and network servers, such as a Wi-Fi Protected Access Preshared Key (WPA-PSK) method. After the lower level host, such as the host, completes the use of the network, the wireless security function can be enhanced by preventing the user from reconnecting to the network as a previously shared key.

Claims (4)

In the network connection control device wherein at least one host shares a key for authentication of the network connection, A host list manager for managing a list including the class of the host and the shared key; A shared key generation unit for generating a new shared key when the lower level host is disconnected; And And a shared key notifying unit for notifying the host of higher level of the generated shared key. In the network connection control device wherein at least one host shares a key for authentication of the network connection, A host list manager for managing a list including a class of the host and a key shared between hosts of the same class; A shared key generator for generating a new key shared between the hosts of the lower class when the connection with the lower class host is terminated; And And a shared key notifying unit for notifying a host having a lower level of the generated shared key. A network connection control method in which one or more hosts share a key for authentication of a network connection. Registering a list including the class of the host and the shared key; Generating a new shared key when the lower level host is disconnected; And And notifying a host of a higher level of the generated shared key, and updating the list with the generated shared key. A network connection control method in which one or more hosts share a key for authentication of a network connection. Registering a list including the class of the host and a key shared between hosts of the same class; Generating a new key shared between the lower-class hosts when the connection with the lower-class host is lost; And And notifying the generated key to a lower level host and updating the list with the generated shared key.

Images