WO2008080352A1

WO2008080352A1 - A wlan authentication charging method based on wapi

Info

Publication number: WO2008080352A1
Application number: PCT/CN2007/071371
Authority: WO
Inventors: Benteng Ma; Jun Cao; Bianling Zhang; Xiaolong Lai; Xiangchen Ma
Original assignee: China Mobile Group Design Institute Co., Ltd.; China Iwncomm Co., Ltd.
Priority date: 2006-12-29
Filing date: 2007-12-28
Publication date: 2008-07-10
Also published as: CN100512110C; CN1996841A

Abstract

A WLAN authentication charging method based on WAPI includes the steps: a same certificate is issued to all mobile terminals, different certificate is issued to each radio access point. When a mobile terminal accesses a network, the mobile terminal associates to a radio access point, and establishes a link connection. The certificate of the mobile terminal and the certificate of the radio access point associated to the mobile terminal are authenticated. When the certificate authentication is successful, the mobile terminal and the radio access point negotiate session keys, the radio access point notifies multicast keys to the mobile terminalto allow the mobile terminal access. After the mobile terminal accesses the network, the account information of the mobile terminal is authenticated. The authentication information of the mobile terminal is obtained according to the result of the account information authentication so that the mobile terminal can access the network. According to the present invention, the operation management of the WLAN is in conformity to original operation network, the bi-directional identity authentication between the user and the network can be realized, and the original authority, charging system can be compatible to, and the related standards are supported.

Description

Method for WLAN authentication and charging based on WAPI This application claims to be submitted to the Chinese Patent Office on December 29, 2006, the application number is 200610105377.9, and the invention name is "Method for implementing WAPI-based WLAN operation with a terminal certificate" Priority of the Chinese Patent Application, the entire contents of which is incorporated herein by reference. Technical field

The present invention relates to the field of network and wireless communication technologies, and more particularly to the field of wireless local area networks, and in particular to a method for WLAN operation based on wireless local area network authentication and privacy infrastructure WAPI. Background technique

WLAN (Wireless Local Area Network) has developed rapidly in recent years due to its flexibility, speed and scalability. It has been widely used in hotspot operations, enterprises, industries and homes. The purpose of mobile operators to build wireless LANs is to use WLANs to combine existing mobile networks and functions to provide users with faster and wider mobile voice and data access services, as well as a complementary means of wired data access. As an operational WLAN, it no longer only provides users with simple network interconnection, but more importantly, implements carrier-class operations. Therefore, it is necessary to add a series of functions such as billing, network management, and authentication on the basis of the basic architecture. Access control method and billing method.

For wireless LANs, security is of paramount importance, and WLAN-related standards have been initially formed, including a new WLAN Authentication and Privacy Infrastructure (WAPI) security mechanism. This security mechanism consists of wireless LANs. It is composed of two parts: WAI (WLAN Authentication Infrastructure) and WPA (WLAN Privacy Infrastructure).

WAPI provides certificate-based authentication and key negotiation methods. This method provides high security, ensures legitimate users access to legitimate networks, and protects data on wireless links.

When a WLAN is used in an operating environment, authentication and charging have a very close relationship. Billing is performed on the basis of authentication. At present, operators have their own mature authentication and charging methods, but these methods are not necessarily integrated with related certificate authentication. How to match these mature authentication charges The way and related certificate authentication is one of the key issues in WLAN operations.

The current authentication mechanism (such as Radius) only implements one-way authentication of the network to the user, and implements charging and other functions based on the authentication. The authentication and charging mode is effective when the link is relatively secure, that is, in a wired environment. The next is more suitable. However, wireless LAN links are not always secure due to their open features. These authentication and charging methods are directly applied to wireless LANs, which may cause major security problems. Summary of the invention

The present invention provides a method for authentication and charging of a wireless local area network, which is compatible with related authentication methods, and supports various authentication and charging methods currently used to implement certificate-based WAPI wireless local area network operation.

The invention provides a WAPI-based WLAN authentication method, including: issuing the same certificate for all mobile terminals, and installing the issued certificates on each mobile terminal;

Issue different certificates for each wireless access point and install the issued certificates at each wireless access point;

When the mobile terminal accesses the network, the mobile terminal is associated with the wireless access point to establish a link connection;

And authenticating the certificate of the mobile terminal and the certificate of the associated wireless access point respectively; when the certificate authentication is successful, the mobile terminal and the wireless access point perform session key negotiation, and the wireless access point notifies the mobile terminal of the multicast secret Key to allow access by the mobile terminal.

The present invention provides a WAPI-based WLAN authentication and charging method, including: issuing the same certificate for all mobile terminals, and installing the issued certificates on each mobile terminal;

Separating the certificate of the mobile terminal and the certificate of the associated wireless access point respectively; when the certificate authentication is successful, the mobile terminal and the wireless access point perform session key negotiation, and the wireless connection Invoicing a multicast key to the mobile terminal to allow the mobile terminal to access;

After the mobile terminal accesses the network, the account information of the mobile terminal is authenticated;

The mobile terminal authentication information is given based on the result of the account information authentication, so that the mobile terminal can access the network.

In the solution provided by the embodiment of the present invention, the same certificate is issued for all the mobile terminals, and different certificates are issued for each wireless access point, and the link-level authentication and the user-level identity are separated into two independent processes, the chain. Road-level authentication is used to protect the security of wireless link access. User-level identity authentication is used for management services such as authorization and accounting, so that the wireless local area network can be used as an extension of the original operating network, and the operation management and original operation of the wireless local area network are enabled. The network is consistent. The invention can implement two-way identity authentication between the user and the network in the link-level authentication process, and is compatible with the original authorization and accounting management systems, and supports related standards.

In addition, the invention adopts a certificate mechanism based on a public key cryptosystem in the link-level authentication process, and truly realizes two-way authentication between a mobile terminal (MT, Mobile Terminal) and a wireless access point (AP, Access Point), which fully satisfies The operator's requirements for secure access ensure the security of the wireless link. Moreover, during the user account information authentication phase, the network further authenticates the user identity of the mobile terminal, controls whether the mobile terminal can access the network, and according to the authentication. The result is controlled by accessing the network and billing the user access network, effectively protecting the information of the subsequent user account authentication phase, and thus the security is high.

After the wireless access point is set up with a certificate, it is no longer necessary to set up the AAA server in the background. It is easy to install and network, and can be used for operations in large-scale hotspots. At the same time, users only need to install a certificate to cover the WLAN. Roaming in different areas, convenient for users.

The invention uses the same terminal certificate on the basis of ensuring secure access, so that operation and maintenance operations and processes are simplified, and the cost is greatly reduced. BRIEF DESCRIPTION OF THE DRAWINGS detailed description

In order to make the principles, features and advantages of the present invention more apparent, the following description will be described in conjunction with the specific embodiments. The mobile terminal (MT) in this specification is a terminal in which a wireless network adapter is installed.

A wireless access point (AP) is a device that provides network access services for mobile terminals.

The server (AS) is a network entity that provides identity authentication services and certificate management functions. The authentication step, where the link level authentication steps are as follows:

1) The server issues the same certificate for all mobile terminals, and issues a certificate for each wireless access point, wherein different wireless access points issue different certificates, and the mobile terminal and the wireless access point install the certificate issued by the server;

2) When the mobile terminal needs to access the network, the mobile terminal first associates with the wireless access point to establish a link connection;

3) after the mobile terminal is associated with the wireless access point, the wireless access point sends the authentication activation frame to the mobile terminal, and starts the authentication process;

4) performing certificate authentication on the mobile terminal and the wireless access point by using a server according to a related operation procedure;

4.1) the mobile terminal sends an access authentication request to the wireless access point, where the certificate of the mobile terminal is included;

4.2) The wireless access point sends a certificate authentication request to the server, which includes a certificate of the mobile terminal and the wireless access point;

4.3) The server verifies the certificate of the mobile terminal and the wireless access point, and verifies whether the certificate of the mobile terminal is a unified legal certificate issued for all mobile terminals in the network, and verifies whether the certificate of the wireless access point is a legal certificate (wireless connection) The certificate of the entry cannot be the same as the certificate issued for the mobile terminal on the network). And returning a certificate authentication response to the wireless access point, where the authentication result of the mobile terminal and the wireless access point certificate is included;

4.4) the wireless access point determines whether the mobile terminal is allowed to access according to the mobile terminal certificate authentication result returned by the server, and sends an access authentication response to the mobile terminal;

4.5) The mobile terminal determines whether to access the wireless access point according to the certificate authentication result of the wireless access point by the server in the access authentication response, and if yes, proceeds to step 5), otherwise ends.

5) If the certificate authentication is successful, the mobile terminal and the wireless access point perform session key negotiation, and the wireless access point notifies the mobile terminal of the multicast key, as follows: The wireless access point sends a unicast key negotiation request to the mobile terminal, where the mobile terminal receives the unicast key negotiation request, and sends a unicast key negotiation response to the wireless access point after receiving the unicast key negotiation request. The data includes the record data of the session key; after receiving the unicast key negotiation response, the wireless access point sends a unicast key negotiation confirmation to the mobile terminal.

The wireless access point sends a multicast key advertisement to the mobile terminal, which includes a key for encrypting the multicast data, and the terminal sends a multicast key notification response to the wireless access point after receiving the call.

6) The wireless access point allows the mobile terminal to access;

Further, the account information authentication steps are as follows:

7) The access controller sends the account information of the mobile terminal to the server for authentication, and the access controller (AC, Access Controller) is a network device that provides access control for the user to access the network;

8) The server gives the mobile terminal authentication information according to the result of the account information authentication, and the mobile terminal exchanges information data with the network, that is, the mobile terminal can access the network.

In step 7), the access controller accesses the account information of the mobile terminal according to the following steps:

When the certificate authentication phase is completed and the user browses the network, the system automatically pops up a web page prompting the user to enter a user name and password. The server verifies the identity of the user according to the user name and password, and controls the network access according to the authentication result. The terminal can access the network.

Step 7) The account information of the access controller to the mobile terminal can also be authenticated as follows:

When the certificate authentication phase is completed, the mobile terminal uses the information in the subscriber identity module (ie, the SIM card) to perform identity authentication and session key negotiation with the wireless access point through the authentication server, and controls network access according to the authentication result. The mobile terminal can access the network.

According to the solution provided by the foregoing embodiment of the present invention, by issuing the same certificate for all mobile terminals and issuing different certificates for each wireless access point, the split link level authentication and the user level identity authentication performed are two. Independent processes, link-level authentication is used to protect the security of wireless link access, user-level identity authentication is used for management services such as authorization and billing, so that the wireless LAN can be used as an extension of the original operating network, and the wireless local area network is enabled. The operation management is consistent with the original operation network. The invention can realize two-way identity authentication between the user and the network in the link level authentication process, and is compatible with the original authorization and accounting management systems, and supports related standards. In addition, the invention adopts a certificate mechanism based on a public key cryptosystem in the link-level authentication process, and truly realizes two-way authentication between the mobile terminal MT and the wireless access point AP, which fully satisfies the requirements of the operator for secure access, so that The security of the wireless link is ensured. Moreover, in the user account information authentication phase, the network further authenticates the user identity of the mobile terminal, controls whether the mobile terminal can access the network, and controls access to the network and access to the network according to the result of the authentication. The billing is performed to effectively protect the information of the subsequent user account authentication phase, so the security is high.

The invention uses the same terminal certificate on the basis of ensuring secure access, so that operation and maintenance operations and processes are simplified, and the cost is greatly reduced.

Those skilled in the art can understand that the steps in the above embodiments can be implemented by instructing related hardware by a program, and the program can be stored in a computer readable storage medium, such as a ROM/RAM, a disk. , CD, etc. Alternatively, they may be fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof may be fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above embodiments are intended to illustrate and explain the principles of the invention. It is to be understood that the specific embodiments of the present invention are not limited thereto. It will be apparent to those skilled in the art that various changes and modifications may be made without departing from the spirit and scope of the invention.

Claims

Rights request

A WAPI-based authentication and charging method for a WLAN, comprising: issuing the same certificate to all mobile terminals, and installing the issued certificate on each mobile terminal;

And authenticating the certificate of the mobile terminal and the certificate of the associated wireless access point respectively; when the certificate authentication is successful, the mobile terminal and the wireless access point perform session key negotiation, and the wireless access point notifies the mobile terminal of the multicast secret a key to allow access by the mobile terminal;

2. The method according to claim 1, further comprising:

After the mobile terminal is associated with the wireless access point, the wireless access point sends an authentication activation packet to the mobile terminal to initiate the authentication process.

3. The method according to claim 1, wherein the certificate authentication comprises the following steps:

The wireless access point sends an authentication activation packet to the mobile terminal;

Receiving, by the wireless access point, an access authentication request sent by the mobile terminal to the wireless access point, where the authentication request carries a certificate of the mobile terminal;

The wireless access point forwards the certificate authentication request to the server, where the authentication request carries a certificate of the mobile terminal and the wireless access point;

When the server completes verification of the certificate of the mobile terminal and the wireless access point, the wireless access point receives the certificate authentication response message returned by the server, and the response message carries the authentication result of the mobile terminal and the wireless access point certificate;

The wireless access point determines whether the mobile terminal is allowed to access according to the mobile terminal certificate authentication result returned by the server, and sends an access authentication response to the mobile terminal.

The method according to claim 1 or 2, wherein the performing the authentication process on the account information of the mobile terminal comprises:

When the certificate authentication phase is completed, the user is prompted to enter a username and password;

The server verifies the identity of the user according to the user name and password, and controls the access of the network according to the authentication result. When the full certificate is passed, the mobile terminal can access the network.

The method according to claim 1 or 2, wherein: the authenticating the account information of the mobile terminal comprises:

When the certificate authentication phase is completed, the mobile terminal uses the information in the SIM card to perform identity authentication and session key negotiation with the wireless access point through the authentication server, and controls network access according to the authentication result. If the authentication is successful, the mobile terminal can access the network. .

A WAPI-based WLAN authentication method, comprising: issuing the same certificate to all mobile terminals, and installing the issued certificate on each mobile terminal;

The method according to claim 6, wherein the certificate authentication specifically includes the following steps:

When the server completes verification of the certificate of the mobile terminal and the wireless access point, the wireless access point receives the certificate authentication response message returned by the server, and the response message carries the mobile terminal. And the identification result of the wireless access point certificate;