CN101778387B - Method for resisting denial of service (DoS) attack for wireless local area network access authentication - Google Patents

Abstract

The invention discloses a method for resisting DoS attack of a wireless access authentication protocol, which mainly solves the problem of DoS attack threat existing in the wireless access authentication process of the existing 802.11i protocol and WAPI protocol. The method utilizes the combined use of the beacon frame publishing mechanism and the client-puzzle mechanism to achieve defense against DoS attacks in the access authentication association process. The implementation steps are: (1) the user obtains the beacon frame issued by the access point by monitoring, and obtains the parameters required for constructing the puzzle; (2) generates the puzzle and makes an answer while completing the authentication interaction; (3) Include the puzzle and the answer in the association request and send it to the access point; (4) The access point decides whether to complete the association process by verifying the puzzle and the answer. The invention has stronger ability to resist DoS attack and adaptability, and is suitable for existing wireless access authentication protocols.

Description

The Method of Resisting Denial of Service Attack of Wireless Local Area Network Access Authentication

technical field

The invention belongs to the field of network technology security, and specifically relates to a method for resisting denial of service DoS attacks in a wireless network environment, which can be used in a wireless local area network environment to reduce the impact of denial of service attacks on the access authentication process. the

technical background

The main purpose of Denial of Service (DoS) attack is to make the service provided in the network lose availability. It is difficult to implement and has a high degree of harm. It is the biggest threat in the network at present. However, due to the openness of the Internet, it is impossible to prevent the existence of such attacks. Therefore, the goal of existing research is how to reduce the impact of DoS attacks on the network. the

Access security of wireless network has always been a hot research topic. Due to limitations of wireless network equipment and bandwidth resources, the access authentication process faces the threat of DoS attacks. Currently existing wireless access authentication protocols, such as WAPI protocol and 802.11i protocol, all have certain DoS attack threats in the wireless access process. the

The 802.11i protocol is currently the most popular wireless network security protocol standard, which provides identity authentication and key exchange functions, and is currently used by mainstream wireless network products on the market. 802.11i inherits two authentication methods of 802.11: open system authentication method and shared key authentication method, and proposes an authentication mechanism based on 802.1X. It is recommended to adopt an authentication mechanism based on 802.1X. The 802.11i protocol proposes a new secure network security system - Robust Security Network (RSN), which is mainly composed of security association management and data encryption mechanisms. The security association management mechanism includes RSN security capability negotiation, 802.1X authentication process and 802.1X key issuance process. the

1. The RSN security capability negotiation process is the process of establishing a security association. Referring to Figure 1, the description is as follows:

1) The user STA obtains the 802.11i information element through the beacon frame or probe response frame of the access point AP;

2) The user STA makes an open system authentication request to the access point AP;

3) The access point AP makes an open system authentication response to the user STA;

4) The user STA sends an association request to the access point AP;

5) The access point AP sends an association request authentication response to the user STA. the

2.802.1X authentication process

After the establishment of the security association is completed, the 802.1X authentication can be entered. The 802.1X authentication protocol realizes the access control of the network. The protocol includes three subjects, the user access terminal, the access authentication terminal and the authentication server, that is, the user STA, the access point AP and the authentication server ASU in the wireless network environment. Under this protocol, the user STA and the access point AP perform mutual authentication through the authentication server ASU. The 802.1X authentication standard is used between the user STA and the access point AP, and the AAA protocol is used as the communication standard between the access point AP and the authentication server ASU, that is, the RADIUS/DIAMETER protocol. the

Referring to Figure 2, the 802.1X authentication process is as follows:

1) The user STA sends an EAP start message to the uncontrolled port of the access point AP;

2) The access point AP returns the EAP extended authentication response, requiring the user STA to provide identity information;

3) The user STA sends its own identity information to the access point AP through the EAP extended authentication response;

4) The access point AP sends the identity information of the user STA to the authentication server ASU through an access request for authentication;

5) The authentication server ASU uses the authentication method encapsulated in the EAP to authenticate the user STA;

6) After the identity of the user STA is authenticated, the authentication server ASU sends the authentication result and key material to the access point AP;

7) The access point AP sends an EAP extended authentication success message to the user STA. the

The above security association establishment process is a state enforcement protocol, and the AP needs to store user state information, so the AP needs to consume certain storage resources. If an attacker sends a large number of false detection requests, the AP will exhaust its own storage resources due to processing these false detection requests, and cannot provide access authentication services for other users. Extended authentication 802.1X provides stronger identity verification for the access authentication process, but it can also be used by attackers to carry out DoS attacks. Attackers can send a large number of false certificates to force the ASU to perform certificate verification, consuming a large amount of computing resources and causing access failures. The login authentication service cannot be performed normally. Therefore, the 802.11i protocol does not play a good role in protecting against DoS attacks. the

The WAPI protocol is a wireless local area network standard in China. It consists of two modules, WAI and WPI, which respectively realize the functions of user identity authentication and transmission data encryption. WAPI is the same as the 802.11i protocol, and requires a security association process first. Referring to Figure 3, the association process is as follows:

1. The user STA obtains the WAPI information element through the beacon frame or probe response frame of the AP

2. The user STA sends an open system authentication request to the access point AP;

3. The access point AP makes an open system authentication response to the user STA;

4. The user STA sends an association request to the access point AP, wherein the association request contains WPAI information elements;

5. The access point AP sends an association request authentication response to the user STA. the

After the WAPI security association is established, WAI authentication will be performed. Refer to Figure 4. The authentication process is as follows: 

First, the access point AP sends an authentication activation request to the user STA, that is, the access point AP sends a beacon frame to the user STA;

Secondly, in the access authentication request, the user STA submits its own certificate and access request time to the access point AP;

Again, in the certificate authentication request, the access point AP sends the certificate of the user STA, the access request time of the user STA, its own certificate and his signature on these three parts to the authentication server ASU;

Then, when the authentication server ASU receives the certificate authentication request sent by the access point AP, it first verifies the signature and certificate of the access point AP. After the authentication is successful, it further verifies the certificate of the user STA. The authentication result of the STA and the access point AP certificate is signed with its own private key, and the signature is sent back to the access point AP together with the result of the certificate verification;

Finally, the access point AP verifies the received certificate authentication response, and obtains the authentication result of the user STA certificate, and decides whether to allow access to the user STA according to the result. At the same time, the access point AP needs to forward the verification result of the authentication server ASU to the user STA, and the user STA also needs to verify the signature of the authentication server ASU, and obtain the authentication result of the access point AP certificate. Enter the access point AP. the

The WAPI protocol also needs to establish an association process, so there is a threat of resource exhaustion in the association process in the 802.11 protocol. For the WAI process, both the AP and the ASU need to perform signature authentication calculation on the certificate. Therefore, the AP and the ASU are vulnerable to DoS attacks. the

Aiming at the DoS attack threat of the authentication protocol, the researchers first proposed the cookie mechanism. The basic idea is: when the request from the initiator comes, the responder generates a cookie bound to the initiator, then sends the cookie to the initiator, and asks the sender to return the cookie. Attackers using forged network addresses are very likely to It is difficult to forge and tamper with cookies to continue to run the protocol, so as to achieve the purpose of defending against DoS attacks. This mechanism has a good defense effect on DoS attacks of forged IP addresses, but it is powerless against DoS attacks of IP addresses from real addresses. the

Later, the client-puzzle mechanism was proposed to further enhance the ability of the authentication protocol to resist DoS attacks. The basic principle is that when the server receives the client's request, the server will send a puzzle to the client, requiring the client to make a solution within the specified time, and send the answer back to the server. But how to prevent the request process from being used by attackers to launch DoS attacks is a problem that needs to be solved. Puzzles are usually constructed by consuming CPU resources and memory resources. the

Recently, some researchers have proposed the method of using wireless modules to construct puzzles to resist DoS attacks of wireless access authentication, but it also brings some other security risks, and there is still a long way to go before it is practical. Therefore, the defense mechanism of the existing wireless access authentication protocol to the DoS attack is still not perfect. It is necessary to design a method that can effectively resist DoS attacks in the access authentication process to improve the security of mobile networks. the

Contents of the invention

The present invention mainly aims at the deficiencies in the above-mentioned wireless access authentication process, and proposes a method for resisting WLAN access authentication denial-of-service attacks by combining the modified beacon frame mode of monitoring and the client-puzzle mechanism.

To achieve the above object, the present invention comprises the following steps:

(1) The user STA obtains relevant information elements by listening to the beacon frame of the access point AP, which contains the original information and the parameters required for the user to generate a problem puzzle;

(2) After obtaining the relevant information elements, the user STA performs corresponding authentication interaction with the access point AP;

(3) While performing authentication interaction, perform the following operations:

3a) The user STA obtains the MAC address AP_add of the access point AP from the beacon frame, obtains the random number Ni used to construct the puzzle and the current difficulty level L from the information element, specifies the Hash function used for the puzzle calculation, and chooses arbitrarily random number r;

3b) Connect the X to be answered, the random number r selected by the user, the MAC address AP_add of the access point, the constructed random number Ni, and the difficulty level L into a bit string X‖r‖Ni‖AP_add‖L in order, and Hash calculation is performed on the bit string, if the last L bit of the calculation result is 0, then X is the answer to the puzzle, otherwise the answer cannot pass;

3c) The user uses the method of exhaustive search to find an answer X, so that it satisfies the judgment conditions of the answer in step 3b;

(4) After completing the generation and answering of the puzzle, the user STA initiates an association request message to the access point AP, and adds relevant parameters for generating the puzzle to the information element of the association request message;

(5) The access point AP verifies the puzzle in the association request message and the searched solution X according to the determination condition of the solution in step 3b), if the puzzle verification is passed, and the puzzle verification result is stored in the temporary list of the current solution If the existing verification results are not repeated, an association request response message is sent to the user to complete the association request, and the verification result is stored in the temporary answer list, otherwise, the user's access request is terminated. the

The invention increases the puzzle construction parameters by modifying the information elements in the beacon frame, so that the user can obtain the puzzle construction parameters by monitoring the beacon frame, reduces the number of times of negotiation for constructing the puzzle in the traditional scheme, and improves At the same time, because the user listens to the beacon frame to obtain the puzzle construction parameters, it avoids the potential DoS attack threat in the process of requesting the puzzle in the traditional client-puzzle mechanism. the

By verifying the puzzle and answer generated by the user in the association request message, the forged request is screened out, so as to improve the anti-DoS attack capability of the wireless access authentication protocol. the

Description of drawings

Figure 1 is a schematic diagram of the association establishment process of 802.11i protocol access authentication;

Fig. 2 is a schematic diagram of the extended authentication process of 802.11i protocol access authentication;

Fig. 3 is a schematic diagram of the association establishment process of WAPI protocol access authentication;

Fig. 4 is a schematic diagram of the WAI authentication process of WAPI protocol access authentication;

Fig. 5 is the schematic diagram that the present invention is applied to WLAN access authentication process;

Fig. 6 is the beacon frame information element format that the present invention modifies for 802.11i agreement;

Fig. 7 is the beacon frame information element format that the present invention modifies for WAPI protocol;

Fig. 8 is the association request information element format that the present invention modifies for 802.11i protocol;

Fig. 9 is the format of the association request information element modified for the WAPI protocol in the present invention. the

Detailed ways

With reference to Fig. 5, the method for resisting denial of service attack in the access authentication process that the present invention provides, comprises the following steps:

In step 1, the user STA obtains the beacon frame issued by the AP through monitoring. the

In the wireless network environment, the beacon frame is periodically sent by the access point AP using the broadcast mechanism, so the user does not need to send a request message to the access point AP, and can obtain the information elements in the beacon frame by monitoring. In the present invention, the information element of the beacon frame monitored by the user is modified on the basis of the original information element, and the parameters required for constructing the puzzle are added. In addition to the original information, it also includes the construction of the random number Ni, The difficulty level L and the Hash algorithm supported by the current AP. the

The present invention modifies the information elements of the 802.11i protocol and the WAPI protocol respectively. For the 802.11i protocol, the modification of the information element format is shown in Figure 6. On the basis of the original information element format, the random number Ni is added to indicate the random number selected by the current AP, which occupies 4 octets; the difficulty level L indicates Calculate the difficulty level required by the puzzle, occupying an octet number; Hash algorithm indicates the Hash algorithm supported by the current AP, such as MD5, SHA-1 or other Hash algorithms with higher security, occupying an octet number. For the WAPI protocol, the modification of the information elements is shown in Figure 7, and the meanings and formats of the added items are the same as those added to the 802.11i protocol information elements. the

The constructed random number Ni is randomly generated by the access point, and the validity period of the constructed random number is stipulated by the AP. If the current constructed random number fails, the access point AP generates a new random number and updates the information element; L means puzzle The difficulty level of L is dynamically adjusted by the access point AP according to the current network and resource consumption status of the access point. If the difficulty level L changes, the AP needs to update the current information element. the

In step 2, the user STA performs corresponding authentication interaction with the access point AP, and at the same time, the user generates a puzzle and makes an answer. the

After listening to the beacon frame of an access point AP, if the user chooses to access the current wireless network, the authentication interaction will be performed for the wireless access authentication protocol used. When the 802.11i protocol is used, the user needs to communicate with the access point AP conducts open system authentication interaction. When using WAPI protocol, users need to perform link authentication interaction;

While performing authentication interaction, the user needs to construct a puzzle based on the obtained information elements and make an answer. Here, the computing resource consumption is used to construct the puzzle: first, the user STA obtains the MAC address AP_add of the access point AP from the beacon frame, Obtain the random number Ni used to construct the puzzle and the current difficulty level L from the information element, specify the Hash function used for the puzzle calculation, and choose a random number r arbitrarily; set the X to be answered, the random number r selected by the user, and the access point The MAC address AP_add, the constructed random number Ni, and the difficulty level L are concatenated in order to form a bit string X‖r‖Ni‖AP_add‖L; Hash calculation is performed on the bit string. If the last L bit of the calculation result is 0, then X is the answer to the puzzle, otherwise the answer cannot be passed, even if X satisfies the following formula:

Hash(X‖r‖Ni‖dest IP‖L)mod 2L＝0 where the signs of each symbol are the same as above. the

Due to the one-way nature of the Hash function, it is not feasible to solve X by answering the judgment conditions. Therefore, users can only find the answer X through exhaustive search, and perform calculation verification until they find the solution that satisfies the solution conditions. X. the

Step 3, the user STA sends an association request message including the puzzle and the answer to the access point AP. the

First, the user modifies the information elements in the association request, and adds all the generation parameters of the puzzle and the answer X to the information elements. For the two wireless access authentication protocols 802.11i protocol and WAPI protocol, modify the information elements of the association request respectively:

If the 802.11i protocol is adopted, on the basis of the information element format of the original association request, add and construct random number Ni, difficulty level L, Hash algorithm selected by the user, random number r selected by the user, and answer X, where Ni occupies 4 8 The number of octets, L occupies 1 octet, Hash algorithm occupies 1 octet, r occupies 4 octets, X occupies 4 octets, as shown in Figure 8 Show;

If the WAPI protocol is adopted, on the basis of the original association request information element format, add and construct random number Ni, difficulty level L, Hash algorithm selected by the user, random number r selected by the user, and answer X, where Ni occupies 4 8-bit bits Group number, L occupies 1 octet number, Hash algorithm occupies 1 octet number, r occupies 4 octet numbers, X occupies 4 octet numbers, as shown in Figure 9. the

Then, the user sends the modified association request message to the access point. the

Step 4, the access point AP receives the association request, and verifies the puzzle and the answer, and if the verification is passed, the association request is completed, otherwise, the user access request is terminated. the

The access point AP receives the user's association request message, and extracts the constructed random number Ni, difficulty level L, user-selected Hash function, user-selected random number r, and answer X from the information elements of the association request message; Click to calculate the hash value of X‖r‖Ni‖AP_add‖L, and verify whether the solution X meets the answer judgment conditions in step 2. If the answer X meets the judgment conditions, continue to judge the uniqueness of the answer, otherwise terminate User's access request;

If the puzzle and the solution X meet the solution conditions, compare the hash value calculated by the solution X with the hash value stored in the solution temporary list to prevent the puzzle and the solution X from being reused: if the hash value is not included in If the answer is in the temporary list, the association request is accepted and an association response is returned to establish a security association; otherwise, the association request is rejected and the user's access request is terminated. After the access point completes the association request process, it stores the calculation results in the solution temporary list. If the information elements in the beacon frame change, the access point needs to clear the solution temporary list to accept new puzzles and solutions. the

Symbol Description:

DoS attack: denial of service (Denial of Service) attack

WAPI: China Wireless Local Area Network Security Standard

802.11i: Wireless Network Security Standard Protocol

RSN: Robust Security Network

802.1X: Port-Based Network Access Control Authentication Standard

AP: Access Point (Access Point)

STA: User (Station)

ASU: Accreditation Services Unit

EAP: Extended Authentication

Hash: hash function

r: random number selected by the user

X: answer

Ni: Constructed random number selected by AP

AP add: AP address

L: The difficulty level chosen by AP. the

MD5: Message-Digest Algorithm 5, Information-Digest Algorithm-5

SHA-1: Secure Hash Standard-1, Secure Hash Standard-1

RADIUS: Remote Authentication Dial In User Service, remote user dial-in authentication service

DIAMETER: A new generation of AAA protocol. the

Claims (3)

1. a method of resisting the Denial of Service attack that exists in the access authentication of WLAN comprises the steps:

(1) user STA obtains relevant information element through the beacon frame that monitor to obtain access point AP issue, comprises original information and the user required parameter of puzzle that has problems in this information element;

(2) after obtaining relevant information element, it is mutual that user STA and access point AP carry out corresponding authentication;

(3) carry out authentication mutual in, carry out operation as follows:

3a) user STA obtains the MAC Address AP_add of access point AP from beacon frame; From information element, obtain used structure random number N i and the current difficulty level L of structure puzzle; Specify puzzle to calculate used Hash function, and select a random number r arbitrarily;

3b) will X answered, MAC Address AP_add, structure random number N i and the difficulty level L of user-selected random number r, access point; In order and be connected into Bit String X||r||Ni||AP_add||L; And this Bit String is carried out Hash calculate; If the last L of result of calculation position is 0, then X is the answer of puzzle, otherwise answer can not be passed through;

3c) user utilizes the method for exhaustive search to seek an answer X, makes it satisfy the decision condition of answering among the step 3b;

(4) after the generation and answer of completion puzzle, user STA initiates association request message to access point AP, adds the relevant parameter that generates puzzle in the information element of this association request message;

(5) access point AP to the answer X of puzzle in the association request message and searching according to step 3b) in to the answer decision condition make checking; If the puzzle checking is passed through; And when the existing checking result of storage does not repeat in the interim tabulation of this puzzle checking result and current answer, then send the association request response message, accomplish association request to the user; And will verify that the result deposits in the interim tabulation of answer, otherwise stop this user's access request.

2. the method for the Denial of Service attack that exists in the opposing access authentication of WLAN according to claim 1; The described user of step (1) the required parameter of puzzle that has problems wherein; Be on the basis that the original information element is made amendment, add required random number N i, difficulty level L and the access point hash algorithm that AP supports of structure puzzle.

3. the method for the Denial of Service attack that exists in the opposing access authentication of WLAN according to claim 1; Wherein the described puzzle of step (4) generates relevant parameter; Be on the basis that the original information element is made amendment, add the answer X of structure random number N i, current difficulty level L, user-selected random number r, hash algorithm and searching.

Images