TWI252649B - A convenient and secure wireless LAN authentication method and system based on SMS mechanism of GSM - Google Patents

Abstract

The present invention relates to a simple and secure wireless LAN authentication method and system integrated with a SMS mechanism of GSM. A user inserts his/her own wireless network interface card into a mobile portable computer, automatically searches for the nearest access point, and request to connect to Internet. The access point asks the user to input the telephone number of the user's mobile communication device as a user's account, and the server in the network management center generates a password for the user based on the user's account and transmits the password to the user's mobile communication device by a short message. The user inputs the password via the portable computer, after the server in the network management center verifies that the password is correct, and the user can normally connect with Internet to use network resource, thereby achieving a simple and secure wireless Internet connection.

Description

1252649 V. INSTRUCTION DESCRIPTION OF THE INVENTION (1) Field of the Invention The present invention relates to a simple benefit line area network authentication method and system for integrating a GSM newsletter mechanism, and more particularly to a telephone number of a user's device... User account, and according to the use of g = generate - password ' and send the password to the use of 2 device number in the form of a short message 'user and then enter the password on the portable computer, after = fast correct ' Normally connect to the Internet to enable individuals to access wireless Internet access that provides easy and secure access. Beiyuan's previous technology, the J-line area network, is to provide users with no troubles in wiring, eliminating the trouble of wiring, fragrant clothes, four users of the same clothes, and can provide roaming line area network with a d , the Internet environment where you can go online. No part of the wireless transmission of the === road transmission line, rice; ^: ί area 5 Internet has been very popular, for example, many international users only need two [; brown chain stores, etc., have similar services. After the card, you can travel to the Internet. Or, plug in the wireless network. It can be said that it is zero time difference, etc., and the network resources are captured and transported. The wireless area Internet is fast and convenient. ..., ten knives are convenient, but because the user terminal accesses the network 1252649. 5. The invention description (2) The line age M y ^ system ^ ^ knife is in the form of wireless transmission, if there is no perfect authentication machine ' 7 ') ^ Right > Unauthorized user intrusion, this will bring great security 1: 1. Loss of commercial interests. Currently in the 1EEE Standard 802. lx domain network architecture, Radius ~ 〇 1 〇 (: 〇 1 is the most important agreement to mention the two = ancestor mechanism, can identify the user's identity and password, after the second Authorized users log in to the domain to use the relevant resources, and can provide a mechanism to save the user's activity record on the network to provide a basis for the full authentication fee mechanism of the spears. Under this mechanism, w= There are three sources of proof: = one is to use the local wireless network card leased by the local area, the user field 1, the location (such as the Zhongzheng Airport) counter is rented by the network management center to provide the special lang; ί: road card 'insert Your own laptop does not require an account and password. ^Wireless Internet access. This method uses the hardware of the lock network card: i (MAC address), ~ ^ Mt ^ ^ ^ ^ + After the Internet users have finished surfing the Internet, they must return the wireless network to the counter of the local location. Through the network management system, μ, , < ^ μ 1 side, with Lu Wei ^When the user uses the network Ξ = use Charges. This way will face Rent. The contract must detail the rights and obligations of both parties to the lease. The wireless network card of the room must be in good condition before and after use. If it is necessary to make a claim after use, it may be temporary for the user: t, it is necessary to sign Is there a contract? Then, 'How to avoid making η】, fill in the fake information when the card is used, so that the user is using: Right does not return the network card... Tracking the user's request to return to the network card to charge the network usage fee These problems will cause rental double

1252649 V. Description of invention (3) Fang: Convenient f trouble, making consumers less willing to go online. A kind of way to use prepaid points. Gambling to buy Internet access points, you will get a group account and password, insert a self-equipped wireless network card in your computer, and then you can wirelessly access the Internet at your location. In this way, there is commercial cooperation between the local network management center and the network management center. After the local network management center receives the account number and password entered by the user, it must be connected to the data center of the operator to check whether the account and password are in the group. legitimate. The cost of the Internet is deducted from the stored value in the account. After a certain period of time on the Internet, the amount will be used up. If you need to continue to use the amount of the deposit, you will continue to use the network. This method also faces some problems: since the user must pay first, the user must pay attention to the stored value balance at any time, 'to avoid being unable to access the Internet due to insufficient points. In addition, since the account number and password will be reused, the user must save it properly to avoid loss caused by theft. Similarly, the account and password must be safely stored in the server database of the operator. loss. In addition, users may only occasionally go to a coffee shop or make a temporary use of the Internet, so they may not deliberately apply for an account number, thus reducing their willingness to use.苐 One way to register as a member of the industry in advance, such as applying for a member of Hinet or Seednet, this way makes the same set of accounts and passwords used at home and online. The way to access the Internet is the same as the first way, but the way of charging Differently, the Internet access fee will be combined with the telecom bill after the event. The problem with this approach is that it must be a member of the industry to be online. The user may not have the will or may not be willing to be a member b due to certain factors.

Page 6 1252649 V. Inventions (4) This service cannot be enjoyed, for example, a monthly fee is required to become a member. Code, security is also a customer's customer information, simple business things. The operator may ask the user to use the account and the secret in the field. And the industry has to integrate the various domestic and market considerations, it is not a piece.

According to the above description, although the wireless local area network access is very convenient, there are still some problems and problems in verifying the right to access the Internet, which is inconvenient for the user, thereby reducing the willingness to access the Internet. "To solve these problems, the present invention proposes a wireless area Internet authentication mechanism that combines the digital communication system of the digital mobile communication device system (Gbbal System for Moblie c〇mmunicati〇ns), anyone who is a digital mobile communication device system GSM The legitimate users of the Internet can use this mechanism to access the Internet. The majority of customers of the digital mobile communication device system GS 成为 become potential users of the wireless area Internet access. The present invention can solve the shortcomings of the above three methods, and establish a convenient and secure wireless Internet access mechanism, and the convenience is to promote the wireless network. The most powerful push for applications' is therefore critical to the promotion of wireless networks. The main purpose of the present invention is to provide a simple and secure benefit line area network authentication method, which is to automatically find the nearest access bridge after the user inserts his own wireless network card into the portable portable computer. And request the Internet access bridge to require the user to enter on the portable computer - the phone number of the user's mobile communication device to be used as the user account, the server of the network management center where the user is located receives the user When the account number is

!252649 V. Invention Description (5) The user of Yuhai generates a password, and the local network management device of the user's location is sent to the user via the user's account number entered by the user. The user mobile communication device, after the user receives the short message on the communication device and knows the password, the user can enter the password in the brain: the network management center of the user's location =: In the case of the password, first verify that the password is correct. If it is correct, ^, the user authenticates to enable the authenticated user to connect to the network to use the network resources. Please refer to the first and second diagrams for the sling and internet implementation. (Note: In the second figure, each line is not wired, the dotted line indicates wireless transmission.) The simple and safe wireless area network authentication method flow of the whole human mechanism of the present invention Including: 枭 (1) After the user inserts his wireless network card (1 1 ) into the removable computer UG), he automatically finds the nearest access bridge and requires 1 (2) access bridge ( 13) The user is required to enter an account of a user mobile communication device (12). ^ 幻 旒 旒 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以 以The user account entered by the user in the network management pipe, and the server (10) is based on the user mobile communication device (12). , the code is shipped (5) the user receives the Jane 1252649 on the user mobile communication device ((1)

After you know the password, you can enter the password on the portable computer (1〇). ^ (6) When the server (1 4) of the network management center where the user is located receives the code, first verify that the password is correct. If it is correct, it is determined that the user has passed the verification. (7) Users who pass the .1⁄4 certificate can normally connect to the Internet to use network resources. In the implementation of the present invention, when the user's local network management center server (1 4) receives the user account, the password generated for the user may be the password of the product.

In the implementation of the present invention, when the user ends the Internet access, the server (14) of the network management center at the user's location will send a short message to the user mobile communication device (1 2) to indicate that the time period of the Internet access has ended. . In the implementation of the present invention, the short message shows that the user uses the network. In the implementation of the present invention, the center charges the user according to the user's use of the network time telephone bill and the digital mobile communication. After the user finishes using the network, the network administrator calculates the fee and incorporates the user's system. The GSM operator then sends the bill.

Wherein, in the implementation of the present invention, the screen of the portable computer (丨〇) has the option of “abandoning”, and the user temporarily gives up the password when the user receives the password:: The daily code may select the input “abandon” option, the network management The center received the "Abandonment" and the second newsletter was sent to the user's mobile communication device. (1 2) The content of the newsletter showed that the network usage time was zero. The figure shows the overall architecture system of the present invention, which is mainly

Page 9 1252649 V. Invention Description (7) Contains: User portable computer (丨〇); network card (1)) for use with portable computers. 〇), 士, ,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,, And sending the secret by means of a short message: (the general server has the function of sending a short message after being set, and the user system is simple to send); and the access bridge (13) of the telephone network official center is used to The zone (14) is connected. Wherein, in the implementation of the present invention, the mobile communication system is equipped with a mobile phone. In the implementation of the present invention, the user's brain in the system can be a notebook computer. u ^式电八八本本明贝施, in the system of the user can be a brain position assistant (p D A). 』镌式电 The architecture of the invention involves the subtle relationship between GSM operators, network management centers and usage, so we will do a complete security analysis on the security threats that these three and these three can occur. Day 1 Some frauds do have some potential security for the architecture of the present invention. However, in general, the wireless area has low Internet access, and each use is more: therefore, the attacker of the present invention must accumulate multiple times::: fraudulently earning more profits, and the precautions taken by this architecture will

Page 10 1252649 V. Description of invention (8) The difficulty of successful attacker fraud becomes higher, and the fraudulent behavior of mother-failure failure is detected by the security mechanism adopted by the framework of the invention, so that the attacker is engaged in cost and risk considerations. The probability of such an explosive behavior will be reduced to a tolerable level. The security analysis of the GSM mobile communication industry: In the current situation, the user must provide the private information of the individual to the GSM industry in order to register as legitimate use of the business. Therefore, it can be reasonably assumed that the GSM industry is trustworthy, so the GSM industry will not use the local network management center to extract the user's Internet access fee. The same 'GSM industry' will not collude with the user to deceive the network management center. Users use the GSM newsletter to collect passwords and access the Internet at the local network management center server. Therefore, GSM operators must carefully choose the network management center with good reputation or sign The contract is legally prevented from spoofing the record in the local network management center to swindle money to the GSM industry. The security of GSM mobile communication device transmission is based on the GSM security protocol (Secur ty P r 〇t 〇c ο 1). • The current GSM security is straightforward but convenient and basic. The characteristics of protection are indeed accepted by the general public. There are also many techniques for improving the security of GSM operations without affecting the efficiency of GSM operations. Moreover, once the password is stolen, the password is lost. This is a network charge. Of course, once the GSM security system is broken, the system is completely destroyed. So we assume that the GSM industry can trust and the system is still secure. Security analysis for the user: The security of the message transmission between the user and the local network management server is not the focus of this article. Therefore, we have used the protection mechanism such as encryption and security to ensure communication. to

III· Page 11 1252649 V. INSTRUCTIONS (9) The behavior of the user itself may be defrauded or defrauded as follows. (1) Loss or theft of the mobile communication device: The invention is based on the following: The system is that only legitimate telecommunications users will receive the password from the network management system, so if the mobile communication device is stolen or sent: Users who can be impersonated by the minded person to surf the Internet, causing the user's money, the user must promptly notify the gsm operator to which they belong, and disable it = this: use the ΐ to set the phone number. Because it is not an expensive service project, - Qin, a f even if there is a loss of money is also limited. In addition, by setting the 仃 汛 I 汛 device PIN (PIN number) can also be initially prevented from being hacked only to 'I) from: 3 attack f: the user should use the mechanism of the present invention to access the Internet, the local network management center m backup device The e-living s account can only receive the password with the first B: ",", and the password sent first. Please give the user a picture. The right user A wants to maliciously move the Internet fee. =; meaning::=__set the phone number = : (two):, the code will be transmitted to user B, user A can not receive the smart @ ^ 73⁄4 S6 · U can not enter the correct password in step (6) Pass the verification and pass the verification

Attack) will not succeed. A kind of fake clothing attack (1叩(10)nating is located by the location L ^= or heavy attack: the password entered by the user on the Internet is generated by the user every time when the user is married to your field, I attacked the attacker. The password to use guessing will not be the same, so if there is a month, Guessing Attack will guess the use.

Page 12 1252649 V. Invention Description (10) ~---- The password of the person or the previous password is used repeatedly for resend attack

Ueplay Attack) will not succeed. Security analysis for the network management center: In the framework of the present invention, the Gsm operator must store a record sent by the network management center to the user's Internet password briefing to determine that the network management center has sent a password message to the user, and if not successfully sent, Send a failed record 'as a basis for future users if there is a dispute over the bill. Since the network management center may be a small regional company, the degree of trustworthiness cannot be as good as that of the GSM industry. Therefore, how to reduce the risk of the network management center to the gsm operators is an important issue. We will discuss as much as possible the possible fraudulent behaviors in the network management center and propose ways to prevent it. Ming (1) Network management center fake user online record: The network management center can deliberately send a fee code to the legitimate users of GS ,, and the gs μ company will leave a message to send a record to successfully swindle the user without being Gsm operators are aware. However, when the short message system sends a text message, the base station of the user's location can be found. Therefore, when signing the contract with the network management center, the GSM industry can only provide the base station near the network management center to provide the password message for the user to access the Internet. (Generally, the sending and receiving of SMS is not limited to this). Therefore, if the SMS system detects that it is not part of these base stations, it does not accept the cryptographic message delivery service and leaves a transmission failure record. Unless the user roams within the range covered by these base stations near the network management center, it is possible to leave a record of successful transmissions in the GSM industry, but at this time, the user does not have to go online but receives the network official center. An accident with a password message. Because the network management center has no ability to determine which users are just in the network management.

Brother 13 Page 1252649 V. Inventions in the area that these base stations can cover, so the difficulty of success is very embarrassing, and once the attack fails, it will leave a record in GSm company. If the failure record is too much, it will cause GSM. The attention of the industry, even if the attack is successful, will be noticed by the user. Even if the user does not notice, the amount earned will not be the same as the cost of the Internet. From a cost-effective point of view, due to high risks and high costs, there is no profit, and it is unlikely that the network management center will engage in such a strike. ^ (2) Network management center floating users online time: how to prevent the network

In the moss. To swindle users by whistling (10) seven 丨 ^). The GfM# operator can ask the network management center to send a short message to the user at the same time that the user ends the Internet to indicate that the time period of the Internet access (5 "3i〇n" has ended, and shows how much network time the user has used. The user is in doubt about the time, and can ask the GSM industry, the GSM industry can also calculate the time of the period (the sessi (10)) of the performance period based on the time of the two simple transmissions. The time gap between the use of the network must be within a reasonable range. Otherwise, the GSM industry must find out whether there is a network management center y or a floating user's online time. The network management center deliberately did not release the user the first time. , the newsletter, by the time of the newsletter to swindle the user's money. The roots of the poor said that 'this attack must be successful after the user has finished the Internet and has not left the management: the range that can be covered by these nearby base stations, once they leave this range 'The second newsletter will fail and leave a record in the GSM company. It will not receive the user's Internet access fee and cause its own financial losses. The attention of the SM industry. However, in order to blackmail users more money, /

1252649 V. Description of invention (12) __ The time of late delivery must be longer before the range is opened, because ^ but the sending time must be in the user's chance of increasing the attack success, the ^ ^, is not evaluated, so in order to Large, the benefits earned are of course not the behavior of the delay in the issuance of the space, and the difficulty of such attacks is retro and less. Since it is difficult to speculate that the user's network management center is going to engage in such a second-hand, so in the cost-effective consideration, in addition, if the user does not pass m? . # The password sent, the temporary device* telecommunication device newsletter received the network management center network management center posing as the user ^ abandon the Internet access, this time will also give the network connection before the computer screen machine ^ we can use The person decides to give up the Internet access, and the second option is to abandon the option. If the user temporarily receives the option, the network management center chooses to input the ''abandon'' message to the user, and the second message is sent. The user does not use the network n, the network usage time is zero, and we have discussed the above table. It is not Φ to ask the user for the fee. The mechanism of prevention, several ways of bullying these, and difficulties The degree becomes higher. In addition to this, the system administrator who wants to swindle the user to engage in fraudulent users to set up the relevant legal control is to reduce the fraudsters, the attack and legal responsibility - the book , we do /, as low as tolerable. & In the original mechanism of this architecture, y" Most of the scams ^_ Flood prevention, make these 砟4;= Page 15 1252649

1252649 V. Description of invention 〇 4) Enough questions. The number of the call, the secret horseman:::::: Use the power of the communication device to generate the power, and then use the server of the official center at the time to temporarily accompany the second heart: send to use*, the data center of the location To verify the second == = user's account and password, and the future #m = f 十厍云Save all and (4) is good C, the user does not need to remember the password and the account is 疋子Phone number threat and maintenance burden. The female servant of the quarter-on-eighth GSM industry is responsible for the method of signing the responsibility for the local network official center.

The chapters are not about two, and all the GSM ports that participate in the agreement: store the user's account and password, so: ί:i: privacy and business interests, so it is purely just Ιίίΐΐ The use of apportionment is simple and easy, and the industry security has made more (four) players more willing to participate in the business opportunities of the i-Min. Therefore, the most complicated billing and charging mechanism is extremely easy in the present invention. As described above, the present invention utilizes (10) the security convenience accepted by the public itself, so that GSM legitimate users can conveniently use the wireless road service's simple management and charging mechanism, and can reach the manufacturer and provide services and everyone can The dual-naked target of the Internet, the technical characteristics of the invention in the scope of the patent application, is not found in the same technology, has a new practical (four) progressive, and can be fully utilized by the industry, has met the requirements, and has been proposed according to law. Application, I ask you to approve it according to law.

Page 17 1252649 V. INSTRUCTIONS (15) Patents to protect the lawful rights and interests of this applicant.

1HH11 Page 18 1252649 Brief Description of the Drawings (I) Schematic Description The first figure is a schematic flow chart of the method of the present invention. The second figure is a simplified schematic diagram of the system architecture and method flow of the present invention. (2) Description of the number (1 0) Portable computer (11) Network card (1 2) Mobile communication device (1 3) Bridge (1 4) Regional network server

Page 19

Claims (1)

1252649 VI. Patent application scope 1. A simple and secure wireless local area network authentication method integrating GSM newsletter mechanism, which mainly includes: a. After the user inserts his wireless network card into the portable computer, he automatically searches for the nearest one. Access the bridge and request access to the Internet; ^The access bridge requires the user to enter the phone number of the user action wanted device on the portable computer as the user account; the server of the user's local network management center receives The user account k' generates a password for the user; the server of the network management center where the user is located sends the password to the user communication device in a short message according to the user account input by the user. After the user receives the short message on the user mobile communication device and knows the password, the user enters the password on the portable computer; when the server of the network management center where the user is located receives the password, first Verify that the password is correct, if it is correct, determine the user pass; and enable the authenticated user to work properly with Inter-network connection to use network resources. 2. The simple female full wireless area network authentication method for integrating the GSM short message mechanism as described in claim 1 of the patent scope; wherein the user's local network official center server receives the user account and is the user The generated password is a temporary password. 3. The simple secure wireless local area network authentication method for integrating the GSM short message mechanism as described in claim 1 of the patent scope; wherein the user ends 1252649 At the same time of the network, Wei 1 is used by the local network management to send the & user to shake the communication device to the front of the bundle 0 4, if the application of simple and secure wireless users use the network 5, such as the application of simple secure wireless After that, the network management center sends the bill to the user's phone and sends the bill to the network. If the application is simple and secure, the user selects the option network, and then selects the option message, and then the content of the newsletter. A whole authentication system, the main user portable user's network has a receiving briefing message; the heart server sends a short time to indicate the time period of the Internet access, and the integrated GSM short message mechanism area network mentioned in item 3 of the patent scope is closed. The method for authenticating the road; wherein the short message shows the time. The method for integrating the GSM short message mechanism regional network authentication according to the first item of the patent scope; wherein the use of the network is calculated according to the time of the user using the network and is incorporated In the bill, the GSM operator of the digital mobile communication device system charges the user. The regional network authentication method for integrating the GSM newsletter mechanism mentioned in the first paragraph of the patent scope; The portable computer display item 'When the user receives the password and temporarily gives up the input ''Abandon' option, the network management center receives the "abandonment" and sends the second short message to the user's mobile communication device, showing the network. The use time is zero. The simple and secure wireless local area network with GSM SMS mechanism should include: a computer; a road card for connecting with a portable computer; a user mobile communication device for receiving functions to receive the network official center a local area network server; used to generate a user password, Page 21 1252649 VI. Application for patents User identity authentication Network management center line. 8. If the application is safe and secure, set it as a mobile phone. 9. If you apply for a simple secure wireless computer, take a note of 10, such as a simple security and portable computer, and send the password by SMS. User · Access Bridge for the user, /, the domain network server with the integrated GSM SMS mechanism regional network authentication system described in the patent scope ; 7; The integrated GSM short message network area network authentication system described in Item 7 of the patent scope; wherein the user can carry a computer. Please integrate the GSM SMS network area network authentication system as described in item 7 of the patent scope; wherein the user can have a digitizer (P D A ). Page 22