KR100738353B1 - Apparatus and its method of optimizing security of the home network - Google Patents

Abstract

1. TECHNICAL FIELD OF THE INVENTION

The present invention relates to an apparatus and method for optimizing home network security.

2. The technical problem to be solved by the invention

The present invention registers the authentication information generated by using the user's personal information and the information of the mobile device in the authentication server (AS) and home server (HS) secure IP address assignment and Internet key exchange (IKE: Internet Key) The purpose of the present invention is to provide an apparatus and method for optimizing home network security for providing enhanced IP Security (IPSec) services in a home network.

3. Summary of the Solution of the Invention

The present invention, in the home network security optimization device, receives the personal information about the user who purchased the mobile device (MD) by encrypting the serial number (SN) of the mobile device (MD) and the user's personal information E-commerce store terminal means for transmitting authentication information and assigning an authentication number accordingly to the mobile device; The serial number SN of the mobile device MD and the authentication information encrypting the personal information of the user are received and registered from the e-commerce store terminal means, and the authentication number in the form of a private key and a password is entered. Authentication means for issuing to an electronic transaction store terminal means and delivering a serial number and a public key of the mobile device (MD); And receive and register a serial number and a public key of the mobile device (MD) from the authentication means, and when the mobile device (MD) accesses a home network, automatically through the password type authentication. Home control means for providing a service by assigning an IPv6 address to (MD).

4. Important uses of the invention

The present invention is used for home network security system and the like.

Home Network System, Home Server, User Privacy, Mobile Device Information, Authentication Information, Auto Address Assignment, IPSec, IKE

Description

Apparatus and its method of optimizing security of the home network}

1 is a configuration diagram of an embodiment of a home network security optimization apparatus according to the present invention;

Figure 2 is a detailed description of an embodiment of the security information setting and exchange structure using the authentication server in the home network security optimization device according to the present invention,

Figure 3 is a detailed description of an embodiment of the authentication and encryption information exchange process when a user purchases and registers a mobile device in a home network security optimization device according to the present invention;

4 is a flowchart illustrating an embodiment of a method for optimizing home network security according to the present invention.

<Description of the symbols for the main parts of the drawings>

101: U (Users)

102: Electronic Store (ES: Electronic Store)

103: authentication server (AS)

104: Mobile Devices (MD)
105: router

106: home server (HS)

107: home network

108: Device Lists (DL)

The present invention relates to an apparatus and method for optimizing home network security, and more particularly, authentication information generated using personal information of a user and information of a mobile device (MD) to an authentication server (AS) and a home server (HS). To provide a secure IP address assignment and IKE (Internet Key Exchange, IKE) to provide enhanced IP Security (IPSec) services in a home network. It is about.

In general, IPSec (IP Security) protocol has been used as an improved security solution in small Internet networks using IPv4 addresses using pre-shared keys. It also supports automatic configuration of IPSec for fixed IP addresses, but automatic address assignment, one of the upcoming features of IPv6, limits the use of IPSec with pre-shared keys. As the Internet 2 era approaches, home appliances, including various mobile devices, will also need a mechanism to accommodate the ubiquitous environment, which automatically receives IP addresses from the home server.

The IPv6 supports basic security policies through AH and ESP headers, and provides enhanced security based on a virtual private network (VPN) for a predetermined IPv6 address. Although IPv6 supports Zero Configuration on the local link using the Neighbor Discovery Protocol (hereinafter referred to as “ND”), it also supports Address Auto-Configuration. These characteristics are inappropriate to be applied in conjunction with IPSec in ubiquitous environment.

That is, when the SA is exchanged in the bootstrapping state of the mobile node having no address set, the chicken-and-egg problem occurs due to IKE. Due to this problem, a lot of researches have been made to devise a solution for the selection of address assignment and security key distribution for home mobile devices in home networks.

The present invention has been proposed to solve the above problems, by registering the authentication information generated using the user's personal information and the information of the mobile device (MD) to the authentication server (AS) and the home server (HS) It is an object of the present invention to provide an apparatus and method for optimizing home network security for providing enhanced IP security (IPSec) services in a home network by providing secure IP address assignment and IKE.

Other objects and advantages of the present invention can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

The apparatus of the present invention for achieving the above object, in the home network security optimization device, receives the personal information about the user who purchased the mobile device (MD) receives the serial number (SN) of the mobile device (MD) and An electronic transaction store terminal means for transmitting authentication information by encrypting the user's personal information, and assigning an authentication number to the mobile device; The serial number SN of the mobile device MD and the authentication information encrypting the personal information of the user are received and registered from the e-commerce store terminal means, and the authentication number in the form of a private key and a password is entered. Authentication means for issuing to an electronic transaction store terminal means and delivering a serial number and a public key of the mobile device (MD); And receive and register the serial number and public key of the mobile device (MD) from the authentication means, and when the mobile device (MD) accesses a home network, automatically through the password type authentication. Home control means for providing a service by assigning an IPv6 address to (MD).

In addition, another apparatus of the present invention, in the home network security optimization device, personal information about the user who purchased the mobile device (MD) and authentication information encrypted with the serial number (SN) of the mobile device (MD) It receives and registers from an external e-commerce store terminal means, issues an authentication number in the form of a private key and password to the external e-commerce store terminal means, and serial number and public key of the mobile device (MD). Authentication means for delivering a public key; Registration means for receiving and registering a serial number and a public key of the mobile device (MD) from the authentication means; And address assignment means for automatically allocating an IPv6 address to the mobile device MD through authentication of a password form when the mobile device MD accesses a home network.

On the other hand, the method of the present invention for achieving the above object, in the home network security optimization method, personal information about the user who purchased the mobile device (MD) and the serial number (SN) of the mobile device (MD) Receiving and registering encrypted authentication information; Issuing an authentication number in the form of a private key and a password; Receiving and registering a serial number and a public key of the mobile device (MD); And automatically assigning an IPv6 address to the mobile device MD through authentication of a password type as the mobile device MD accesses a home network.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings, whereby those skilled in the art may easily implement the technical idea of the present invention. There will be. In addition, in describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description thereof will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.
Prior to the description of the present invention, a general public key infrastructure (PKI) will be described.
In public key cryptography, the public and private keys are generated simultaneously by the certificate authority using the RSA algorithm. The private key is given only to the requester, and the public key is published as part of a digital certificate in a directory accessible to everyone. Private keys are never shared with others or transmitted over the Internet.
You use your private key to decrypt text that someone encrypted with their public key found in the public directory. Therefore, if he wants to send a message to someone, he first finds the recipient's public key through a central administrator, such as an authentication server, and then encrypts the message using that public key. The person who receives the message decrypts it using his private key. In addition to encrypting the message, the sender encrypts the digital certificate with its private key and sends it together so that the sender must know that the sender is the sender.
These RSA algorithms are the most commonly used encryption and authentication algorithms, and are included as part of Netscape and Microsoft's Web browser functionality, and form part of the existing Web, Internet, and computing standards. Detailed mathematical descriptions of the algorithms used to obtain public and private keys can be found on the RSA website. In short, this algorithm is a product of two large prime numbers (the prime numbers are numbers and numbers divided by one), and two sets of additional keys used to construct the public key and the private key. Derivation of the number system is accompanied by a detailed description of the RSA algorithm.

1 is a block diagram of an embodiment of a home network security optimization apparatus according to the present invention.

As shown in FIG. 1, the apparatus for optimizing home network security according to the present invention may receive personal information about a mobile device (MD, 104) and a user who purchased the mobile device (MD, 104). Encrypts the serial number (SN) of the MD (104) and the user's personal information and transmits authentication information to the authentication server (AS) 103, and receives the corresponding authentication number from the authentication server (AS, 103). E-commerce store (ES, 102) for assigning to the mobile device (MD, 104), serial number (SN) of the mobile device (MD, 104) from the e-commerce store (ES, 102) and the user's personal Receive and register authentication information encrypted with information, and issue an authentication number in the form of a private key and password to the e-commerce store (ES, 102), the serial number of the mobile device (MD, 104) and In order to transfer the public key to the home server (HS, 106) Receive the serial number and public key of the mobile device (MD, 104) from the authentication server (AS, 103) and the authentication server (AS, 103), and registers in the device list (DL, 108), Home server (HS, 106) for providing a service by automatically assigning an IPv6 address to the mobile device (MD, 104) through authentication of a password form when the mobile device (MD, 104) accesses the home network (107). ).

As shown in FIG. 1, the home network security optimization process operates as follows.

First, a user (U, 101) who purchases an IPv6-based mobile device (MD) (terminal) transmits his / her personal information (User Details: social security number, personal number, contact information, etc.) to the electronic transaction store (ES, 102) To the place of purchase). Accordingly, the electronic store (ES) 102 in the serial number (SN) and personal information (User Details: social security number, password, personal number, contact information of the mobile device (MD, 104) purchased by the user (U, 101) And the like) are encrypted by a predetermined algorithm, and the encrypted authentication information is transmitted to the authentication server AS 103 to request registration.

Accordingly, the authentication server (AS) 103 issues an authentication number in the form of a private key and password (Private Key + Password) using an RSA key algorithm, and then transmits the authentication number to a purchase destination terminal (terminal of an electronic transaction store). To be assigned to device MD (104). When assigning a private key to the mobile device MD, 104, purchase information and an authentication number are assigned to the user U101.

At the same time, the authentication server (AS) 103 uses the serial number (SN) and the public key of the mobile device (MD) in order to securely use the home network service in the home registration of the mobile device (MD) later. Send to home server (HS, 106).

Subsequently, the user (U, 101) moves to the home network (107) location and requests authentication using a private key and password (Private Key + Password) when requesting the home server (HS, 106) and automatic address setting. The mobile device MD is authenticated. That is, the mobile device (MD, 104) possessed by the user is compared with the device list (DL, 108) (storage means) already registered in the home server (HS, 106) in the home, and is automatically and securely obtained an IPv6 address after authentication. It is assigned and used.
That is, the home server HS, 106 uses the private key of the mobile device MD, 104 and the public key of the mobile device MD, 104, which are pre-registered in the device list DL, 108 (storage means). The operation authenticates the private / public key pair and assigns an IPv6 address accordingly.
This technique is generally well known through the above-mentioned RSA key algorithm, and the present invention uses it.

Figure 2 is a detailed description of the embodiment of the security information setting and exchange structure using the authentication server in the home network security optimization device according to the present invention.

As shown in FIG. 2, the personal information (resident number, personal number, contact number, etc.) provided by the user U 101 may be stored in the mobile device MD purchased from the electronic transaction store ES 102 (purchase point). The data is encrypted (AES) along with information such as a serial number (SN) and transmitted to the authentication server (AS) 103. At this time, the information exchange between the authentication server (AS) 103 and the e-commerce store (ES, 102) (purchase destination) is encrypted using a unique code of only the registered e-commerce store (ES, 102) (purchase destination). Personal information of the and the serial number (SN) of the mobile device can be securely transmitted to the authentication server (AS, 103).

The authentication server (AS) 103, which has received this information, registers the serial number (SN) and other personal information of the mobile device (MD), and uses a private key and password (Private Key + Password) through the RSA key algorithm. A certificate number of a type is issued and sent to an electronic transaction store (ES) 102 (purchase point).

Accordingly, the electronic store (ES) 102 assigns a private key to the mobile device (MD) 104 and gives purchase information and an authentication number to the user (U, 101).

3 is a detailed view illustrating an embodiment of a process of exchanging authentication and encryption information when a user purchases and registers a mobile device in a home network security optimization device according to the present invention.

As shown in FIG. 3, the information and the public key of the mobile device MD registered in the authentication server AS 103 are transferred to the home server HS 106. Then, the mobile device (MD, 104) possessed by the user is compared with the device list (DL, 108) (storage means) already registered in the home server (HS, 106) in the home, and is automatically and securely obtained an IPv6 address after authentication. It is assigned and used.

4 is a flowchart illustrating an embodiment of a method for optimizing home network security according to the present invention.

First, a user (U, 101) purchases a home terminal (mobile device, MD) (401) and purchases personal information (User Details: social security number, personal number, contact information, etc.) (user's personal information) through the Internet. Provided to e-commerce store (ES, 102) (402).

Accordingly, after confirming the registration of the user's personal information (403), the e-commerce store (ES, 102) and the serial number (SN) and the personal information (SN) of the mobile device (MD, 104) purchased by the user (U, 101) User Details: Social Security number, password, personal number, contact information, etc.) is encrypted by a predetermined algorithm, and the encrypted authentication information is transmitted to the authentication server (AS) 103 to request registration (404). At this time, the information exchange between the authentication server (AS) 103 and the e-commerce store (ES, 102) (purchase destination) is encrypted using a unique code of only the registered e-commerce store (ES, 102) (purchase destination). Personal information of the and the serial number (SN) of the mobile device can be securely transmitted to the authentication server (AS, 103).

Accordingly, the authentication server registers authentication information for the newly purchased mobile device MD (104) by the user (U, 101) (405).

When the authentication information is confirmed to be registered with the authentication server (AS) 103, the authentication server (AS) 103 issues an authentication number in the form of a private key and a password using an RSA key algorithm. After that, it is transmitted to the purchase destination terminal (terminal of the electronic transaction store) to be assigned to the mobile device MD (104). When assigning a private key to the mobile device MD, 104, purchase information and an authentication number are assigned to the user U101 (not shown in the figure).

At the same time, the authentication server (AS) 103 to use the authentication information, including the serial number (SN) and the public key (Public Key) of the mobile device (MD, 104) to use later in the home registration of the mobile device (MD) To the home server (HS, 106) (406). As a result, the home server registers the authentication information (407).

After that, the user (U, 101) moves to the home network and connects the home server (HS, 106) and the mobile device (MD) so that the user can use the private key and password (Private Key + Password) In step 408, the home server is authenticated. That is, when the user (U, 101) moves to the home network (107) location and requests the home server (HS, 106) and automatic address setting, the authentication process (Authentication) using a private key and password (Private Key + Password) is performed. The mobile device MD is authenticated.

At this time, the mobile device (MD, 104) is compared with the device list (DL, 108) previously registered in the home server (HS, 106) of the home, and when authentication is confirmed, an IPv6 address is automatically and securely assigned to the mobile device (MD). 104, the terminal can use the home network service (409).

Therefore, home network security can be optimized through a sequential flow for secure IKE exchange and use through home server authentication (408).

In the future, the IKE between the home server (HS, 106) and the mobile device (MD, 104) is not additionally required when setting IPSec. This can optimize security by using an RSA key that has already been registered and exchanged through the authentication server (AS) 103 before address assignment.
That is, when the mobile device (MD, 104) moves to the home and sets an automatic address with the home server (HS, 106), the home server (HS, 106) encrypts the IP address information with the public key and the mobile device (MD, 104). The mobile device (MD, 104) decrypts the IP address information encrypted with the public key with the private key and receives the IP address information without a separate IKE request.
Meanwhile, in order to control various devices existing in the home network, the use of the authentication server is inevitable, and only the mobile device should know the private key generated through the authentication server. That is, the mobile device does not generate a key pair directly, but instead generates a public key and a private key through a third authentication server.
The present invention is not a proposal of a key generation and management module for each mobile device, and it is also expected that it is impossible to establish an authentication server in a home server that will exist in each home in reality. Of course, the present invention relates to a home network security optimization device that proposes public key disclosure and private key management, which is in line with the technical idea of PKI.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

As described above, the present invention, if the IKE support, including authentication and registration of the mobile device using the authentication server for the IPSec service in the IPv6-based home network Chicken-and-Egg (Chicken-and) that could not be achieved in the existing IPSec -Egg) The problem can be solved easily. That is, it is possible to support secure IKE exchange in an IPv6-based ubiquitous home network using an authentication server for mobile nodes registered in the home network through an authenticated procedure.

In addition, the present invention improves security by supporting secure key exchange through authentication of the mobile device for more secure IKE exchange in consideration of the problem of selecting the address assignment and security key distribution before and after the home mobile device in the home network. In addition, it is possible to realize the characteristics of IPv6, that is, automatic address allocation and zero configuration without external threats, thereby optimizing the application and security of mobile nodes using IPSec.

Claims (5)

In the home network security optimization device, Receives personal information about a user who purchased a mobile device (MD) and transmits authentication information by encrypting the serial number (SN) of the mobile device (MD) and the user's personal information, and transmits the authentication number accordingly. E-commerce store terminal means for allocating to the device; The serial number SN of the mobile device MD and the authentication information encrypting the personal information of the user are received and registered from the e-commerce store terminal means, and the authentication number in the form of a private key and a password is entered. Authentication means for issuing to an electronic transaction store terminal means and delivering a serial number and a public key of the mobile device (MD); And The serial number and the public key of the mobile device MD are received from the authentication means and registered, and when the mobile device MD accesses a home network, the mobile device MD is automatically authenticated through a password. Home control means for providing service by assigning IPv6 address to MD) Home network security optimization device comprising a. The method of claim 1, The e-commerce store terminal means, And assigning the purchase information and the authentication number to the user when assigning the authentication number to the mobile device. The method according to claim 1 or 2, The e-commerce store terminal means, And encrypting the serial number (SN) of the mobile device (MD) and the user's personal information using its own unique code. In the home network security optimization device, Personal information of the user who purchased the mobile device (MD) and authentication information encrypted with the serial number (SN) of the mobile device (MD) are received and registered from an external electronic transaction store terminal means, and a private key. And authentication means for issuing an authentication number in the form of a password to the external electronic transaction store terminal means and delivering a serial number and a public key of the mobile device (MD); Registration means for receiving and registering a serial number and a public key of the mobile device (MD) from the authentication means; And Address assignment means for automatically allocating an IPv6 address to the mobile device MD through authentication of a password type when the mobile device MD accesses a home network; Home network security optimization device comprising a. In the home network security optimization method, Receiving and registering personal information about a user who purchased a mobile device (MD) and authentication information that encrypts a serial number (SN) of the mobile device (MD); Issuing an authentication number in the form of a private key and a password; Receiving and registering a serial number and a public key of the mobile device (MD); And Automatically assigning an IPv6 address to the mobile device MD through authentication of a password type as the mobile device MD accesses a home network; Home network security optimization method comprising a.

Images