Method of improving wireless local area authentication mechanism

Abstract

The invention provides a method of improving a wireless local area authentication mechanism. After a wireless access point sends a message that the authentication is successful in a plain text to a client in a bidirectional authentication process, the method comprises the steps of providing a first encryption parameter, if the first encryption parameter remains unchanged after being encrypted by the client, decrypted by the wireless access point, encrypted by the wireless access point and decrypted by the client, judging that the wireless access point is legal; providing a second encryption parameter, if the second encryption parameter remains unchanged after being encrypted by the wireless access point, decrypted by the client, re-encrypted by the client and re-decrypted by the wireless access point, judging that the entire authentication process is completed. The method of improving the wireless local area authentication mechanism provided by the invention can effectively prevent the "man-in-the-middle attack", i.e., the illegal user is unable to access the network through the port of the legal user, so as to avoid the "communication hijack" attack.

Description

technical field [0001] The invention relates to the technical field of communication, in particular to an improved method of a wireless local area network authentication mechanism. Background technique [0002] With the development of wireless networks, more and more people are using wireless methods to access networks. Due to the openness of wireless channels, intruders can easily intercept wireless data or access wireless networks by means of scanning or monitoring, so the security of wireless networks has attracted more and more attention. In order to protect the security of the wireless network, people use terminal authentication. At present, people usually use the IEEE802.1X protocol or EAP-TLS (two-way authentication based on digital certificates) to realize the access authentication of the device. [0003] The main purpose of the IEEE802.1X protocol is to solve the problem of access verification of wireless LAN users. EAP-TLS authentication provides a two-way authen...

AI Technical Summary

Problems solved by technology

[0004] Although EAP-TLS authentication is based on two-way authentication between STA and RADIUS server, and the key on the pre-issued digital certificate is used in the authentication process, it does not fully verify the selected AP, and the AP is considered reliable by default. Therefore, there will be malicious users posing as APs, deceiving users by sending unprotected EAP-Success and other information, making users connect to illegal APs, thereby obtaining all network communications of users, and even sending disassociation frames to use Legitimate user disconnects

The AP does not know that the legitimate user has disconnected and continues to communicate. At this time, the illegal user can access the network through the port of the legitimate user, thereby carrying out "communication hijacking" attacks

Images