WO2008134918A1

WO2008134918A1 - Authentication method and authentication system

Info

Publication number: WO2008134918A1
Application number: PCT/CN2007/071224
Authority: WO
Inventors: Qin Wu
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2007-05-08
Filing date: 2007-12-12
Publication date: 2008-11-13
Also published as: CN101304365A; CN101304365B

Abstract

An authentication method and an authentication system are provided, which are used to authenticate a handover to a base station for a mobile terminal node, the method includes steps that: an access router of the first base station receives an authentication request from the mobile terminal node, the authentication request contains the first hash value and a media access control address of the mobile terminal node, the first hash value is obtained by looking up a locally preset mobile buffer list by the mobile terminal node according to the base station identifier of the second base station, the mobile buffer list contains the first hash value and the base station identifier; the access router looks up a locally preset access buffer list based on the media access control address to obtain the second hash value, compares the first hash value obtained from the authentication request with the second hash value, and the authentication successes if they are equal, in which the access buffer list contains the second hash value and the media access control address. The question that the mutual authentication efficiency is low during the handover for the mobile terminal node and the access router can be solved.

Description

Recognize the method and recognize the system

The present invention relates to the field of communications, and in particular, to an authentication method and an authentication system <, BACKGROUND

The present invention relates to a fast handover technology in the mobile IPv6 field, that is, a mobile terminal node (Mobile Station; hereinafter referred to as: MS) forward access router (hereinafter referred to as PAR) registers its new handover in advance. The node moves from one access router to another, and maintains the continuity of the session. This process is called handover in the handover process, due to the link handover delay. And the IP protocol works, the mobile terminal node is in a segment. The packet cannot be sent or received within the time, resulting in an increase in the packet loss rate during this time. Mobile IPv6 fast handover is a handover technique proposed to reduce handover delay and reduce packet loss rate. Generally, the mobile terminal node includes a mobile phone, or a notebook computer with a wireless network card, etc., and can be used to save a relatively simple data list. The fast binding update management is a process for notifying the relevant node of the new care-of address in the fast handover, wherein A very important security issue is about the issue of fast binding update and fast binding confirmation message authentication. One way to ensure the security of the handover process is to introduce a one-way hash function algorithm, which authenticates the binding message. The principle is to generate a one-way hash value by using a one-way hash function, and the mobile terminal node distributes a hash value to the access router AR (Access Roofer: AR) as an authentication material, and the message from the mobile terminal node The certification is implemented, and a new hash value is replaced as a certification material each time it is switched.

A one-way hash chain is based on a one-way hash function 3⁄4 into a set of one-way hash values... ίζ, and satisfies ( ). The one-way hash function may be a hash function such as Secure Flash Algorit m 1 (hereinafter referred to as SI1.1;) and Message Digest 5 (hereinafter referred to as MD5). The technical solution implements authentication on the binding message by introducing a one-way hash function algorithm. The authentication principle is that the mobile terminal node generates a one-way hash list. In the proxy route prefix request, the hash list extracts a hash value as a key material and distributes it to the AR. Then, the key material is used to authenticate the fast binding message from the mobile terminal node, and the key material for the next handover is transmitted during the process of establishing a channel between the PAR and the new access router (NAR.).

Figure ί shows a fast handover authentication procedure in a prediction mode according to the related art, the process of which is as follows:

1. In the fast handover, the mobile terminal node first generates a set of 128b it hash values such as 3⁄4, ί';, ".';_& , and satisfies K-ZXU, one-way hash function according to the one-way hash function. Can be SHA1., Zhan 5 and other hash functions. It is emphasized here that the one-way hash function has an irreversible sexual shield, that is, knowing ϋ, you can get n> according to (f') and know that it cannot be launched.

1. The mobile terminal node constructs a hash switching option (Hash Mancloff Option; hereinafter referred to as 0) from the one-way hash chain according to the type length value (Type Lengiti Value; the following cylinder: TLV), and is encapsulated in the option. The request is carried by the proxy router request message to the MR. To ensure the security of the proxy router request message, the proxy router may request a message signature using a Cryptogical Data Generated Address (hereinafter referred to as CC.A) technology. PAfl is extracted from the RH0 option, and a 64bU switching vector (Handof f Vector; hereinafter referred to as HY) is randomly generated, and the switching vector option (llandof f Vector Option; hereinafter referred to as: and carried in the proxy router advertisement, is sent to the mobile terminal node. In order to prevent the iiV from being tampered with, the mobile terminal node performs a hash operation on the HV after receiving the proxy route advertisement (hereinafter referred to as PrRtAdv) message, and generates a new HV ₍ provided that the PAR must know the mobile terminal node to the HV Suitable processing

3. The mobile terminal node extracts 64bit ίί¥ from the HV0 option _; and extracts the new link prefix from the proxy router advertisement message to start configuring the new care-of address. The new care-of address interface IS is calculated as follows: Interface ID part of nCoA. First (64, f'-) oK First (64, nil?) , that is, the interface identification part of the new care-of address is equal to the first 64 bits and the first 64t>h. of the nMV The result, where nCoA (new Care of Address:) refers to the new transfer place, address,

iHV-Fi rst (64, t(n-l)HV)

The mobile terminal node sends a binding update message to the forward access router, and carries a hash extension option (Ha sh Ex t en s I on Op 11 on; hereinafter referred to as ίίΒΟ ), which includes a hash extension (f!as ΙΊ Extension; Hereinafter referred to as: HE) {&, The value is calculated as follows:

HE=Last (64, i) XoR First (64, ntlV)

4. The front access router pair fast binding update (FBU) message real-time authentication, extracting the first 64blt of the ί·; from the nCoA, plus the last 64 bits extracted from the HE, get, and After the first hash operation, compared with ί"; if the . is equal, the former router successfully authenticates the FBU.

After the PAR receives the binding update message from the mobile terminal node, it immediately initiates a handover initialization message to the new access router, and the message carries a 64-bit handover option (Handoff Option; hereinafter referred to as H0), USblt's The Greek chain item HO) (i1⁄2sh Ch in Option, ), the book option is the 64bi t HV generated by R, and the HC0 option contains a one-way hash value.

6. The front router receives the handover acknowledgement (Handover Acknowl edge; hereinafter referred to as HAck), and then responds to the mobile terminal node with the Fast Binding Ackno l edge (FBAck) option, carrying the token. : Token. Acknowl edge Option (hereinafter referred to as: Ding AO), TA0 option package TAck. Value, calculated as follows:

TAck - First [ 64, SHA1 [ nCoA (pref ίχ) ! (nCo fliD) XOR BV) ]] The mobile terminal node authenticates the FBAck message, and calculates the TAck value based on the configured new care-of address, and compares it with the TAc'k value carried in the FBAck. If 杲 is equal, the authentication is performed. Success, see Figure i where the HH0 option contains the 128-bit HV0 option that the mobile terminal node passes to P. The PAR passed to the mobile terminal node's 6413 random number»(;€;; 酣0 option contains; HC0 option contains 1281 The ^H0 option of 1 contains a 64bi 3⁄4m random number.

At present, a one-way hash chain is generated by a mobile terminal node based on a one-way hash chain pair handover authentication policy, and each time the handover is completed, a hash value needs to be discarded. When all the hash values are discarded, The mobile terminal node needs to regenerate a new hash chain. For the mobile terminal node, the consumption overhead is relatively large.

The embodiment of the present invention provides an authentication method and an authentication system, which can solve the problem of low mutual authentication efficiency when the mobile terminal node and the AR switch.

In an embodiment of the present invention, an authentication method is provided for performing handover on a mobile terminal node from a first base station to a second base station, where the method includes the following steps: The access router of the first base station receives an authentication request of the mobile terminal node The authentication request includes a first hash value and a media access control address of the mobile terminal node, where the first hash value is obtained by the mobile terminal node querying the locally preset mobile cache list according to the base station identifier of the second base station, where the mobile cache list includes a first hash value and a base station identifier; the access router queries the locally preset access cache list according to the media access control address to obtain a second hash value, and the first hash value and the second hash value that are to be retrieved from the authentication request The value is compared. If the authentication is equal, the authentication succeeds. The access cache list includes a second hash value and a media access control address. In the example of the present invention, an authentication system is further provided, including: a mobile terminal node, where When switching from the first base station to the base station, querying the local according to the base station identity of the second base station The mobile cache list is configured to obtain a first hash value, and the media access control address of the first hash value and the mobile terminal node is encapsulated in an authentication request and sent to the access router of the first base station, where the mobile cache list includes a first hash value and a station identifier; an access router, configured to query a locally preset access cache list according to the media access control address to obtain a second hash value, the first hash value obtained from the authentication request Compared with the second hash value, if the 杲 is equal, the authentication succeeds, wherein the access cache list includes the second hash value and the media access control address.

In the above technical solution, the cache list is used, thereby avoiding that the mobile terminal node needs to regenerate a new hash chain, which is beneficial to the mobile terminal node to the Achilles and authentication of each AR, and the mutual authentication of the mobile terminal node and the AR, and improve Mutual authentication efficiency when the mobile terminal node and the AR switch.

Other features and advantages of the present invention will be set forth in the description which follows, and in part The objectives and other advantages of the present invention will be realized and attained by the <RTIgt;

The present invention is intended to be a part of the present invention, and is intended to be illustrative of the invention and is not to be construed as limiting the invention. In the drawing:

FIG. 1 shows a fast handover authentication process in a prediction mode according to the related art;

2 shows a flow chart of an authentication method in accordance with an embodiment of the present invention;

FIG. 3 illustrates a prediction mode fast authentication process according to an embodiment of the present invention;

4 shows a reaction mode fast authentication process according to an embodiment of the present invention, and a specific implementation manner

The technical solutions of the embodiments of the present invention are further described in detail below with reference to the accompanying drawings and embodiments.

2 shows a flow chart of a lightweight fast handover authentication method according to an embodiment of the present invention, including the following steps:

Step S10: The AR of the former base station (ie, PAR) receives the authentication request of the MS (such as the FBU message, which is exemplified by the FBU message), and the FBU message includes the first hash value and the media access control address of the MS (below) Abbreviation: MAC), the MS obtains a first hash value by querying a local preset mobile cache list according to a base station identifier (Base Station: BSID) to be switched to a new base station, where The cache list includes a first hash value and a BSID; the PAR queries the locally preset access cache list according to the MAC of the MS to obtain a second hash value, and obtains the first hash value and the second hash from the FBy message. The values are compared. If they are equal, the authentication succeeds. The access cache list includes the second hash value and the MAC address. Step S20, the PAR queries the locally preset access cache list according to the MAC of the MS to obtain a second hash value, and compares the first hash value obtained from the FBI) message with the second hash value, and if equal, authenticates Success, indicating that the one-way hash value of the MS is that the first hash value is not equal to the second hash value of the A distribution, or that the PAR does not query the access cache entry according to the MAC of the MS (Viated Cache Entry; The following is abbreviated: When the authentication fails, the access cache list includes the second hash value and the MAC address.

The mobile cache list and the access cache list can be established by the following steps: P generates multiple hash values and sends them to the MS; the MS uses the prefix generated by itself (ie, the random number) and the received hash value as the first hash. The value gets the new BSID, and the first hash value and the BSID constitute a mobile cache entry (Mobile Cache Entry; hereinafter referred to as MCE); the PAR uses multiple hash values as the second hash value, and the MAC of the MS constitutes the VCE, Form a list of mobile cache list access caches

Optionally, the PAR generates a set of hash values of a certain length, such as V0, Vl^*'Vn, according to the one-way hash function F, and satisfies Vi-F (Vi + U. The length of the hash chain is limited, The calculation overhead of generating a one-way hash chain by a mobile terminal node is relatively large, and the energy consumption is large. The calculation of the hash chain by PAR is beneficial to the terminal to save energy and bandwidth. It is very important to generate a one-way hash chain by MR. The advantage is that the mobile terminal node tracks and authenticates the AR, and mutual authentication between the mobile terminal node and the AR is implemented. The specific steps are as follows:

The PA generates a PrRtAdv message and sends it to the mobile terminal node, where the 携带 is carried;

Preferably, the PAR encrypts the PrRtAdv message and sends it to the mobile terminal node. This can further enhance security.

For example, the PAR encrypting the PrRtMv message may include the following steps: The MS generates a public-private key pair, and sends the public key to the AR through a proxy routing request (hereinafter referred to as RtSoLPr) message; the AR encrypts the PrR iv message by using the public key.

The implementation of the present invention is combined with a symmetric key system to generate a shared key through a 3?3^. public-private key mechanism of Secure Neighbor Discovery (SEND) protocol, and protect the FBU with a shared key. Fast Binding Answer ( Fast Biiidlng Acknowledge; Hereinafter referred to as: FBAck), enhanced message security

According to the authentication method implemented above, an authentication system is established, including:

The MS is configured to: when the base station is switched, query the local preset mobile cache list by using the new BSID to be switched to obtain the first hash value, and encapsulate the first hash value and the own MAC in the FBU message. An access router that is sent to the former base station, where the mobile cache list includes a first hash value and a new BSID;

An AR, configured to query a locally preset access cache list according to the MAC of the MS to obtain a second hash value, and compare the first hash value obtained from the FBU message with the second hash value, if the 杲 is equal The authentication succeeds, wherein the access cache list includes the second hash value and MA (;.

Let's take a look at the local cache list of the mobile terminal node and the AR.

The AR establishes a VCE list locally. The VCE stores entries for Mac, Ks, and Vi.

The MS establishes the MC £ ^ table locally, and the MCE stores the entries BSID, Ks, and Vi.

How to use the above cache list for authentication;

FIG. 3 illustrates a prediction mode fast authentication process according to an embodiment of the present invention, including the following steps: PAR generates a set of 128-bit hash values such as V(), Vl, '''^ according to a one-way hash function F. Meet V i F(Vi+:i) _s

2. The mobile terminal node generates a 64-bit random number Nonce as a prefix, and generates an RSA public-private key pair according to the internal L system, and sends the random number and the RSA public key to the PAR through the RtSoiPr message, and the message is carried by the C (JA signature, carrying RSA, HV0 option It is worth noting here that only the RtSoiPr sent by the mobile terminal node for the first time is signed <.

3. PAR extracts the RSA public key, generates a shared key Ks according to the internal mechanism, and sends s to the mobile terminal node through the PrRtAdv message. The message is encrypted by RSA public copper to ensure the security of Υί, Ks transmission <fcL

4. The mobile terminal node extracts the shared key lis from the PrRtAclv message, and generates an interface ID of the new care-of address based on Vi and Nonce (ie, the BSID of the new base station) as follows:

ID of nCoA - First (64, VI) @ Nonce

At the same time, HE is generated as follows: HE - Las t (6 ₅ Vi) ® Nonce

At the same time, the MCE cache list entry of the corresponding PAR is established, and then the FBU message is sent to the PAR, the message carries the 0-escape item, and the message is encrypted by the shared key Ks.

The PAR receives the FBI! message from the mobile terminal node, authenticates the message, and calculates from the message that V I is compared with the locally established YCE of the PAR. If there is a (Mac, s, Vi) entry in the YCE, the authentication succeeds.

5. After the PAR successfully authenticates the FBli, it sends a Handover Initiative (hereinafter referred to as HI) message to the AR, carrying the i!EO option and the RSA public key option, and the NAR is based on the new care-of address and the HE0 option. Calculate the VI, generate a new shared key KKs according to the internal mechanism, and establish a VCE entry corresponding to the mobile terminal node

6. Wake up the RSA public key to encrypt the shared key lis in IIAck and send the message to

PAR,

7. PAR enhances the encrypted s option, sends an FBAck: message to the mobile terminal, carries the TAck option and the encrypted s option, and JL encrypts with the shared key Ks.

The mobile terminal node decrypts the FBAck message with Ks and calculates TAcfc with the new care-of address. If 杲 is equal to TAck in the message, the FBAck authentication succeeds. At the same time with the RSA private key to decrypt KKs options, and add a cache list MCE article about NAR is _¾ Λ

The tracking of the AR by the mobile terminal node is as follows:

When the mobile terminal node sends a proxy routing request at the time of handover, or resends the routing request on the local link, first according to the new query MCE. If there is a corresponding entry, extracting ¥i, the VI is encapsulated in the message as the MN0 option. The message is encrypted and sent to the AR by using the shared key Ks. The AR queries the local VCE according to the MAC of the mobile terminal node, obtains the shared key Ks, decrypts the received message with the shared key, and obtains the Vi option, and Compared with the corresponding VCE entries, if equal, the one-way hash value of the mobile terminal node is distributed by the AR. The AR responds to the mobile terminal node message, carries the Vi 1 option, and encrypts with the shared key. If the unequal or M does not query the corresponding VCE strip according to the MAC of the mobile terminal node, the AR responds to the mobile terminal node message without carrying any I option.

The mobile terminal node decrypts the routing agent advertisement with Ks, extracts V] 1, and verifies whether Vi 1 is equal to F (vn. If equal, mutual authentication is implemented, and if the mobile terminal node does not wait, the mobile terminal node deletes the corresponding

MCE cache list entry If there is no Π 】 in the proxy route advertisement, the mobile terminal node deletes the corresponding entry and initiates a handover to the AR according to the above authentication process.

If the MCE is queried according to the BSID and the corresponding entry is not found, the M-initiation is initiated according to the above authentication process.

Figure 4 shows the reactive mode fast authentication process in accordance with the implementation of the present invention. Note that the KKS option contains the newly generated shared key material of the NAR, and the process is as follows:

Steps 2 and 3 quickly switch the authentication step with the prediction mode;

4, the mobile terminal node sends an FNA message to the NAR, nests the F leg message, and encrypts only the 11E0 option in the FBI! message with the shared key, and the FBU message includes the UE0 option and the RSA public key material.

5. The NAR performs DAD detection on the new care-of address. If the new care-of address has no MD conflict, the FFI is extracted from the FNA and sent directly to the PAR. At the same time, the RSA public key material is extracted, and the H-local PAR is decrypted to the HB0 option. The mode authentication method calculates \Ί., checks whether the local VCE. exists (Mae, s, Vi). If it exists, the FBU message is successfully authenticated.

6 . After the PAR successfully recognizes the FMJ, the TA0 escape item is sent to the NAR through the FBAek message with the shared key Ks encryption.

7. The MAR extracts the TA0 option and option, and generates a new shared key ls according to the internal mechanism, encrypts with the RS public key, sends the TO, Ks and the new KKs to the mobile terminal node through the R tAdv message and then establishes the mobile terminal node. VCE list entry „

The mobile terminal node decrypts the R tAdv message, calculates TA0 according to the new care-of address, and compares it with the TAO in the R tMv message. If 杲 is equal, the entire authentication is successful. Simultaneously extract s and establish an MCE cache list entry for R.

From the above description, it can be seen that the present invention achieves the following technical effects:

1. Apply the SEND protocol to generate a shared key, and use the key system to encrypt the signaling transmission. Protection, enhance the security of signaling transmission;

1. A one-way hash chain is generated by PAR, which reduces the energy consumption of the terminal, and the length of the one-way hash value is not limited, and the generation is easier;

3. A one-way hash chain is generated by the PAR, and the mobile terminal node and the AR respectively generate a cache list, and the mobile terminal node is prevented from re-generating a new hash chain, which is beneficial to the mobile terminal node to each AR. Tracking and authentication, and mutual authentication of mobile terminal nodes, improve the mutual authentication efficiency of mobile terminal nodes and AR handover.

Finally, it should be noted that the above embodiments are only used to illustrate the invention and not to limit the invention; although the invention has been described in detail with reference to the foregoing embodiments, those skilled in the art will understand that The technical solutions described in the foregoing embodiments are modified, or some of the technical features are equivalently replaced; and the modifications or substitutions do not deviate from the spirit and scope of the technical solutions of the embodiments of the present invention. .

S.0

Claims

An authentication method is used for authenticating a mobile terminal node from an access router of a first base station to an access router of a second base station, and the method includes the following steps:

The access router of the first base station receives the authentication request of the mobile terminal node, where the authentication request includes a first hash value and a media access control address of the mobile terminal node, where the first hash value is The mobile terminal node obtains a locally preset mobile cache list according to the base station identifier of the second base station, where the mobile cache list includes the first hash value and the base station identifier; The media access control address queries the locally preset access cache list to obtain the second hash value, and compares the first hash value obtained from the authentication request with the second hash value. If the authentication is equal, the authentication succeeds, where the access cache list includes the second hash value and the media access control address „

The authentication method according to claim 1, wherein the authentication request is a fast binding update message.

3. The authentication method according to claim i, characterized in that the authentication is successful further comprises a terminal access router notifies the mobile node authentication is successful _s

4. The authentication method according to claim 1, further comprising:

When the first hash value is not equal to the second hash value, or the access router does not query the access cache entry according to the media access control address of the mobile terminal node, the authentication fails. .

The authentication method according to claim, wherein the mobile cache list and the access cache list further comprise a shared key, and the mobile terminal node encrypts the fast binding by using the shared key. Update message, the access router decrypts the fast binding update message by using the shared key.

6. The authentication method according to the #1 claim, characterized in that the mobile cache list and the access cache list are established by the following steps:

The switching router generates a plurality of hash values and sends the hash values to the mobile terminal node; The mobile terminal node uses the hash value as the first hash value, and generates a random number as a prefix;

The mobile terminal node obtains the base station identifier by using the prefix and the hash value, where the first hash value and the base station identifier constitute an access cache entry, and the access cache list is established; the access router The hash value is used as the second hash value, and the media access control address forms a mobile cache bar, and the mobile cache list is established.

The authentication method according to claim 6, wherein the generating, by the access router, the plurality of hash values comprises: the access router stepping into the plurality of hash values based on the one-way hash function ... , . ίζ, and meet ( K

8. The authentication method according to claim 6, wherein the access router transmits the hash value to the mobile terminal node by using a proxy route advertisement message.

The authentication method according to claim 8, wherein the access router encrypts the proxy route advertisement message, and specifically includes the following steps:

The mobile terminal node generates a public-private key pair, and sends the public key to the access router through a proxy routing request message;

The access router generates a shared key, encrypts the proxy route advertisement message by using the public key, and sends the proxy route advertisement message to the mobile terminal node, where the proxy route advertisement message includes the shared key; Applying a private key corresponding to the public key, decrypting the proxy route advertisement message, and extracting the shared key.

1 0. An authentication system, comprising:

a mobile terminal node, configured to query a locally preset mobile cache list according to a base station identifier of the second base station to obtain a first hash when switching from an access router of the first base station to an access router of the second base station a value, the first hash value and the media access control address of the mobile terminal node are encapsulated in an authentication request and sent to the access router of the first base station, where the mobile cache list includes the a hash value and the base station identifier;

The access router is configured to query a local preset visit according to the media access control address Querying the cache list to obtain the second hash value, comparing the first hash value obtained from the authentication request with the second hash value, and if equal, the authentication succeeds, wherein the The access cache list includes the second hash value and the media access control address.