KR102065583B1 - Method and apparatus for registering and authenticating a device in a wireless communication system - Google Patents

Abstract

According to an embodiment of the present disclosure, in a wireless communication system, a gateway (GW) transmits a registration request message including first information to a device, and receives a registration response message including second information from the device. Generating first authentication information for the device based on whether the second information corresponds to the first information, assigning the generated first authentication information to the device, and based on the first authentication information. Establish an authentication channel between the GW and the device, register the device with a server, receive second authentication information for the device from the server, and receive the received second authentication information through the authentication channel. To send.

Description

METHOD AND APPARATUS FOR REGISTERING AND AUTHENTICATING A DEVICE IN A WIRELESS COMMUNICATION SYSTEM}

Various embodiments of the present disclosure relate to a method and an apparatus for performing device registration and authentication in a wireless communication system.

Conventional gateways (GWs) are not subjects of authentication or registration indoors, such as homes or offices, but are connected to external servers / systems and indoor control devices or service devices and agents for supporting the same. It acts as an agent.

In addition, Wi-Fi devices that communicate with indoor GWs have various security problems during the access point (AP) registration / authentication process. This is because in general, problems such as use of inferred service set identifiers (SSIDs), exposure of passwords, and key management occur during registration / authentication of the Wi-Fi device. Therefore, the Wi-Fi device generally uses a separate payload encryption method when transmitting and receiving privacy data through Wi-Fi communication.

In privacy data encryption, symmetric key generation is mainly used. The symmetric key generation method generates a symmetric key based on a unique personal identification number (PIN) / key or password and uses the symmetric key as an encryption key through mutual sharing. That's the way it is.

Wi-Fi devices on a home network where a home service is provided are always assigned an account from a server and use a corresponding security PIN and password. However, this method has a difficulty in connecting to the server at the time of server maintenance cost and device registration.

In the related art, a registration method through a one-way web server account is used as a method for authentication at the time of registering a service of a Wi-Fi device, which has a weak security problem.

In addition, in the conventional symmetric key generation method for forming a secure channel, a PIN / key can be inferred, and if the symmetric key itself is also exposed to each other, a problem occurs on the secure channel.

An embodiment of the present disclosure proposes a method and apparatus for performing device registration and authentication in a wireless communication system.

In addition, an embodiment of the present disclosure provides a certificate issuing function for a Wi-Fi device to a GW, and allows the GW to act as a server for the Wi-Fi device to register with a server, thereby providing more secure authentication and higher security. A method and apparatus for enabling communication with the present invention are proposed.

In addition, an embodiment of the present disclosure proposes a method and apparatus for reinforcing authentication information security by using a certificate using asymmetric key method in the device authentication process.

Furthermore, an embodiment of the present disclosure proposes a method and apparatus for applying additional security techniques and techniques during registration and authentication to minimize the possibility of security threats and to perform a more secure and convenient registration and authentication process.

Method according to an embodiment of the present disclosure; A method of performing device registration and authentication by a gateway (GW) in a wireless communication system, the method comprising: transmitting a registration request message including first information to a device; and registering a registration response message including second information. Receiving first information from the device, generating first authentication information for the device based on whether the second information corresponds to the first information, and assigning the generated first authentication information to the device; Setting an authentication channel between the GW and the device based on the first authentication information, registering the device with a server and receiving second authentication information about the device from the server; And transmitting second authentication information to the device through the authentication channel.

Another method according to an embodiment of the present disclosure; A method of registering and authenticating a device in a wireless communication system, the method comprising: receiving a registration request message including first information from a gateway (GW); and receiving a registration response message including second information from the GW. Transmitting the first authentication information generated by the GW based on whether the second information corresponds to the first information, and transmitting the first authentication information based on the first authentication information. Establishing an authentication channel between GWs, receiving second authentication information generated by a server from the GW through the authentication channel, and communicating with the server based on the received second authentication information Process.

Another method according to an embodiment of the present disclosure; A method for a server to perform device registration and authentication in a wireless communication system, the method comprising: receiving a first registration request message including first information from a gateway (GW), and storing the first information in the server Allocating first authentication information to the GW based on whether the second information corresponds to second information; establishing an authentication channel between the GW and the server based on the first authentication information; Requesting registration with the server, generating second authentication information for the device, and transmitting the second authentication information to the GW through the authentication channel.

An apparatus according to an embodiment of the present disclosure; In a gateway (GW) in a wireless communication system, the transceiver unit and the transceiver unit to transmit a registration request message containing the first information to the device, and receives a registration response message containing the second information from the device. Control, generate first authentication information for the device based on whether the second information corresponds to the first information, assign the generated first authentication information to the device, and generate the first authentication information. Establish an authentication channel between the GW and the device, register the device with a server, receive second authentication information for the device from the server, and receive the received second authentication information through the authentication channel. And a control unit for controlling the transceiver to transmit to the device.

Another apparatus according to an embodiment of the present disclosure; A device in a wireless communication system, comprising: a transceiver unit and a transceiver to receive a registration request message including first information from a gateway (GW) and to transmit a registration response message including second information to the GW. Control and receive first authentication information generated by the GW based on whether the second information corresponds to the first information, and establish an authentication channel between the device and the GW based on the first authentication information. And a control unit configured to receive the second authentication information generated by the server from the GW through the authentication channel and to control the transceiver to communicate with the server based on the received second authentication information. .

Another apparatus according to an embodiment of the present disclosure; A server in a wireless communication system, the server comprising: a transceiver and a second registration control message to receive a first registration request message including first information from a gateway (GW), wherein the first information is stored in the server; Assigning the first authentication information to the GW based on whether the information corresponds to the information, establishing an authentication channel between the GW and the server based on the first authentication information, and registering the device with the server. And a controller for generating second authentication information about the device and controlling the transceiver to transmit the second authentication information to the GW through the authentication channel.

According to an embodiment of the present disclosure, since the GW acts as a registration agent of the Wi-Fi device as a server in a wireless communication system such as a home network, the Wi-Fi device may be registered even in a server offline environment. . Accordingly, in one embodiment of the present disclosure, the setting and registration time for the Wi-Fi device is reduced.

According to an embodiment of the present disclosure, when there are a plurality of Wi-Fi devices that want to register with a server for service subscription, the GW may collectively register the plurality of Wi-Fi devices with the server. As a result, maintenance and repair costs are reduced.

In addition, in one embodiment of the present disclosure, since the registration process is performed based on a specific interface, security at the time of registration may be improved. In addition, an embodiment of the present disclosure has an advantage of enhancing security on a corresponding channel by performing mutual authentication through a certificate after device registration, and easily extending a service based on a certificate.

1 is a diagram illustrating a configuration of a wireless communication system according to an embodiment of the present disclosure;
2 is a signal flow diagram illustrating a process of registering a GW with a server in a wireless communication system according to an embodiment of the present disclosure;
3 is a signal flow diagram illustrating a process in which a headless Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure;
4 is a signal flowchart illustrating a process in which a display Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure;
5 is a signal flowchart illustrating a process in which a GW registers a Wi-Fi device with a server in a wireless communication system according to an embodiment of the present disclosure;
6 is a flowchart illustrating an operation of registering a GW to a server in a wireless communication system according to an embodiment of the present disclosure;
7 is a flowchart illustrating an operation of registering a GW by a server in a wireless communication system according to an embodiment of the present disclosure;
8 is a flowchart illustrating an operation in which a headless Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure;
9 is a flowchart illustrating an operation in which a GW registers a headless Wi-Fi device in a wireless communication system according to an embodiment of the present disclosure;
10 is a flowchart illustrating an operation in which a display Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure.
11 is a flowchart illustrating an operation in which a GW registers a display Wi-Fi device in a wireless communication system according to an embodiment of the present disclosure.
12 is a flowchart illustrating an operation in which a GW registers a Wi-Fi device to a server in a wireless communication system according to an embodiment of the present disclosure;
13 is a flowchart illustrating an operation in which a server registers a Wi-Fi device through a GW in a wireless communication system according to an embodiment of the present disclosure.
14 is a block diagram illustrating a Wi-Fi device according to one embodiment of the present disclosure;
15 is a block diagram illustrating a GW according to an embodiment of the present disclosure;
16 is a block diagram illustrating a server according to an embodiment of the present disclosure.

Hereinafter, operation principles of various embodiments of the present disclosure will be described in detail with reference to the accompanying drawings. In the following description of the various embodiments of the present disclosure, when it is determined that a detailed description of related known functions or configurations may unnecessarily obscure the subject matter of various embodiments of the present disclosure, the detailed description thereof will be omitted. In addition, terms to be described below are terms defined in consideration of functions in various embodiments of the present disclosure, and may be changed according to a user's or operator's intention or custom. Therefore, the definition should be made based on the contents throughout the specification.

Various embodiments of the present disclosure provide a device registration and authentication method and apparatus in a wireless communication system. The device proposed in various embodiments of the present disclosure may be a home appliance such as a washing machine, a refrigerator, a television, or a mobile phone or a tablet PC. However, the device is not limited to the above devices and can be variously changed.

Hereinafter, as an example, the device is a device that performs Wi-Fi communication, and a method and apparatus for performing a registration and authentication process based on Wi-Fi communication will be described. However, the method and apparatus proposed in various embodiments of the present disclosure may be applied and used to be suitable for a wireless communication system in which other communication is used in addition to the Wi-Fi communication. On the other hand, it should be noted that the terms of certificate and authentication information may be used interchangeably below.

Hereinafter, a wireless communication system according to an exemplary embodiment of the present disclosure will be described with reference to FIG. 1.

1 is a diagram illustrating a configuration of a wireless communication system according to an exemplary embodiment of the present disclosure.

Referring to FIG. 1, the wireless communication system may be configured as, for example, a home network, and includes a Wi-Fi device 100, a gateway (GW) 120, and a server 140.

The Wi-Fi device 100 represents a device that is included in the home network and can receive and use a home network service from the server 140 based on Wi-Fi communication. The Wi-Fi device 100 is a Wi-Fi device (hereinafter referred to as a display Wi-Fi device) including a display unit such as a mobile terminal and a TV, and a Wi-Fi device that does not include a display unit such as a refrigerator and a washing machine. Fi device (hereinafter referred to as a 'headless Wi-Fi device').

The Wi-Fi device 100 needs to be registered with the server 140 connected to an external network and an access point (AP) in order to receive a service. In order for the Wi-Fi device 100 to be registered with the server 140, a registration process for the GW 120 of the Wi-Fi device 100 must be performed first. This is because when the Wi-Fi device 100 is registered with the GW 120, the GW 120 performs a registration process with the server 140 with respect to the Wi-Fi device 100. That is, registration of the Wi-Fi device 100 to the server 140 is performed through the GW 120.

When the Wi-Fi device 100 is registered, the GW 120 transmits information about the Wi-Fi device 100 to the server 140. Then, the server 140 transmits the authentication information to the Wi-Fi device 100 by allocating unique authentication information to the Wi-Fi device 100 and transmitting the authentication information to the GW 120. To be possible.

The above process may be performed in a background mode, and authentication information between the Wi-Fi device 100 and the GW 120 and authentication information between the GW 120 and the server 140 may be used. It can be done via a secure channel on which it is based.

To this end, the GW 120 has a function of issuing a self-signed certificate and allocates authentication information 115 to the Wi-Fi device 100 to be registered. The authentication information 115 of the Wi-Fi device 100 may be a certificate authority (CA) that issued the corresponding authentication information of the GW 120 or a public certificate of a sub CA (sub). 115), which may be provided through an SDK or the like.

When the Wi-Fi device 100 obtains the authentication information 115. Based on the authentication information 115, a one-way authentication channel may be formed to be authenticated by the GW 120 to register with the GW 120. In addition, the server 140 and the GW 120 have authentication information 135 and 145 issued from the same root / sub CA, thereby forming a channel for two-way authentication upon interconnection. can do.

The Wi-Fi device 100 and the GW 120 may include interfaces 110 and 130 for generating a registration event for performing a registration process. The interface 110 or 130 may be a physical button or a specific menu capable of selecting (input or clicking) from a user configured in a web page or an application.

When the registration event occurs, the Wi-Fi device 100 and the GW 120 may respectively perform a registration process for a preset time, and during the other time (for example, after the preset time), the registration process may be performed. Do not perform. To this end, the Wi-Fi device 100 and the GW 120 may each drive a timer having a preset time when a registration event occurs.

Hereinafter, a method of registering and authenticating a Wi-Fi device performed in a wireless communication system as shown in FIG. 1 will be described in detail.

According to an embodiment of the present disclosure, in order for the Wi-Fi device 100 to be registered in the server 140, the following four processes should be largely performed. (Steps (2-1) and (2-2) of the following four processes may be alternatively performed according to the characteristics of the Wi-Fi device (with or without display).)

(1) a process in which the GW 120 is registered in the server 140

(2-1) Process of Registering the Wi-Fi Device (Headless Wi-Fi Device) 100 to the GW 120

(2-2) Process in which the Wi-Fi device (display Wi-Fi device) 100 is registered in the GW 120

(3) the GW 120 registering the Wi-Fi device 100 with the server 140

Hereinafter, the four processes as described above will be described with reference to FIGS. 2 to 5.

(1) a process in which the GW 120 is registered in the server 140

2 is a signal flowchart illustrating a process in which a GW is registered in a server in a wireless communication system according to an exemplary embodiment of the present disclosure.

Referring to FIG. 2, when the user 150 wants to register the GW 120 as the new GW in the server 140, the user 150 newly registers a username and password associated with the GW 120. Generated as GW information. In operation 200, the user 150 transmits the new GW information to the server 140 to register the new GW information. Then, the server 140 receives and registers the new GW information, and provides the user 150 with registration status information indicating whether the new GW information is registered in step 202.

Operations between the user 150 and the server 140 may be performed based on a server management web page (or application). For example, the user 150 selects a menu for logging in to the server management web page to register a new GW. The user 150 transmits the new GW information to the server 140 through the selected menu, and the server 140 displays the registration result of the new GW information on a corresponding web page. 150 may provide the registration status information.

When the user 150 determines that the new GW information is registered in the server 140 through the registration status information, the user 150 generates a registration event in step 206. As described above, the registration event may be generated by the user 150 through a separate interface. Hereinafter, the registration event is generated by pushing (or touching) the "register button" as an example.

The GW 120 enters a registration mode when the registration event occurs, and drives the timer in step 208. The timer may be set to a duration time (eg, 3 minutes) during which the registration process may continue, and the duration of the timer may be adjusted according to the implementation.

When the GW 120 enters the registration mode, the user 150 accesses the web page of the GW 120 in step 210 and inputs the user name and password which are the new GW information registered in the server 140. Enter it. In step 212, the GW 120 transmits a registration request message including the user name, a password, and the MAC address of the GW 120 to the server 140. Here, the registration request message may be transmitted to the server 140 in the form of HTTP Send Post (HTTPS) using the HTTP Post method.

When the registration request message is received, the server 140 determines whether the user name and password included in the registration request message match the previously registered user name and password. If the server 140 determines that the user name and password included in the registration request message match the previously registered user name and password, the server 140 identifies the ID and password as authentication information to the GW 120. Allocate

In step 214, the server 140 transmits the assigned ID and password to the GW 120 through an HTTP POST message. Meanwhile, the ID assigned to the GW 120 may be a unique ID or a Jabber ID, and the assigned password may be a GW management password used by the server 140 to manage the GW 120. Can be.

The GW 120 stores the ID and password allocated from the server 140 as authentication information for mutual authentication with the server 140 in step 216. The server 140 also stores the ID and password of the GW 120 in step 218 and registers the GW 120 as a new GW. On the other hand, when the timer expires in step 220, the GW 120 releases the registration mode and ends all registration process.

When the GW 120 is registered in the server 140 through the above process, and the ID and password are stored as authentication information for the GW 120 in the GW 120 and the server 140, respectively. In operation 222, the GW 120 and the server 140 may form a channel capable of mutual authentication based on the authentication information to perform communication.

(2-1) Process of Registering the Wi-Fi Device (Headless Wi-Fi Device) 100 to the GW 120

3 is a signal flow diagram illustrating a process in which a headless Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure.

In FIG. 3, a case in which the Wi-Fi device 100 is a headless Wi-Fi device will be described.

Referring to FIG. 3, in order for the Wi-Fi device 100 to be registered in the GW 120, first, network pairing should be performed. To this end, the Wi-Fi device 100 performs an operation for network pairing with the AP 160 in the home network, as shown in steps 300 to 308.

Specifically, the Wi-Fi device 100 and the AP 160 are pressed by the user 150 in step 300 and step 302 (for example, a WPS (Wi-Fi protected setup) button). Accordingly, when a registration event occurs, each timer is driven and the registration mode is entered.

The Wi-Fi device 100 obtains a Wi-Fi network internet protocol (IP) from the GW 120 and in step 304, the AP 160 is based on the obtained Wi-Fi network IP. Connect to When the Wi-Fi device 100 is connected, the AP 160 assigns an IP address to the Wi-Fi device 100 in step 306. In operation 308, the Wi-Fi device 100 performs network pairing based on the assigned IP address.

When the Wi-Fi device 100 is network paired, the user 150 may generate a registration event by pressing a registration button between the Wi-Fi device 100 and the GW 120. When the registration event occurs in steps 310 and 312, the Wi-Fi device 100 and the GW 120 respectively drive a timer for performing the registration process.

The user 150 may access the GW management web page (or application) and request the GW 120 to provide information about a Wi-Fi device that can be currently registered in a product registration page menu. Accordingly, the GW 120 performs a discovery operation for detecting the corresponding Wi-Fi device. The discovery operation may be performed based on a simple service discovery protocol (SSDP) / multicast domain name system (mDNS) or another discovery protocol.

The GW 120 broadcasts a discovery advertisement message in step 314. Then, the Wi-Fi device 100 receives the discovery advertisement message and transmits the discovery response message to the GW 120 in step 316. The discovery response message may include information (eg, Wi-Fi MAC address, IP address, etc.) of the Wi-Fi device 100.

When the discovery response message is received, the GW 120 may provide the user 150 with information about the detected Wi-Fi device as shown in Table 1 below.

Device information MAC address Unique ID Node ID Status information OK button Ref ... etc IEEE address - IP address Ready
(Ready) [Selection]  ...  ...  ...  ...  ...  ...

Referring to Table 1, the device information indicates the identification number, device type information, etc. of the Wi-Fi device 100, the MAC address indicates the MAC address of the Wi-Fi device 100, the Unique ID represents an ID assigned from the server 140 (before the Wi-Fi device 100 is registered with the GW 120 and thus no corresponding information is included in Table 1), the Node ID is The Wi-Fi device 100 represents an IP address, and the state information indicates information indicating whether the Wi-Fi device 100 can be registered with the GW 120 (or in a registration mode). The confirmation button indicates an interface for the user 150 to select the Wi-Fi device 100 as a device to register with the GW 120.

If the user 150 selects the Wi-Fi device 100 as a device to register with the GW 120 through the confirmation button, the GW 120 determines the Wi-Fi device 100 in step 318. Send a registration request message. In this case, the registration request message may include a password for checking message integrity. The password may be randomly generated by the GW 120.

When the registration request message is received, the Wi-Fi device 100 includes a password included in the registration request message, a device type of the Wi-Fi device 100 and a Wi-Fi MAC address. The registered response message to the GW 120. Here, the registration response message may be transmitted in the form of an HTTP Post message. As the registration response message is transmitted, a unidirectional transport layer security (TLS) session may be formed between the Wi-Fi device 100 and the GW 120.

The GW 120 performs an integrity check on the registration response message based on whether the password included in the registration response message is identical to the password included in the registration request message transmitted in step 318. The GW 120 determines that the registration response message has integrity when the two passwords are the same. In step 322, the GW 120 generates a certificate and a private key (PKCS # 12 or PEM) as authentication information for the Wi-Fi device 100, and in step 324, the generated certificate and The secret key is transmitted to the Wi-Fi device 100.

Then, the Wi-Fi device 100 stores the certificate and the secret key in step 326, and after completion of the registration process, in step 328, the channel capable of mutual authentication with the GW 120 based on the certificate and the secret key. (Two-way TLS session) can be established to perform communication.

(2-2) above Wi - Fi  Device (display Wi - Fi  device)( 100)  remind On GW 120  Process to be registered

4 is a signal flowchart illustrating a process in which a display Wi-Fi device is registered in a GW in a wireless communication system according to an exemplary embodiment of the present disclosure.

In FIG. 4, a case in which the Wi-Fi device 100 is a display Wi-Fi device will be described.

Referring to FIG. 4, in order for the Wi-Fi device 100 to be registered in the GW 120, network pairing should be performed first. To this end, the Wi-Fi device 100 performs an operation for network pairing with the AP 160 in the home network, as shown in steps 400 to 404.

The Wi-Fi device 100 obtains a Wi-Fi network IP from the GW 120 and accesses the AP 160 based on the obtained Wi-Fi network IP in step 400. When the Wi-Fi device 100 is connected, the AP 160 assigns an IP address to the Wi-Fi device 100 in step 402. In operation 404, the Wi-Fi device 100 performs network pairing based on the assigned IP address.

When the Wi-Fi device 100 is network paired, the user 150 may generate a registration event by pressing the registration button of the GW 120. When the registration event occurs in step 406, the GW 120 drives a timer to perform the registration process.

The user 150 may access the GW management web page (or application) and request the GW 120 for a Wi-Fi device that can be currently registered from the product registration page menu. Accordingly, the GW 120 performs a discovery operation for detecting a Wi-Fi device. The discovery operation may be performed based on SSDP / mDNS or another discovery protocol.

The GW 120 broadcasts a discovery advertisement message in step 408. Then, the Wi-Fi device 100 receives the discovery advertisement message and transmits the discovery response message to the GW 120 in step 410. The discovery response message may include information about the Wi-Fi device 100 (Wi-Fi MAC address, IP address, etc.).

When the discovery response message is received, the GW 120 may provide the user 150 with information about the detected Wi-Fi device. Information about the detected Wi-Fi may be provided to the user 150 in the form as shown in Table 1 described above.

If the user 150 selects the Wi-Fi device 100 as a device to register with the GW 120 based on the detected information on the Wi-Fi device, the GW 120 proceeds to step 411. Generate a personal identification number (PIN). In step 412, the GW 120 includes the PIN in a registration request message and transmits the PIN to the Wi-Fi device 100. In this case, the PIN may be used to check the integrity of the registration request message, and may consist of numbers or letters randomly generated by the GW 120.

When the registration request message is received, the Wi-Fi device 100 displays an input window for receiving a PIN identical to the PIN included in the registration request message from the user 150. When the user 150 inputs a PIN into the input window in step 414, the Wi-Fi device 100 inputs the PIN and the device type of the Wi-Fi device 100 and Wi-Fi in step 416. A registration response message including a Fi MAC address and the like is transmitted to the GW 120. Here, the registration response message may be transmitted in the form of an HTTP Post message, and a one-way TLS session may be formed as the registration response message is transmitted.

The GW 120 performs an integrity check on the registration response message based on whether the PIN included in the registration response message is identical to the PIN included in the registration request message transmitted in step 412. When the two PINs are the same, the GW 120 determines that the registration response message has integrity. In operation 418, the GW 120 generates a certificate and a secret key (PKCS # 12 or PEM) for the Wi-Fi device 100, and in step 420, the GW 120 generates the certificate and a secret key. Transmit to device 100.

Then, the Wi-Fi device 100 stores the certificate and the secret key in step 422, and after completion of the registration process, in step 424, the channel capable of mutual authentication with the GW 120 based on the certificate and the secret key. (Two-way TLS session) can be established to perform communication.

(3) above GW 120  remind Wi - Fi  Registering the device 100 to the server 140

As the process (1), (2-1) or (2-2) is performed, the GW 120 is registered with the server 140 and the Wi-Fi device 100 is connected with the GW 120. ), The GW 120 performs an operation as a registration agent for registering the Wi-Fi device 100 with the server 140. This will be described with reference to FIG. 5.

5 is a signal flow diagram illustrating a process in which a GW registers a Wi-Fi device with a server in a wireless communication system according to an exemplary embodiment of the present disclosure.

Referring to FIG. 5, when the GW 120 establishes a mutual authentication channel with the server 140 in step 500 as a result of the process (1), in step 502, the GW 120 may enter (2-1) or (2- 2) a registration request message for requesting registration of the registered Wi-Fi device 100 is transmitted to the server 140. Here, the registration request message includes information of the Wi-Fi device 100 such as a device type, a Wi-Fi MAC address, and the like, of the GW 120 allocated from the server 120 in step (1). ID and password (hereinafter referred to as 'GW authentication information') may be included.

When the registration request message is received, the server 140 determines the integrity of the registration request message by determining whether the GW authentication information included in the registration request message matches the GW authentication information registered in the server 140. Check it. If the server 140 determines that the GW authentication information included in the registration request message matches the GW authentication information registered in the server 140, the server 140 determines that the registration request message has integrity.

In operation 504, the server 140 generates authentication information (ID and password) for the Wi-Fi device 100 according to the registration request message and registers the Wi-Fi device 100. In step 506, the server 140 transmits the generated authentication information to the GW 120, and the GW 120 receives the authentication information and transmits the authentication information to the Wi-Fi device 100 in step 508. do. In operation 510, the Wi-Fi device 100 stores the received authentication information, and then communicates with the server 140 using the stored authentication information.

Next, an operation of each of the Wi-Fi device 100, the GW 120, and the server 140 according to an embodiment of the present disclosure will be described in detail.

6 is a flowchart illustrating an operation in which a GW is registered in a server in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 6, when a registration event occurs in step 600, the GW 120 enters a registration mode in step 602 and drives a timer. In addition, the GW 120 may include a user name of the GW 120 registered by the user 150 as new GW information in the server 140 through a web page or a separate application of the GW 120 in step 604. Obtain a password.

Subsequently, the GW 120 transmits a registration request message including the obtained user name and password and the MAC address of the GW 120 to the server 140 to register with the server 140. In step 608, the GW 120 determines whether authentication information (ID, password) used for mutual authentication between the GW 120 and the server 140 is received from the server 140. If it is received in step 610 to store the received authentication information. Then, the GW 120 may form a channel capable of mutual authentication with the server 140 based on the stored authentication information to perform communication.

7 is a flowchart illustrating an operation of registering a GW by a server in a wireless communication system according to an exemplary embodiment of the present disclosure.

Referring to FIG. 7, when the server 140 receives new GW information including a user name and a password from a user through a server management web page (or an application) in step 700, the server 140 stores the received new GW information.

When the server 140 receives a registration request message from a specific GW (eg, the GW 120) in step 702, the server 140 includes a user name, a password, and the stored user name included in the registration request message in step 704. , Compares whether passwords are identical.

If the user name, password and the stored user name and password included in the registration request message are the same in step 706, the server 140 proceeds to step 708 to generate authentication information (ID, password) for a specific GW. In step 710, the generated authentication information is transmitted to a specific GW. The generated authentication information may then be used to form a channel capable of mutual authentication with the GW 120 to perform communication.

8 is a flowchart illustrating an operation in which a headless Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 8, the headless Wi-Fi device performs a network pairing operation through communication with the AP 160 in operation 800, and determines whether a registration event occurs in operation 802. When the registration event occurs, the headless Wi-Fi device enters the registration mode and drives a timer in step 804.

In step 806, when the discovery advertisement message is received from the GW 120, the headless Wi-Fi device transmits a discovery response message to the GW 120. The discovery response message may include information about the headless Wi-Fi device (Wi-Fi MAC address, IP address, etc.).

In step 808, the headless Wi-Fi device determines whether a registration request message is received from the GW 120. When the registration request message is received, the headless Wi-Fi device detects a password for the message integrity check included in the registration request message. In operation 810, the headless Wi-Fi device transmits a registration response message including the detected password, the device type of the headless Wi-Fi device, a Wi-Fi MAC address, etc. to the GW 120.

If the message integrity of the registration response message is checked based on the detected password, the headless Wi-Fi device receives and stores a certificate and a private key from the GW 120 in step 812. Then, after the registration process is completed, the headless Wi-Fi device may perform communication by forming a channel capable of mutual authentication with the GW 120 based on the stored certificate and secret key.

9 is a flowchart illustrating an operation in which a GW registers a headless Wi-Fi device in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 9, when a registration event occurs in step 900, the GW 120 enters a registration mode in step 902 and drives a timer. The GW 120 broadcasts a discovery advertisement message in step 904 when a request for information on a registerable Wi-Fi device is received from the user 150. Meanwhile, the user 150 may access the GW management web page (or application) and perform the above request through a product registration page menu.

The GW 120 determines whether a discovery response message is received in step 906. When the discovery response message is received, the GW 120 provides the user with information about the Wi-Fi device that transmitted the discovery response message in step 908. When the headless Wi-Fi device is selected by the user 150 in step 910, the GW 120 registers a request including a password for checking message integrity with the selected headless Wi-Fi device in step 912. Send the message.

Subsequently, when the GW 120 receives a registration response message including a device type, a Wi-Fi MAC address, and a password from the headless Wi-Fi device in step 914, the password included in the registration response message is requested to register. The integrity of the registration response message is checked based on whether it is the same as the password included in the message. In operation 916, if the registration response message is determined to have integrity, the GW 120 generates a certificate and a secret key for the headless Wi-Fi device to generate the headless Wi-Fi device 100. To send). The generated certificate and secret key may be used to form a channel capable of mutual authentication between the GW 120 and the headless Wi-Fi device.

10 is a flowchart illustrating an operation in which a display Wi-Fi device is registered in a GW in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 10, the display Wi-Fi device performs a network pairing operation through communication with the AP 160 in step 1000. In operation 1002, when the discovery advertisement message is received from the GW 120, the display Wi-Fi device transmits a discovery response message to the GW 120. The discovery response message may include information about the display Wi-Fi device (Wi-Fi MAC address, IP address, etc.).

The display Wi-Fi device determines whether a registration request message is received from the GW 120 in step 1004. When the registration request message is received, the display Wi-Fi device detects a PIN for checking the message integrity included in the registration request message. In addition, the display Wi-Fi device displays an input window on which the same PIN as the detected PIN can be input from the user 150 on the display unit. The display Wi-Fi device receives a PIN from the user 150 through the input window in step 1006, and the input PIN, the device type of the display Wi-Fi device and the Wi-Fi MAC address in step 1008. The registration response message including the message is transmitted to the GW 120.

If the message integrity of the registration response message is checked based on the input PIN, the display Wi-Fi device receives and stores a certificate and a private key from the GW 120 in step 1010. Then, after the registration process is completed, the display Wi-Fi device may perform communication by forming a channel capable of mutual authentication with the GW 120 based on the stored certificate and secret key.

FIG. 11 is a flowchart illustrating an operation in which a GW registers a display Wi-Fi device in a wireless communication system according to an exemplary embodiment.

Referring to FIG. 11, when a registration event occurs in step 1100, the GW 120 enters a registration mode in step 1102 and drives a timer. The GW 120 broadcasts a discovery advertisement message in step 1104 when there is a request for information on a Wi-Fi device that can be registered from the user 150. Meanwhile, the user 150 may access the GW management web page (or application) and perform the above request through a product registration page menu.

The GW 120 determines whether a discovery response message is received in step 1108. When the discovery response message is received, the GW 120 provides the user with information about the Wi-Fi device that transmitted the discovery response message in step 1110. When the display Wi-Fi device is selected by the user 150 in step 1112, the GW 120 sends a registration request message including a PIN for message integrity check to the selected display Wi-Fi device in step 1114. Send.

Next, when the GW 120 receives a registration response message including a device type, a Wi-Fi MAC address, and a PIN from the display Wi-Fi device in step 1116, the PIN included in the registration response message is the registration request message. The integrity of the registration response message is checked based on whether it is the same as the PIN included in the.

In operation 1118, if the registration response message is determined to have integrity, the GW 120 generates a certificate and a secret key for the display Wi-Fi device and transmits the certificate to the display Wi-Fi device. The generated certificate and secret key may be used to form a channel capable of mutual authentication between the GW 120 and the display Wi-Fi device.

12 is a flowchart illustrating an operation in which a GW registers a Wi-Fi device to a server in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 12, when the Wi-Fi device 100 is registered and a mutual authentication channel is established with the server 140 in step 1200, the GW 120 registers the Wi-Fi device 100. A request message (device type, Wi-Fi MAC address, GW authentication information) is transmitted to the server 140. Here, the GW authentication information is transmitted to the server 140 as information for message integrity for the registration request message.

When the GW 120 receives the authentication information (ID and password) for the Wi-Fi device 100 from the server 140 in step 1202, the GW 120 receives the received authentication information (ID and password) in step 1204. Transmit to the Wi-Fi device 100.

13 is a flowchart illustrating an operation in which a server registers a Wi-Fi device through a GW in a wireless communication system according to an embodiment of the present disclosure.

Referring to FIG. 13, the server 140 sets up a mutual authentication channel with the GW 120 in step 1300, and a registration request message for the Wi-Fi device 100 from the GW 120 in step 1302. (Device Type, Wi-Fi MAC Address, GW Authentication Information).

In operation 1304, the server 140 checks the integrity of the registration request message based on the GW authentication information. When the server 140 determines that the registration request message has integrity based on the check result, the server 140 checks the integrity of the registration request message. Generate authentication information (ID, password) for the Wi-Fi device 100 and register the Wi-Fi device 100. In step 1308, the server 140 transmits authentication information (ID, password) for the Wi-Fi device 100 to the GW 120.

Next, an internal configuration of each of the Wi-Fi device 100, the GW 120, and the server 140 according to an embodiment of the present disclosure will be described in detail.

14 is a block diagram of a Wi-Fi device according to one embodiment of the present disclosure.

Referring to FIG. 14, the Wi-Fi device 100 includes a wireless unit 1400, a display unit 1402, a key input unit 1404, a memory 1406, and a controller 1408.

The wireless unit 1400 is a component for performing wireless communication of the Wi-Fi device 100 and may include an interface for Wi-Fi communication.

The display 1402 displays various information generated according to the operation of the Wi-Fi device 100, and the key input unit 1404 is a component for receiving an input from a user.

The display 1402 and the key input unit 1404 may exist as one physical component when the Wi-Fi device 100 is a touch screen type device. The display 1402 may not be included in the Wi-Fi device 100 when the Wi-Fi device 100 is a headless Wi-Fi device.

 The memory 1406 stores authentication information (such as ID and password) acquired during the registration and authentication process of the Wi-Fi device 100 and various information generated according to the operation of the Wi-Fi device 100. .

The control unit 1408 controls the overall operation of the Wi-Fi device 100 by controlling the wireless unit 1400, the display unit 1402, the key input unit 1404, and the memory 1406. In particular, the controller 1408 controls the components to perform the operation of the Wi-Fi device according to the processes (2-1), (2-2), and (3) described above.

15 is a block diagram illustrating a GW according to an embodiment of the present disclosure.

Referring to FIG. 15, the GW 120 includes a wireless unit 1500, a key input unit 1504, a memory 1506, and a controller 1508.

The wireless unit 1500 may be a component for performing wireless communication of the GW 120 and may include an interface for communicating with the Wi-Fi device 100 and the server 140.

The key input unit 1504 is a component for receiving an input from a user, and may include, for example, a key for generating a registration event to enter a registration mode.

The memory 1506 stores authentication information (such as ID and password) obtained during the registration and authentication process of the GW 120 and various information generated according to the operation of the GW 120.

The controller 1508 controls the overall operation of the GW 120 by controlling the wireless unit 1500, the key input unit 1504, and the memory 1506. In particular, the controller 1508 controls the components such that the operation of the GW according to the processes (1), (2-1), (2-2), and (3) described above is performed.

16 is a block diagram illustrating a server according to an embodiment of the present disclosure.

Referring to FIG. 16, the server 140 includes a wireless unit 1600, a memory 1606, and a controller 1608.

The wireless unit 1600 may be a component for performing wireless communication of the server 140 and may include an interface for communicating with the GW 120.

The memory 1606 may be variously generated according to the authentication information (ID and password, etc.) obtained during the registration and authentication process of the GW 120 and the Wi-Fi device 100 and the operation of the server 140. Save the information.

The controller 1608 controls the overall operation of the server 140 by controlling the wireless unit 1600 and the memory 1606. In particular, the controller 1608 controls the components to perform the operation of the server according to the above-described processes (1) and (3).

Meanwhile, in the detailed description of the present disclosure, specific embodiments have been described. However, various modifications may be possible without departing from the scope of the present disclosure. Therefore, the scope of the present disclosure should not be limited to the described embodiments, but should be determined not only by the scope of the following claims, but also by the equivalents of the claims.

Claims (24)

In the method (GW) performs the device registration and authentication in a wireless communication system,
Transmitting a registration request message including the first information to the device;
Receiving a registration response message including second information from the device;
Generating first authentication information for the device based on whether the second information corresponds to the first information, and allocating the generated first authentication information to the device;
Setting an authentication channel between the GW and the device based on the first authentication information;
Registering the device with a server and receiving second authentication information for the device from the server;
And transmitting the received second authentication information to the device through the authentication channel.
The method of claim 1,
And the first information and the second information include a first password and a second password, respectively.
The method of claim 1,
And the first information and the second information each include a first personal identification number (PIN) and a second PIN.
The method of claim 1,
The first authentication information is allocated to the device when the device and the GW enter a registration mode.
The registration mode is a mode for performing an operation for registering the device in the GW, and when the interface for entering the registration mode is selected in each of the device and the GW, the device registration is performed for a preset time. And how authentication is performed.
The method of claim 1,
Registering the device to the server includes transmitting a registration request message to the server requesting registration of the device,
And the registration request message includes information on the device and third authentication information for authentication between the GW allocated from the server and the server.
In the method for the device to perform registration and authentication in a wireless communication system,
Receiving a registration request message including first information from a gateway (GW),
Transmitting a registration response message including second information to the GW;
Receiving first authentication information generated by the GW based on whether the second information corresponds to the first information;
Setting an authentication channel between the device and the GW based on the first authentication information;
Receiving second authentication information generated by a server from the GW through the authentication channel;
And performing communication with the server based on the received second authentication information.
The method of claim 6,
And the first information and the second information include a first password and a second password, respectively.
The method of claim 6,
And the first information and the second information each include a first personal identification number (PIN) and a second PIN.
The method of claim 6,
The first authentication information is allocated to the device when the device and the GW enter a registration mode.
The registration mode is a mode for performing an operation for registering the device in the GW, and when the interface for entering the registration mode is selected in each of the device and the GW, the device registration is performed for a preset time. And how authentication is performed.
In the method in which the server performs the device registration and authentication in a wireless communication system,
Receiving a first registration request message including first information from a gateway (GW),
Allocating first authentication information to the GW based on whether the first information corresponds to second information stored in the server;
Setting an authentication channel between the GW and the server based on the first authentication information;
If the GW requests registration of the device with the server, generating second authentication information for the device;
And transmitting the second authentication information to the GW through the authentication channel.
The method of claim 10,
The generating of the second authentication information may include receiving a second registration request message from the GW requesting registration of the device, registering the device with the server based on the second registration request message, and generating the second registration information. Generating authentication information,
The registration request message is a device registration and authentication method comprising the information on the device and the first authentication information.
The method of claim 11,
The second authentication information is transmitted to the GW entering the registration mode,
The registration mode is a mode for performing an operation for registering the GW with the server, and when the interface for entering the registration mode is selected in the GW, the registration mode is performed for a preset time. .
In a gateway (GW) in a wireless communication system,
A transceiver unit,
Control the transceiver to transmit a registration request message including first information to a device, and receive a registration response message including second information from the device,
Generate first authentication information for the device based on whether the second information corresponds to the first information, assign the generated first authentication information to the device, and based on the first authentication information. Establish an authentication channel between the GW and the device,
And a control unit configured to register the device to a server, receive second authentication information about the device from the server, and control the transceiver to send the received second authentication information to the device through the authentication channel. .
The method of claim 13,
And the first information and the second information each include a first password and a second password.
The method of claim 13,
Wherein the first information and the second information each include a first personal identification number (PIN) and a second PIN.
The method of claim 13,
The first authentication information is allocated to the device when the device and the GW enter a registration mode.
The registration mode is a mode for performing an operation for registering the device to the GW, and when the interface for entering the registration mode in each of the device and the GW is selected, the GW is performed for a preset time.
The method of claim 13,
The controller controls the transceiver to transmit a registration request message requesting registration of the device to the server,
The registration request message includes information on the device and third authentication information for authentication between the GW and the server allocated from the server.
A device in a wireless communication system,
A transceiver unit,
Control the transceiver to receive a registration request message including first information from a gateway (GW), and transmit a registration response message including second information to the GW,
Receiving first authentication information generated by the GW based on whether the second information corresponds to the first information, establishing an authentication channel between the device and the GW based on the first authentication information,
And a control unit which receives the second authentication information generated by a server from the GW through the authentication channel and controls the transceiver to communicate with the server based on the received second authentication information.
The method of claim 18,
Wherein the first information and the second information include a first password and a second password, respectively.
The method of claim 18,
Wherein the first information and the second information each include a first personal identification number (PIN) and a second PIN.
The method of claim 18,
The first authentication information is allocated to the device when the device and the GW enter a registration mode.
The registration mode is a mode for performing the operation for registering the device to the GW, characterized in that the device is performed for a predetermined time when the interface for entering the registration mode in each of the device and the GW is selected.
A server in a wireless communication system,
A transceiver unit,
Controlling the transceiver to receive a first registration request message including first information from a gateway (GW),
Assigning first authentication information to the GW based on whether the first information corresponds to second information stored in the server, setting an authentication channel between the GW and the server based on the first authentication information, When the GW requests registration of the device with the server, the second authentication information is generated for the device.
And a controller configured to control the transceiver to transmit the second authentication information to the GW through the authentication channel.
The method of claim 22,
The control unit controls the transceiver to receive a second registration request message requesting registration of the device from the GW, registers the device to the server based on the second registration request message, and generates the second authentication information. Creates a,
The registration request message includes the information on the device and the first authentication information.
The method of claim 22,
The second authentication information is transmitted to the GW entering the registration mode,
The registration mode is a mode for performing an operation for registering the GW with the server, and when the interface for entering the registration mode is selected in the GW, the server is performed for a preset time.

Images