CN101489226A - Wireless local area network switching authentication method based on elliptical curve - Google Patents

Abstract

The present invention discloses a wireless local area network switching authentication method based on elliptic curve, and belongs to the filed of network switching authentication. The method comprises the following steps: initializing an authentication server, which includes establishing two prime number sets and one elliptic curve; initializing the access point and mobile station, which comprises calculating authentication server, establishing the common and private key pair by the base point of common and private key pair of broadcast access point and mobile station to the base point, the access point and mobile station according to the secret information transmitted by authentication server; and switching authentication, which comprises executing mutual authentication with target access point and common key of mobile station and establishing sharing key with an ECDH algorithm. The method of the invention can effectively defend all known wireless local area network attack comprising denial of service and domino effect attack, and furthermore effectively reducing the computing expenditure and transmission expenditure.

Description

A kind of wireless local area network switching authentication method based on elliptic curve

Technical field

The present invention relates to the switching authentication method in a kind of network communication, relate in particular to a kind of wireless local area network switching authentication method, belong to network and switch field of authentication based on elliptic curve.

Background technology

Switching between the WAP (wireless access point) is very important for the WLAN (wireless local area network) mobile radio station, and it then is a kind of challenge that the low time delay of design safety is switched authentication protocol.

When mobile radio station when the current access point switches to target access, need authenticate in target access and associated subsequently.IEEE802.11 basic agreement in 1997 has defined two kinds of certificate schemes, that is: shared key authentication and open system authentication, however these two kinds of schemes can not be resisted multiple attack.IEEE802.11f working group and IETFSeamoby working group have formulated the context transfer protocol that is used to switch authentication immediately, but this agreement still can not be resisted the domino effect attack.

At present, IEEE802.11r group is designing a kind of fast B SS handover scheme (FBBST) that is applied to switch authentication, and the FBSST agreement is the tripartite certificate scheme of a class Kerberos, yet still there are some problems in the FBSST agreement:

The one, 802.11r document requirement access point need be set up the trusting relationship of recognizing each other in twos in the 802.11r territory.Supposing has n in the 802.11r territory _ApIndividual access point, then the total security association between each access point will reach n _Ap ²Therefore work as n _ApDuring growth, the deployment of security association will become impossible between access point.

The 2nd, Denial of Service attack.In the FBSST agreement, only received that 3 just can be verified the initial message that mobile radio station sends after from the message of initial access point when target access, and judge whether to refuse mobile radio station, so the assailant can create a large amount of illegal handoff request information and sending to target access.Because target access can not be verified this message, thus can with initial access point communication, initial access point then needs to verify and deciphers a large amount of message of coming from target access.

The 3rd, domino effect is attacked.In case the access point in 802.11r territory is broken, the access point that the assailant just can disguise oneself as and be broken is set up success identity with other access point that is not broken as yet.This shows that the FBSST agreement does not solve domino effect and attacks problem, even has also introduced more efficient and safety problem.

The authentication public key scheme had been applied to wireless network already, distributed but the scheme that is based on PKI all greatly depends on public key certificate, and it is particularly high that this operates in the wireless environment of the certificate scheme that use designs based on trusted right delegation cost.When portable terminal when a trusted right delegation territory roams to another trusted right delegation territory, the trusted right delegation initialization procedure must repeat to set up, and therefore can not save any switching time, can not meet the demand of switching authentication.

Summary of the invention

The present invention proposes a kind of wireless local area network switching authentication method based on elliptic curve for the trust management overhead issues that solves in the WLAN (wireless local area network) switching.

A kind of wireless local area network switching authentication method based on elliptic curve comprises the steps:

The first step: initialization

(1) certificate server initialization

Certificate server is created the first prime number S set TAPRI and the second prime number set B SSPRI, uses the SECG technology at finite field F then _pLast establishment elliptic curve T=(p, a, b, G, n, h), and wherein: p, a, b, n, h is for constituting the parameter of elliptic curve T, and G is a basic point on the elliptic curve T;

(2) when the access point request was supported, access point is initialization as follows:

A. certificate server produces the current first prime number j at random and it is added among the second prime number set B SSPRI, calculates the current first basic point G _j=jG=(j mod n) G;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all mobile radio stations in the territory are broadcasted current the 3rd basic point G that was signed by certificate server _N

E. certificate server sends the current first message BSSKEYING={G under the protection of security association _M, j, N, G _j, T} is to access point, and access point calculates the current first private key k after receiving this message _Bss=(N/j) modn,＜k _Bss, G _NFormed the current first basic point G _jThe public private key pair of last access point;

(3) when the mobile radio station request was served, mobile radio station is initialization as follows:

A. certificate server produces the current second prime number r at random and it is added among the first prime number S set TAPRI, calculates current the 4th basic point G _r=rG=(r mod n) G;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all access points in the territory are broadcasted the current second basic point G that was signed by certificate server _M

E. certificate server sends the current second message STAKEYING={G under the protection of security association _N, r, M, G _r, T} is to mobile radio station, and mobile radio station calculates the current second private key k after receiving this message _Sta=(M/r) mod n,＜k _Sta, G _MFormed current the 4th basic point G _rThe public private key pair of last mobile radio station;

Second step: switch authentication

Switch verification process and comprise two message:

Message 1: mobile radio station sends the 3rd message to target access $Q_1={\{G_r,y_1\}}_{k_{\mathrm{sta}}};$

Message 2: target access receives the 3rd message Q ₁The second corresponding basic point G of back _MThe 4th basic point G with correspondence _rVerify the 3rd message Q ₁, target access sends the 4th message to mobile radio station then $Q_2={\{G_j,y_2\}}_{k_{\mathrm{bss}}},$ Mobile radio station receives the 4th message Q ₂The 3rd corresponding basic point G of back _NThe first basic point G with correspondence _jVerify the 4th message Q ₂, then target access and mobile radio station use ECDH key generting machanism to generate shared key k respectively _Ptk

The reciever that switches in the verification process is checked the 3rd message Q ₁Middle the 4th corresponding basic point G _rWith the 4th message Q ₂The middle first corresponding basic point G _jThe second basic point G that is not equal to basic point G, correspondence _MOr the 3rd corresponding basic point G _N

Wherein: y ₁Be the ECDH public private key pair＜x of mobile radio station ₁, y ₁PKI, y ₂Be the ECDH public private key pair＜x of access point ₂, y ₂PKI, ECDH is an elliptic curve Diffie-Hellman algorithm;

Essence of the present invention is to have designed a kind of PKI allocative decision of novelty, promptly all mobile radio stations are shared same PKI but are respectively held different private key and different public private key pair basic point among same area, certificate server all access point broadcasting in the territory should be shared PKI, the authentication mobile radio station so access point can use public-key, simplify the PKI assigning process, reduced the trust management expense.Because certificate server does not involve in handoff procedure, so can avoid Denial of Service attack; Because switch the trusting relationship that authenticates and do not rely between access point, so can avoid domino effect to attack.Fail safe expense of the present invention is much smaller than FBSST scheme and other certificate schemes based on PKI, and switching authentication only needs two message of two inter-entity, thereby has also taken into account efficient and security performance.

Description of drawings

Fig. 1 is the trust model schematic diagram between certificate server, access point and the mobile radio station among the present invention, number in the figure title: AS-certificate server, AP-access point, STA-mobile radio station, PSA-already present security association.

Embodiment

Trust model schematic diagram between certificate server in the WLAN (wireless local area network), access point and the mobile radio station as shown in Figure 1, certificate server is responsible for safeguarding initial trusting relationship, and promptly we suppose to have safe lane respectively between certificate server and each access point, certificate server and each mobile radio station.When using the inventive method, certificate server will at first carry out initialization to self and each access point, each mobile radio station, then when mobile radio station need switch authentication, as long as authentication mutually between mobile radio station and the target access.

A kind of wireless local area network switching authentication method based on elliptic curve comprises the steps:

The first step: initialization

(1) certificate server initialization

Certificate server is created the first prime number S set TAPRI and the second prime number set B SSPRI, uses the SECG technology at finite field F then _pLast establishment elliptic curve T=(p, a, b, G, n, h), and wherein: p, a, b, n, h is for constituting the parameter of elliptic curve T, and G is a basic point on the elliptic curve T;

(2) when the access point request was supported, access point is initialization as follows:

A. certificate server produces the current first prime number j at random and it is added among the second prime number set B SSPRI, calculates the current first basic point G _j=jG=(j mod n) G, nG=O wherein, O is coordinate zero point;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all mobile radio stations in the territory are broadcasted current the 3rd basic point G that was signed by certificate server _N,,, can add timestamp in the message for preventing Replay Attack so that the authentication of integrity protection and message source to be provided;

E. certificate server sends the current first message BSSKEYING={G under the protection of security association _M, j, N, G _j, T} is to access point, and access point calculates the current first private key k after receiving this message _Bss=(N/j) modn,＜k _Bss, G _NFormed the current first basic point G _jThe public private key pair of last access point;

(3) when the mobile radio station request was served, mobile radio station is initialization as follows:

A. certificate server produces the current second prime number r at random and it is added among the first prime number S set TAPRI, calculates current the 4th basic point G _r=rG=(r mod n) G;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all access points in the territory are broadcasted the current second basic point G that was signed by certificate server _M,,, can add timestamp in the message for preventing Replay Attack so that the authentication of integrity protection and message source to be provided;

E. certificate server sends the current second message STAKEYING={G under the protection of security association _N, r, M, G _r, T} is to mobile radio station, and mobile radio station calculates the current second private key k after receiving this message _Sta=(M/r) modn,＜k _Sta, G _MFormed current the 4th basic point G _rThe public private key pair of last mobile radio station;

Second step: switch authentication

Switch verification process and comprise two message:

Message 1: mobile radio station sends the 3rd message to target access $Q_1={\{G_r,y_1\}}_{k_{\mathrm{sta}}},$ The 3rd message Q ₁Use ellipse curve signature mechanism is subjected to the current second private key k of mobile radio station _StaProtection;

Message 2: target access receives the 3rd message Q ₁Back with the second corresponding basic point G of hold _MBe contained in the 3rd message Q ₁The 4th basic point G of correspondence _rVerify the 3rd message Q ₁, target access sends the 4th message to mobile radio station then $Q_2={\{G_j,y_2\}}_{k_{\mathrm{bss}}},$ The 4th message Q ₂Use ellipse curve signature mechanism, mobile radio station receive the 4th message Q ₂Back with the 3rd corresponding basic point G of hold _NBe contained in the 4th message Q ₂The first basic point G of correspondence _jVerify the 4th message Q ₂, then target access and mobile radio station use ECDH key generting machanism to generate shared key k respectively _Ptk

The reciever that switches in the verification process is checked the 3rd message Q ₁Middle the 4th corresponding basic point G _rWith the 4th message Q ₂The middle first corresponding basic point G _jThe second basic point G that is not equal to basic point G, correspondence _MOr the 3rd corresponding basic point G _N

Wherein: y ₁Be the ECDH public private key pair＜x of mobile radio station ₁, y ₁PKI, y ₂Be the ECDH public private key pair＜x of access point ₂, y ₂PKI, ECDH is an elliptic curve Diffie-Hellman algorithm;

The storage of two big numbers of M and N and transmission are all represented with following formula in the inventive method: establish the big number of P for storing and transmit, then:

P is log by length just ₂m _StaBit

With length be b _StaBit

This two number is stored and is transmitted;

Wherein: being located among the first prime number S set TAPRI has m _StaIndividual element, the length of these elements is b _StaBit, the P in the formula are a parameter.

Because comprise several access points and several mobile radio stations in the WLAN (wireless local area network), so in whole initialization procedure, element among the first prime number S set TAPRI and the second prime number set B SSPRI can constantly increase, the first prime number j that certificate server produces at random is also different with the second prime number r, so the first basic point G _j, the 4th basic point G _r, the second basic point G _MWith the 3rd basic point G _NAlso carrying out and can change with whole initialization procedure.

Claims (2)

1, a kind of wireless local area network switching authentication method based on elliptic curve is characterized in that comprising the steps:

The first step: initialization

(1) certificate server initialization

Certificate server is created the first prime number S set TAPRI and the second prime number set B SSPRI, uses the SECG technology at finite field F then _pLast establishment elliptic curve T=(p, a, b, G, n, h), and wherein: p, a, b, n, h is for constituting the parameter of elliptic curve T, and G is a basic point on the elliptic curve T;

(2) when the access point request was supported, access point is initialization as follows:

A. certificate server produces the current first prime number j at random and it is added among the second prime number set B SSPRI, calculates the current first basic point G _j=jG=(j mod n) G;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all mobile radio stations in the territory are broadcasted current the 3rd basic point G that was signed by certificate server _N

E. certificate server sends the current first message BSSKEYING={G under the protection of security association _M, j, N, G _j, T} is to access point, and access point calculates the current first private key k after receiving this message _Bss=(N/j) modn,＜k _Bss, G _NFormed the current first basic point G _jThe public private key pair of last access point;

(3) when the mobile radio station request was served, mobile radio station is initialization as follows:

A. certificate server produces the current second prime number r at random and it is added among the first prime number S set TAPRI, calculates current the 4th basic point G _r=rG=(r mod n) G;

B. the product M and the current second basic point G of all elements among the authentication server computes first prime number S set TAPRI _M=MG=(M mod n) G;

C. the product N and current the 3rd basic point G of all elements among the authentication server computes second prime number set B SSPRI _N=NG=(N mod n) G;

D. certificate server all access points in the territory are broadcasted the current second basic point G that was signed by certificate server _M

E. certificate server sends the current second message STAKEYING={G under the protection of security association _N, r, M, G _r, T} is to mobile radio station, and mobile radio station calculates the current second private key k after receiving this message _Sta=(M/r) mod n,＜k _Sta, G _MFormed current the 4th basic point G _rThe public private key pair of last mobile radio station;

Second step: switch authentication

Switch verification process and comprise two message:

Message 1: mobile radio station sends the 3rd message to target access $Q_1={\{G_r,y_1\}}_{k_{\mathrm{sta}}}$ ；

Message 2: target access receives the 3rd message Q ₁The second corresponding basic point G of back _MThe 4th basic point G with correspondence _rVerify the 3rd message Q ₁, target access sends the 4th message to mobile radio station then $Q_2={\{G_r,y_2\}}_{k_{\mathrm{bss}}}$ , mobile radio station receives the 4th message Q ₂The 3rd corresponding basic point G of back _NThe first basic point G with correspondence _jVerify the 4th message Q ₂, then target access and mobile radio station use ECDH key generting machanism to generate shared key k respectively _Ptk

The reciever that switches in the verification process is checked the 3rd message Q ₁Middle the 4th corresponding basic point G _rWith the 4th message Q ₂The middle first corresponding basic point G _jThe second basic point G that is not equal to basic point G, correspondence _MOr the 3rd corresponding basic point G _N

Wherein: y ₁Be the ECDH public private key pair＜x of mobile radio station ₁, y ₁PKI, y ₂Be the ECDH public private key pair＜x of access point ₂, y ₂PKI, ECDH is an elliptic curve Diffie-Hellman algorithm;

2, a kind of wireless local area network switching authentication method based on elliptic curve according to claim 1 is characterized in that: the storage of big number and transmission are represented with following formula: establish the big number of P for storing and transmit, then:

P is log by length just ₂m _StaBit

With length be the bsta bit This two number is stored and is transmitted;

Wherein: being located among the first prime number S set TAPRI has m _StaIndividual element, the length of these elements is b _StaBit, the P in the formula are a parameter.

Images