KR101165350B1 - An Authentication Method of Device Member In Ubiquitous Computing Network - Google Patents

Abstract

The present invention relates to a device member authentication method for community computing in a ubiquitous computing network environment, and the device member authentication method for community computing in the ubiquitous computing network environment includes a management server in a ubiquitous computing network (UCN) environment. A method for performing a first local member authentication, comprising: (a) generating, by the management server, a random number and transmitting the random number to the first local member; (b) encrypting, by the first local member, the random number received from the management server using the stored first master key (1MK) and then transmitting the encrypted random number to the management server; (c) comparing, by the management server, the random number transmitted in step (a) with the random number obtained by decrypting the encrypted message received in step (b) with a first master key; And (d) if the random number comparison result of step (c) is the same, authenticating the first local member by the management server, wherein the same first master key is stored in the management server and the first local member. A device member authentication method for community computing in a ubiquitous computing network environment.

According to the present invention, member authentication and encryption / decryption can be efficiently performed even in author-owned devices using a symmetric key-based master key. Also, according to the present invention, community tokens can be assigned to a plurality of members belonging to a specific community. This has the advantage of simplifying the authentication process between members and improving security.

UCN, Ubiquitous Computing, Security, Key Exchange, Member Registration, Device Registration, Authentication

Description

An authentication method of device member in ubiquitous computing network

The present invention relates to a member authentication and data encryption method in a ubiquitous computing network (UCN) environment, and more particularly, to member authentication and encryption even in a low-frequency device using a symmetric key-based master key. A device member authentication method for community computing in a ubiquitous computing network environment that can perform decryption, and to grant a community token to a plurality of members belonging to a specific community to simplify the authentication process between members and to improve security. will be.

A member authentication method in a UCN environment according to the prior art includes a public key infrastructure (PKI) based on RSA (Rivest Shamir Adlman). Public key infrastructure is a complex security system environment that provides encryption and digital signatures through public key algorithms. The public key infrastructure uses a public key composed of an encryption key and a decryption key to encrypt transmission data, decrypt received data, and authenticate a user through a digital certificate. There are two methods of encrypting data: public key and symmetric key. While the symmetric key method shares the same symmetric key on both sides of the sender and receiver, the public key method differs from the symmetric key method in key management because the encryption key and the decryption key are different. For the commercialization of public key cryptography, the public key infrastructure is a system for generating, authenticating, distributing and securely managing keys.

The public key infrastructure stores certification authorities that issue certificates for public keys, registries that verify the identity and affiliation of users on behalf of a certification authority when users apply for certificates, certificates and user-related information, cross certificates, and certificate revocation lists. This includes a directory, a search place, and a user who generates and verifies digital signatures using public keys in various applications, and encrypts and decrypts data. However, in the public key method, the procedure for registering a certificate for a public key with a certification authority is complicated, and a public key operation must always be performed to check the public key of the other party. The problem is that it is difficult to do and that the Certificate Revocation List (CRL) is always checked.

In addition, during authentication between members, the device requesting service receives a key from the management server and performs circular authentication, which increases the complexity of the authentication procedure.

In order to solve the problems of the prior art as described above, the member authentication and decryption can be efficiently performed even in the author-member device by using a symmetric key-based master key, to a plurality of members belonging to a specific community The aim of the present invention is to provide a device member authentication method for community computing in a ubiquitous computing network environment that can improve security while at the same time simplifying the authentication process between members by granting community tokens.

In order to achieve the above object, according to a preferred embodiment of the present invention, in the method for the management server to perform the first local member authentication in a ubiquitous computing network (UCN) environment, (a) Generating, by the management server, a random number and transmitting the random number to the first local member; (b) encrypting, by the first local member, the random number received from the management server using the stored first master key (1MK) and then transmitting the encrypted random number to the management server; (c) comparing, by the management server, the random number transmitted in step (a) with the random number obtained by decrypting the encrypted message received in step (b) with a first master key; And (d) if the random number comparison result of step (c) is the same, authenticating the first local member by the management server, wherein the same first master key is stored in the management server and the first local member. A device member authentication method for community computing in a ubiquitous computing network environment is provided.

 In this case, the above-described first master key may be configured to be randomly generated using the administrator password as the seed value.

In addition, the aforementioned first master key may be a symmetric key based master key.

Meanwhile, in the aforementioned ubiquitous computing network environment, the device member authentication method for community computing includes (e) a hash value of the corresponding data when the first local member attempts to transmit data to the management server after step (d). Generating a; (f) encrypting, by the first local member, the hash value and data generated in step (e) with a first master key and transmitting the encrypted data to a management server; (g) hashing the data after the management server decrypts the encrypted data received in the step (f) with a first master key; (h) comparing the hash value generated in step (f) with the hash value generated directly by the management server to determine the integrity of the data.

Here, when the first local member belongs to a specific community and receives a community token from the management server, the first local member and the management server may be configured to ensure integrity by using a community token instead of a master key. have.

According to another preferred embodiment of the present invention, in a method for performing authentication between a first local member and a second local member in a ubiquitous computing network (UCN) environment, (A) a service server is included in a community Transmitting information of the first local member and the second local member to the management server; (B) generating, by the management server, a first community token to be transmitted to the members to be included in the community by using the information of the first local member and the second local member transmitted from the service server; (C) encrypting, by the management server, the first community token generated in the step (B) with a first master key and a second master key, respectively, and multicasting the first local token to the first local member and the second local member, respectively; (D) the first local member and the second local member decrypt the first community tokens received from the management server using their master keys and store them in a secure area; Including, The security server and the first local member is stored in the same first master key, the security server and the second local member is stored in the same second master key ubiquitous computing network, characterized in that A member-member authentication method in an environment is provided.

 Here, the member to be included in the community in step (A) described above may be configured to include at least two members according to the information transmitted from the service server.

In addition, the members belonging to the same community as the above-described management server may be configured to encrypt / decrypt data by using mutually stored community tokens.

As described above, according to the device member authentication method for community computing in the ubiquitous computing network environment according to the present invention, member authentication and decryption can be efficiently performed even in a low-power device using a symmetric key-based master key. There is an advantage.

In addition, according to the present invention, by granting community tokens to a plurality of members belonging to a specific community, it is possible to simplify the authentication process between members and to improve security.

Hereinafter, exemplary embodiments of a device member authentication method for community computing in a ubiquitous computing network environment will be described in detail with reference to the accompanying drawings.

Prior to the description of the preferred embodiment of the present invention, the definitions of terms used below are as follows.

UCN: Ubiquitous Computing Network,

Management server: centralized server responsible for device authentication and community formation,

Device member: Local device (hereinafter referred to as `` member '') certified within UCN environment,

MK: Symmetric key-based master key (hereinafter referred to as `` MK '') shared between the management server and the device,

Community: Dynamic network area that enables members to communicate with each other.

Community Tokens: Keys needed for community formation and data encryption within communities,

Secure Area: Secure storage space such as memory on members.

1 is a diagram illustrating a flow of UCN according to the present invention. A configuration of a ubiquitous computing network according to a preferred embodiment of the present invention will be described with reference to FIG. 1.

Ubiquitous computing, also known as pervasive computing, refers to an information technology (IT) environment that can be freely connected to a network regardless of time and place, computer or network conditions. In other words, ubiquitous computing refers to a human-centered computing environment that embeds computer chips into everything and optimizes the invisible living environment through mutual communication.

As shown in FIG. 1, the UCN according to the present invention includes an external user terminal 100, a management server 120, an application service server 130, an administrator terminal 140, and a plurality of members 150, 152, and 154. It may include.

The external user terminal 100 performs a function of controlling the operation of the members 150, 152, and 154 constituting the UCN by accessing the management server 120 through a communication path such as the Internet 110 according to a user's operation. Done. The external user terminal 100 may be implemented as an information communication device such as a personal computer, a notebook, a mobile phone and the like configured to perform data communication through a network.

The management server 120 performs a function of configuring / managing a ubiquitous computing network, and is a centralized server that is responsible for authentication and community formation of members 150, 152, and 154 participating in the network in detail. The control request from the user terminal 100 is received to control the functions of the members 150, 152 and 154. The member authentication process of the management server 120 will be described in detail with reference to FIG. 2.

The manager terminal 140 accesses the management server 120 according to a manager's operation and manually deletes the members 150, 152 and 154 included in the community, or the members 150, 152 and 154 and the management server 120. ) To change the master key of the members (150, 152, 154) stored in.

The members 150, 152, and 154 perform data communication to participate in the UCN according to the present invention. Information communication devices such as mobile phones, home appliances, and personal computers, and devices connected thereto, such as telephones, facsimiles, and video recording / playback devices, are provided. As a function, the function may be controlled by the management server 120. The authentication process and community authentication and generation of the members 150, 152 and 154 will be described later with reference to FIGS.

The application service server 130 performs a function of providing various applications necessary for driving the members 150, 152, and 154 and the management server 120.

First, the authentication method according to the present invention configures a system using a symmetric key based master key to service without problems even in the case of low resource devices. The master key is a symmetric key for encrypted communication between the management server 120 and the members 150, 152, and 154, and is an identification value for identifying the members 150, 152, and 154. The symmetric key decryption algorithm is a simple reverse operation of encryption (eg, addition is subtraction, multiplication is division), in which the sender and receiver share a key, so that the key used for encryption and decryption is the same. This is simply a technique for encrypting and decrypting data with a single private key. Since symmetric key-based cryptography is performed by repeating simple bit operations, the amount of data that can be encrypted per unit time is relatively large. Therefore, the symmetric key-based encryption / decryption method is suitable for handling a large amount of data, and the encryption and decryption keys are the same, so that the processing speed is fast and the service can be smoothly performed even in a low resource device. Such a master key is generated and assigned a unique value to each local member, and stored in the security area of the management server 120 and the local member is used for encryption and decryption and authentication. That is, when the master key for the first local member is called the first master key and the master key for the second local member is called the second master key, the management server 120 has both the first master key and the second master key. The first master key is stored in the security area of the first local member, and the second master key is stored in the security area of the second local member to be used for authentication and decryption.

The system of the present invention for achieving the above object consists of a centralized management server 120 responsible for device authentication and community formation and a device for providing a service. As the administrator initially registers the local member, the management server 120 and the members 150, 152, and 154 share a symmetric key-based master key (hereinafter, 'MK') between the server and the member. The master key may be randomly generated using an administrator password as a seed value.

Meanwhile, according to another aspect of the present invention, when a plurality of local members are configured as a specific community, community tokens generated by the management server 120 and broadcast to each local member and stored in the security area of the local member are substituted for the master key. Can be used to configure integrity. When the embodiment is configured in this manner, even if authentication for a plurality of members is required, multicasting the community token as described above to each member can form a community that can be easily communicated between members, thereby increasing the size of the community. As compared to the authentication process according to the prior art may have an advantage that can significantly reduce the complexity of the authentication process.

Hereinafter, the authentication and encryption / decryption process of the UCN configured as described above will be described in detail with reference to FIGS. 2 to 6.

First, Figure 2 is a flow chart showing the authentication flow of the management server-member in accordance with the present invention. First of all, management server-member authentication uses challenge / response authentication.

The management server sends a message consisting of a random number (N _S ) to the first local member for authentication of the member (S200), the first local member receives a random number transmitted from the management server to the first master key shared in advance Encrypt (S210), and transmits the encrypted E _MK1 (N _S ) to the management server (S220).

After receiving the encrypted E _MK1 (N _S ) transmitted from the first local member, the management server decrypts the message to D _MK1 (E _MK1 (N _S )) using the stored first master key (S230). The decrypted result is compared with the random number N _S transmitted to the first local member in step S200 (240). If the same, the local member is authenticated.

3 is a diagram illustrating a community authentication and generation flow according to the present invention, and FIG. 4 is a flowchart illustrating a community authentication and generation flow according to the present invention.

Member-member authentication is to perform the authentication using a community token (hereinafter 'CT') (Fig. 3).

First, if the service server transmits the information of the first local member and the second local member to be included in the community to the management server (plural members may be included in the community, in the following two members join the community for convenience of explanation) The management server generates a random CT that uses the administrator password as a seed value to form a community by using the information of the first local member and the second local member transmitted from the service server. (S400).

After the CT is generated, the management server generates an E _MK (CT) message (S410) by encrypting each of the local members included in the community with a master key (S410) and multicasts the message generated by each member (S420). . That is, the management server transmits the E _MK1 (CT) message to the first local member and the E _MK2 (CT) message to the second local member.

Each local member receiving the message transmitted from the management server uses the stored master key and decrypts it like D _MK (E _MK (CT)) (S430) to store the CT value in the secure area (Secure Area) ( S440).

When a community is created through the above-described process, subsequent authentication and decryption between members are performed using CT values.

5 is a diagram illustrating a flow of encryption / decryption between member-members according to the present invention.

Once the community is formed, members and members included in the community, the management server and members on the community to ensure confidentiality by encrypting (510) / decryption (520) during data transmission using the CT (500).

6 is a flowchart illustrating a flow of verifying data integrity between management servers and members according to the present invention. Hereinafter, it will be described on the assumption that the data communication between the first local member and the management server.

When the first local member intends to transmit data to the management server, first, a hash value of the corresponding data is generated (S600).

When the hash value is generated, the first local member encrypts the generated hash value and data using the stored first master key (S610) and transmits the hash value to the management server.

The management server receiving the encrypted data transmitted from the first local member decrypts the encrypted data using the stored first master key (S620) and hashes the data to generate a hash value (S630).

When the hash value is generated, the management server compares the received hash value and the directly generated hash value (S640), and if the received hash value and the directly generated hash value are the same (S650), the data is recognized and transmitted. If the received hash value and the directly generated hash value are not the same, the integrity of the data is not recognized (S660).

In this case, when the member belongs to a specific community, it may be configured to encrypt / decrypt a message including a hash value and data using CT instead of MK.

Preferred embodiments of the present invention described above are disclosed for purposes of illustration, and those skilled in the art will be able to make various modifications, changes and additions within the spirit and scope of the present invention. Additions should be considered to be within the scope of the following claims.

1 is a view showing a flow of UCN according to the present invention,

2 is a flowchart illustrating an authentication flow of a management server-member according to the present invention;

3 is a diagram illustrating a community authentication and generation flow according to the present invention;

4 is a flow chart illustrating a community authentication and generation flow in accordance with the present invention;

5 is a diagram illustrating a flow of encryption / decryption between member-members according to the present invention;

6 is a flowchart illustrating a flow of verifying data integrity between management server and members according to the present invention.

Description of the Related Art [0002]

100: external user terminal 110: the Internet

120: Security Privacy Gateway

130: application service server

140: administrator terminal 150: Type A member

152: type B member 154: type C member

Claims (8)

In the method in which the management server performs the first local member authentication in a ubiquitous computing network (UCN) environment, (a) the management server generating a random number and transmitting the random number to the first local member; (b) encrypting, by the first local member, the random number received from the management server using the stored first master key (1MK) and then transmitting the encrypted random number to the management server; (c) comparing, by the management server, the random number transmitted in step (a) with the random number obtained by decrypting the encrypted message received in step (b) with a first master key; And (d) if the random number comparison result is the same in the step (c), the management server authenticating the first local member; The same first master key is stored in the management server and the first local member, The device member authentication method for community computing in the ubiquitous computing network environment may be performed after step (d). (e) generating a hash value of the data when the first local member attempts to transmit data to the management server; (f) encrypting, by the first local member, the hash value and data generated in step (e) with a first master key and transmitting the encrypted data to a management server; (g) hashing the data after the management server decrypts the encrypted data received in the step (f) with a first master key; (h) the management server comparing the hash value received in step (f) with the hash value generated directly to determine the integrity of the data; When the first local member belongs to a specific community and receives a community token from the management server, the first local member and the management server ensure the integrity by using a community token instead of a master key. Device member authentication method for community computing in network environment. The method of claim 1, The first master key is a device member authentication method for community computing in a ubiquitous computing network environment, characterized in that randomly generated using the administrator password as the seed value. The method of claim 1, The first master key is a device member authentication method for community computing in a ubiquitous computing network environment, characterized in that the master key based on the symmetric key. delete delete delete delete delete

Images