KR20130033691A - Terminal and apparatus authentication surpporting for network access security enhancement system - Google Patents

Abstract

PURPOSE: A terminal device for a network access security reinforcement system and an authorization supporting device thereof are provided to allow a security relay device to relay data traffic corresponding to the terminal device outside through a security channel. CONSTITUTION: A security level determination unit(110) determines whether the security level of a connected network relay device is under a specific security level. When security level of the network relay device is under a specific security level, an authentication control unit(130) forms a security channel and a specific security relay channel using an authentication information generated based on the acquired specific authentication information. A data control unit(140) transmits and receives data traffic corresponding to the network relay device through the security channel. The security level determination unit determines the security level of the network relay device based on the authentication method or an encryption method of the network relay device. [Reference numerals] (110) Security level determination unit; (120) Security warning unit; (130) Authentication control unit; (140) Data control unit;

Description

Terminal device and authentication support device for network access security enhancement system {TERMINAL AND APPARATUS AUTHENTICATION SURPPORTING FOR NETWORK ACCESS SECURITY ENHANCEMENT SYSTEM}

The present invention relates to a network access security enhancement system and method, and more particularly, to a network access security enhancement system and method for providing a method for improving security when accessing a WiFi network, and a terminal device and a method of operating the terminal device. And an operation method of the authentication support device and the authentication support device.

Currently, authentication methods provided when accessing a WiFi network through a WiFi network relay device, that is, a WiFi AP, can be roughly divided into three types. First, mutual authentication method based on EAP (Extensible Authentication Protocol) between network and user terminal device through authentication server, and second, single authentication method of user terminal device such as EAP-MD5, WAP-PSK, etc. Connection is possible without additional authentication procedure. Among the three authentication methods, the method of accessing the WiFi AP without additional authentication procedure is not vulnerable to the transmission of wireless data traffic and is vulnerable to security because it is defenseless against security threats such as eavesdropping and man-in-the-middle attacks. Mutual authentication via a server would be most desirable.

However, the mutual authentication method through the authentication server is limited only because it is applied only to a specific AP managed by a mobile carrier, and the majority of WiFi access environments are made through an AP installed by an individual. An authentication method for accessing a WiFi AP without a procedure is mainly used.

Therefore, it is necessary to develop a technology that enables secure data communication when accessing a WiFi network through a majority of APs installed by an individual, that is, an AP adopting an authentication method for accessing a WiFi AP without an additional authentication procedure.

The present invention has been made in view of the above circumstances, and an object of the present invention is to obtain the authentication according to whether or not a terminal device accesses a network relay device having a predetermined security level or less, according to whether or not it possesses specific authentication related information. Requesting the related information, and according to the request from the terminal device, the terminal generates the authentication related information corresponding to the terminal device and provides it to the terminal device and is generated based on the authentication related information. Providing authentication information of the device to a specific security relay device, the terminal device forms a secure channel with the specific security relay device using the authentication information generated based on the specific authentication related information, the network relay device Corresponding data traffic is transmitted and received through the secure channel, and the secure relay device transmits the secure channel. Through the proposed network access security system and method for relaying data traffic corresponding to the terminal to the outside, and for improving the security when accessing a WiFi network via a network access point that is not secure authentication.

The present invention has been made in view of the above circumstances, and another object to be reached in the present invention is to determine whether a network relay device to be connected is below a specific security level, and when the network relay device is below the specific security level, A terminal for generating authentication information based on the acquired specific authentication related information and forming a secure channel with a specific security relay device using the authentication information, and transmitting and receiving data traffic corresponding to the network relay device through the security channel. The present invention provides a method of operating a device and a terminal device, and improves security when accessing a WiFi network through an unauthenticated network relay device.

The present invention has been made in view of the above circumstances, and another object to be achieved in the present invention is authentication performance information upon initial authentication with a specific authentication server corresponding to the terminal device in response to a request from a specific terminal device. Obtains and generates specific authentication generation information using the authentication performance information, generates specific authentication information based on the authentication generation information, and includes authentication authentication information and information on a specific security relay device. Providing an information to the terminal device and providing a method of operating an authentication support device and an authentication support device for providing the authentication information generated corresponding to the terminal device to the security relay device, This is to improve security when connecting to WiFi network.

Network access security strengthening system according to a first aspect of the present invention for achieving the above object, the authentication information generated based on the specific authentication-related information obtained when accessing a network relay device of a predetermined specific security level or less A terminal device for establishing a secure channel with a specific secure relay device and transmitting and receiving data traffic corresponding to the network relay device through the secure channel; A security relay device configured to relay data traffic corresponding to the terminal device to the outside through the secure channel formed based on the authentication information corresponding to the terminal device; And generating, by the terminal, the authentication related information corresponding to the terminal device according to a request from the terminal device, and providing the terminal device with the authentication information corresponding to the terminal device generated based on the authentication related information. It includes an authentication support device provided by the device.

Terminal device according to a second aspect of the present invention for achieving the above object is a security level determination unit for determining whether or not the network relay apparatus to access a certain security level; An authentication controller configured to form a secure channel with a specific security relay apparatus using the authentication information generated based on the acquired specific authentication related information when the network relay apparatus is less than or equal to the specific security level; And a data controller for transmitting and receiving data traffic corresponding to the network relay apparatus through the secure channel.

Preferably, the security level determining unit determines whether the network relay device is below a specific security level based on at least one of an authentication method and an encryption method of the network relay device recognized based on a connection with the network relay device. You can judge.

Preferably, when the network relay device is below the specific security level, a security alarm unit for providing at least one of a warning indicating that a security channel is formed with a specific security relay device and selection induction to select the security channel formation. It may further include.

Preferably, when the authentication control unit does not hold the specific authentication related information, the authentication control unit performs initial authentication with an authentication server through a specific authentication support device, and generates the authentication support device based on the initial authentication. The specific authentication related information can be requested and obtained.

Preferably, the authentication control unit, if the network relay device is not less than the specific security level, performs the initial authentication with the authentication server through the network relay device in the authentication support apparatus based on the initial authentication performed; And requesting and obtaining the generated specific authentication related information.

The authentication support apparatus according to the third aspect of the present invention for achieving the above object, according to a request from a specific terminal device, to obtain the authentication performance information according to the initial authentication performed with a specific authentication server corresponding to the terminal device; Information acquisition unit; An information generation unit generating specific authentication generation information using the authentication performance information and generating specific authentication information based on the authentication generation information; And an information providing unit providing authentication related information including the authentication generation information and information on a specific security relay device to the terminal device, and providing the authentication information generated corresponding to the terminal device to the security relay device. do.

In accordance with a fourth aspect of the present invention, there is provided a method for strengthening network access security according to an embodiment of the present invention. Requesting relevant information; In response to a request from the terminal device, an authentication support device generates and provides the authentication related information corresponding to the terminal device to the terminal device. The authentication information of the terminal device generated based on the authentication related information is specified security. Providing to the relay device; Establishing, by the terminal device, a secure channel with the specific security relay device using the authentication information generated based on the specific authentication related information; The terminal device transmitting and receiving data traffic corresponding to the network relay device through the secure channel; And relaying, by the security relay device, data traffic corresponding to the terminal device to the outside through the secure channel.

A security level determining step of determining whether an operating method of a terminal apparatus according to a fifth aspect of the present invention for achieving the above object, or whether a network relay apparatus to be accessed is below a specific security level; An authentication information generation step of generating authentication information based on the acquired specific authentication related information when the network relay apparatus is lower than the specific security level; A secure channel forming step of forming a secure channel with a specific secure relay device using the authentication information; And a data transmission / reception step of transmitting and receiving data traffic corresponding to the network relay apparatus through the secure channel.

Preferably, the step of determining the security level, whether the network relay device is below a certain security level based on at least one of an authentication method and an encryption method of the network relay device recognized based on the connection with the network relay device. Can be determined.

Preferably, when the network relay device is less than or equal to the specific security level, a security alert providing at least one of a warning indicating that a security channel is formed with a specific security relay device and selection induction to select a security channel formation. It may further comprise a step.

Preferably, when the network relay device is below the specific security level, if the network relay device does not have valid specific authentication related information, initial authentication with an authentication server is performed through a specific authentication support device, and based on the initial authentication, The method may further include requesting and obtaining specific authentication related information generated by the authentication support device.

Preferably, when the network relay apparatus is not below the specific security level, the initial authentication with the authentication server is performed through the network relay apparatus, and the specific authentication associated with the specific authentication generated by the authentication support apparatus based on the initial authentication is performed. The method may further include requesting and obtaining information.

Method of operation of the authentication support apparatus according to the sixth aspect of the present invention for achieving the above object, the authentication performance information according to the initial authentication performed with a specific authentication server corresponding to the terminal device in response to a request from a specific terminal device Obtaining an information; An information generation step of generating specific authentication generation information using the authentication performance information and generating specific authentication information based on the authentication generation information; And providing an authentication related information including the authentication generation information and information on a specific security relay device to the terminal device, and providing the authentication information generated corresponding to the terminal device to the security relay device. Include.

Therefore, according to the network access security enhancement system and method of the present invention, when connecting to a low-security network AP (WiFi AP) automatically detects it and informs the user to the security level information on the WiFi network connection In addition, it can improve security by transmitting and receiving data traffic through a secure channel to a specific security relay device that is guaranteed instead of a low security network relay device (WiFi AP).

1 is a block diagram showing a network access security enhanced system according to a preferred embodiment of the present invention.
2 is a block diagram showing the configuration of a terminal apparatus according to a preferred embodiment of the present invention.
3 is a block diagram showing the configuration of an authentication support apparatus according to a preferred embodiment of the present invention.
4 is a flowchart illustrating a flow of a method for enhancing network access security according to an embodiment of the present invention.
5 is a flowchart illustrating a flow of a method for enhancing network access security according to another embodiment of the present invention.
6 is a flowchart illustrating a method of operating a terminal device according to an exemplary embodiment of the present invention.
7 is an operation flowchart illustrating a method of operating an authentication support apparatus according to an exemplary embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described with reference to the accompanying drawings.

1 is a diagram illustrating a network access security enhancement system in a preferred embodiment of the present invention.

As shown in Figure 1, the network access security enhanced system according to the present invention, the authentication is generated based on the specific authentication-related information obtained when connecting to the network relay device 201 of a predetermined security level or less The terminal device 100 forms a secure channel with the specific secure relay device 600 using the information, and transmits and receives data traffic corresponding to the network relay device 201 through the secure channel, and the terminal device 100. A security relay device 600 for relaying data traffic corresponding to the terminal device 100 to the outside through the secure channel formed based on the corresponding authentication information, and a terminal according to a request from the terminal device 100. The security relay apparatus 600 generates authentication information corresponding to the device 100 and provides the authentication information corresponding to the terminal device 100 generated based on the authentication related information. It includes an authentication support device 700 to provide.

The terminal device 100 may be connected to a network by connecting to a network relay device 200 or 201 supporting a corresponding network to access a specific network. For example, the specific network is a WiFi network and the network relays 200 and 201 may include a WiFi AP. Here, for example, the network relay device 200 is a WiFi AP having a high security level, and the network relay device 201 is a WiFi AP having a predetermined security level or less.

In this case, the terminal device 100 determines whether the connected network relay device is less than or equal to a predetermined security level when the network relay device is connected.

Therefore, when accessing the network relay device 201 that is less than a specific security level, the terminal device 100 is connected to the specific security relay device 600 by using the authentication information generated based on the acquired specific authentication related information and secured. A secure channel with the relay device 600 may be formed.

In more detail, the terminal device 100 determines whether the terminal apparatus 100 has valid authentication related information when the network relay device 201 is connected to the security level or less. That is, if there is no history of acquiring authentication related information or the valid period of the acquired authentication related information has expired, the terminal device 100 will determine that it does not hold valid authentication related information.

Thus, when the terminal device 100 does not have specific authentication related information, the terminal device 100 performs initial authentication with the authentication server 800 through the specific authentication support device 700, and based on the initial authentication, the authentication support device ( Specific authentication related information generated in 700 may be requested and obtained.

That is, the terminal device 100 performs EAP-based initial authentication with the authentication server 800 through the authentication support device 700. In this process, the authentication server 800 is connected to the terminal device 100 and the master session key. Are shared, and the master session key is not transmitted to the network relay device 201 having a security level or less. Here, the authenticator becomes an authentication support apparatus 700, and when the authentication support apparatus 700 receives the authentication success message from the authentication server 210, the authentication support information 700 receives the authentication performance information, that is, the master session key. Acquire.

When the initial authentication with the authentication server 800 is performed, the terminal apparatus 100 requests authentication related information to the authentication support apparatus 700.

According to a request from the terminal device 100, the authentication support device 700 generates the authentication related information corresponding to the terminal device 100, provides the authentication related information to the terminal device 100, and generates the authentication related information based on the authentication related information. It provides the authentication information corresponding to the terminal device 100 to the security relay device 600.

That is, when authentication related information is requested from the terminal device 100, the authentication support apparatus 700 generates authentication generation information by using authentication performance information (master session key) obtained in correspondence with the terminal device 100. In addition, specific authentication information may be generated based on the authentication generation information. In addition, the authentication support apparatus 700 provides the terminal 100 with authentication related information including authentication generation information and information about the security relay device, and secures the authentication information generated corresponding to the terminal device 100. It is provided to the relay device 600.

In this case, the authentication related information may include information about the security relay device including the security relay device 600 domain name and IP address, current time, authentication information expiration time, and authentication generation information including information necessary for generating authentication information. It may include.

In addition, the authentication support apparatus 700 may provide the security relay 600 with authentication information generated in correspondence with the terminal apparatus 100, identification information of the terminal apparatus 100, an authentication information expiration time, and the like.

As such, when the terminal device 100 is connected to the network relay device 201 having a security level or less, if the terminal device 100 does not have valid authentication related information, it may be obtained from the authentication support device 700.

Accordingly, the terminal device 100 generates authentication information based on previously held or newly acquired authentication related information. In this case, the authentication information (authentication value) generated based on the authentication related information in the terminal device 100 is generated in response to the terminal device 100 in the authentication support device 700 and provided to the security relay device 600. It will be the same as the information (authentication value), thereby sharing the authentication information between the terminal device 100 and the security relay device 600.

Accordingly, the terminal device 100 may establish a secure channel with the secure relay device 600 by accessing the specific secure relay device 600 using the generated authentication information.

That is, the terminal device 100 and the security relay device 600 may form a secure channel by performing mutual authentication and key exchange procedures using previously shared authentication information (authentication value). In this case, the mutual authentication and key exchange procedure may use one of various authentication and key exchange techniques, such as a pre-shared password-based authenticated Diffie-Hellman key exchange technique or a challenge-response type quick re-authentication technique. The session key generated by the mutual authentication and key exchange procedure between the terminal device 100 and the secure relay device 600 may be used to derive a key or data encryption key of IPSec for forming a secure channel.

As such, when a secure channel is formed between the terminal device 100 and the secure relay device 600, the terminal device 100 transmits data traffic corresponding to the network relay device 201 to the secure relay device 600 through the secure channel. Send and receive In this case, since the data traffic transmitted and received through the secure channel between the terminal device 100 and the secure relay device 600 is encrypted and transmitted and received, the security is greatly improved in preparation for transmission and reception through the network relay device 201 having a low security level. do.

Accordingly, the security relay apparatus 600 relays data traffic corresponding to the terminal apparatus 100 to the outside through a security channel formed based on authentication information (authentication value) corresponding to the terminal apparatus 100. That is, the secure relay device 600 decrypts the encrypted data traffic transmitted and received with the terminal device 100 through the secure channel and relays the encrypted data traffic to the outside.

The secure relay device 600 may be a Secure Proxy Gateway device.

Meanwhile, in the present invention, in a heterogeneous network environment in which several networks, such as WCDMA, CDMA, WiBro, WLAN (WiFi), and Long Term Evolution (LTE), are mixed as in the present invention, two terminals of the terminal device 100 are actively active according to the state of the network. A heterogeneous network based data simultaneous transmission service scheme is considered for selecting an ideal network and for efficient data transmission using the selected two or more networks.

The heterogeneous network-based data transmission service divides one piece of data between the terminal device 100 and the management device 400 and transmits the divided partial data for data transmission and reception between the terminal device 100 and the external device 500. Simultaneous transmission service is implemented by transmitting using a plurality of heterogeneous networks (eg WiFi and 3G) and restoring original data by combining received partial data. In this case, the terminal device 100 will be provided with a communication module that can be connected to two or more networks (for example, WiFi and 3G) to use the simultaneous transmission service.

Here, in FIG. 1, a first network refers to a local area wireless network (WiFi), a second network refers to a wireless packet service network (WCDMA), that is, 3G, and a second network device 300 for operating a wireless packet service network. It may refer to a Gateway GPRS Support Node (GGSN) device.

In this simultaneous transmission service environment, if the terminal device 100 accesses the WiFi network through the network relay device 201 having a low security level, it may be difficult to guarantee the security / security of some partial data divided from one transmission target data.

However, according to the present invention described above, when the terminal device 100 is connected to the network relay device 201 having a low security level, a secure channel is formed between the terminal device 100 and the secure relay device 600 and the terminal device ( 100 encrypts and receives data traffic corresponding to the network relay device 201 through a secure channel, and the secure relay device 600 decrypts encrypted data traffic transmitted and received with the terminal device 100 through a secure channel. That is, since the relay to the management device 400, the security is greatly improved.

Hereinafter, a detailed configuration of a terminal device according to the present invention will be described with reference to FIG. 2.

The terminal device 100 according to the present invention includes a security level determining unit 110 for determining whether a network relay device to be connected is less than or equal to a specific security level, and a specific authentication obtained when the network relay device is less than or equal to the specific security level. Authentication control unit 130 that forms a secure channel with a specific security relay device 600 using authentication information generated based on the related information, and data for transmitting and receiving data traffic corresponding to the network relay device through the security channel. It includes a control unit 140.

In addition, the terminal device 100 according to the present invention may further include a security alarm unit 120.

The security level determining unit 110 determines whether the network relay apparatus to be connected is below a specific security level.

That is, the security level determining unit 110, when the terminal device 100 is connected to a specific network relay device, at least one of an authentication method and an encryption method of the network relay device recognized based on the connection with the network relay device. On the basis of this, it may be determined whether the network relay apparatus is below a specific security level.

For example, security levels according to authentication methods and encryption methods can be defined as shown in Table 1 below.

Security level Authentication method Encryption method Level 1 Mutual Authentication Encrypted Level 2 Single authentication Encrypted Level 3 Mutual Authentication Do not encrypt Level 4 Single authentication Do not encrypt Level 5 No authentication Do not encrypt

Accordingly, the security level determining unit 110 may recognize the authentication method and the encryption method of the network relay device 200 or 201 based on the connection with the connected network relay device 200 or 201, and are connected based on this. It may be determined whether the network relay device 200 or 201 is below a specific security level (for example, Level 5), and the determination result is transmitted to the security alarm unit 120 and the authentication control unit 130.

The security alarm unit 120 provides at least one of a warning for informing that a security channel is formed with a specific security relay device and a selection induction for selecting a security channel when the network relay device is below the specific security level. .

That is, when the security alarm unit 120 is connected to the network relay device 201 having a specific security level (for example, Level 5) or less as a result of the determination of the security level determining unit 110, the security of the connected network relay device 201 is secured. A low level can output a warning message and / or a warning tone indicating that a secure channel establishment with a secure relay device is required, or a selection induction to induce a user to select a secure channel formation together with a warning message and a warning tone output. You can print an item.

Accordingly, the user of the terminal device 100 recognizes that the network relay device 201 of the WiFi network to which the terminal device 100 is currently connected is vulnerable to security, and selects to establish a secure channel with the security relay device 600. To accept.

When the network relay device is less than the specific security level, the authentication control unit 130 forms a secure channel with the specific security relay device 600 by using the authentication information generated based on the obtained specific authentication related information, and relays the network. If the device is not below the specific security level, perform an initial authentication with the authentication server 800 through the network relay device, and requests the specific authentication related information generated by the authentication support device 700 based on the initial authentication performed Acquire.

In more detail, when the authentication control unit 130 is connected to the network relay device 200 that is not lower than a specific security level (for example, Level 5) as a result of the determination of the security level determining unit 110, the network relay device ( Initial authentication with the authentication server 809 is performed through 200, and the specific authentication related information generated by the authentication support apparatus 700 is requested and obtained based on the initial authentication.

That is, when the authentication control unit 130 is connected to the network relay device 200 that is not lower than the security level (for example, Level 5), the network relay device 200 according to the authentication method of the network relay device 200. Performs a general connection / authentication procedure that performs initial authentication (eg, EAP-based initial authentication) with the authentication server 809. In this process, the authentication server 800 shares the master session key with the authentication control unit 130. do.

Thereafter, the data control unit 140, after performing the initial authentication with the authentication server 800 will be connected to the WiFi network through the network relay 200 to transmit and receive data traffic as before.

When the initial authentication with the authentication server 800 through the network relay apparatus 200 is performed, the authentication controller 130 requests authentication related information to the authentication support apparatus 700. Accordingly, the authentication support apparatus 700 obtains authentication performance information, that is, a master session key, from the authentication server 800 in response to a request for authentication related information from the terminal device 100, and based on this, the authentication related information as described above. It will be provided to (100), the authentication control unit 130 obtains and stores the authentication related information.

This is because, after performing initial authentication with the authentication server 800 through the network relay device 200, the data controller 140 of the terminal device 100 accesses the WiFi network through the network relay device 200 having a high security level. This is because the authentication control unit 130 separately obtains and holds authentication related information while transmitting and receiving data traffic as described above.

On the other hand, the authentication control unit 130, the security level determination unit 110 determines whether the network relay device 201 having a specific security level (for example, Level 5) or less, whether or not has valid authentication related information. To judge.

That is, the authentication control unit 130 is effective when the security channel is selected by the user when the network relay device 201 having a specific security level (for example, Level 5) or less is connected as a result of the determination of the security level determining unit 110. It is possible to determine whether or not there is authentication related information. Of course, the authentication control unit 130 omits the procedure for selecting a security channel by the user, and when the network relay device 201 is connected to a network having a specific security level (for example, Level 5) or less as a result of the determination of the security level determining unit 110. It is also possible to automatically determine whether it has valid authentication information.

Thus, if the procedure of acquiring / holding the authentication related information is not performed or the validity period of the obtained authentication related information has expired, the authentication controller 130 may determine that it does not have valid authentication related information.

As such, if it is determined that the authentication control unit 130 does not have valid authentication related information, the authentication control unit performs initial authentication with the authentication server 800 through the specific authentication support apparatus 700 and based on the initial authentication, the authentication support apparatus. Requests and obtains specific authentication related information generated at 700.

That is, the authentication control unit 130 performs initial authentication based on EAP with the authentication server 800 through the authentication support apparatus 700, and in this process, the authentication server 800 is the authentication control unit 130 and the master session key. Will be shared. When the authentication support device 700 receives the authentication success message according to the initial authentication from the authentication server 210, the authentication support device 700 obtains authentication performance information, that is, master session key, according to the initial authentication.

When the initial authentication with the authentication server 800 through the authentication support apparatus 700 is performed, the authentication control unit 130 requests authentication related information to the authentication support apparatus 700. Accordingly, the authentication support apparatus 700 will provide the authentication related information to the terminal device 100 according to the request for authentication related information from the terminal device 100 as described above, and the authentication control unit 130 will provide the authentication related information. You get it.

In this regard, the authentication control unit 130 generates authentication information (authentication value) based on previously held or newly acquired authentication related information.

Specifically, the authentication related information includes the information about the security relay apparatus including the security relay apparatus 600 domain name and IP address, the current time, the authentication information expiration time, and the like, and information necessary for generating authentication information. It may include authentication generation information.

Thus, the authentication control unit 130 may generate authentication information (authentication value) according to Equation 1 below based on authentication generation information of the authentication related information.

Equation 1.

Authentication value = H (Authentication generation information || high 64 bits of master session key)

Here, the H function is a one-way hash function of sufficient security strength.

Accordingly, the authentication control unit 130 connects to the secure relay device 600 based on the information on the secure relay device of the authentication related information, and forms a secure channel with the secure relay device 600 using the generated authentication information. can do.

That is, the authentication control unit 130 and the security relay 600 may form a secure channel by performing mutual authentication and key exchange procedures using previously shared authentication information (authentication value). In this case, the mutual authentication and key exchange procedure may use one of various authentication and key exchange techniques, such as a pre-shared password-based authenticated Diffie-Hellman key exchange technique or a challenge-response type quick re-authentication technique. The session key generated by the mutual authentication and key exchange procedure between the authentication controller 130 and the security relay 600 may be used to derive a key or data encryption key of IPSec for forming a secure channel.

As such, when a secure channel is formed between the authentication controller 130 and the secure relay device 600, the data controller 140 transmits data traffic corresponding to the network relay device 201 to the secure relay device 600 through the secure channel. Send and receive In this case, since the data traffic transmitted and received through the secure channel between the data control unit 140 and the security relay device 600 is encrypted and transmitted and received, the security is greatly improved in preparation for transmission and reception through the network relay device 201 having a low security level. do.

Accordingly, the security relay apparatus 600 relays data traffic corresponding to the terminal apparatus 100 to the outside through a security channel formed based on authentication information (authentication value) corresponding to the terminal apparatus 100. That is, the secure relay device 600 decrypts the encrypted data traffic transmitted and received with the terminal device 100 through the secure channel and relays the encrypted data traffic to the outside.

In this case, a separate UI unit (eg, security information display unit) of the terminal device 100 stores a security level, such as current authentication and encryption, and then displays the color or shape of the security information tray icon so that the user can easily know. Different forms can be displayed. When the user selects the security information tray icon, the UI unit (eg, the security information display unit) informs detailed authentication and encryption information, and includes information such as mutual authentication or encryption method.

The security information tray icon displayed by the UI unit (eg, the security information display unit) may be set to be displayed or not displayed at all times in consideration of user convenience. In this case, the user may check the detailed information of the security information tray icon, and when it is determined that the security channel is formed with the security relay device 600, the user may select the formation of the security channel. In this case, the authentication controller 130 may use the security relay device ( The above-described procedure for establishing a secure channel with 600 may be performed.

Hereinafter, the configuration of the authentication support apparatus according to the present invention will be described in more detail with reference to FIG. 3.

The authentication support apparatus 700 according to the present invention, according to a request from the specific terminal device 100, to obtain the authentication performance information according to the initial authentication performed with the specific authentication server 800 corresponding to the terminal device 100; An information acquisition unit 710, an information generation unit 720 for generating specific authentication generation information using the authentication execution information, and generating specific authentication information based on the authentication generation information, and the authentication generation information and the specific information. An information system for providing authentication related information including information about the security relay device 600 to the terminal device 100 and providing the authentication information generated corresponding to the terminal device 100 to the security relay device 600. Study 730 is included.

The information acquisition unit 710 acquires authentication performance information according to initial authentication with the specific authentication server 800 corresponding to the terminal device 100 in response to a request from the specific terminal device 100.

More specifically, the information acquisition unit 710, when the authentication related information is requested from the terminal device 100, the initial authentication with the authentication server 800 is performed, from the authentication server 800 to the terminal device 100; It can be obtained by requesting authentication performance information, i.e., master session key, according to corresponding initial authentication.

In addition, when the information acquisition unit 710 receives an authentication success message from the authentication server 210 in response to the terminal device 100 performing initial authentication with the authentication server 800 through the authentication support device 700. Authentication performing information according to initial authentication, that is, master session key can be obtained.

The information generation unit 720 generates specific authentication generation information using the obtained authentication performance information, that is, the master session key, and generates specific authentication information based on the authentication generation information.

In more detail, the information generation unit 720 generates the information necessary for generating authentication information, that is, authentication generation information according to Equation 2 using the obtained authentication performance information, that is, the master session key.

Equation 2.

Authentication generation information = H (lower 64bit of master session key || secure relay device (600) domain name || current time || authentication information expiration time)

In addition, the information generating unit 720 may generate authentication information (authentication value) according to Equation 1 above based on the authentication generation information.

The information providing unit 730 provides the terminal 100 with authentication related information including the authentication generation information and the information about the specific security relay 600, and generated in response to the terminal device 100. The authentication information is provided to the security relay device 600.

That is, the information providing unit 730, the authentication relay generation information including the information necessary for generating the authentication information, the security relay device 600 including a domain name and IP address, the current time, authentication information expiration time, etc. It provides the terminal 100 with the authentication-related information, including information about.

The information providing unit 730 provides the security relay 600 with authentication information (authentication value) generated in correspondence with the terminal device 100, identification information of the terminal device 100, and an expiration time of the authentication information. can do.

Thus, the security relay device 600 stores the authentication information (authentication value) generated in correspondence with the terminal device 100, identification information of the terminal device 100, authentication information expiration time, and the like, and then the terminal device 100 It will be used to establish a secure channel with.

As described above, the network access security strengthening system according to the present invention automatically detects when connecting to a low security network relay device (WiFi AP) and informs the user of the security level information on the WiFi network connection as a user. It can improve security by transmitting and receiving data traffic through a secure channel to a specific security relay device to ensure security instead of a low security network relay device (WiFi AP).

Hereinafter, a method of strengthening network access security according to a preferred embodiment of the present invention will be described with reference to FIGS. 4 to 7. Here, for convenience of description, the components shown in FIGS. 1 to 3 will be described with reference to corresponding reference numerals.

First, a method of strengthening network access security according to a preferred embodiment of the present invention will be described with reference to FIGS. 4 and 5.

4 illustrates an embodiment in which the terminal device 100 accesses a network relay device that is less than or equal to a security level after accessing a network relay device that is not security level or less, that is, security is guaranteed.

The terminal device 100 connects to the network relay device 200 supporting the network in order to access a specific network (S5), and the network relay device 200 is not below a specific security level (for example, Level 5). As before, initial authentication with the authentication server 809 is performed through the network relay apparatus 200 (S10). Thus, the terminal device 100, after performing the initial authentication with the authentication server 800 will be connected to the WiFi network through the network relay device 200 to transmit and receive data traffic as before.

In addition, the terminal apparatus 100 requests authentication related information to the authentication support apparatus 700 (S20).

Accordingly, the authentication support apparatus 700 obtains authentication performance information (master session key) from the authentication server 800 according to the authentication related information request from the terminal device 100 (S25), and based on the authentication generation information Generate and generate authentication information using the authentication generation information (S30).

In addition, the authentication support apparatus 700 provides authentication related information to the terminal apparatus 100 (S33), authentication information generated in correspondence with the terminal apparatus 100, identification information of the terminal apparatus 100, and authentication information. The expiration time and the like are provided to the security relay device 600 (S36).

In this case, the authentication related information may include information about the security relay device including the security relay device 600 domain name and IP address, current time, authentication information expiration time, and authentication generation information including information necessary for generating authentication information. It may include.

Accordingly, the terminal device 100 may separately obtain and store / store authentication related information in advance, while accessing a WiFi network through a network relay device 200 having high security level and transmitting and receiving data traffic as before (S40). ).

Thereafter, the terminal device 100 connects to the network relay device 201 to connect to the WiFi network again after the connection with the network relay device 200 is terminated (S50).

The terminal device 100 determines that the network relay device 201 is an AP having a low security level equal to or less than a specific security level (eg, Level 5) (S60), and based on valid authentication related information stored / held in step S40. By connecting to the security relay 600 to form a secure channel (S70).

That is, the terminal device 100 generates authentication information based on the authentication related information. In this case, the authentication information (authentication value) generated based on the authentication related information in the terminal device 100 is generated in response to the terminal device 100 in the authentication support device 700 and provided to the security relay device 600. It will be the same as the information (authentication value), thereby sharing the authentication information between the terminal device 100 and the security relay device 600.

Accordingly, the terminal device 100 may establish a secure channel with the secure relay device 600 by accessing the specific secure relay device 600 using the generated authentication information.

As such, when a secure channel is formed between the terminal device 100 and the secure relay device 600, the terminal device 100 transmits data traffic corresponding to the network relay device 201 to the secure relay device 600 through the secure channel. Send and receive (S80). In this case, since the data traffic transmitted and received through the secure channel between the terminal device 100 and the secure relay device 600 is encrypted and transmitted and received, the security is greatly improved in preparation for transmission and reception through the network relay device 201 having a low security level. do.

Accordingly, the security relay apparatus 600 relays data traffic corresponding to the terminal apparatus 100 to the outside 1 through a security channel formed based on authentication information (authentication value) corresponding to the terminal apparatus 100. (S85). That is, the secure relay device 600 decrypts the encrypted data traffic transmitted and received with the terminal device 100 through the secure channel and relays the encrypted data traffic to the outside 1.

FIG. 5 illustrates an embodiment in which the terminal apparatus 100 accesses a network relay apparatus having a specific security level or less without having valid authentication related information already held.

The terminal device 100 connects to a network relay device 201 supporting the corresponding network in order to access a specific network (S90).

The terminal device 100 determines that the network relay device 201 is an AP having a low security level below a specific security level (for example, Level 5) (S100), and does not have valid authentication related information. Initial authentication with the authentication server 800 is performed (700) (S110).

That is, the terminal device 100 performs EAP-based initial authentication with the authentication server 800 through the authentication support device 700. In this process, the authentication server 800 is connected to the terminal device 100 and the master session key. Are shared, and the master session key is not transmitted to the network relay device 201 having a security level or less.

At this time, when receiving the authentication success message from the authentication server 210, the authentication support apparatus 700 obtains authentication performance information, that is, master session key, according to the initial authentication (S125).

When the initial authentication with the authentication server 800 is performed, the terminal device 100 requests authentication related information to the authentication support apparatus 700 (S120).

Accordingly, the authentication support apparatus 700 generates authentication generation information using the authentication performance information (master session key) obtained in correspondence with the terminal apparatus 100, and generates authentication information using the authentication generation information ( S130).

In addition, the authentication support apparatus 700 provides authentication related information to the terminal apparatus 100 (S133), authentication information generated corresponding to the terminal apparatus 100, identification information of the terminal apparatus 100, and authentication information. The expiration time and the like are provided to the security relay device 600 (S136).

In this case, the authentication related information may include information about the security relay device including the security relay device 600 domain name and IP address, current time, authentication information expiration time, and authentication generation information including information necessary for generating authentication information. It may include.

Accordingly, when the terminal device 100 is connected to the network relay device 201 having a security level or less, if the terminal device 100 does not have valid authentication related information, the terminal device 100 may obtain and store it from the authentication support device 700 (S140).

The terminal device 100 forms a secure channel by accessing the secure relay device 600 based on the obtained authentication related information (S150).

That is, the terminal device 100 generates authentication information based on the authentication related information. In this case, the authentication information (authentication value) generated based on the authentication related information in the terminal device 100 is generated in response to the terminal device 100 in the authentication support device 700 and provided to the security relay device 600. It will be the same as the information (authentication value), thereby sharing the authentication information between the terminal device 100 and the security relay device 600.

Accordingly, the terminal device 100 may establish a secure channel with the secure relay device 600 by accessing the specific secure relay device 600 using the generated authentication information.

As such, when a secure channel is formed between the terminal device 100 and the secure relay device 600, the terminal device 100 transmits data traffic corresponding to the network relay device 201 to the secure relay device 600 through the secure channel. Transmit and receive (S160). In this case, since the data traffic transmitted and received through the secure channel between the terminal device 100 and the secure relay device 600 is encrypted and transmitted and received, the security is greatly improved in preparation for transmission and reception through the network relay device 201 having a low security level. do.

Accordingly, the security relay apparatus 600 relays data traffic corresponding to the terminal apparatus 100 to the outside 1 through a security channel formed based on authentication information (authentication value) corresponding to the terminal apparatus 100. (S165). That is, the secure relay device 600 decrypts the encrypted data traffic transmitted and received with the terminal device 100 through the secure channel and relays the encrypted data traffic to the outside 1.

Hereinafter, a method of operating a terminal device according to the present invention will be described in detail with reference to FIG. 6.

In the method of operating a terminal device according to the present invention, a specific network relay device (AP) is connected to connect to a specific network, that is, a WiFi network (S200).

In the operation method of the terminal apparatus according to the present invention, it is determined whether the network relay apparatus to be connected is below a specific security level (S210).

That is, in the method of operating a terminal apparatus according to the present invention, when the terminal apparatus 100 is connected to a specific network relay apparatus, at least any one of an authentication method and an encryption method of the network relay apparatus recognized based on the connection with the network relay apparatus. Based on one, it may be determined whether the network relay device is below a specific security level (eg, Level 5).

When the network relay device is less than or equal to the specific security level, the method of operating a terminal device according to the present invention may include at least any one of an induction of selecting a warning and a security channel formation indicating that a security channel is formed with a specific security relay device. Provide one (S220).

That is, in the method of operating the terminal device according to the present invention, the security level of the connected network relay device 201 when connected to the network relay device 201 that is less than a specific security level (for example, Level 5) as a result of the determination in step S210. This low level can output a warning message and / or a warning tone indicating that a secure channel establishment with the secure relay device is required, or a selection induction item for inducing a user to select a secure channel formation together with the warning message and the warning tone output. You can output

Accordingly, the user of the terminal device 100 recognizes that the network relay device 201 of the WiFi network to which the terminal device 100 is currently connected is vulnerable to security, and selects to establish a secure channel with the security relay device 600. To accept.

On the other hand, when the determination result of step S210 is connected to the network relay device 200 that is not below a specific security level (for example, Level 5), the operation method of the terminal device according to the present invention, authentication through the network relay device 200 Initial authentication with the server 809 is performed, and the specific authentication related information generated by the authentication support apparatus 700 is requested and obtained based on the initial authentication (S280).

That is, the operation method of the terminal device according to the present invention, when connected to the network relay device 200 not lower than the security level (for example, Level 5), according to the authentication method of the network relay device 200 network relay device ( A general connection / authentication procedure for performing initial authentication (eg, EAP-based initial authentication) with the authentication server 809 is performed through 200. In this process, the authentication server 800 establishes a master session with the terminal device 100. The key will be shared.

Subsequently, in the method of operating the terminal device according to the present invention, after performing initial authentication with the authentication server 800, the network will be connected to the WiFi network through the network relay 200 to transmit and receive data traffic as before.

In addition, in the method of operating the terminal device according to the present invention, when initial authentication with the authentication server 800 through the network relay device 200 is performed, the authentication support device 700 requests authentication related information. Accordingly, the authentication support apparatus 700 obtains authentication performance information, that is, a master session key, from the authentication server 800 in response to a request for authentication related information from the terminal device 100, and based on this, the authentication related information as described above. A method of operating a terminal device according to the present invention will obtain and store authentication related information.

This is, after performing initial authentication with the authentication server 800 through the network relay device 200, the terminal device 100 is connected to the WiFi network through the network relay device 200 with high security to transmit and receive data traffic as before. In the meantime, this is to separately obtain and retain authentication related information.

On the other hand, in the method of operating the terminal device according to the present invention, when the network relay device 201 of a certain security level (for example, Level 5) or less is connected as a result of the determination in step S210, it is determined whether or not to hold valid authentication related information. (S240).

That is, in the method of operating the terminal device according to the present invention, when the network relay device 201 having a specific security level (for example, Level 5) or less is connected, if a secure channel is selected by the user (S230), valid authentication related information It may be determined whether or not hold (S240). Of course, the operation method of the terminal device according to the present invention skips the procedure for selecting a security channel by the user and automatically determines that the network relay device 201 having a specific security level (for example, Level 5) or less is connected as a result of the determination in step S210. In addition, it may be determined whether it holds valid authentication information.

In the method of operating a terminal device according to the present invention, if the procedure of acquiring / holding authentication related information is not performed or the valid period of the acquired authentication related information has expired, it is determined that the terminal device does not have valid authentication related information. will be.

As described above, when it is determined that the terminal device operating method does not have valid authentication related information, initial authentication with the authentication server 800 is performed through the specific authentication support apparatus 700 (S260). Based on the performance, the specific authentication related information generated by the authentication support apparatus 700 is requested and obtained (S270).

That is, the operating method of the terminal device according to the present invention, performs the initial authentication based on EAP with the authentication server 800 through the authentication support device 700, in this process, the authentication server 800 is the terminal device 100; You will share the master session key with. When the authentication support device 700 receives the authentication success message according to the initial authentication from the authentication server 210, the authentication support device 700 obtains authentication performance information, that is, master session key, according to the initial authentication.

In addition, the method of operating a terminal device according to the present invention requests authentication related information to the authentication support apparatus 700 when initial authentication with the authentication server 800 through the authentication support apparatus 700 is performed. Thus, the authentication support apparatus 700 will provide the authentication related information to the terminal device 100 according to the request for authentication related information from the terminal device 100 as described above, and the operation method of the terminal device according to the present invention In addition, authentication related information is obtained.

Accordingly, the method of operating the terminal device according to the present invention forms a secure channel with the security relay device 600 based on the authentication related information previously held as a result of the determination in step S240 or newly obtained authentication related information through the step S270. (S250).

Specifically, the authentication related information includes the information about the security relay apparatus including the security relay apparatus 600 domain name and IP address, the current time, the authentication information expiration time, and the like, and information necessary for generating authentication information. It may include authentication generation information.

Accordingly, the method of operating a terminal device according to the present invention may generate authentication information (authentication value) according to Equation 1 above based on authentication generation information of authentication related information.

Accordingly, in the method of operating a terminal device according to the present invention, the security relay device 600 is connected to the security relay device 600 based on the information on the security relay device of the authentication-related information, and the security relay device 600 is generated using the generated authentication information. A secure channel can be formed.

As such, when a secure channel is formed between the terminal device 100 and the secure relay device 600, the operation method of the terminal device according to the present invention provides a secure relay device for transmitting data traffic corresponding to the network relay device 201 through a secure channel. Transmit and receive with 600 (S295). In this case, since the data traffic transmitted and received through the secure channel between the terminal device 100 and the secure relay device 600 is encrypted and transmitted and received, the security is greatly improved in preparation for transmission and reception through the network relay device 201 having a low security level. do.

At this time, the operation method of the terminal device according to the present invention can be displayed by differentiating and displaying the security information tray icon in the form of a color or a shape so that the user can easily know after storing the security level, such as the current authentication and encryption. There is (S290). When the user selects the security information tray icon, the method of operating the terminal device according to the present invention informs the detailed authentication and encryption information, which includes information such as mutual authentication or not.

The security information tray icon to be displayed may be set to be displayed or not displayed at all times in consideration of user convenience. In this case, the user may check the detailed information of the security information tray icon, and when it is determined that the security channel is formed with the security relay device 600, the user may select the formation of the security channel. In this case, the operation method of the terminal device according to the present invention In addition, the above-described procedure for establishing a secure channel with the secure relay device 600 may be performed.

Hereinafter, an operation method of the authentication support apparatus according to the present invention will be described in detail with reference to FIG. 7.

The operation method of the authentication support apparatus according to the present invention, according to a request from the specific terminal device 100 (S300) to perform the authentication information according to the initial authentication performed with the specific authentication server 800 corresponding to the terminal device 100; Acquire (S310).

More specifically, in the operation method of the authentication support apparatus according to the present invention, when authentication-related information is requested from the terminal device 100 on which the initial authentication with the authentication server 800 is performed, the authentication device 800 from the terminal device. It may be obtained by requesting authentication performance information, that is, master session key, according to the initial authentication performed corresponding to 100.

In addition, in the operation method of the authentication support apparatus according to the present invention, the authentication server 210 receives an authentication success message in response to the terminal device 100 performing initial authentication with the authentication server 800 through the authentication support apparatus 700. When receiving from the authentication authentication information, that is, the master session key according to the initial authentication can be obtained.

In the operation method of the authentication support apparatus according to the present invention, the specific authentication generation information is generated using the obtained authentication performance information, that is, the master session key, and specific authentication information is generated based on the authentication generation information (S320).

More specifically, the operation method of the authentication support apparatus according to the present invention generates the information necessary for generating authentication information, that is, authentication generation information according to Equation 2, using the obtained authentication performance information, that is, the master session key. .

In addition, the operation method of the authentication support apparatus according to the present invention may generate authentication information (authentication value) according to Equation 1 above based on the authentication generation information.

The operation method of the authentication support apparatus according to the present invention provides the terminal 100 with authentication related information including the authentication generation information and information on the specific security relay 600 (S330) and the terminal apparatus 100. In step S340, the authentication information generated in correspondence to the security relay device 600 is provided.

That is, the operation method of the authentication support apparatus according to the present invention includes authentication generation information including information necessary for generating authentication information, security relay device 600 domain name and IP address, current time, authentication information expiration time, etc. It provides the terminal 100 with the authentication-related information, including information on the security relay device.

In addition, the operation method of the authentication support apparatus according to the present invention, the authentication information (authentication value) generated in correspondence with the terminal device 100, identification information of the terminal device 100, authentication information expiration time and the like security relay device ( 600).

Thus, the security relay device 600 stores the authentication information (authentication value) generated in correspondence with the terminal device 100, identification information of the terminal device 100, authentication information expiration time, and the like, and then the terminal device 100 It will be used to establish a secure channel with.

As described above, the method for enhancing network access security according to the present invention automatically detects a connection to a network AP (WiFi AP) having a low security level and notifies the user of the security level information on the WiFi network connection. It can improve security by transmitting and receiving data traffic through a secure channel to a specific security relay device to ensure security instead of a low security network relay device (WiFi AP).

Meanwhile, the steps of a method or algorithm described in connection with the embodiments disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. A software module may reside in a RAM memory, a flash memory, a ROM memory, an EPROM memory, an EEPROM memory, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from, and write information to, the storage medium. Alternatively, the storage medium may be integrated into the processor. The processor and the storage medium may be included within an ASIC. The ASIC may be included in the user terminal device. In the alternative, the processor and the storage medium may be included as separate components within the user terminal device.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the invention as defined by the appended claims.

According to the system and method for enhancing network access security according to the present invention, a user may recognize security level information on a WiFi network connection by automatically detecting and informing the user when a network AP (WiFi AP) having a low security level is connected. It is possible to improve security by transmitting and receiving data traffic through a secure channel to a specific security relay device that is guaranteed instead of a low security network relay device (WiFi AP). As the technology goes beyond the limits of the technology, it is an industrially applicable invention because not only the use of the related technology but also the possibility of marketing or operating the applied device is not only sufficient but also practically obvious.

100: terminal device 200, 201: network relay device
600: security relay 700: authentication support device
800: authentication server

Claims (12)

A security level determining unit for determining whether a network relay apparatus to be connected is below a specific security level;
An authentication controller configured to form a secure channel with a specific security relay apparatus using the authentication information generated based on the acquired specific authentication related information when the network relay apparatus is less than or equal to the specific security level; And
And a data controller for transmitting and receiving data traffic corresponding to the network relay apparatus through the secure channel. The method of claim 1,
The security level determination unit,
And determining whether the network relay device is below a specific security level based on at least one of an authentication method and an encryption method of the network relay device recognized based on the connection with the network relay device. The method of claim 1,
If the network relay device is less than the specific security level, further comprises a security alarm unit for providing at least one of a warning indicating that the security channel is formed with a specific security relay device and selection induction to select the security channel formation is required. Terminal device, characterized in that. The method according to any one of claims 1 to 3,
The authentication control unit,
If the specific authentication related information is not valid, initial authentication with an authentication server is performed through a specific authentication support device, and the specific authentication related information generated by the authentication support device is obtained based on the initial authentication. Terminal device, characterized in that. The method according to any one of claims 1 to 3,
The authentication control unit,
If the network relay device is not below the specific security level, perform initial authentication with the authentication server through the network relay device and request specific authentication related information generated by the authentication support device based on the initial authentication. Terminal device, characterized in that obtaining. An information acquisition unit for acquiring authentication performance information according to an initial authentication with a specific authentication server corresponding to the terminal device according to a request from a specific terminal device;
An information generation unit generating specific authentication generation information using the authentication performance information and generating specific authentication information based on the authentication generation information; And
And an information providing unit providing authentication related information including the authentication generation information and information on a specific security relay device to the terminal device, and providing the authentication information generated corresponding to the terminal device to the security relay device. Authentication support device, characterized in that. A security level determining step of determining whether a connected network relay device is below a specific security level;
An authentication information generation step of generating authentication information based on the acquired specific authentication related information when the network relay device is less than or equal to the specific security level;
A secure channel forming step of forming a secure channel with a specific secure relay device using the authentication information; And
And transmitting / receiving data traffic corresponding to the network relay device through the secure channel. The method of claim 7, wherein
The security level determination step,
And determining whether the network relay device is below a specific security level based on at least one of an authentication method and an encryption method of the network relay device recognized based on the connection with the network relay device. Way. The method of claim 7, wherein
If the network relay device is less than or equal to the specific security level, further comprising a security alert step of providing at least one of a warning indicating that a security channel establishment with a specific security relay device is required and selection induction to select a security channel formation. Method of operation of the terminal device, characterized in that. 10. The method according to any one of claims 7 to 9,
If the network relay device is less than the specific security level, and does not hold the valid specific authentication related information, initial authentication with the authentication server through a specific authentication support device, and based on the initial authentication performed in the authentication support device And requesting and obtaining the generated specific authentication related information. 10. The method according to any one of claims 7 to 9,
If the network relay device is not below the specific security level, perform initial authentication with the authentication server through the network relay device and request specific authentication related information generated by the authentication support device based on the initial authentication. Method of operation of the terminal device further comprising the step of obtaining. An information obtaining step of acquiring authentication performance information according to initial authentication with a specific authentication server corresponding to the terminal device according to a request from a specific terminal device;
An information generation step of generating specific authentication generation information using the authentication performance information and generating specific authentication information based on the authentication generation information; And
And providing an authentication related information including the authentication generation information and information on a specific security relay device to the terminal device, and providing the authentication information generated corresponding to the terminal device to the security relay device. Operation method of the authentication support device, characterized in that.

Images