KR20090021419A - Method for id-based ticket authentication - Google Patents

Abstract

A method for authenticating a ticket base on identification is provided to reduce an authentication time by minimizing the number of the communication between a user, a home authentication server, and an external authentication server. A user, a home authentication server and an external authentication server store password and a symmetric key of the user(S301). A user produces the OTP(One Time Password)(S302). The user encrypts ID, OTP, and AT of the user by using a symmetric key(S303). The user transmits the encrypted authentication message to the home authentication server(S304). The hone authentication server decodes the encrypted authentication message by using the symmetric key(S305). The home authentication server compares OTP' and OTP(S306). The home authentication server generates the secret information when the OTP' are equal to the OTP(S307). The home authentication server generates anonymous ID of the user(S308). The home authentication server issues the ticket(S309). The home authentication server encrypts the ticket issued by using the symmetric key(S310). The home authentication server transmits the encrypted ticket to the user(S311). The user decodes the encrypted ticket. The user stores the ticket(S312).

Description

ID-based ticket authentication {Method for ID-based ticket authentication}

The present invention relates to an ID-based ticket authentication method, and more particularly, to an ID-based ticket authentication method that can reduce the number of communication, increase safety and efficiency in moving in a network by using an ID-based ticket.

Since the concept of public key cryptographic algorithm was first introduced in 1976 by Diffie and Hellman, various public key cryptographic algorithms have been studied. However, the public key used in the public key cryptographic algorithm has a disadvantage in that its size is large in comparison with the private key. Thus, there is a problem of the public key itself and an additional problem of separately managing the public key.

In order to solve the problems of the public key cryptographic algorithm, in 1984, Shamir proposed ID-based cryptography. The ID-based encryption technique is a method of public keying using an arbitrary string that can identify the user, and an e-mail address and a network address may be used as the ID-based public key. The ID-based public key has the advantages of being easy to manage, excellent in security, and especially not requiring a certificate for the public key, compared to a certificate-based public key. In the case of certificate-based public key, the certificate must be reissued when renewing, but in the case of ID-based public key, it can be easily renewed by concatenating the renewal month and month.

Meanwhile, a ticket-based model has been proposed as a method of authenticating whether to grant a use right. Here, the ticket refers to data indicating that a user has been granted a specific right, and the ticket authentication model refers to an authentication model using a ticket. One of the representative methods of cross domain authentication is the ticket-based model. For example, the concept of a ticket-based model is that a user requesting a service submits a ticket as a credential to the service provider, and the service provider checks the ticket and provides a service corresponding to the ticket.

Looking at the ticket-based authentication model according to the prior art as follows. A typical ticket-based authentication model is a Kerberos system. The Kerberos system is a ticket authentication system that uses a centralized authentication server and performs authentication using symmetric key encryption.

Specifically, the flow of the Kerberos system is as follows. The ticket-authorization ticket is issued from the authentication server and the service-authorization ticket is issued from the ticket issuing server to use the service. In such a Kerberos system, in order to access each component of the Kerberos system, it is necessary to remember a pre-promised password. Currently, the Kerberos protocol has been developed up to version 5, which is standardized in IETF RFC 4120.

On the other hand, the Kerberos protocol has a weakness of the password, and since the ticket issuing server distributes the session key, message information transmitted between the client and the service providing server is exposed, which causes anonymity and privacy to be violated. In addition, since the Kerberos server is separated into the authentication server and the ticket generation server, there may exist a problem that a delay may occur in the authentication request.

Looking at the specific process of the ticket-based authentication model using a conventional Kerberos system as follows. First, as shown in FIG. 1, the client C sends a message requesting a connection to a ticket-granting server (TGS) to an authentication server (AS) (S101).

C → AS: ID _c ∥ ID _tgs ∥ TS1 ................. (S101)

The AS sends a response by encrypting with a key extracted from the password K _c of the client including the ticket (S102). At this point, the encrypted message has a copy of the session key (K _{c, tgs} ). Here, the subscript 'c, tgs' indicates that 'K _{c, tgs} ' is the session key for client (C) and TGS. Since the session key (K _{c, tgs} ) is in a message encrypted with K _c , only the client can read it, and the same session key as the session key is included in the ticket that only the TGS can read. Accordingly, the session key can be securely delivered to the client (C) and the TGS.

AS → C:

EK _c [K _{c, tgs} ∥ ID _tgs ∥ TS2 ∥ Lifetime2 ∥ Ticket _tgs ...... (S102)

Ticket _tgs = EK _tgs [K _{c, tgs} ∥ ID _c ∥ AD _c ∥ TS2 ∥ Lifetime2]

By holding the ticket and session key, client C is ready to access TGS. In this state, the client C sends a message including the ticket and the ID of the requested service to the TGS (S103). In addition, client C sends an authenticator, which includes an ID, the address of client C, and a timestamp. Unlike reusable tickets, the authenticator is used only once and has a very short validity time.

C → TGS: ID _v ∥ Ticket _tgs ∥ Authenticator _c ... (S103)

The TGS can decrypt the ticket using a key shared with the AS. This ticket indicates that the client C has been provided with a session key (K _{c, tgs} ). In practice, the ticket says 'People who use K _{c, tgs} must be C'. TGS uses the session key to decrypt the authenticator. The TGS then checks the authenticator's name and address against the name and address in the ticket and the network address of the received message. If everything matches, TGS means that the person who sent the ticket is the actual owner of the ticket. In fact, the authenticator says, 'When in TS3, I use K _{c, tgs} .' A ticket does not identify anyone, but it is a secure way of distributing keys, and it is the authenticator that verifies the identity of the client. The authenticator is used only once and its validity time is short, preventing an attacker from stealing tickets and certificates.

The TGS transmits a ticket to the client C (S104). The message format in step S104 follows the message format in step S102. The message is encrypted by a message key shared by the client C and the TGS and includes a session key to be shared between the client C and the server V, an ID of V and a timestamp of the ticket. The ticket itself contains the same session key.

TGS → C:

EK _{c, tgs} [K _{c, v} ∥ ID _v ∥ TS4 ∥ Ticket _v ] ...... (S102)

Ticket _tgs = EK _tgs [K _{c, tgs} ID _c ∥ AD _c ∥ ID _v ∥ TS2 ∥ Lifetime2]

Ticket _v = EK _v [K _{c, v} ∥ ID _c ∥ AD _c ∥ ID _v ∥ TS4 ∥ Lifetime4]

Authenticator _c = EK _{c, tgs} [ID _c ∥ AD _c ∥ TS3]

Client C now has a reusable service-approved ticket for V. When the client C shows the ticket, it also sends an authenticator as shown in the message of step S105 below.

C → V: Ticket _v ∥ Authenticator _c ....................... (S105)

V decrypts the ticket, finds the session key, and decrypts the authenticator. If mutual authentication is required, V can respond with

V → C: E _{c, v} [TS5 + 1] ......................... (S106)

Ticket _v = EK _v [K _{c, v} ∥ ID _c ∥ AD _c ∥ ID _v ∥ TS4 ∥ Lifetime4]

Authenticator _c = EK _{c, v} [ID _c ∥ AD _c ∥ TS5]

V encrypts the session key with a value incremented by one from the timestamp in the authenticator. Client C can decrypt this message to find the increased timestamp. Since the message is encrypted with the session key, the client (C) is sure that it was only created by V. The content of the message assures the client that this response is not a previous response. At the conclusion of this procedure, client (C) and server (V) share a secret key. This secret key can then be used to encrypt messages between the two or exchange new random session keys.

So far, the method of the Kerberos system has been described in detail. As described above, the Kerberos protocol has a weakness in the password, and since the ticket issuing server distributes the session key, a message transmitted between the client and the service providing server is exposed to prevent anonymity and privacy. In addition, since the Kerberos server is divided into an authentication server and a ticket issuing server, there is a problem that a delay may occur when an authentication request is made.

An object of the present invention is to provide an ID-based ticket authentication method that can reduce the number of communication and increase safety and efficiency in moving in a network by using an ID-based ticket. have.

ID-based ticket authentication method according to the present invention for achieving the above object in the ID-based ticket authentication method on a wireless communication network comprising a user, a home authentication server and an external authentication server, the user, home authentication server And a first step in which the external authentication server stores the user's password PW and the symmetric key KS _U-AAAH , respectively, and the user exponentially calculates PW in the generator g of the multiplication group Zn *, and the authentication time A second step of generating a one-time password (OTP) by XOR operation with a value (AT), a third step in which the user encrypts the user's ID, OTP, and AT using a symmetric key, and the user has a home authentication server A fourth step of transmitting the encrypted authentication message (E _KSU-AAAH [ID _U , OTP, AT]) to the user; and a fifth step of the home authentication server decrypting the encrypted authentication message using a symmetric key; , Home certificate XTP operation of the stored user's password and AT received from the user to generate an OTP ', and the sixth step of comparing the generated OTP' and the OTP received from the user, and if the OTP 'and OTP match 7, the home authentication server generates secret information S _i , H _i , X _i , Y _i , and the home authentication server performs an XOR operation on the user's ID to _generate an anonymous ID of the user. An eighth step of generating; and a ninth step of issuing a ticket composed of an anonymous ID of the user, a valid time of the ticket, a hash value of secret information, and an ID of the home authentication server; A tenth step of encrypting the ticket issued by the home authentication server using a symmetric key, an eleventh step of transmitting the ticket to the user by the home authentication server, and an encrypted ticket transmitted from the home authentication server by the user. Decode, S _i ', H _i '^' , X _{i, and} 'Y _i ' are generated, and comparing with the secret value included in the ticket sent from the home authentication server, if it matches, and comprises a twelfth step of storing the ticket. .

A thirteenth step in which the user moves from the home network to the external network when the ticket is issued by the first to twelfth steps and the user moves from the home network to the external network while the user stores the ticket; And (14) generating, by the user, an external network authentication message by encrypting the user's ID, OTP, AT, and a pre-stored ticket with a symmetric key, wherein the user uses the generated external network authentication message as an external authentication server. A fifteenth step of transmitting; and a sixteenth step of decrypting, by a symmetric key, an external network authentication message received from a user by the external authentication server, and the external authentication server using secret information S _i ', H _i '^' , X _i, 'Y _i' and h (X _i ∥Y _i) 'and the resulting claim 17 and further comprising: wherein the external authentication server created in the first step _{17 h (X i ∥Y i)} ' and tickets The method may further include an eighteenth step of verifying the ticket compared to the secret value h (X _i ∥Y _i ) included in the.

In the seventh step of the home authentication server generating secret information S _i , H _i , X _i , Y _i , OTP is exponentially calculated on the user's ID to generate Si, and OTP is generated to the generator g of the multiplication group Zn *. Exponential power to generate Hi, exponential multiplication of AT to the generator g of the multiplication group Zn *, XOR operation of the generated Si to generate Xi, and exponent multiplication of AT to the generated Si and Hi You can multiply one to produce Yi.

ID-based ticket authentication method according to the present invention has the following effects.

The time required for authentication can be reduced by minimizing the number of communication between the user, home authentication server, and external authentication server, and security can be secured by applying to anonymous ID authentication process.

Prior to the description of one embodiment of the present invention, the symbols used herein are defined as follows.

*: Each object (U: User, AAAF: Local Authentication Server, AAAH: Home Authentication Server)

Id _* : * id

ID _UAnomy : Anonymous ID

PW: User's Password

g: Constructor for multiplication group Zn _*

h (): non-collision hash function

OTP: one-time password

AT: Authentication time value

E _* []: encrypt with * key

KS _{U- *} : Symmetric key shared by user and *

Sign _* : Sign with private key

Lifetime: Ticket valid time

Hereinafter, an ID-based ticket authentication method according to an embodiment of the present invention will be described in detail with reference to the accompanying drawings. 2 is a schematic diagram showing an AAA system in which an ID-based ticket authentication method is implemented in a wireless communication network according to an embodiment of the present invention, and FIG. 3 is an ID-based ticket authentication method according to an embodiment of the present invention. 4 is a reference diagram illustrating a flow of an ID-based ticket authentication method in an AAA system.

ID-based ticket authentication method according to an embodiment of the present invention is largely divided into 1) ticket issuing process by the home authentication server and 2) ticket verification process by the external authentication server, first 1) ticket issuance by the home authentication server The process is as follows.

As shown in FIG. 3, the user, home authentication server, and external authentication server store the user's password and symmetric key, respectively (S301). In this state, the user generates an one-time password, that is, one time password (OTP) by XOR operation of his password and AT (Authentication Time) (S302). Here, as the OTP is generated based on the AT, the authentication value is randomly generated, thereby maintaining safety from retransmission attacks. Subsequently, the user encrypts ID _U , OTP and AT using a symmetric key stored in advance (S303), and transmits the same to the home authentication server (S304).

AT ............................... (S302)OTP = g ^PW

AT ............................... (S302)

E _KSU-AAAH [ID _U , OTP, AT] ........... (S303)

The home authentication server decrypts the encrypted message (E _KSU-AAAH [ID _U , OTP, AT]) received from the user (S305), and OTP by XOR operation of the previously stored user's password and AT received from the user. Create ' Next, the generated OTP 'is compared with the OTP received from the user (S306).

As a result of the comparison, the home authentication server generates the secret information S _i , H _i , X _i , Y _i (S307) and generates the user's anonymous ID (ID _UAnomy ) to ensure the anonymity of the user. (S308). Here, X _i and Y _i are secret values used for user authentication by an external authentication server, and S _i and _Hi are public parameters for generating the X _i and Y _i .

Subsequently, the home authentication server issues a ticket (S309). The ticket is _composed of a user's anonymous ID (ID _UAnomy ), a secret value, a value signed by the home authentication server for the lifetime of the ticket, and the ID of the home authentication server. The home authentication server encrypts the issued ticket using a pre-stored symmetric key (S310) and transmits it to the user (S311).

ATOTP '= g ^PW

AT

OTP =? OTP '..................... (S306)

S _i = ID _U ^OTP .......................... (S307 )

H _i = g ^OTP .......................... (S307)

S_i .......................................... (S307)X _i = g ^AT

S _i ......................... (S307)

Y _i = S _{iH i} ^AT ... (S307)

AT ................................ (S308)ID _UAnomy = ID _U

AT (S308)

Ticket = ID _AAAH , Sign _AAAH [ID _UAnomy , Lifetime, h (X _i ∥ Y _i )] ...... (S309)

E _KSU-AAAH [Ticket] ................ (S310)

On the other hand, the user decrypts the encrypted ticket transmitted from the home authentication server, and generates S _i ', H _i '^' , X _i, ' Y _i '. Then, the validity of the ticket is verified by comparing with the secret value included in the ticket transmitted from the home authentication server, and if the ticket is justified (S312). As described above, when the home authentication server issues a ticket and the user verifies the issued ticket, the ticket issuing process by the home authentication server according to the embodiment of the present invention is completed.

S _i '= ID _U ^OTP

H _i '= g ^OTP

S_i X _i '= g ^AT

S _i

Y _i = S _i ' _Hi ' ^AT

h (X _i ∥ Y _i ) =? h (X _i ∥ Y _i ) ' (S312)

Meanwhile, as described above, when the home authentication server issues a ticket and the user verifies the issued ticket, when the user moves to an external network (see FIG. 2) (S313), according to an embodiment of the present invention. 2) The ticket verification process is performed by an external certificate unit.

Specifically, the user connects to an external authentication server (AAAF) of an external network using a SSL (Transport Socket Security) / TLS (Transport Level Security) protocol. Then, the user encrypts his ID, OTP, AT and pre-stored tickets with a symmetric key (S314) to generate an external network authentication message and transmits it to the external authentication server (S315).

E _KSU-AAAF [ID _U , OTP, AT, Ticket] ..................... (S314)

Subsequently, the external authentication server decrypts the external network authentication message (E _KSU-AAAH [ID _U , OTP, AT, Ticket]) received from the user (S316). Subsequently, S _i ', H _i '^' , X _i, ' Y _i 'and h (X _i ∥ Y _i ) are generated (S317), and the secret value (h (X _i ∥Y) included in the ticket is generated. _i )) to verify the ticket (S318). Then, when the external authentication server authenticates the user by calculating the value received from the user (S319), 2) the ticket verification process by the external authentication unit according to an embodiment of the present invention is completed. The authenticated user can continue to receive services on the external network.

S _i '= ID _U ^OTP (S317)

H _i '= g ^OTP ................... (S317)

S_i ........................... (S317)X _i '= g ^AT

S _i ........................... (S317)

Y _i = S _i ' ^{_{· H i 'AT ....................... (S317}} )

h (X _i ∥ Y _i ) =? h (X _i ∥ Y _i ) ' (S318)

S_i) ............... (S319)Y _i ^OTP-1 = ID _U (X _i

S _i ) ............... (S319)

ACCESS_Accept ............... (S319)

1 is a flowchart illustrating a ticket-based authentication model using a conventional Kerberos system.

2 is a schematic diagram illustrating an AAA system in which an ID-based ticket authentication method is implemented in a wireless communication network according to an embodiment of the present invention.

Figure 3 is a flow chart for explaining the ID-based ticket authentication method according to an embodiment of the present invention.

Figure 4 is a reference diagram showing the flow of ID-based ticket authentication method in the AAA system.

Claims (3)

In the ID-based ticket authentication method on a wireless communication network comprising a user, a home authentication server and an external authentication server, A first step of storing the user's password PW and a symmetric key KS _{U-AAAH by} the user, the home authentication server, and the external authentication server; A second step of the user generating a one-time password (OTP) by exponentially calculating PW to the generator g of the multiplication group Zn * and performing an XOR operation on the authentication time value AT; A third step of the user encrypting the user's ID, OTP, and AT using a symmetric key; A fourth step of the user sending the encrypted authentication message (E _KSU-AAAH [ID _U , OTP, AT]) to a home authentication server; A fifth step of the home authentication server decrypting the encrypted authentication message using a symmetric key; A sixth step of generating an OTP 'by performing an XOR operation on the password of the user in which the home authentication server is stored and the AT received from the user, and comparing the generated OTP' with the OTP received from the user; A seventh step in which the home authentication server generates secret information S _i , H _i , X _i , Y _i if the OTP ′ and OTP coincide; An eighth step of the authentication, the home server by performing an XOR operation on the AT to the user's ID of the user generates an anonymous ID (ID _UAnomy); A ninth step of the home authentication server issuing a ticket composed of a user's anonymous ID, a ticket valid time, a hash value of secret information, and an ID of the home authentication server; A tenth step of encrypting the ticket issued by the home authentication server using a symmetric key; An eleventh step of the home authentication server transmitting a ticket to a user; And The user decrypts the encrypted ticket sent from the home authentication server, generates S _i ', H _i '^' , X _i, ' Y _i ', and stores the secret value included in the ticket sent from the home authentication server. And a twelfth step of storing the ticket in comparison if there is a match. The method of claim 1, wherein when the ticket is issued by the first to twelfth steps and the user stores the ticket, the user moves from the home network to the external network. A thirteenth step of the user moving from a home network to an external network; A fourteenth step of the user generating an external network authentication message by encrypting the user's ID, OTP, AT and a pre-stored ticket with a symmetric key; A fifteenth step in which the user transmits the generated external network authentication message to an external authentication server; A sixteenth step of the external authentication server decrypting the external network authentication message received from the user by using a symmetric key; A seventeenth step in which the external authentication server generates secret information S _i ', H _i '^' , X _i, ' Y _i 'and h (X _i ∥ Y _i )'; And An eighteenth step in which the external authentication server verifies the ticket by comparing h (X _i ∥Y _i ) ′ generated in the seventeenth step with a secret value h (X _i ∥Y _i ) included in the ticket. ID-based ticket authentication method characterized in that it further comprises. The method of claim 1, wherein the home authentication server generates a secret information S _i , _Hi , X _i , Y _i , Generate Si by exponential operation of OTP on user ID, Generate Hi by exponential-operating OTP on constructor g of multiplication group Zn *, AT exponential operation of the generator g of the multiplication group Zn *, XOR operation of the generated Si to generate Xi, ID-based ticket authentication method, characterized in that to generate Yi by multiplying the exponential power of the generated Si and Hi.

Images