蒋　华　张乐乾　阮玲玲

(桂林电子科技大学计算机科学与工程学院　广西 桂林 541004)



基于公钥密码体制的802.1x双向认证研究

蒋华张乐乾阮玲玲

(桂林电子科技大学计算机科学与工程学院广西 桂林 541004)

摘要针对申请者和认证者间认证的不平等以及控制帧和管理帧的明文传输问题，通过分析802.1x/EAP认证过程，提出一种基于公钥密码体制的802.1x双向认证改进方案。该方案利用引入的公钥密码体制的认证性实现申请者与认证服务器的双向认证，同时利用对称密钥实现申请者、认证者和认证服务器三者之间的两两双向认证并对控制帧和管理帧中的敏感域加密。该方案能够保护认证进程的机密性，对AP身份进行认证，有效阻止了中间人攻击和拒绝服务攻击。通过仿真实验证明，该方案比原协议认证成功率平均高约13.1%，接入的STA数量有显著增加，约增加STA总数的26%，在攻击次数达到50次以上时，接入STA数量下降速率平稳缓慢。

关键词802.1x双向认证公钥密码中间人攻击拒绝服务攻击

STUDY ON PUBLIC KEY CRYPTOGRAPHY-BASED 802.1X BIDIRECTIONAL AUTHENTICATION

Jiang HuaZhang LeqianRuan Lingling

(School of Computer Science and Engineering,Guilin University of Electronic Technology,Guilin 541004,Guangxi,China)

AbstractIn order to solve the problems of the unequal authentication between applicant and authenticator and the plaintext transmission of the control frame and management frame, according to the analysis on 802.1x/EAP authentication process, we proposed an improved scheme of 802.1x/EAP bidirectional authentication which is based on public key cryptosystem. The scheme uses the authentication property of the introduced public key cryptosystem to achieve bidirectional authentication between applicant and authentication server. Meanwhile it uses symmetric key cryptosystem to achieve the bidirectional authentication between each pair of supplicant, authenticator and authentication server and encrypts the sensitive domains of control frame and management frame. The scheme can protect the confidentiality of authentication process, authenticates the identity of AP, and effectively prevents the man-in-the-middle attacks and denial of service attacks. It was proved by simulation experiments that in average the scheme was about 13.1% higher in successful authentication than the original protocol, the number of the successful STA access had the significant increase, roughly about 26% of total STA numbers, and the descending rate of STA access number was slow and stable while the number of attacks was more than 50.

Keywords802.1xBidirectional authenticationPublic key cryptographyMan-in-the-middle attackDenial of service attacks

0引言

无线局域网因其网络空间的开放性和用户的移动接入性，使得网络在各种便携式终端上的应用越来越方便。用户接入网络的不确定性和频繁移动性使得我们必须要建立更加强健和完善的身份认证和访问控制机制来保障无线网络用户的合法性。

在IEEE 802.11i标准中802.1x协议认证框架的基础上，本文通过分析802.1x/EAP认证机制的过程及其安全性，提出一种基于公钥密码体制的802.1x认证改进方案。……