CN100499899C - Playback attack prevention method - Google Patents

Abstract

The invention discloses a method for preventing replay attacks, the method comprising: A, after the mobile station switches to the target base station, both the mobile station and the authentication device regenerate the AK, and update the AK serial number; B, the authentication device generates the The AK and the updated AK serial number are sent to the target base station; C. The message exchanged between the mobile station and the target base station carries the updated AK serial number. In the present invention, the mobile station and the authentication device update the AK serial number during the handover process within an authentication period, and carry the updated AK serial number in the message during the communication process between the mobile station and the target base station. Therefore, in an authentication Within a period, even if the mobile station establishes connections with the same base station multiple times, messages with the same sequence number will not appear, thereby preventing replay attacks while ensuring normal communication.

Description

A Method to Prevent Replay Attack

technical field

The invention relates to the technical field of authentication in the communication field, in particular to a method for preventing replay attacks.

Background technique

IEEE802.16 is a point-to-multipoint wireless access technology standard defined by IEEE. The system defined by IEEE802.16 consists of a base station (BS) and multiple mobile stations (MS). The communication between the base station and the mobile station is carried out in units of radio frames. Due to the openness and mobility of the wireless mobile communication system, the communication of the mobile station is easy to be intercepted, and the system is also vulnerable to attack. For example, the attacker forges the identity of the mobile station and embezzles the network. Therefore, almost all wireless communication systems have a complete set of security measures, including authentication and encryption, to ensure communication security and prevent attacks. Authentication refers to confirming the identity of the mobile station to ensure that it is a legal mobile station; encryption refers to encrypting data on the air interface to ensure the privacy of communication. Generally, in order to improve the dynamics of the key and further improve the security of the system, the key used for encryption is connected with the authentication process, and the key is dynamically generated and distributed through the authentication process.

In the IEEE802.16 system, a variety of authentication methods can be used, such as RSA (a public key encryption algorithm developed by Rivest, Shamir, and Adleman), Extensible Authentication Protocol (EAP), RSA+EAP, EAP+EAP, etc. , the system generates an authorized key (AuthorizedKey, AK) through these authentication methods, and then regenerates other keys used in the communication process through AK.

The following uses EAP authentication as an example to briefly describe the process of generating AK and other keys used in the communication process after the mobile station accesses the base station. As shown in Figure 1, the process of generating a key through EAP authentication is as follows:

In step 101, the mobile station interacts with the authentication server for EAP authentication before accessing the base station, and generates a master session key (Master Session Key, MSK) after completing the EAP authentication. Then from step 102 to step 105, the authentication server transmits the MSK to the authentication device (Authenticator), and the authentication device first calculates the pairwise master key (Pairwise Master Key, PMK) from the MSK according to the agreement, and then according to the PMK and the mobile station's The base station identifier (BSID) to be accessed and the mobile station identifier (MSID) calculate the AK, and then pass the calculated AK to the base station to be accessed by the mobile station; after the base station receives the AK, it generates an uplink link based on the AK The key of the check code of the message (CMAC_KEY_U, or HMAC_KEY_U), the key used to calculate the check code of the downlink message (CMAC_KEY_D, or HMAC_KEY_D) and the key used to encrypt the actual encryption key (TEK) ( KEK).

During the execution of the above steps 102 to 105, correspondingly on the mobile station side, step 102' and step 103' are executed: the mobile station MSK calculates the PMK, then calculates the AK according to the PMK, and then generates an uplink and downlink message according to the AK The verification code of the key and KEK.

Then in step 106 to step 109, the mobile station sends a message request TEK to the base station, and after the base station receives the message, it generates a random number as the TEK, then encrypts the TEK with KEK, and sends it to the mobile station, after which the mobile station and the base station The communication between them is encrypted using TEK encrypted by KEK.

From step 110 to step 112, when the mobile station needs to update the TEK, it sends a message requesting TEK to the base station again, and the base station generates a new TEK, encrypts the TEK with KEK, and sends it to the mobile station.

The above is a description of the key generation process using EAP as an example. When other authentication methods are used, the difference from the above process is only that the process before generating AK is different, that is, the method of generating AK is different, and when generating AK After that, the method of generating other keys based on AK is the same as the above process. Among the various specific authentication methods, the methods for generating AK and other keys can be realized by referring to the methods in the protocol, and will not be described in detail here.

In the above step 109, during the communication process, the sender calculates the check code according to the message text and the key used to calculate the message check code by using the algorithm known by the sender and the receiver, and uses the calculated check code Send it to the recipient together with the message text; after receiving the above verification code and the message text, the recipient calculates the verification code based on the algorithm known to both parties and the key used to calculate the verification code, and then sends the calculated The check code is compared with the received check code, and if the two are equal, the message check passes; otherwise, the check fails. Since the above-mentioned verification key is private shared information calculated by the sender and the receiver respectively according to the AK, it can be guaranteed that the attacker cannot calculate the correct verification key and cannot tamper with the message.

In the communication process of step 109 above, although the verification key can ensure that the message is not tampered with, replay attacks cannot be prevented. A replay attack means that the attacker intercepts the data sent by one of the parties A (or B) during the interaction between the two parties A and B, and resends the above-mentioned intercepted data to B (or A) at a later time, so that The attacker can pretend to be one of the two communication parties to deceive the other party and achieve the purpose of attacking the network.

To prevent replay attacks, it is common practice to add a sequence number to each message to ensure that identical messages will not appear during normal communication. In this way, when the attacker performs a replay attack, the receiver can determine that the message is illegal, thereby preventing the replay attack. According to the IEEE802.16 protocol, the sequence number carried by the downlink management message is the encrypted downlink message authentication code number CMAC_PN_D, and the sequence number is incremented by one each time a downlink management message is sent; the sequence number carried by the uplink management message is the encrypted uplink message authentication code number CMAC_PN_U , each time an uplink management message is sent, the sequence number is incremented by one. In addition, the above CMAC_PN_D and CMAC_PN_U can also be replaced by the hashed downlink message authentication code sequence number HMAC_PN_D and the hashed uplink message authentication code sequence number HMAC_PN_U.

In a wireless communication network, since the mobile station is mobile and the base station is fixed, as the mobile station moves and passes through the coverage areas of different base stations, the mobile station ensures communication by changing the base station for communication. continuity, this process is called switching. Before and after the handover, if no re-authentication is performed, the PMK or PAK of the mobile station will not change, and the PMK sequence number (Sequence Number) and PAK Sequence Number will not change, so the AKSequence Number will not change, but due to the connection The base station has changed. According to the previous method of calculating AK, after the base station changes, the AK has changed due to the change of the BSID. After the AK is updated, CMAC_PN_D and CMAC_PN_U are also updated.

The process of updating the key during the handover process is: after the mobile station is handed over, the target base station requests the AK of the mobile station from the authentication device, and the authentication device generates a new AK corresponding to the base station and sends it to the base station; Re-initialize CMAC_PN_D and CMAC_PN_U, that is, calculate the two from 0; and the mobile station also updates the AK, and also re-initializes CMAC_PN_D and CMAC_PN_U, and sets the key in the message according to the new AK in the subsequent communication process, and in the message Set the updated serial number.

Since the mobile station often switches back and forth between the two base stations, in the above process, when the mobile station switches from base station a to base station b and then to base station a, since it is switched back to a, there is no re-authentication In this case, the generated AK is the same as the AK obtained by base station a before handover, and since both CMAC_PN_D and CMAC_PN_U start from 0, there will be a message including the same check code and the same sequence number, if the base station uses such a message as a replay Rejecting the attack message will hinder the normal communication of the legitimate mobile station; if the base station receives such a message as a legitimate message, it will give the attacker an opportunity to implement a replay attack.

Contents of the invention

In view of this, the purpose of the present invention is to provide a method for preventing replay attacks, which can prevent replay attacks under the premise of ensuring normal handover of mobile stations.

In order to achieve the above object, the present invention provides a method for preventing replay attacks, the method includes the following steps:

A. After the mobile station switches to the target base station, both the mobile station and the authentication device regenerate the AK and update the AK serial number;

B. The authentication device sends the generated AK and the updated AK serial number to the target base station;

C. The updated AK serial number is carried in the message exchanged between the mobile station and the target base station, and the message verification is performed by using the updated AK serial number.

Preferably, the method for updating the AK serial number is:

The AK serial number is incremented or decremented based on the stored original AK serial number.

Preferably, before the step A, it further includes: after the mobile station and the authentication device initialize the AK serial number after authentication, set the initial value of the AK serial number to a preset value.

Preferably, the preset value is 0 or 1.

Preferably, in the step A, the authentication device regenerates the AK, and updates the serial number of the AK to:

After the mobile station switches access, the target base station sends a message to the authentication device to request to obtain the AK and the AK serial number;

The authentication device updates the AK and the AK sequence number according to the received message and the latest authentication information of the mobile station stored in itself.

Preferably, the method for the target base station to determine the handover access of the mobile station is:

The target base station determines that the mobile station accesses through handover after receiving an indication message sent by the mobile station side or the network side to indicate that the mobile station is handed over to the target base station.

Preferably, step A further includes:

The mobile station and the authentication device respectively judge whether the updated AK serial number has been used in this authentication process, and if so, initiate re-authentication, and then end the process; otherwise, execute the steps B and C.

If the AK sequence number carried in the message exchanged between the mobile station and the base station has a maximum value;

Then the method for judging whether the updated AK serial number has been used can be:

Judging whether the updated AK serial number exceeds the maximum value, if so, judging that the AK serial number has been used; otherwise, judging that the AK serial number has not been used.

Preferably, the method for the authentication device to initiate re-authentication is:

The authentication device sends a message to the base station to notify the base station to initiate re-authentication.

Preferably, the method for the base station to initiate re-authentication is:

The base station sends an EAP authentication request message or an RSA authentication invalid message to the mobile station to trigger the mobile station to initiate re-authentication.

It can be seen from the above scheme that in the present invention, the mobile station and the authentication device update the AK Sequence Number during the handover process within an authentication period, and carry the updated AK Sequence Number in the message during the communication process between the mobile station and the target base station. Number, therefore, within an authentication period, even if the mobile station establishes connections with the same base station multiple times, there will be no message with the same sequence number, thus preventing replay attacks while ensuring normal communication;

Furthermore, since the AK Sequence Number set in the message has a maximum value, in the present invention, by judging whether the AK Sequence Number exceeds the maximum value, and reinitiating authentication after exceeding the above maximum value, the application effect of the present invention is improved , which further ensures normal communication and prevents replay attacks.

Description of drawings

Figure 1 is a flow chart of authentication and encryption communication;

Fig. 2 is the flowchart of the mobile station side in the specific embodiment of the present invention;

Fig. 3 is a flow chart of the base station side in a specific embodiment of the present invention.

Detailed ways

In order to make the object, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings.

The main idea of the present invention is that, in an authentication cycle, after the mobile station switches to the target base station, both the mobile station and the authentication device update the AK Sequence Number, and during the communication process between the mobile station and the target base station, the AK Sequence Number is updated in the message Carry the updated AK Sequence Number.

The present invention will be described in detail below through a specific embodiment.

As shown in Figure 2, it is a flow chart of the mobile station side in a specific embodiment of the method for preventing replay attacks in the handover process of the present invention, which specifically includes the following steps:

Step 201, the mobile station switches to the target base station, and after obtaining the target base station ID, calculates a new AK and other encryption keys for message verification according to the last stored authentication information, the mobile station ID and the currently connected target base station ID key and other keys, update the context of AK, and update the AK Sequence Number.

In this embodiment, after each re-authentication, when the mobile station side initializes the AK SequenceNumber, the initial value can be 0, or 1, or the same as the prior art, determined according to the value of the PMK/PAKSequence Number, after which the mobile station records The value of the current AK Sequence Number. When updating the AK Sequence Number, it is incremented or decremented on the basis of the original AK Sequence Number value. Of course, other complex algorithms can also be used to update the AK Sequence Number. Since there are many methods that can be used, they will not be listed here. In the following description of this process, the incremental update of the AK Sequence Number is taken as an example.

In addition, when updating the context of the AK in this step, CMAC_KEY_D and CMAC_KEY_U may or may not be reinitialized.

Step 202, whether the mobile station judges whether the updated AK Sequence Number has been used in this authentication process, if yes, then execute step 203, initiate re-authentication, and then end the process; otherwise, execute step 204, the updated AK Sequence Number The AK Sequence Number setting is communicated in messages interacting with the currently connected base station.

This step is added in this embodiment because when the AK SequenceNumber is carried in the message, the number of bits allocated to the AK Sequence Number is fixed, for example, 4 bits, and the AK Sequence Number has a maximum value of 15. When updating the AK Sequence After Number, after its value exceeds the above maximum value, due to overflow, if the value is set in the message, the value may have been used, so in this step, it is judged whether the updated AK Sequence Number has been used, that is Judging whether the updated AK Sequence Number is greater than the above maximum value, if so, it is judged that the updated AK Sequence Number has been used; otherwise, it is judged that it has not been used.

The above is the implementation process of the mobile station side in the specific embodiment of the present invention. Correspondingly, the implementation process of the base station side in this embodiment is shown in Figure 3, specifically including the following steps:

Step 301, after a mobile station accesses through handover, the base station sends a request message to the authentication device, requesting to obtain the AK and AK Sequence Number of the mobile station.

In this step, the base station can determine that there is a mobile station accessing through handover by receiving an instruction message from the mobile station side or the network side to handover the mobile station to a new base station.

Step 302, the authentication device calculates a new AK according to the stored information of the current authentication of the mobile station, and the identity of the base station and the identity of the mobile station that initiated the request, and updates the AK Sequence Number in the same way as that of the mobile station.

Corresponding to the mobile station side, in the present invention, on the authentication device side, after each re-authentication, when initializing the AK Sequence Number, the initial value can be 0, or 1, or a preset maximum value. Or the same as the prior art, it is determined according to the value of the PMK/PAK Sequence Number, after which the authentication device records the value of the current AK Sequence Number. When updating the AK Sequence Number, it is incremented or decremented on the basis of the original AK Sequence Number value. Of course, other complex algorithms can also be used to update the AK Sequence Number. Since there are many methods that can be used, they will not be listed here.

In this step, the authentication device can also calculate other authentication-related information, such as AKID, AKLifetime, and other keys such as CMAK_KEY_D and CMAC_KEY_U.

Step 303, the authentication device judges whether the updated AK Sequence Number has been used in this authentication process, if yes, executes step 304, notifies the base station to initiate re-authentication through a response message, and then ends the process; otherwise executes step 305, the authentication device Send the updated AK and AKSequence Number or other keys that will be further generated to the above-mentioned base station that sent the request message through a response message, and then perform step 306.

In this step, the method for judging whether the AK Sequence Number has been used is the same as the method for judging in the above-mentioned step 202, so it will not be described in detail. In addition, in this step, the base station initiates re-authentication, and may trigger the mobile station to initiate re-authentication by sending a message. For example, in EAP authentication, the base station can send an EAP authentication request (EAP-Request) message to the mobile station to trigger the mobile station to initiate re-authentication; in RSA authentication, the base station can send an authentication invalid (Authen-Invalid) message to the mobile station to trigger the mobile station Taiwan initiates re-authentication.

Step 306: After receiving the AK and AK Sequence Number sent by the authentication device, the base station calculates other keys according to the received AK, and sets the received AK Sequence Number in the message interacted with the mobile station.

In this step, the base station uses other keys other than AK, such as CMAK_KEY_D and CMAC_KEY_U, etc. in the messages interacted with the mobile station. If the authentication device has been sent to the base station, the base station directly uses the received related key. If the authentication device If it is not sent to the base station, the base station will calculate it by itself. Corresponding to the mobile station side, CMAC_PN_D and CMAC_PN_U may or may not be reinitialized.

It can be understood that the above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the within the protection scope of the present invention.

Claims (10)

1, a kind of method that prevents Replay Attack is characterized in that, this method may further comprise the steps:

Behind A, the switching mobile station to target base station, travelling carriage and authenticate device all regenerate authorization key AK, and upgrade the AK sequence number;

B, authenticate device send to described target BS with the AK of generation and the AK sequence number after the renewal;

Carry the AK sequence number after the described renewal in C, travelling carriage and the target BS interactive messages, utilize the AK sequence number after upgrading to carry out the message verification.

2, method according to claim 1 is characterized in that, the method for described renewal AK sequence number is:

With AK sequence number increasing or decreasing on the basis of the former AK sequence number of storage.

3, method according to claim 1 is characterized in that, further comprise before the described steps A: travelling carriage and authenticate device are after authenticating, and during initialization AK sequence number, the initial value that the AK sequence number is set is predefined value.

4, method according to claim 3 is characterized in that, described predefined value is 0 or 1.

5, method according to claim 1 is characterized in that, authenticate device regenerates AK in the described steps A, and the sequence number of renewal AK is:

Described target BS sends message request to authenticate device and obtains AK and AK sequence number after described travelling carriage switches access;

Authenticate device is according to the described message of reception and the last information updating AK and the AK sequence number of storing in self that authenticates of described travelling carriage.

6, method according to claim 5 is characterized in that, described target BS determines that described travelling carriage switches the method that inserts and is:

Described target BS determines that described travelling carriage inserts by switching after receiving the Indication message of the described switching mobile station to target base station that mobile station side or network side send.

7, according to the described method of each claim in the claim 1 to 6, it is characterized in that, further comprise in the described steps A:

Travelling carriage and authenticate device judge that respectively whether the AK sequence number after the renewal used, if then initiate re-authentication, finished this flow process then in this verification process; Otherwise carry out described step B and step C.

8, method according to claim 7 is characterized in that, the AK sequence number that carries in described travelling carriage and the base station interactive messages has maximum;

Whether used method is AK sequence number after then described judgement is upgraded:

Judge that whether the AK sequence number after upgrading has surpassed described maximum, used if then judge the AK sequence number; Otherwise, judge the AK sequence number and do not use.

9, method according to claim 7 is characterized in that, the method that described authenticate device is initiated re-authentication is:

Authenticate device sends the message informing base station to the base station and initiates re-authentication.

10, method according to claim 9 is characterized in that, the method that re-authentication is initiated in described base station is:

The base station sends EAP authentication request message or Revest-Shamir-Adleman Algorithm (RSA) authentication invalid message triggering Mobile Origination re-authentication to travelling carriage.

Images