WO2018004114A2 - Proxy authentication system and authentication method for providing proxy service - Google Patents

Abstract

A proxy authentication technique using a username/password specified in the standard specifications (RFC1928, RFC1929, etc.) of existing proxy server technologies is a method of authenticating by comparing subscriber information with information for authentication sent by a terminal, and therefore has the problems of the burden of the proxy server to manage a vast amount of subscriber information when used in an environment with a vast number of subscribers such as a commercial mobile network, and performance being significantly degraded due to proxy authentication. The present invention is an invention capable of solving the above-mentioned problem, and relates to a new proxy authentication system and an authentication method, in which, by confirming whether the same key value is used, instead of comparing subscriber information, for proxy authentication conducted during every proxy session, the proxy server can quickly conduct the proxy authentication without need to manage subscriber information, even in a commercial mobile network with a vast amount of subscriber information.

Description

Proxy Authentication System and Authentication Method for Proxy Service

The present invention relates to a proxy authentication system and an authentication method for providing a proxy service. More specifically, proxy authentication is performed by checking whether the same key value is used instead of matching subscriber information in proxy authentication performed every proxy session. The present invention relates to a proxy authentication system and an authentication method for providing a proxy service that can rapidly perform proxy authentication and minimize performance degradation that occurs during proxy authentication in a commercial mobile network with a large number of subscribers.

Proxy Server technology is a technology that provides additional services for a packet by passing a specific proxy server before the packet arrives at the receiving end. It is used to provide differentiated supplementary services to network users such as observation, data leakage prevention, and providing aggregation point for MPTCP.

Since Proxy Server technology provides additional services to users, it may be necessary to provide only to specific users. For this purpose, standard specifications (RFC1928, RFC1929, etc.) of Proxy Server technology provide a user authentication method using Username / Password.

However, this username / password user authentication method, when used in a commercial network that covers a large number of subscribers, is a proxy authentication procedure that must be contrasted with a large amount of information and the administrative burden of managing a database that manages a large number of subscriber information. There is a limit that the degradation of proxy service provisioning performance occurs.

Alternatively, the proxy server passes the information required for authentication (eg Username / Password) to the authentication server and allows or denies the access according to the result of the authentication server. However, this method is not suitable for MPTCP-based aggregation applications because the access delay is long and processing performance is deteriorated when it is necessary to determine whether access from a plurality of mobile terminals in real time.

[Preceding technical literature]

[Patent Documents]

Korean Patent Publication No. 10-2004-0036813

The present invention has been made to solve the above problems, and an object of the present invention is to manage the management of millions of subscribers while using the existing proxy authentication method when providing a service using a proxy in a commercial mobile network having millions or more of subscribers. It is to provide proxy authentication system and authentication method for proxy service provision that can reduce proxy performance and subscriber management burden by the number of subscribers by not needing.

Proxy authentication system for providing a proxy service according to an embodiment of the present invention includes a Proxy-Manager for pre-authenticating subscribers and forwarding initial configuration information for proxy authentication without subscriber information to the terminal and the Proxy-Server; A terminal for generating a username code1 and a password code2 constituting a proxy authentication packet based on the initial configuration information received from the proxy-manager, and transmitting the proxy authentication packet to the proxy-server; And based on the initial configuration information received from the Proxy-Manager, generates an analysis key to enable authentication processing without subscriber information, perform authentication by using the analysis key in the authentication request of the terminal, authentication And a Proxy-Server for restoring and storing the information of the completed subscriber.

The initial configuration information may include a usage code list including each terminal-independent code item and / or a code item dependent on each terminal, a group code, a shared secret for generating an One Time Password (OTP), and a random- Including the length of the number, each terminal non-dependent code item of each code item included in the use code list, the value of the code item if the value of the code item that can not be collected from the network is included It may further include.

In addition, the code2 is a random-number equal to the length of the code item included in the use code list received from the proxy-manager and the length of the random number among the value of the terminal dependent code item that each terminal can store. Code1 may be generated by combining the UE-ID having the terminal information and the Random-Number and then encrypting using a Proxy authentication key generated based on the initial configuration information.

At this time, the proxy authentication key includes a Group-Key and a Master-key, the Group-Key is generated based on the Group Code, the Master-key is based on the Shared Secret for OTP generation included in the use code list OTP generated by, and may be composed of each code item included in the use code list.

In addition, the Proxy authentication key may be updated whenever one or more events occur, such as reaching a regeneration period of an OTP value, receiving an authentication policy change from the Proxy-Manager, or changing a value of each code item included in a use code list. have.

In addition, the Proxy-Server may perform authentication without subscriber information by checking whether the analysis key is the same as the Proxy authentication key used when the terminal encrypts the Code1.

In addition, the Proxy-Server extracts a Random-Number from Code2 contained in the Password field of the Proxy authentication packet received from the terminal, and decrypts the information stored in the Username field of the Proxy authentication packet using the analysis key. After extracting the decrypted Code1, it may be determined whether the analysis key is the same as the Proxy authentication key by comparing the Random-Number extracted from the decrypted Code1 and the Random-Number extracted from the Code2.

In addition, the Proxy-Server generates an OTP at a plurality of preset time points in order to overcome the difference in the OTP value due to time asynchronous with the terminal, and proceeds with the analysis key generation and authentication attempt by the number of generated OTPs. Can be.

In the proxy authentication method for providing a proxy service according to an embodiment of the present invention, the proxy-manager pre-authenticates a subscriber and initializes initial setting information for performing proxy authentication without subscriber information to the terminal and the proxy-server. step; A transmitter-side key generation step of generating, by the terminal, Code1 and Code2 used for a proxy authentication packet based on the initial configuration information received from the Proxy-Manager; An authentication packet transmission step of transmitting, by the terminal, the Code1 and Code2 to the Proxy-Server in the Username field and the Password field of the Proxy authentication packet, respectively; An analysis key generation step of generating an analysis key for allowing the Proxy-Server to process the authentication request without subscriber information based on the initial configuration information received from the Proxy-Manager when an authentication request is made by the terminal; And an authentication and user information restoration step in which the Proxy-Server processes the authentication request of the terminal and restores and stores the information of the subscriber which has been authenticated upon successful authentication.

In the transmitting key generation step, the code2 includes a code item value included in a usage code list received from the proxy-manager among terminal-dependent values that each terminal can store, and a random received from the proxy-manager. It consists of a random number as long as the number of -Number, Code1 is encrypted by using the Proxy authentication key generated based on the initial configuration information after combining the UE-ID having the information of the terminal and the Random-Number Can be generated.

In addition, the proxy authentication key includes a Group-Key and Master-key, the Group-Key is generated based on the Group Code, the Master-key based on the Shared Secret for generating OTP included in the initial configuration information The generated OTP and each code item included in the usage code list may be included.

In addition, the analysis key generation step and the authentication and user information recovery step, the proxy-server of the OTP generated at a plurality of preset time points to overcome the difference in the OTP value due to time asynchronous with the terminal The number of times may be repeated to attempt authentication of the terminal.

In addition, in the authentication and user information restoration step, the terminal can be authenticated without subscriber information by checking whether the analysis key is the same as the Proxy authentication key used when the terminal encrypts the Code1.

Finally, the authentication and user information restoration step may include: extracting a Random-Number from Code2 contained in a Password field of a Proxy authentication packet transmitted from the terminal; Extracting the decrypted Code1 by decrypting the information stored in the Username field of the Proxy authentication packet by using the analysis key, and extracting a Random-Number included in the decrypted Code1; Contrasting the Random-Number extracted from Code1 with the Random-Number extracted from Code2; And when the two random numbers coincide, completing terminal authentication, and extracting user information of the authenticated terminal from the proxy authentication packet and storing them for monitoring proxy service usage and usage pattern information of each proxy service subscriber. Can be done.

According to an embodiment of the present invention, the Proxy Server used to provide additional network services, such as MPTCP Aggregation Point, provides a number of Proxy authentication requests received from multiple subscribers while providing proxy services in a network having a large number of subscribers. You have to deal quickly. In the present invention, regardless of the number of subscribers to provide a constant proxy authentication performance, even when used in a network having a large number of subscribers, it is possible to provide a proxy service and authentication without degradation.

In addition, one of the major problems faced when installing equipment that provides differentiated additional services for each subscriber is management of the subscriber. In order to use differentiated services, the use of subscriber database is essential. When managing subscriber information locally, care should be taken to synchronize subscriber information, and when using subscriber information managed by an external server, You must bear the performance penalty due to communication. According to an embodiment of the present invention, even if a differentiated network supplementary service for each subscriber, such as network speed improvement through MPTCP, is delivered through a proxy server, the proxy server using the authentication concept of the present invention uses subscriber information for subscriber authentication. Since it is not used, it can be freed from the management burden on subscriber information.

1 is a configuration diagram of an entire network of an MPTCP Aggregation service system which is an embodiment of a proxy authentication system of the present invention.

2 is a list and description of initial setting information.

FIG. 3 is an introduction to the Proxy Server's Proxy Authentication Key Generation for solving the difference in OTP caused by network delay or time synchronization delay.

4 is a configuration and description of a proxy authentication key.

5 is a configuration and description of Proxy authentication information.

6 is a description of the procedure of the initial setup step.

7 is a description of the procedure of the sender key generation step and the authentication packet transmission step.

8 illustrates a method of generating Code1 and Code2 which are proxy authentication information.

9 is a description of a proxy authentication key generation method.

10 is a description of the procedure of the interpretation key generation step.

11 is a description of the procedure of the authentication and user information restoration step.

As the invention allows for various changes and numerous embodiments, particular embodiments will be illustrated in the drawings and described in detail in the written description. However, this is not intended to limit the present invention to specific embodiments, it should be understood to include all transformations, equivalents, and substitutes included in the spirit and scope of the present invention. In the following description of the present invention, if it is determined that the detailed description of the related known technology may obscure the gist of the present invention, the detailed description thereof will be omitted.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In the present application, the terms "comprise" or "consisting" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other It is to be understood that the present invention does not exclude the possibility of the presence or the addition of features, numbers, steps, operations, components, parts, or a combination thereof.

One embodiment of the present invention is a typical server that a terminal of a particular subscriber does not support MPTCP using MPTCP using an Aggregation Point Proxy Server for MPTCP (MPTCP) in a commercial network This is a proxy authentication system and authentication method that does not require extensive subscriber management in Proxy-Server and does not cause deterioration of proxy performance when proceeding with authentication of a specific subscriber's terminal using Username / Password. .

That is, the proxy authentication system according to an embodiment of the present invention includes a Proxy-Manager for pre-authenticating subscribers and delivering initial configuration information for performing Proxy authentication without subscriber information to the terminal and the Proxy-Server, and from the Proxy-Manager. A terminal for generating Code1 for Username and Code2 for Password based on the received initial configuration information, and transmitting the Proxy authentication packet to the Proxy-Server, and the received from the Proxy-Manager Proxy-based key that generates analysis key that enables authentication processing without subscriber information based on initial setting information, performs authentication using analysis key when requesting authentication of terminal, and restores and stores information of the completed subscriber. It can be done by including Server.

In addition, in the proxy authentication method of the present invention using the authentication system described above, the Proxy-Manager transmits initial configuration information for pre-authenticating subscribers and proceeding with proxy authentication without subscriber information to the terminal and the Proxy-Server to transmit the initial configuration information. Initial setup step for the terminal and the Proxy-Server to share, Step for generating a key on the sending side for generating the Code1 for the Username and Code2 for the password to be used for the packet for the proxy authentication, the terminal is the Proxy authentication packet for the Code1 and Code2 Authentication packet transmission step of sending to the Proxy-Server in Username and Password fields of the server, and generation of an analysis key that generates an analysis key that allows the Proxy-Server to process the authentication request of the terminal without subscriber information when the terminal requests authentication. Step, and process the authentication request of the terminal, and restore and save for later operations such as monitoring, statistics, information of the subscriber is completed authentication Authentication and a user information recovery method comprising.

In the proxy authentication method, when the operation of the Proxy-Server starts, the Proxy-Server requests initial configuration information from the Proxy-Manager, and the Proxy-Manager delivers initial configuration information to the Proxy-Server in response to the request. The process proceeds to a part of the initial setting step.

In the proxy authentication method, when the operation of the terminal starts, the terminal requests pre-authentication from the Proxy-Manager, and after the Proxy-Manager proceeds with the authentication of the subscriber, the initial authentication information is transmitted to the authenticated subscriber station. Proceed with some of the initial setup steps. At this time, it is recommended to use strong security techniques such as Secure Tunnel and VPN for pre-authentication that the terminal proceeds with Proxy-Manager.

More preferably, the initial configuration information delivered by the Proxy-Manager to the Proxy-Server and the terminal is a Group Code, Shared Secret for generating one time password (OTP), a usage code list, and a random-number length. In addition, among the codes included in the usage code list, the values of terminal-independent items which are not dependent on the terminal and are shared by all the terminals on the network are not properly shared between the Proxy-Server and each terminal. Hold in addition. Each code item included in the usage code list is information that can be stored by the terminal itself while all terminals on the network such as MCC (Mobile Country Code) and MNC (Mobile Network Code) share the same value, or IP address, Each terminal, such as MSISDN and IMSI, can be kept and is dependent on each terminal, and the concept of the present invention is not limited to the code used for MCC, MNC, IP Address, MSISDN, IMSI. If necessary, a number of necessary codes can be selected and used.

When the pre-authentication of the terminal is completed in the MP-Manager through the initial setting step, and the terminal and the Proxy-Server receive the same initial configuration information from the Proxy-Manager and share the same, the terminal completes the proxy authentication without subscriber information. You are ready to generate proxy authentication information (packets) to make it possible.

This proxy authentication information is composed of two codes, Code1 and Code2. Code2 is a code included in the usage code list received from Proxy-Manager among the device-dependent values that each terminal can store, such as IP Address, MSISDN, and IMSI. It consists of the value of the item and the Random-Number equal to the length of the Random-Number received from the Proxy-Manager. Code1 is based on the initial configuration information after combining the UE-ID having the terminal information and the Random-Number of Code2. It is generated by encrypting using the proxy authentication key generated by. In this way, the terminal creates Code1 and Code2 to complete the generation of the proxy authentication information.

More preferably, the terminal divides the initial configuration information into two groups to generate the proxy authentication key. The first group is an immutable group unless the authentication policy is changed. The group code is received from the Proxy-Manager when the terminal completes the Proxy-Manage and pre-authentication. The Group-Code received from the Proxy-Manager is the Group-Key. It is used to create a subset of the Proxy authentication keys. The second group consists of the codes included in the OTP generated based on the shared secret for generating the OTP received from the Proxy-Manager and the usage code list received from the Proxy-Manager. It is used to generate a key after being updated for each proxy authentication key regeneration event and used to generate a master-key which is a key of the remaining part except the group code in the proxy authentication key. It is recommended that the proxy authentication key be at least 256 bits in size. The size of the proxy authentication key, the size of the Group-Key, and the size of the Master-key generated from the information of the second group may be operators using the concept of the present invention. Can be decided according to your needs.

Even more preferably, the Proxy authentication key regeneration event is triggered when the OTP value is regenerated, the authentication policy change is received from the Proxy-Manager, and the value of each code included in the use code list is changed. When is invoked, Code1 and Code2 update using new Proxy authentication key is also performed.

When the generation or update of the latest Proxy authentication information consisting of the Code 1 and the Code 2 is completed, the terminal may be able to request a proxy service using the Proxy-Server at any time. In this state, if a packet that requires a proxy service is generated at the terminal, the terminal first attempts authentication with the proxy server to establish a proxy connection. At this time, Code1 and Code2 generated at the sender key generation step are generated. Is sent to the Proxy-Server with the Username and Password fields of the Proxy authentication packet. If the authentication packet is authenticated by the proxy server in response to the authentication packet, the communication session of the terminal can use the proxy service immediately.

When the terminal transmits the proxy authentication packet through the authentication packet transmission step, the Proxy-Server of the present invention accesses the subscriber database and compares the subscriber information one by one. Generates an interpretation key that is dependent on each terminal needed to perform proxy authentication.

More preferably, the Proxy-Server also divides the initial configuration information into two groups, like the terminal. When receiving the proxy authentication packet and starting the interpretation key generation step, the Proxy-Server forwards it from the Proxy-Manager in advance. Generate Group-Key using the received Group Code as the first group and use it as part of the analysis key, and receive it in advance from the OTP and Proxy-Manager created in advance as Shared Secret for OTP generation received from Proxy-Manager. The remaining key of the analysis key is generated by using the value of each terminal-independent code included in the usage code list and each terminal-dependent value extracted from Code2 in the Password field of the Proxy authentication packet received from the terminal as a second group. This completes the analysis key generation step.

Even more preferably, the OTP is generated at every regeneration cycle of the OTP or when a new shared secret for OTP is received due to the change of the proxy-manager's authentication policy.

Even more preferably, when the value of each code included in the use code list receives a new use code list and a value of each terminal independent code included in the use code list due to the change of the proxy-manager authentication policy, The code list and values of each code are kept by Proxy-Server.

When generation of an analysis key dependent on each terminal necessary to perform proxy authentication for a terminal without subscriber information through the interpretation key generation step, the Proxy-Server checks the subscriber information using the analysis key. It authenticates the proxy authentication packet transmitted by the terminal without any authentication, and extracts user information of the completed terminal from the proxy authentication packet and stores it for monitoring information such as proxy service usage and usage pattern of each proxy service subscriber. And the user information restoration step.

More preferably, the Proxy-Server extracts a Random-Number from Code2 sent by the terminal using the Password field of the Proxy authentication packet transmitted by the terminal, and uses the analysis key generated in the analysis key generation step. After decrypting the information stored in the Username field of the extracted Decoded Code1, and then compares the Random-Number extracted from the decrypted Code1 and the Random-Number extracted from Code2 to proceed with the proxy authentication of the terminal without subscriber information.

That is, it can be seen that the decryption key generated by the Proxy-Server is identical to the proxy authentication key of the terminal by verifying that the Random-Number extracted from Code1 is the same as the Random-Number delivered by the terminal through Code2 through decryption. This means that the terminal completed the pre-authentication with the Proxy-Manager without any problem, so that the Proxy-Server can immediately proceed with the Proxy authentication without checking the user of the terminal.

More preferably, the Proxy-Server may generate the OTP at a plurality of preset time points in order to overcome the difference in the OTP value due to time asynchronous with the terminal. For example, up to three OTPs may be generated, and upon receiving a proxy authentication packet, three proxy authentication keys may be generated and authentication attempts may be performed. At this time, the three proxy authentication keys may be OTP at the present time, OTP at one time before, and OTP at one time after, respectively.In case of proxy authentication request or proxy authentication failure, an analysis key generation step and authentication and user information are performed. Repeated restoration steps are generated three times each and authentication is attempted.

At this time, the OTP generation period must be larger than the time difference between the terminal and the Proxy-Server and the packet reception delay due to the network delay, and a period in which the proxy authentication security is not invalidated due to packet eavesdropping should be set. OTP generation period can also be set according to the needs of the operator using the present invention,

Through the above process, the Proxy-Server checks whether the terminal uses the same Proxy authentication key (interpretation key) instead of checking the user information of the terminal, and confirms whether the terminal has completed pre-authentication with the Proxy-Manager. The Proxy-Server eliminates the need for the subscriber information management and eliminates the change in the terminal authentication performance according to the number of subscribers. To provide.

Hereinafter, the necessary information and concept of the present invention will be described with reference to the accompanying drawings, and preferred embodiments of the present invention will be described in detail for each step. 1 is a network diagram of an MPTCP Aggregation Service System 1000, which is an embodiment of a proxy authentication system of the present invention. The MPTCP Aggregation Service System 1000, which applies the concept of proxy authentication system of the present invention, can quickly identify subscribers and provide MPTCP Aggregation differentially without burdening subscriber information management. That is, the MPTCP Aggregation Service System 1000, as shown in Figure 1, the proxy for pre-authenticating each terminal 300, and forwards the initial configuration information 400 to each of the authenticated terminal 300 and Proxy-Server (200) The manager 100 generates the same analysis key 500 as the Proxy authentication key 500 generated by the terminal whenever the authentication request of each terminal is shared with the initial configuration information 400 shared by the Proxy-Manager 100. By using the Proxy-Server (200) to quickly authenticate the terminal, and the terminal 300 using the MPTCP Aggregation service provided by the Proxy-Server (200).

In the MPTCP Aggregation Service System 1000 according to an embodiment using the concept of the present invention, when the Proxy-Server 200 and the terminals 300 are started, the subscriber information after pre-authentication with the Proxy-Manager 100 is performed. MPTCP in an environment where huge subscriber information such as a commercial mobile network is used, by allowing each of the authenticated terminals 300 and the Proxy-Server 200 to share the initial configuration information 400 that allows the proxy authentication request to proceed quickly without the need for storage. Although the Aggregation Service System 1000 provides a service in which the number of proxy authentications is increased according to the number of paths, the authentication procedure can be processed at a constant rate without being affected by the number of subscribers without storing subscriber information. .

In order for the terminal 300 to benefit from the use of the MPTCP technology, the server to which the terminal 300 makes a TCP connection must have the MPTCP function. The conventional servers existing in the commercial network have the new technology MPTCP. Not. Therefore, in order to utilize the MPTCP function of the terminal 300, the terminal 300 can obtain a benefit of MPTCP by allowing the proxy-server to communicate with the Proxy-Server 200 having the MPTCP function located in a high-speed back-borne network. An MPTCP Aggregation Service System 1000 is provided.

However, due to the characteristics of this system, the service should be provided only to specific subscribers subscribed to this service. When using existing Proxy authentication for subscriber identification, Proxy-Server (200) must manage huge subscriber information of commercial network, and Proxy authentication Due to the proxy authentication method in which subscriber information must be collated for each path of MPTCP for each request, the larger the number of subscribers, the lower the proxy authentication performance and the lower the gain through the utilization of MPTCP technology.

Solving such a problem is the MPTCP Aggregation service system 1000 according to an embodiment using the concept of the present invention, and the MPTCP Aggregation service system 1000 utilizes the concept of the present invention instead of collating subscriber information. By checking whether the terminal 300 requesting authentication uses the same Proxy authentication key 500 as the Proxy-Server 200, it processes the Proxy authentication request, thereby maintaining a constant and rapid rate without being affected by the number of subscribers without storing subscriber information. It allows the authentication process to be processed at a speed, thereby preventing the gain from using the MPTCP technology from being lowered.

2 shows a configuration of initial setting information 400 according to the present invention. The initial configuration information 400 is information received from the Proxy-Manager 100 when the terminal 300 or the Proxy-Server 200 of each subscriber subscribed to the MPTCP Aggregation Service System 1000 is authenticated by the Operator. Unless the policy is modified, the information is unchanged, and information necessary for proceeding with the proxy authentication procedure of the present invention for quickly performing proxy authentication between the subscriber terminal 300 and the Proxy-Server 200 where pre-authentication is completed.

As shown in Figure 2, the initial configuration information 400 according to the present invention is a "Group Code" (410), "OTP Shared Secret" (420), "Use Code List" (430), "Random-Number length 440, “value of each terminal independent item” 450.

The “Group Code” 410 is a code generated and used by the Proxy-Manager and is transmitted to the terminal and the Proxy-Server where the pre-authentication is completed and used as the Group-Key 510 which is part of the Proxy authentication key 500. “Shared Secret for OTP” (420) is also a value generated by the Proxy-Manager and transmitted to the terminal and Proxy-Server where pre-authentication is completed, and Master-Key (part of Proxy authentication key 500 in each terminal and Proxy-Server). While generating one time password (hereinafter referred to as OTP), which is one of information for generation, based on the current time, the UE and the Proxy-Server can generate the same OTP. The reason why the OTP is used to generate the master-key 520 is to prevent an unauthenticated terminal from using an eavesdropping packet unfairly using a function of the Proxy-Server 200 such as the MPTC aggregation service. Yet, since the authenticated terminals 300 and the Proxy-Server 200 must share the same Proxy authentication key 500, the authenticated terminals 300 and the Proxy-Server 200 should have the same OTP. In order to accomplish this, the concept of the present invention delivers the same shared secret 420 for the OTP to the authenticated terminals 300 and the Proxy-Server 200 to calculate the OTP. Even when the same shared secret 420 for OTP is used in the authenticated terminals 300 and the Proxy-Server 200, the Proxy authentication packet transmitted from the terminal is transmitted to the Proxy-Server due to network delay or delay in time synchronization. When it arrives, there is a case where Proxy-Server and a different Proxy authentication key 500 are used. A method for coping with this problem is specified in FIG. 3 and described later in the paragraph below.

The “use code list” 430 transmits a list of information of which items are used as information for generating a master-key 520 that is part of the proxy authentication key 500. The terminal 300 and the proxy-server The terminal 300 and the Proxy-Server 200 can share the same Proxy authentication key 500 when the 200 generates the Master-Key 520 with the same item information, and the same Proxy authentication of the present invention. Since the concept of quickly processing the proxy authentication request without subscriber information may be implemented by checking whether the key 500 is used, the Proxy-Manager 100 may authenticate the terminals 300 and the Proxy-Server 200. Information to pass on.

There are two types of items to be delivered: "terminal independent" and "terminal dependent". "Terminal independent item" refers to an item that all terminals have the same information because the information is shared by the network, such as MNC and MCC. Thus, the "terminal independent items" are items that the Proxy-Server 200 needs to store without the terminal 300 having to transmit them to the Proxy-Server 200. Typically, the terminal 300 and the Proxy-Server 200 may also collect information on the “terminal independent item” from the network, but when collecting information on a specific “terminal independent item” is difficult, the corresponding information Only the Proxy-Manager 100 can use the "value of each terminal non-dependent items" (450) so that the corresponding information can be shared between each terminal 300 and the Proxy-Server (200) that pre-authentication is completed. "Terminal dependent item" is an item in which each terminal has different information such as IP address and MSISDN, and each terminal 300 and Proxy- which have been pre-authenticated by being included in the Proxy authentication packet when the authentication procedure of the present invention is performed. Information shared by the server 200.

"Random-Number Length" (440) is used to check instead of subscriber information in the Proxy authentication process of the present invention to determine whether the terminal 300 and the Proxy-Server (200) uses the same Proxy authentication key (500) As the information transmitted to allow the Proxy-Server 200 and the terminal 300 to share the length of the information used, Code1 610 and Code2 620 constituting the proxy authentication information 600 are generated. When the terminal is created and used. Since Proxy-Server 200 should collect Random-Number information from Code2 620 when processing Proxy authentication request, terminals 300 and Proxy-Server 200 should use the same Random-Number length. In this case, the Proxy-Manager 100 transmits the “Random-Number Length” 440 information to the terminals 300 and the Proxy-Server 200 where each authentication is completed. However, since the Random-Number itself is the last item of Code2, the Proxy-Server 200 can infer the length of the Random-Number by excluding all of the “terminal dependent item” information from Code2. As described above, the value of each terminal-independent item 450 indicates that the terminal 300 and the Proxy-Server (for which the authentication is completed) are performed by the Proxy-Manager 100 only for the "terminal-independent item" which is difficult to collect specific information. This field is used to allow the information to be shared.

3 is not the same in spite of the same time zone due to network delay or time synchronization delay in OTP generated using the OTP generation Shared Secret 420 shared between the terminal 300 and the Proxy-Server 200. It is a countermeasure of the present invention to the problem that Proxy authentication key 500 may be generated. If a network delay occurs even when time synchronization between the terminal 300 and the Proxy-Server 200 occurs, the OTP used for generating the Proxy authentication key 500 by the terminal 300 when the Proxy authentication packet is generated, When the server arrives at the server 200, it may be different from the OTP used by the proxy server 200. Similarly, if there is a delay in time synchronization between the terminal 300 and the Proxy-Server 200, even if the network delay is minimal, since the OTP generated in the same time zone is different, even if the terminal 300 is authenticated, the terminal 300 Proxy authentication key 500 may be different from Proxy authentication key 500 of Proxy-Server 200. In order to solve this problem, in the present invention, the Proxy-Server 200 stores three OTPs as shown in FIG. 3, and then generates three Proxy authentication keys 500 when the Proxy authentication packet is received. Before rejecting the request, the authentication attempt for each of the three proxy authentication keys 500 is performed so that a delay occurs in the network or time synchronization between the terminal 300 and the Proxy-Server 200. It will provide as much time as possible.

At this time, the OTP generation cycle can be set according to the needs of the operator using the present invention. The OTP generation cycle can be set according to the state of the network in which the service is provided. A time that is long enough to cope with the delay caused by the time synchronization scheme used is recommended. The time synchronization method may also be selected according to the needs of the operator using the present invention, and time synchronization through a third server or a direct time synchronization method between the Proxy-Server 200 and the terminal 300 may be performed according to the needs of the operator. Can be selected.

4 is a proxy authentication key 500 of the Proxy-Server 200 and the terminal 300 of the present invention to share the same by generating based on the initial configuration information 400 received from the Proxy-Manager (100) Configuration and explanation. 4 and this paragraph describe only the respective components of the Proxy authentication key 500, and detailed creation procedures and usage examples of the Proxy authentication key 500 describe each progress step of the embodiment of the present invention in a later section. Explain. Proxy authentication key 500 is composed of two keys, Group-Key (510) and Master-key (520). The Group-Key 510 is a key generated based on the Group Code 410 received from the Proxy-Manager 100 and uses Key-Generation in the Group Code 410 according to the needs of the Operator using the present invention. The generated or Group Code 410 may be used as the Group-Key 510 which is part of the Proxy authentication key 500 as it is, and the length of the Group-Key 510 may be set according to the needs of the operator. The master-key 520 is generated based on the sum of the values of the items specified in the OTP and the use code list 430 generated through the shared secret 420 for generating the OTP. The Master-key 520 together with the Group-Key 510 constitutes a part of the Proxy authentication key 500, and like the Group-Key 510, the Master-key 520 according to the needs of the operator using the present invention. The length can also be set. However, the present invention recommends the total length of the proxy authentication key 500 to be at least 256 bits.

5 is a configuration and description of the proxy authentication information 600 which is actually used so that the present invention can quickly process a Proxy authentication request without subscriber information. The Proxy-Server 200 and the terminal 300 generate and share the same Proxy authentication key 500 by using the initial configuration information 400 that is identically received after the strong line authentication with the Proxy-Manager 100. The Proxy-Server 200 checks whether the Proxy-Server 200 and the terminal 300 share the same key by transmitting the same Proxy authentication key 500 shared in the Proxy authentication packet. Authentication of the 300 is quickly processed without subscriber information.

In this case, in order to prevent the external exposure of the proxy authentication key 500 due to packet eavesdropping and to transmit the information of the terminal 300 to the Proxy-Server 200, the concept of the present invention is that the terminal 300 uses the Proxy authentication key ( Proxy-Server which encrypts the information of the terminal 300 and prepares the proxy authentication information 600, inserts it into the Username field and the Password field of the Proxy authentication packet, and transfers the received packet. The same proxy authentication key is decrypted sequentially by using three proxy authentication keys 500 generated based on three OTPs and initial configuration information 400 storing the proxy authentication information 600 received by the 200. If 500 is found to be used, authentication is completed and if the same Proxy authentication key 500 is found not to be used, the authentication is rejected.

Proxy authentication information 600 used in this process will have Code1 610 and Code2 620. As described in FIG. 5, Code1 610 is random generated when Proxy authentication information 600 is generated. After adding -Number and UE-ID, which is terminal information, the value is encrypted with Proxy authentication key 500 and Code2 620 is a value that combines the terminal-dependent code and the Random-Number value. Code1 610 is transmitted to the Proxy-Server 200 using the Username field of the Proxy authentication packet, and Code2 620 is transmitted to the Proxy-Server 200 using the Password field of the Proxy authentication packet.

Code1 610 and Code2 620 delivered to Proxy-Server 200 share the same Random-Number while Code1 610 is encrypted with Proxy authentication key 500 and Code2 620 is not encrypted. Since the Proxy-Server 200 decodes Code1 610 after decoding the Code1 610, the Proxy-Server 200 compares the Random-Number extracted from the Code2 620, and the terminal 300 and the Proxy-Server 200 have the same Proxy. It is possible to check whether the authentication key 500 is used, so that the Proxy-Server 200 can quickly perform authentication for the terminal without subscriber information.

In addition, Code1 610, which is decrypted in the concept of the present invention, includes UE-ID, which is terminal information, to determine who is using a subscriber's service even when Proxy-Server 200 does not store subscriber information. To get information.

Although the concept of the present invention is strong through the above method, the Proxy-Manager 100 may use the high-performance authentication method that consumes a lot of time and resources depending on the number of subscribers when the service of the Proxy-Server 200 and the terminal 300 starts. Proceed to pre-authentication with the client and allow the authenticated terminal 300 and the Proxy-Server 200 to generate the same Proxy authentication key 500 based on the same initial configuration information 400 and then use the Proxy service. In the Proxy authentication process that proceeds when the Proxy-Server (200) using the Proxy authentication information (600) created based on the same Proxy authentication key 500, the Proxy-Server (200) is quickly authenticated the terminal 300, the pre-authentication is completed without the subscriber information Identify and provide services immediately.

Until now, the information and concepts required for understanding the present invention have been described, and the following paragraphs and drawings describe the progress of the present invention using the MPTCP Aggregation service system 1000, which is one of the preferred embodiments of the present invention.

The first step of the present invention is the initial setting step, Figure 6 shows the detailed procedure of the initial setting step. The initial setting step is to initialize the information necessary for the operation of the present invention when each component of the present invention is started, the time-consuming but strong line authentication for the Proxy-Server (200) and the terminal (300) This is a procedure for sharing the initial configuration information 400 necessary for the operation of the present invention, which can rapidly proceed with proxy authentication without using subscriber information, to the Proxy-Server 200 and the subscriber station 300.

As illustrated in FIG. 6, each component of the present invention performs authentication with the Proxy-Manager 100 and receives initial configuration information 400 from the Proxy-Manager 100. When the Proxy-Server (200) is started in the first procedure, the Proxy-Server (200) after the authentication with the Proxy-Manager (100), and stores the initial configuration information (400) received in the second procedure . The third procedure proceeds when the terminal 300 starts to use the MPTCP Aggregation service provided by the Proxy-Server 200, and proceeds with pre-authentication with the Proxy-Manager 100 for use of the service at the same time as the service starts. do. This pre-authentication is not a quick authentication of the present invention, but is a normal authentication procedure, and is a procedure for confirming whether the terminal 300 is a service subscriber, and an authentication method may be selected according to the needs of an operator using the concept of the present invention. have. Unlike the proxy authentication that occurs every time, the terminal 300 and the proxy-manager 100 proceed with the line authentication, which requires a periodic or one-time authentication at the start of the service. The use of authentication methods is recommended. In the concept of the present invention, this pre-authentication actually authenticates the subscriber, and the method of rapidly proxieing the proxy without the subscriber information introduced by the concept of the present invention only determines whether the terminal 300 requesting the proxy authentication has completed the pre-authentication process. Check and provide fast proxy authentication.

When the terminal 300 completes pre-authentication with the Proxy-Manager 100 in the third procedure of FIG. 6, the terminal 300 transmits the initial configuration information 400 to the Proxy-Manager 100 in the fourth procedure of FIG. 6. Will be provided by The terminal 300 generates the proxy authentication information 500 based on the received initial configuration information 400 and the proxy authentication information 600 using the random number, and performs the proxy authentication procedure for each proxy communication session. By using it, the Proxy-Server 200 allows the terminal 300 to request Proxy authentication to proceed with quick authentication by checking only using the same Proxy authentication key 500 as its own. The procedure up to Proxy authentication after the initial configuration step is described in detail later in the drawings and paragraphs.

7 illustrates a procedure from the second key generation step of the present invention to the third authentication packet transmission step. The terminal 300 using the MPTCP Aggregation service completes the initial setting step of FIG. 6 and receives and stores the initial setting information 400. The stored initial setting information 400 is stored in the proxy authentication procedure of FIG. It is used to generate a key 500 and information 600 for proxy authentication.

First, the terminal, which has been authenticated through the initial setting step, has received the initial setting information 400 according to the authentication policy, and using the initial setting information 400, the proxy authentication key 500 and the proxy authentication shown in FIG. 7 immediately. The procedure for generating the usage information 600 is entered. To this end, the terminal generates an OTP using the shared secret 420 for generating the OTP included in the received initial setting information 400, and the group code 410 of the initial setting information 400 together with the generated OTP. The proxy authentication key 500 is generated and stored using the value of each item of the usage code list 430. The detailed method of generating the Proxy authentication key 500 is described in detail with the description of FIG. 9 in the following paragraph.

When the proxy authentication key 500 is generated in this way, the terminal 300 generates a random number in the manner of FIG. 8 illustrating a method of generating Code 1 610 and Code 2 620, and the Proxy-Server 200 MPTCP. After aggregating with the UE-ID including the terminal and subscriber information to be stored during the aggregation service provision, Code1 (610) is generated by encrypting using the Proxy authentication key (500) generated above, and among the use code list (430) items. Code2 620 is generated by combining the value of the terminal-dependent item and the same value as the Random-Number used to generate Code1 610.

When generating Code1 610 and Code2 620, the position of Random-Number in Code2 620 is set to Random-Number even if Proxy-Server 200 does not have information about the length of Random-Number. It is recommended that the length information of each item is aggregated after the values of the published terminal dependent items so that the length of each item can be extracted from the random number. Similarly, when the Random-Number and the UE-ID are combined to generate Code1 610, the Random-Number is placed before the UE-ID as shown in FIG. 8, so that the Proxy-Server 200 does not know the exact length of the UE-ID. It is recommended to be able to extract the UE-ID by using the length of the Random-Number extracted in Code2. In addition, the concept of the present invention is described as transferring the information of Code2 620 without encryption in order to make the authentication of the Proxy authentication packet as quick as possible, but this is not a problem using any encryption method according to the needs of the operator. .

When the proxy authentication key 500, Code1 610, and Code2 620 are generated in this way, the terminal 300 stores this information for subsequent Proxy authentication packets. Event of type causes regeneration process.

The first event is the change of the authentication policy, when the authentication policy is changed according to the needs of the operator, the Proxy-Server (200) and the terminal (300) to receive a new initial configuration information 400 according to the changed authentication policy. In addition, since there was a change in the initial setting information 400, the above-described process of generating the OTP and generating the Proxy authentication key 500 to generate and store the Code 1 (610) and the Code 2 (620). Since the initial setting information 400 includes the shared secret 420 for generating the OTP, the OTP is generated again.

The second event is when the regeneration cycle of the OTP is reached, which is triggered when the regeneration cycle of the OTP, which the present invention uses as a countermeasure against packet eavesdropping, arrives. Since the OTP is regenerated, the proxy authentication key 500 generated with the information including the OTP expires, and the terminal 300 newly generates the proxy authentication key 500, Code1 (610), and Code2 (620). The process of creating and archiving is going on.

The last event occurs when the terminal dependent information used to generate the proxy authentication key 500 is changed. The terminal dependent information may include information that may be changed due to terminal mobility, such as IP-Address of the terminal, and the change of the terminal dependent information may mean the expiration of the existing Proxy authentication key 500, and thus, a new Proxy authentication key ( 500), Code1 (610), and Code2 (620) will be created and stored.

When the code 1 610 and the code 2 620 are generated and stored in the terminal 300 as the procedure or the event, the terminal 300 can start the proxy communication at any time using the concept of the present invention. do. In this state, when the communication using the MPTCP Aggregation service is started in the terminal, the communication becomes a proxy communication, and the proxy authentication procedure for authenticating whether the corresponding proxy communication is started from the terminal of the service subscriber is started.

At this time, the terminal inserts Code1 610 and Code2 620, which are generated in advance in the Username and Password fields of the Proxy authentication packet, as described in FIG. Thereafter, when the terminal 300 receives the authentication success from the Proxy-Server 200, the proxy 300 may proceed with the proxy communication. If the terminal 300 receives the authentication failure, the proxy 300 does not proceed.

Meanwhile, in the present embodiment, the Random-Number is generated in advance, and Code1 610 and Code2 620 are generated and stored in advance, but the Random-Number is generated at the time of starting the proxy communication according to the needs of the operator. It is also possible. In this case, the terminal 300 generates and stores only the proxy authentication key 500, and generates a random number when a proxy authentication packet is produced due to the start of proxy communication, and generates Code1 610 and Code2 620. It is generated and used for Proxy authentication packet. This method requires more time and resources to generate Proxy authentication packets, but can prevent the random number leakage of the terminal 300 due to packet eavesdropping.

When the Proxy authentication packet of the terminal 300 is transmitted to the Proxy-Server 200 as described above, the Proxy-Server performs the Proxy authentication of the terminal 300 through a key generation step for interpretation, authentication, and user information restoration. However, in this paragraph, first, the proxy authentication key 500 will be described in detail with reference to FIG. 9 before explaining the proxy authentication procedure of the Proxy-Server 200.

As shown in FIG. 9, the proxy authentication key 500 is a combination of a Group-Key 510 and a Master-key 520. The Group-Key (510) and the Master-key (520) are the values of each item of the initial setting information (400) received by the terminal 300 and the Proxy-Server 200 after the pre-authentication with the Proxy-Manager 100, respectively. Is generated based on

The Group-Key 510 is generated based on the Group Code 410 of the initial setting information 400. The Key-Generation module used at this time is not specified and can be selected by the operator as needed.

In the case of the master-key 520, the OTP generated based on the shared secret 420 for generating the OTP among the initial setting information 400 and the value of each item specified in the use code list 430 are generated. Like the Key 510, the Key-Generation module used for generating the Master-key 520 is not specified and can be selected by the Operator as needed. The Group-Key 510 and the Master-key 520 may use different Key-Generation modules.

Unlike the Group-Key 510, the Master-key 520 may use a plurality of values of each item specified in the use code list 430, but the Operator may decide which item to use. If there is no information that the operator wants to use in generating the master-key 520 by specifying the use code list 430, the use code list 430 and the value 450 of each terminal-independent item are set in the initial setting information 400. It may be completely excluded. However, at least one information is required to prepare the master-key 520, and since OTP is selected as a protection against packet eavesdropping, the OTP value must be included when generating the master-key 520. As the method of generating the OTP value, as shown in FIG. 9, the time-based One-time Password Algorithm (RFC 6238) method is recommended. Can be freely selected as needed.

In addition, among the items of the usage code list 430, each terminal-independent item such as an MNC may be included. The terminal 300 and the proxy-server 200 collect information on these values from the network or initialize information. The terminal non-dependent items of 400 may be collected through the value 450.

When the Group-Key 510 and the Master-key 520 are generated based on the initial setting information 400 in the above manner, the two keys are combined into one to generate the Proxy authentication key 500. That is, when a 128-bit key is generated for the Group-Key 510 and another 128-bit key is generated for the Master-key 520, two keys are combined to generate a 256-bit Proxy authentication key 500. Will be. At this time, the length of the Group-Key (510) and the length of the Master-key (520) may be determined according to the needs of the operator, the present invention, the Group-Key (510) and Master-key (520) for security purposes It is recommended that the length of the Group-Key 510 and the Length of the Master-key 520 be set so that the result of the Proxy authentication key 500 formed by combining the keys is at least 256 bits long.

10 illustrates a process of an analysis key generation step performed by the Proxy-Server 200 before proceeding with the authentication and user information restoration step when the proxy authentication packet is received from the terminal 300.

The Proxy-Server 200 receives the initial setting information 400 from the Proxy-Manager 100 through the initial setting step after the start of the service, generates the OTP, and stores the generated initial setting information 400. 10 and OTP are updated when the authentication policy is changed to change the initial setting information 400 or when the OTP expires because the set OTP regeneration period is reached.

At this time, as described in FIG. 3 above, the Proxy-Server 200 generates and stores three OTPs, and when the Proxy authentication packet is received, generates the Proxy authentication key 500, which is a key for interpretation, and authenticates the Proxy authentication packet. Three OTPs are used sequentially.

When the initial configuration information 400 and OTP are stored through Event1 and Event2 of FIG. 10 as described above, the Proxy-Server 200 is ready to receive and authenticate the Proxy authentication packet and receives the Proxy authentication packet of Event3 of FIG. If this occurs, the proxy authentication key 500 is generated by the proxy authentication key 500 generation method described with reference to FIG. 9, and then the authentication and user information restoration steps are performed.

When the Proxy-Server 200 generates the Proxy authentication key 500, the Proxy-Server 200 receives the Group-Key 510 using the Group Code 410 of the initial configuration information 400 received and stored. In the case of generating the master-key 520, but not the value of the terminal non-dependent items of the OTP in storage and the initial setting information 400 received and stored in the proxy authentication received from the terminal 300. UE-dependent information such as IP address extracted from the packet's Password field should also be used. Therefore, in the present embodiment of the present invention and FIG. 10, the generation of the proxy authentication key 500 is performed after receiving the packet for proxy authentication. However, the terminal-independent item is not used or terminal-independent items are not used depending on the needs of the operator. If the value 450 is shared with the Proxy-Server 200 in advance, the Proxy-Server 200 may also prepare and store three Proxy authentication keys 500 in advance and use them when receiving a packet for Proxy authentication.

If the Proxy-Server 200 receives the Proxy authentication packet through the above steps and the Proxy Authentication Key 500 is created, the Proxy-Server proceeds with the authentication and user information restoration steps shown in FIG. By fast proxy authentication for the terminal 300 without the subscriber information, it is possible to proceed to extract and store the subscriber information of the service user for the convenience functions for the operator, such as service usage tracking for each service user.

When the Proxy-Server 200 receives the Proxy authentication packet and generates the Proxy authentication key 500, the Proxy-Server 200 generates Code1 610 and Code2 620 in the Username and Password fields of the Proxy authentication packet as shown in FIG. Proceed with proxy authentication and user information extraction. The Proxy-Server 200 extracts values of terminal dependent items from Code2 620 to create a Proxy authentication key 500 to be used for this Proxy authentication attempt, and the terminal 300 is a Proxy such as Proxy-Server 200. The Random-Number required to check whether the authentication key 500 is shared is extracted.

In addition, the Proxy-Server 200 decrypts Code1 610 with the Proxy authentication key 500 and extracts the [Random-Number, UE-ID] combination. When the necessary information is extracted, the Proxy-Server 200 proceeds to check whether the Random-Number extracted from Code1 and the Random-Number extracted from Code2 are the same, and if the two Random-Number values are the same, the terminal 300 transmits an authentication success message. Establish a Proxy connection by sending to

However, if the two random-number values are different, the next proxy authentication key 500 is created using the following OTP information, and the necessary information is extracted again from the packet for proxy authentication, and the operation of matching the random number again is performed again. If the authentication attempts using the three OTPs and the proxy authentication key 500 have already failed, the Proxy-Server 200 records the terminal information and the authentication failure in a log, and transmits the Proxy authentication failure message to establish the Proxy connection. Reject.

As such, when the Proxy-Manager 100 starts service at the terminal 300 with strong line authentication, the terminal authentication is completed, and the authenticated terminal 300 uses the same Proxy authentication key 500 as the Proxy-Server 200. By generating the proxy, when the Proxy-Server 200 and the terminal 300 proceeds with Proxy authentication, the Proxy-Server 200 only checks whether the terminal 300 shares the same Proxy authentication key 500. It is a concept of the present invention to check whether the terminal 300 completes pre-authentication with the Proxy-Manager 100 so that the Proxy-Server 200 can be quickly completed without the subscriber information.

As shown in FIG. 1, since the MPTCP Aggregation Service System 1000 uses two paths, two proxy authentication processes are performed per communication session. In addition, since the MPTCP Aggregation service system 1000 is serviced in a commercial network, the MPTCP Aggregation service system 1000 must deal with a large amount of subscriber information. However, the MPTCP Aggregation service system 1000 must provide a differentiated service for each subscriber due to the property of premium service. When the existing proxy authentication method is used in such an environment, there is a burden that the Proxy-Server 200 manages a large amount of subscriber information, and each time a proxy communication session is created, a contrast of the subscriber information and the session authentication request is performed. There is a problem that the service performance is greatly reduced because it has to proceed twice.

The present invention proposes a method of minimizing the performance degradation due to proxy authentication without requiring subscriber management for a situation where proxy authentication should be used in a commercial network in which a large amount of subscribers exist. Proxy service such as) can be provided without deterioration due to proxy authentication in commercial mobile network.

The present invention is not limited to the above-described embodiments, and the scope of application is not limited, and various modifications can be made without departing from the gist of the present invention as claimed in the claims.

[Description of the code]

1000: MPTCP Aggregation Service System

100: Proxy-Manager

200: Proxy-Server

300: terminal

400: Initial setting information

410: Group Code 420: Shared Secret for OTP

430: Code Listing 440: Length of Random-Number

450: value of each terminal independent item

500: Proxy authentication key

510: Group-Key 520: Master-Key

600: Proxy authentication information

610: Code1 620: Code2

Claims (14)

1. Proxy-Manager for pre-authenticating the subscriber and forwarding initial configuration information for proxy authentication without subscriber information to the terminal and the Proxy-Server;

   A terminal for generating a username code1 and a password code2 constituting a proxy authentication packet based on the initial configuration information received from the proxy-manager, and transmitting the proxy authentication packet to the proxy-server; And

   Based on the initial configuration information received from the Proxy-Manager, generates an analysis key to enable authentication processing without subscriber information, performs authentication using the analysis key in the authentication request of the terminal, the authentication is Proxy-Server for restoring and storing the information of the completed subscriber;

   Proxy authentication system for providing a proxy service comprising a.
2. The method of claim 1,

   The initial setting information,

   A usage code list including each terminal-independent code item and / or code item dependent on each terminal, a Group Code, a shared secret for generating an One Time Password (OTP), and a random-number,

   In the terminal-dependent code item of each code item included in the usage code list, if the value of the code item that cannot be collected from the network further comprises a value of the corresponding code item Proxy authentication system for provisioning.
3. The method of claim 2,

   Code2 is,

   It consists of the value of the code item included in the usage code list received from the Proxy-Manager from the value of the terminal-dependent code item that can be stored by each terminal, and the Random-Number as long as the length of the Random-Number,

   Code1 is

   The proxy authentication system for providing a proxy service, characterized in that generated by encrypting using a proxy authentication key generated based on the initial configuration information after combining the UE-ID having the information of the terminal and the Random-Number.
4. The method of claim 3, wherein

   The Proxy authentication key is

   Includes Group-Key and Master-key,

   The Group-Key is generated based on the Group Code,

   The master-key is a proxy authentication system for providing a proxy service, characterized in that the OTP generated based on the shared secret for generating the OTP included in the use code list, and each code item included in the use code list .
5. The method of claim 3, wherein

   The Proxy authentication key is

   Providing a proxy service, characterized in that each time one or more of the occurrence of the regeneration period of the OTP value, receiving the authentication policy change from the Proxy-Manager, changes in the value of each code item included in the usage code list occurs Proxy authentication system.
6. The method of claim 1,

   The Proxy-Server,

   The proxy authentication system for providing a proxy service, characterized in that authentication is performed without subscriber information by checking whether the analysis key is the same as the proxy authentication key used when the terminal encrypts the Code1.
7. The method of claim 6,

   The Proxy-Server,

   After extracting Random-Number from Code2 contained in the Password field of the Proxy authentication packet received from the terminal, extracting the decrypted Code1 by decrypting the information stored in the Username field of the Proxy authentication packet using the analysis key, And comparing the Random-Number extracted from the decrypted Code1 with the Random-Number extracted from the Code2 to determine whether the analysis key is the same as the Proxy authentication key.
8. The method of claim 6,

   The Proxy-Server,

   Proxy service, characterized in that to generate the OTP at a plurality of preset time points in order to overcome the difference of the OTP value due to the time asynchronous with the terminal, the analysis key generation and authentication attempt as the number of generated OTP Proxy authentication system for provisioning.
9. An initial setting step of transmitting, by the Proxy-Manager to the terminal and the Proxy-Server, initial configuration information for pre-authenticating the subscriber and performing proxy authentication without the subscriber information;

   A transmitter-side key generation step of generating, by the terminal, Code1 and Code2 used for a proxy authentication packet based on the initial configuration information received from the Proxy-Manager;

   An authentication packet transmission step of transmitting, by the terminal, the Code1 and Code2 to the Proxy-Server in the Username field and the Password field of the Proxy authentication packet, respectively;

   An analysis key generation step of generating an analysis key for allowing the Proxy-Server to process the authentication request without subscriber information based on the initial configuration information received from the Proxy-Manager when an authentication request is made by the terminal; And

   An authentication and user information restoration step in which the Proxy-Server processes the authentication request of the terminal and restores and stores the information of the subscriber which has been authenticated upon successful authentication;

   Proxy authentication method for providing a proxy service comprising a.
10. The method of claim 9,

    In the transmitting key generation step,

    Code2 is a value of a code item included in a usage code list received from the Proxy-Manager among terminal dependent values that each terminal can store, and a Random-Number equal to a Random-Number length received from the Proxy-Manager. Done,

    The code1 is generated by encrypting using a proxy authentication key generated based on the initial configuration information after combining the UE-ID having the terminal information and the random number and generating the proxy authentication for providing a proxy service. Way.
11. The method of claim 10,

    The Proxy authentication key is

    Includes Group-Key and Master-key,

    The Group-Key is generated based on Group Code,

    The master-key is a proxy authentication method for providing a proxy service comprising an OTP generated based on the OTP generation Shared Secret included in the initial configuration information, and each code item included in the use code list.
12. The method of claim 9,

    The analyzing key generation step and the authentication and user information recovery step,

    In order to overcome the difference in the OTP value due to time asynchronous with the terminal, the Proxy-Server repeatedly performs as many as the number of OTPs created at a plurality of preset time points, and attempts to authenticate the terminal. Proxy authentication method to provide.
13. The method of claim 9,

    In the authentication and user information restoration step,

    Proxy authentication method for providing a proxy service, characterized in that for performing the authentication of the terminal without subscriber information by confirming whether the analysis key is the same as the proxy authentication key used in the encryption of the code1 in the terminal.
14. The method of claim 13,

    The authentication and user information restoration step,

    Extracting a Random-Number from Code2 contained in a Password field of a Proxy authentication packet transmitted by the terminal;

    Extracting the decrypted Code1 by decrypting the information stored in the Username field of the Proxy authentication packet by using the analysis key, and extracting a Random-Number included in the decrypted Code1;

    Contrasting the Random-Number extracted from Code1 with the Random-Number extracted from Code2; And

    When the two random numbers coincide, completing terminal authentication, extracting user information of the authenticated terminal from the Proxy authentication packet, and storing the extracted proxy information for monitoring proxy service usage and usage pattern information of each Proxy service subscriber;

    Proxy authentication method for providing a proxy service comprising a.

Images