WO2011017876A1

WO2011017876A1 - Method and system for re-authenticating a terminal

Info

Publication number: WO2011017876A1
Application number: PCT/CN2009/075686
Authority: WO
Inventors: 李冬贵
Original assignee: 中兴通讯股份有限公司
Priority date: 2009-08-12
Filing date: 2009-12-17
Publication date: 2011-02-17
Also published as: CN101626569A; CN101626569B

Abstract

A method and system for re-authenticating a terminal are provided. The method includes that: a firmware sends an authentication start message to an authentication client; the authentication client generates an authentication response message, and sends the authentication response message to an Authentication, Authorization and Accounting (AAA) server; the AAA server sends a challenge message of a predetermined algorithm to the authentication client; the authentication client sends a response message of the predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server; the AAA server sends an authentication success message to the authentication client, wherein, the identification information of the terminal is carried in the authentication response message. By changing initiation manner of re-authentication, and on the basis of completing initialization authentication, the method of the present invention simplifies re-authentication flow, and solves the problems that the speed of the existing World Interoperability for Microwave Access (WiMAX) terminal is slow in the re-authentication process, the operation is not relatively stabile and the stress of the AAA server is great and so on.

Description

Method and system for re-authenticating terminal

The present invention relates to an authentication technology in wireless communication, and in particular, to a method and system for re-authenticating a terminal. Background technique

WiMAX (World Interoperability for Microwave Access) is a broadband wireless access metropolitan area network (WMAN) technology based on the IEEE 802.16 series of standards. WiMAX is for the wave and A new air interface standard proposed by the millimeter wave band. The basic goal of WiMAX is to ensure the interconnection of wireless devices from different vendors in the metro access environment, mainly for providing home, enterprise and mobile communication networks. High-speed broadband access in the last mile, and future personal mobile communication services. Compared to other broadband wireless access technologies, WiMAX has the advantages of wide coverage, scalability, and controllable quality of service (QoS). as follows:

(1) High-speed mobile, WiMAX terminals can wirelessly access in the scene of moving speed, which is generally considered to be 120km/h.

(2) Broadband access, the terminal can obtain different access speeds under different carrier broadband and modulation modes, and the maximum rate can reach 30 Mbit/s.

(3) The coverage is wide and the coverage is on the order of several km.

(4) It mainly provides data services, provides data access services for individual users, and can also provide voice services.

The WiMAX industry chain is gradually improving. From system equipment to terminals, WiMAX upstream and downstream supply chains are making unremitting efforts for the development of this technology, and will jointly promote the commercialization of the WiMAX market. Currently, the authentication methods of WiMAX terminals adopt the EAP protocol. The EAP-TTLS/MSCHAPv2 and EAP-TLS EAP authentication methods are mainly used in the market. The WiMAX protocol standard stipulates that the WiMAX terminal needs to perform re-authentication after a certain time. Therefore, the EAP authentication process can be divided into two types: an EAP initial authentication process and an EAP re-authentication process.

FIG. 1 is a flowchart of initial authentication of an existing WiMAX terminal, and FIG. 1 shows an existing EAP initial authentication process by using EAP-TLS as an example.

2 is a flow chart of re-authentication of an existing WiMAX terminal, and FIG. 2 shows an existing EAP re-authentication process by using EAP-TLS as an example.

Comparing Figure 1 and Figure 2, it can be seen that the EAP re-authentication process has only one more EAP-start message that initiates re-authentication than the EAP initial authentication process, and the rest of the process is exactly the same. This existing EAP re-authentication process has the following disadvantages:

1) The interaction information is relatively large, and the re-authentication speed is relatively slow.

2) If the re-authentication time set by the operator is short, such as 5 minutes, the AAA server will face great pressure in the large-scale commercial scenario.

3) The stability of the WiMAX terminal is reduced. In the case of poor signal strength, it is prone to difficulty in re-authentication access or dropped calls. Summary of the invention

The main object of the present invention is to provide a method and system for re-authentication of a terminal, which can optimize the access procedure of the existing WiMAX terminal in re-authentication, improve the re-authentication speed of the WiMAX terminal, and relieve the pressure of the AAA server.

The present invention provides a method for re-authenticating a terminal, including the following steps: The firmware sends an authentication start message to the authentication client;

The authentication client generates an authentication response message, and sends the authentication response message to the AAA server;

The AAA server sends a challenge message of the predetermined algorithm to the authentication client; The authentication client sends a response message of a predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server;

Sending, by the AAA server, an authentication success message to the authentication client;

The authentication response message carries the identifier information of the terminal.

After the AAA server sends the authentication success message to the authentication client, the method further includes:

The authentication client calculates an MSK key according to the challenge message of the predetermined algorithm, the challenge message identifier, and the shared key, and sends the calculated key to the firmware.

After the firmware sends the authentication start message to the authentication client, before the AAA server sends the challenge message of the predetermined algorithm to the authentication client, the method further includes:

The algorithm used by the firmware to notify the authentication client is a predetermined algorithm.

Sending the authentication response message to the AAA server includes:

The authentication client transmits the authentication response message to the AAA server via the firmware, the base station, and the gateway in sequence.

Sending, by the AAA server, the challenge message of the predetermined algorithm to the authentication client includes: transmitting, by the AAA server, the challenge message of the predetermined algorithm to the card via the gateway, the base station, and the firmware Right client.

Sending, by the authentication client, a response message of a predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server includes:

The authentication client sequentially transmits a response message of the predetermined algorithm to the AAA server via the firmware, the base station, and the gateway.

Sending, by the AAA server, the authentication success message to the authentication client includes: the AAA server sequentially transmitting the authentication success message to the authentication client via the gateway, the base station, and the firmware end. And when the authentication response message is transmitted from the gateway to the AAA server, encapsulating the authentication response message as information identified by the AAA server, and when the authentication response message is transmitted from the AAA server And when the network management is performed, the authentication response message is decapsulated.

The terminal is a WiMAX terminal, including the firmware and the authentication client, where the firmware is a WiMAX chip.

A system for re-authenticating a terminal, comprising: a firmware, an authentication client, and an AAA server, where

Firmware, configured to send an authentication start message to the authentication client;

An authentication client, configured to generate an authentication response message, and send an authentication response message to the AAA server via the firmware, the base station, and the AGW gateway; and receive the challenge message, and the predetermined algorithm corresponding to the challenge message of the predetermined algorithm The response message is sent to the AAA server;

An AAA server, configured to send a challenge message of the predetermined algorithm to the authentication client via the AGW gateway, the base station, and the firmware; receiving a response message of the predetermined algorithm, and sending the authentication response message to the authentication client;

The system also includes: a base station, an AGW gateway,

The authentication client sends a response message of a predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server via the base station and the AGW gateway;

The AAA server sends an authentication response message to the authentication client via the AGW gateway and the base station.

The terminal is a WiMAX terminal, including the firmware and the authentication client; wherein the firmware is a WiMAX chip.

It can be seen from the above method of the present invention that the firmware includes sending an authentication start message to the authentication client; the authentication client generates an authentication response message, and sends an authentication response message to the AAA server; the AAA server will schedule the challenge message of the algorithm. Sending to the authentication client; the authentication client sends a response message of the predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server; AAA The server sends an authentication success message to the authentication client, where the authentication response message carries the identifier information of the terminal. The method of the invention mainly changes the initiation mode of the re-authentication right, and simultaneously reorganizes the re-authentication process on the base station where the initial authentication is completed, and solves the problem that the existing WiMAX terminal is slow in the process of re-authentication and relatively operates. Unstable and AAA server pressure and other issues.

The invention has the following advantages and effects:

1) The speed of re-authentication is increased. By optimizing the re-authentication process, the WiMAX terminal can quickly complete the interaction process in the process of re-authentication, thereby significantly improving the access speed of re-authentication.

2) Relieve AAA stress. As the amount of data interaction between the WiMAX terminal and the AAA in the re-authentication process is reduced, the pressure on the AAA is significantly alleviated in the large-scale commercial scenario.

3) Improve stability. By optimizing the re-authentication process, the re-authentication process does not need to transmit the CA certificate, device certificate, and the like of the AAA server, thereby improving the access success rate of the WiMAX terminal in the re-authentication process, and effectively reducing the dropped line. The possibility to improve the stability of the WiMAX terminal. DRAWINGS

The drawings are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flow chart of initial authentication of an existing WiMAX terminal;

2 is a flow chart of re-authentication rights of an existing WiMAX terminal;

3 is a flow chart of the WiMAX terminal of the present invention implementing fast re-authentication;

4 is a MAC PUD format of an exemplary embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the present invention will be further described in detail below with reference to the accompanying drawings. It is understood that the specific embodiments described herein are merely illustrative of the invention and are not intended to limit the invention.

The implementation method of the fast re-authentication right of the WiMAX terminal according to the present invention is described in detail below by referring to the EAP initial authentication process of the existing WiMAX terminal and the EAP re-authentication procedure of the existing WiMAX terminal.

FIG. 3 is a flowchart of implementing fast re-authentication of a WiMAX terminal according to the present invention. As shown in FIG. 3, the method includes:

Step 301: The firmware firmware sends an authentication start (EAP-Start) message to the authentication client Supplicant to initiate a re-authentication process. Firmware Firmware can be a chip embedded in a terminal, such as a WiMAX chip.

Step 302 ~ Step 305: The authentication client Supplicant sends an EAP response/identification message to the AAA server. The message from the AGW gateway to the AAA server is the Radius access request/identity.

Step 306 ~ Step 309: The AAA server sends an MD5 challenge message to the authentication client Supplicant. Where MD5 is the predetermined algorithm.

After the step of the firmware sending the authentication start message to the authentication client, before the step of the AAA server sending the challenge message of the predetermined algorithm to the authentication client, the method further includes: firmware notifying that the algorithm used by the authentication client is a predetermined algorithm.

Step 310 ~ Step 313: The authentication client Supplicant sends an MD5 response message to the AAA server.

Step 314 ~ Step 317: The AAA server sends an EAP success message to the authentication client Supplicant, and the re-authentication process ends. The authentication response message, that is, the EAP success message carries the identifier information of the terminal. The authentication client calculates a master session key (MSK, Master Session Key) according to the challenge message, the challenge message identifier, and the shared key of the predetermined algorithm.

Step 318: The authentication client Supplicant sends the MSK to the firmware firmware to form a key hierarchy of the WiMAX terminal security sublayer.

Compared with the existing WiMAX re-authentication technology, the re-authentication technology adopted by the present invention mainly changes the initiation mode of the re-authentication right, and simultaneously reorganizes the re-authentication process on the base station where the initial authentication is completed. The method of the invention solves the problems of slow speed, relatively unstable operation and high pressure of the AAA server in the process of re-authentication of the existing WiMAX terminal.

The existing WiMAX re-authentication technology is to send an EAP-Start message from the firmware Firmware to the AGW gateway to start the re-authentication process, and the WiMAX re-authentication method of the present invention sends an EAP-Start message from the firmware Firmware to the authentication client. Supplicant starts the re-authentication process, and the firmware Firmware notifies the authentication client Supplicant to use the MD5 algorithm to calculate the MSK in the re-authentication process instead of using EAM-TTLS/MSCHAPv2 or EAP-TLS used in the initial authentication. The authentication method is used to calculate the MSK. The EAP-Response/Identity sent by the WiMAX terminal carries the information of the user's network access identifier (NAI, Network Access Identifier, for example, NAI format MAC_Address@realm), thereby achieving the purpose of authenticating a specific terminal. The WiMAX terminal selects a relatively simple MD5 algorithm supported by the WiMAX base station, so that the terminal can calculate the MSK through the MD5 challenge, the challenge message identifier (CHAP-ID) and the shared key sent by the base station, after the re-authentication succeeds. The MSK encapsulated in the WiMAX API message is sent to the firmware Firmware to complete the update to the MSK.

In order to implement the above method, the present invention also provides a system for re-authenticating a terminal, including: a firmware, an authentication client, a base station, an AGW gateway, and an AAA server, where

Firmware, configured to send an authentication start message to the authentication client; An authentication client, configured to generate an authentication response message, and send an authentication response message to the AAA server via the firmware, the base station, and the AGW gateway; and receive the challenge message, and the predetermined algorithm corresponding to the challenge message of the predetermined algorithm The response message is sent to the AAA server via the firmware, the base station, and the AGW gateway;

An AAA server, configured to send a challenge message of the predetermined algorithm to the authentication client via the AGW gateway, the base station, and the firmware; receive a response message of the predetermined algorithm, and send the authentication response message from the server to the AGW gateway, the base station, and the firmware The authentication client, where the authentication response message carries the identification information of the terminal.

The fast re-authentication right of the present invention is based on successful initial authentication, and the security established by the initial authentication is used to improve the re-authentication process, so that the WiMAX terminal can be completed more quickly and stably. The process of re-authentication also helps to alleviate the pressure on AAA due to the large amount of data interaction.

Existing WiMAX terminals generally use EAP-TTLS/MSCHAPv2 or EAP-TLS authentication methods in initial authentication. If the WiMAX terminal selects the EAP-TLS authentication method, the authentication client Supplicant establishes the transport layer security (TLS, Transport Layer Security) after the initial authentication is completed. If the WiMAX terminal selects the EAP-TTLS/MSCHAPv2 authentication method. After the initial authentication is completed, the authentication client Supplicant establishes tunnel-based TLS. Therefore, whether the terminal selects EAP-TTLS/MSCHAPv2 or EAP-TLS, after the initial authentication, the authentication client Supplicant establishes the transport layer security, and after the initial authentication, the transport layer security is not released. The fast re-authentication right of the present invention utilizes the transmission layer security established by the initial authentication, and the terminal is authenticated by the NAI, and the MD5 algorithm of the relative single-single is used to calculate the MSK, which is achieved on the basis of ensuring security. Fast and stable re-authentication.

From the perspective of the security field, the security analysis of the fast re-authentication method of the present invention is as follows:

1. Integrity protection (integrality).

Due to the completion of the initial authentication, the WiMAX terminal and the WiMAX base station share an authentication key (AK, Authorization Key), and the WiMAX management is calculated according to the key hierarchy. The CMAC (Cipher-based Message Authentication Code) of the message is placed after the Payload. After receiving the WiMAX management message, the receiver calculates the CMAC of the message through the shared AK. Then compare with the CMAC value carried in the message. If the two CMAC values are equal, the CMAC verification succeeds, otherwise the message is discarded. If the attacker changes the data, the attacker cannot obtain the AK, so the correct CMAC value cannot be calculated. Once the receiver finds that the CMAC does not match, it indicates that the data packet has been changed by the tomb, and then the message is directly discarded. , thus achieving the integrity protection of the message.

2. Replay Attack.

In the payload of the MAC PDU, the packet number (PN, Packet Number) is placed in the highest 4 bytes of the MAC PDU. After the security association (SA) is established, the PN is 1 when the first packet is sent and 1 for each subsequent packet. When attacking the replay attack, the receiver can continuously check the PN value, so the retransmitted PN value message will be discarded, thus preventing the replay attack. Figure 4 shows the MAC PUD format with a ciphertext payload.

3. Protect from reorder-attacks. The serial number mentioned above also prevents attackers from recording packets and sending them in a different order, thus preventing reorder attacks.

4. Man-in-the-middle attack (ΜΙΜΤ λ

As the name suggests, Man-in-the-Middle Attack means that an attacker inserts himself between two communicating objects to intercept information that he cannot access or is not eligible to access. The middle man attack is considered to be the most dangerous attack on the WiMAX network. When an attacker intercepts a packet, but the attacker cannot obtain the shared key, the forwarded packet cannot be forged, thereby preventing a man-in-the-middle attack.

Through the above analysis, the improved fast re-authentication method of the present invention has been provided to prevent various major security threats.

The MD5 algorithm used in the present invention is an open source implementation, and the implementation method is relatively easy to implement with respect to the EAP-TTLS/MSCHAPv2 or EAP-TLS authentication method. Since the current WiMAX protocol does not specify how to implement the re-authentication technology, most of the current WiMAX Vendors use the same technology as initial authentication. Since the EAP protocol belongs to the WiMAX protocol category, when the EAP protocol is used for re-authentication, the re-authentication can be performed using a more compact and fast EAP-MD5 method.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. within the spirit and scope of the invention are intended to be included within the scope of the invention.

Claims

Claim

A method for re-authenticating a terminal, comprising the steps of: the firmware sending an authentication start message to an authentication client;

The method according to claim 1, wherein after the AAA server sends the authentication success message to the authentication client, the method further includes:

The method according to claim 1, wherein after the firmware sends the authentication start message to the authentication client, the AAA server sends the challenge message of the predetermined algorithm to the authentication client, the method Also includes:

The method according to any one of claims 1 to 3, wherein the sending the authentication response message to the AAA server comprises:

The method according to claim 4, wherein the sending, by the AAA server, the challenge message of the predetermined algorithm to the authentication client comprises: The AAA server sequentially transmits a challenge message of the predetermined algorithm to the authentication client via the gateway, the base station, and the firmware.

The method according to claim 5, wherein the sending, by the authentication client, a response message of a predetermined algorithm corresponding to the challenge message of the predetermined algorithm to the AAA server comprises:

The method according to claim 6, wherein the sending, by the AAA server, an authentication success message to the authentication client includes:

The AAA server sequentially transmits the authentication success message to the authentication client via the gateway, the base station, and the firmware.

8. The method according to claim 4, wherein when the authentication response message is transmitted from the gateway to the AAA server, the authentication response message is encapsulated into information identified by the AAA server And when the authentication response message is transmitted from the AAA server to the network management, decapsulating the authentication response message.

The method according to claim 1, wherein the terminal is a WiMAX terminal, and the firmware and the authentication client are included, wherein the firmware is a WiMAX chip.

An AAA server, configured to send the challenge message of the predetermined algorithm to the authentication client via the AGW gateway, the base station, and the firmware; receive the response message of the predetermined algorithm, and send the authentication response message to the authentication client; The authentication response message carries the identifier information of the terminal.

The system according to claim 10, wherein the system further comprises: a base station, an AGW gateway,

The system according to claim 10 or 11, wherein the terminal is a WiMAX terminal, including the firmware and the authentication client; wherein the firmware is a WiMAX chip.