KR20070063416A - Method for local authenticating for micro mobility in mobile active network environment - Google Patents

Abstract

A method for local authentication supporting micro mobility in a mobile active network environment is provided to generate and distribute a session key for weak wireless area security in a wireless mobile network and AAA structure inter-working model. A method for local authentication supporting micro mobility in a mobile active network environment includes the steps of: receiving and storing an authenticator generated in a home network by each node. An active network consists of nodes(S401); detecting local mobility inside the active network by a mobile node and transmitting a register request message to a server of the home network(S403); and performing authentication and binding processes inside the active network based on the authenticator by a local authentication server. The local authentication server receives the register request message of the mobile node through a foreign agent(S405).

Description

Local authentication method that supports local mobility in mobile active network environment {Method for Local authenticating for micro mobility in mobile active network environment}

1 is a diagram illustrating a conceptual configuration of an active network supporting mobility.

2 is a signal flow diagram illustrating the flow of messages exchanged between a mobile node and a home network, which is the premise of the present invention.

3 is a conceptual diagram illustrating a path change according to a local movement of a mobile node.

4 is a flowchart illustrating a process of a local authentication method supporting local mobility in a mobile active network environment according to the present invention.

5 is a flowchart illustrating step S405 of FIG. 4 in more detail.

6 is a signal flow diagram illustrating a message flow between a mobile node and a network node by a local authentication method according to the present invention.

The present invention relates to a method for performing authentication locally to support local mobility of a mobile node in a mobile active network environment. More particularly, the present invention relates to an active network structure in a mobile communication network using a MIP. In this case, the present invention relates to a local authentication method for localizing a security association and interworking authentication process for home network registration, thereby excluding the damage factor of local mobility efficiency.

The demand for applications using the Internet and the network of users is complicated, and active network technology has been proposed as a technology to actively accommodate this. Active networks enable the programming of network node structures and the transmission / execution of program code to perform user-requested functions so that new services can be introduced into the network more quickly and economically, and network resources can be utilized more appropriately. The networking technology you want to do.

Unlike the existing network node, which simply stores and forwards the packet, the network function is simple. The active network transmits and executes a desired program through the packet. By executing this function, the network node can perform complex functions such as various error handling and flow control that were previously performed only between network ends or other functions desired by the user.

This feature can provide many advantages as well as flexibility for the user or the network itself. In particular, when the active network is applied to a mobile communication network using MIP, it is possible to optimize the process of registering the mobile node's home network and setting up the packet path between the home agent and the foreign agent, which is a characteristic procedure of the MIP. Configuring the local mobility (Micro Mobility) seen in visited network access can provide an improved mechanism.

When the visited network is an active network, as shown in FIG. 1, the active network 110 is composed of active routers (ARs), and mobility of terminals managed in this domain is often local or local mobility (Micro). Mobility). It exists as a broad mobility infrastructure that is maintained by tunneling between the HA 130 and the FA through the public communication network 120, and when only MIP is used, the portion is composed of overlapped tunneling. However, since each active router remembers (binds) the address of the mobile node, it can perform the same function as a foreign agent in the existing MIP structure, and thus this overlap in the network 110 of ARs is performed. Packet forwarding is possible without requiring lower tunneling.

When a mobile node (hereinafter referred to as “MN”) is locally moved in an active network, the MN requests a registration message to a home agent (HA) in the registration network. In simple MIP, the mobile node's authentication and mobile address binding (registration) are performed by the home network's authentication server (AAAH) and HA. Since the agent function can be performed, the gateway active router (GAR), which becomes a FA role in the wide area MIP, is centered to update the registration of the mobile station-address binding, and the current effective address (COA) In the infrastructure for local mobility, each AR actively processes packet forwarding, thereby reducing the burden of updating the address binding of the home network every time the terminal moves.

On the other hand, for the secure mobility management of the mobile node (Mobile Node) also requires a mobile node authentication procedure, which is based on the "MN-HA security association (MN-HA security association)" base structure. This combined structure requires wide-area security interworking when the mobile node requests registration between the home network where the HA exists and the visiting network where the mobile node exists. There is a problem that causes damage to locality and reduces efficiency.

The technical problem to be solved by the present invention is to solve the above problems, which is a problem of remaining inefficiency in the case of efficiently configuring local mobility by applying an active network structure to a mobile communication network using MIP. It is to provide a local authentication method to localize the security binding and interlocking authentication process for registration, thereby excluding the damage factor of local mobility efficiency.

In order to solve the above technical problem, a local authentication method for supporting local mobility in a mobile active network environment according to the present invention includes a plurality of access routers (AR), a gateway access router (GAR) for connecting to a communication network, and local authentication. A method of performing local authentication in an active network including a server, the method comprising: receiving and storing a local authentication authenticator by each node constituting the active network; Transmitting, by a mobile node, a registration request message to a server of a home network after detecting a local movement in the active network; And performing the authentication and binding procedure in the active network by performing authentication by the local authentication server based on the authenticator by receiving the registration request message of the mobile node through a foreign agent. It is characterized by including.

More preferably, the authenticator is generated in the authentication server of the home network when the mobile terminal is initially registered.

More preferably, the authenticator generates the authentication server of the home network using a value including sskM_AH and a home challenge value as a factor.

More preferably, the mobile node detects local movement as a prefix of a router advertisement (RA), and attaches the authenticator to generate the registration request message.

More preferably, the performing of the authentication and binding procedure may include: receiving, by an external agent, a registration request message from the mobile node; Requesting, by the foreign agent, a registration for the mobile node from a local authentication server; The local authentication server decrypting the authenticator based on a session key to authenticate the authenticator; If the authentication is successful, transmitting a registration message excluding the authenticator to a gateway foreign agent (GFA) to execute local binding update; And distributing a session key to the foreign agent.

More preferably, the distributing of the session key may be performed by encrypting and distributing the session key based on sskAAL-FA.

Hereinafter, with reference to the accompanying drawings will be described in detail an embodiment of the present invention. 1 is a diagram illustrating a conceptual configuration of an active network supporting mobility, and FIG. 2 is a signal flow diagram illustrating a flow of messages exchanged between a mobile node and a home network, which is the premise of the present invention. Meanwhile, FIG. 3 is a conceptual diagram illustrating a path changing according to a local movement of a mobile node. 4 is a flowchart illustrating a process of a local authentication method supporting local mobility in a mobile active network environment according to the present invention, and FIG. 5 is a flowchart showing step S405 of FIG. 4 in more detail. Finally, Figure 6 is a signal flow diagram showing the flow of messages between the mobile node and the network node by the local authentication method according to the present invention.

First, the premise and outline of the present invention (which is illustrated in FIGS. 1 to 3) will be described. MN-GAR security association based on the existing MN-HA security association based on the existing MN-HA security association for the support of secure micro mobility technology in MIP-based mobile networks. We propose a new authentication registration procedure centered on Gateway Access Router (GAR).

1 is a conceptual diagram of an active network supporting mobility. The active network is composed of an AR in the active router 110, a local authentication server (not shown), and a mobile node 140.

The active router (AR) is responsible for data transfer between the mobile node and the internet network. The local authentication server is in charge of mobile node authentication in connection with the home authentication server. The mobile node is the subject receiving the service. Meanwhile, the active network 110 accessed by the mobile node 140 is connected to the home network 130 through the communication network 120.

2 shows a form of message exchange between a mobile node and a home agent. First, when the mobile node 201 requests a registration to the FA 203 (S201), the FA 203 requests a registration to the GFA 205 (S203), and the GFA 205 is a regional authentication server (AAAL, 207). AHR (AA-Home-Agent-Request message) is transmitted (S205). The AAAL 207 again sends the AHR to the home authentication server AAAH 209 (S207), and the AAAH 209 sends the AHR back to the HA 210 (S209). In response, the HA 210 sends the AHR to the AAAH (209). In step 209, AHA (AA-Home-Agent-Answer message) is transmitted (S210). The AAAH 209 sends a registration response message (RegRep), an encrypted session key ((SK) sskAAAH-AAAL), an encrypted session key and a home challenge ((SK, HC) sskAAAH-MN) to the AAAL 207. (S211). The AAAL 207 transmits a registration response message (RegRep), an encrypted session key ((SK) sskAAAL-FA), an encrypted session key and a home challenge ((SK, HC) sskAAAH-MN) to the GFA 205. (S213). Subsequently, the GFA 205 sends a registration response message (RegRep), an encrypted session key ((SK) sskAAAL-FA), and an encrypted home challenge ((SK, HC) sskAAAH-MN) to the FA 203 (S215). . Finally, the FA 203 completes the flow by sending a registration response message (RegRep), an encrypted session key and a home challenge ((SK, HC) sskAAAH-MN) to the MN 201. Where ssK stands for shared secret key, HC stands for Home challenge, and SK stands for session key.

Assume that there is a local movement as shown in FIG. 3 under the premise of FIG. 1 and FIG. 2. 3 shows a situation in which the mobile node changes the connection point. That is, the mobile node 140 connects to the AR3 111 and then moves to the area of the AR4 113 to generate a local handover. The AR3 and the AR4 are the same active networks (110 and 120). In most cases, only a partial path conversion is required without a large change in the whole path, and the present invention reduces the burden of updating the entire path by reflecting this.

In this situation, authentication by the present invention is performed. In order to perform the required authentication procedure according to the mobile node's movement, a new authenticator that is available locally is needed, which is created in the home network during initial registration of the mobile node and then through the session duration for local registration. It is used continuously.

The new authenticator proposed by the present invention is as follows.

Authenticator: h (sskM_AH, HC) SK

Here, ssK: shared secret, HC: home challenge, and SK: session key.

When the mobile node detects local movement, it checks this by prefix of RA (Router Advertisement), and sends the registration request message to the network (to the registration server of the home network) and attaches the above authenticator.

Referring to FIG. 4, first, each node constituting the active network receives and stores the authenticator generated in the home network (S401). When the mobile node detects local movement in the active network and transmits a registration request message to the server of the home network (S403), the mobile node receives the registration request message of the mobile node through a foreign agent. The authentication server is to perform the authentication and binding procedure in the active network based on the authenticator (S405).

Referring to FIG. 5, the authentication and binding procedure will be described in detail. The local AAA server authenticates the mobile node through the following procedure.

The new FA receiving the registration request message from the mobile node controls packet transmission for the mobile node (S501), and transmits the registration message to the local AAA server for authentication (S503). The local AAA server first decrypts the authenticator using the session key. At the time of home registration, the authenticator of the registration message is authenticated using h (sskM_AH, HC) received from the home AAA server (S505). If the authentication of the node is successful, the registration message excluding the authenticator is transmitted to the GFA to execute the local binding update (S507). It also distributes the session key to the FA that sent the message. At this time, using a shared key (sskAAAL-FA) between the local authentication server and the FA (S509).

The local AAA server and mobile node require the following values to perform the regional authentication procedure described above.

AAAL: h (sskM_AH, HC), session key

MN: HC, session key

All the above values are generated by AAAH at home registration and distributed to the node. Each parameter is encrypted using the corresponding ssk. Therefore, AAAL and MN are provided with means to mutually authenticate by HA.

FIG. 6 is a procedure of delivering a message when the access point changes due to local movement of a mobile node as in FIG. 3.

The MN 601 transmits a registration request message (RegReq) and a home challenge hash value (h (sskMN-AAAH, HC)) to the FA 603 (S601), and the FA 603 requests a registration to the AAAL 605. The message RegReq and the home challenge hash value h (sskMN-AAAH, HC) are transmitted (S602). Subsequently, the AAAL 605 makes a registration request to the GFA 607 (S603), and correspondingly, the GFA 607 sends a message indicating that it is registered (S604), and the AAAL 605 sends a registration response encrypted with the FA 603. The message RegRepSK and the encrypted session key (SK) skAAAL-FA are transmitted (S605). Finally, the FA 603 ends by sending an encrypted registration response message (RegRep) SK to the MN 601 (S607).

The invention can also be embodied as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD_ROM, magnetic tape, floppy disks, and optical data storage, and may also include those implemented in the form of carrier waves (eg, transmission over the Internet). . The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. As described above, optimal embodiments have been disclosed in the drawings and the specification. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not intended to limit the scope of the invention as defined in the claims or the claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the present invention has proposed a solution for generating and distributing session keys for security of vulnerable wireless sections in an existing interworking model of a wireless mobile network and AAA structure. The AAA server of the home network, which is the subject of mobile node authentication, generates a session key and delivers it to the FA and MN through each secure method, and creates a secret association between FA-MN to solve the weak wireless section security problem. However, if the mobility is divided into two stages to manage the movement in the local network separately, a quick handoff is possible, but the security problem is revealed because there is no message exchange with the home network. In the MIP, since the authentication of the mobile node is performed only on the home network, a mechanism for performing authentication on its own is required. The present invention solves the problem.

The present invention is expected to be applicable to almost all fields to which the mobile environment is applied in the future, and may be applied to the ubiquitous computing environment in the future.

Claims (7)

A method of performing local authentication in an active network including a plurality of access routers (ARs), a gateway access router (GAR) for connecting to a communication network, and a local authentication server, (a) receiving and storing a local authenticator for each node constituting the active network; (b) the mobile node detecting a local movement in the active network and transmitting a registration request message to a server of a home network; And (c) the local authentication server receiving the registration request message of the mobile node through a foreign agent and performing an authentication and binding procedure in the active network based on the authenticator; Local authentication method for supporting local mobility in mobile active network environment. The method of claim 1, wherein the authenticator Local authentication method for supporting local mobility in a mobile active network environment, characterized in that generated in the authentication server of the home network when the mobile terminal is initially registered. The method of claim 2, wherein the authenticator Local authentication method for supporting local mobility in the mobile active network environment, characterized in that the authentication server of the home network to generate a value including the sskM_AH, home challenge value as a factor. The method of claim 1, wherein step (b) And the mobile node detects local movement as a prefix of a router advertisement, and generates the registration request message by attaching the authenticator to support local mobility in a mobile active network environment. The method of claim 1, wherein step (c) (c1) receiving, by an external agent, a registration request message from the mobile node; (c2) the foreign agent requesting registration of the mobile node to a local authentication server; (c3) the local authentication server decrypting the authenticator based on a session key to authenticate the authenticator; (c4) if the authentication is successful, transmitting a registration message excluding the authenticator to a gateway foreign agent (GFA) to execute local binding update; And (c5) distributing a session key to the foreign agent; a local authentication method for supporting local mobility in a mobile active network environment. The method of claim 4, wherein step (c5) Local authentication method for supporting local mobility in a mobile active network environment, characterized in that the session key is encrypted and distributed based on sskAAL-FA. A method of performing local authentication in an active network including a plurality of access routers (ARs), a gateway access router (GAR) for connecting to a communication network, and a local authentication server, (a) receiving, by nodes constituting the active network, an authenticator for local authentication of an active node; (b) transmitting a registration request message to a server of a home network after the mobile node detects local movement; And (c) a local authentication server receiving the registration request message of the mobile node through an external agent, performing authentication and binding in a mobile network by performing authentication by the authenticator; A computer-readable recording medium that records a program capable of executing a local authentication method on a computer that supports local mobility in an active network environment.

Images