A WAPI authentication and secret key negotiation method and system

Abstract

The present invention provides a method and a system for authentication and key negotiation in the WLAN Authentication and Privacy Infrastructure (WAPI), in which an authentication organization is included. The method has two steps. Firstly, a client end and / or an access point apply for a self-verified public key certificate from the authentication organization; and secondly, the identity verification and key negotiation is carried out between the client end and the access point by utilizing the self-verified public key certificate. By the present invention, the quantity of data transmission and on-line calculation is reduced, the security of the authentication sytem is enhanced, and problems exist in the course of identity authentication and key negotiation in the WLAN Authentication and Privacy Infrastructure (WAPI), thus further increasing the security intensity of the WAPI authentication mechanism.

Description

technical field [0001] The present invention relates to the field of wireless communication technology, in particular to the security technology of wireless local area network WLAN, specifically, to a WAPI authentication and key negotiation method and system, to solve the identity authentication and key negotiation when mobile devices access the WAPI network question. Background technique [0002] In 2003, the China Intellectual Property Office published an invention patent application with the application number 02139508.X, titled "Security Access of Mobile Terminals in Wireless Local Area Network and Data Confidential Communication Method for Wireless Links". The patents involved in this application are applied in China's national wireless LAN standard GB15629.11-WLAN Authentication and Privacy Infrastructure (WAPI: WLAN Authentication and Privacy Infrastructure), and the wireless LAN authentication infrastructure is called WAI (WLAN Authentication Infrastructure) for shor...

AI Technical Summary

Problems solved by technology

That is to say, at the end of the protocol, the access point AP and the client STA get different session keys, so the key agreement protocol is not secure

[0016] 2. The identity authentication function of the access point AP to the client STA is not implemented

Because in this WAI, an attacker can impersonate a legitimate user to access the network as long as he submits the certificate of a legitimate user, so when the network is billed by time, it may lead to wrong charges

At the same time, once an attacker accesses the network, he may launch many attacks, posing a serious threat to network security.

[0018] 4. The execution efficiency of the protocol is too low. The client STA and the access point AP must transmit their respective public key certificates through the wireless channel with limited resources, and verify the legitimacy and validity of the other party’s certificate through the authentication service unit ASU, which seriously increases The network load, calculation burden and transmission delay are reduced, especially the client STA needs to do heavy signature and signature verification calculations, which affects the real-time performance of user access

[0020] The security of the unicast key negotiation interaction process in the WAPI implementation guide has been improved to a certain extent compared with the security of the national standard Zhongyuan scheme, but it has not fundamentally solved the original security defects and failed to achieve sufficient security strength

Images