WO2010102497A1 - 一种基于wapi的漫游认证和业务鉴权方法 - Google Patents

一种基于wapi的漫游认证和业务鉴权方法 Download PDF

Info

Publication number
WO2010102497A1
WO2010102497A1 PCT/CN2009/075758 CN2009075758W WO2010102497A1 WO 2010102497 A1 WO2010102497 A1 WO 2010102497A1 CN 2009075758 W CN2009075758 W CN 2009075758W WO 2010102497 A1 WO2010102497 A1 WO 2010102497A1
Authority
WO
WIPO (PCT)
Prior art keywords
authentication
certificate
roaming
terminal
authentication server
Prior art date
Application number
PCT/CN2009/075758
Other languages
English (en)
French (fr)
Inventor
易星
张变玲
曹军
王雪松
李琳
叶续茂
赖晓龙
罗先林
黄振海
余创
Original Assignee
西安西电捷通无线网络通信股份有限公司
中太数据通信(深圳)有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 西安西电捷通无线网络通信股份有限公司, 中太数据通信(深圳)有限公司 filed Critical 西安西电捷通无线网络通信股份有限公司
Publication of WO2010102497A1 publication Critical patent/WO2010102497A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/062—Pre-authentication
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04W—WIRELESS COMMUNICATION NETWORKS
    • H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
    • H04W12/06—Authentication
    • H04W12/069—Authentication using certificates or pre-shared keys

Definitions

  • the present invention relates to the field of network security access systems, and more particularly to a WAPI-based roaming authentication method and a service authentication method.
  • IP network carries a wide variety of services, and has been involved in all aspects of the national economy and social life.
  • wireless IP networks transmit data through radio waves, and the network's physical openness reaches a new stage.
  • secure access The problem becomes a key issue in the safe operation of the network.
  • the WLAN provides users with wireless access to the network, so that users are no longer restricted to one Internet cable, but can move flexibly to meet the needs of users to access the network.
  • the network scale covers all geographic regions of the country, and the number of users is very large, and roaming often occurs frequently.
  • WAPI provides a security mechanism based on certificates and pre-shared keys.
  • the certificate mechanism is suitable for the environment in which the application is running.
  • only the interface of the AS for certificate authentication is defined in the WLAN national standard, and there is still no specific method for how to implement certificate roaming authentication.
  • the patent application number 200810018166.0 discloses a WAPI-based certificate roaming authentication method.
  • the access authentication server when the terminal roams, the access authentication server returns the certificate to the locality for authentication, returns the certificate authentication result, and the access location is authenticated according to the certificate. As a result, the corresponding access control is performed.
  • the access authentication server does not obtain the service authorization information of the user terminal, and cannot perform the next information according to the information. Step access control.
  • the invention solves the problem of certificate roaming authentication when applying the WAPI security mechanism in the background art, and provides a high security and convenient WAPI-based roaming authentication and service authentication method for a secure, operable, manageable WAPI SOM.
  • the Secure (Operation, Manageable, Manageable WAPI network) solution provides protection.
  • the technical solution of the present invention is:
  • the present invention is a WAPI-based roaming authentication and service authentication method, and the special method is as follows:
  • the method includes the following steps:
  • the wireless access point of the network where the terminal and the external network authentication server are located enable the WAPI security mechanism, and the terminal associates with the wireless access point to start the WAPI authentication process;
  • the external network authentication server accessed by the terminal receives the certificate authentication request packet of the wireless access point, and if it is determined that the terminal is roaming access according to the certificate information of the terminal, the server information is authenticated according to the home network trusted by the terminal, if If the home network authentication server trusted by the terminal is found in the local external network authentication server trust list, the certificate roaming authentication request packet is sent to the home network authentication server;
  • the home network authentication server After receiving the certificate roaming authentication request packet, the home network authentication server verifies the message authentication field of the certificate roaming authentication request packet, and if the verification is successful, verifying the validity of the terminal certificate, and if it is legal, querying the local And saving the user service authentication information, and returning, to the external network authentication server, a certificate roaming authentication response packet including the user service authentication information;
  • the external network authentication server After successfully verifying the received certificate roaming authentication response packet, the external network authentication server parses the certificate roaming authentication response packet, and returns a certificate authentication response packet to the wireless access point according to a relevant format of the WLAN national standard. And saving the user service authentication information locally;
  • the wireless access point and the terminal perform corresponding access control according to the returned certificate authentication response packet.
  • the method further includes:
  • the certificate roaming authentication request packet is sent to the upper-level central root authentication server;
  • the root authentication server After receiving the certificate roaming authentication request packet, the root authentication server verifies the message authentication field of the certificate roaming authentication request packet, and if the verification is successful, according to the authentication server information trusted by the terminal in the certificate roaming authentication request packet, Search for a list of trusted authentication servers stored locally, If found, construct a message authentication field and send the certificate roaming authentication request packet to the home network authentication server trusted by the terminal, and if not found, set the certificate authentication result of the terminal to the issuer ambiguity, and return the roaming certificate authentication response packet. .
  • the home network authentication server After receiving the certificate roaming authentication request packet, the home network authentication server verifies the message authentication field of the certificate roaming authentication request packet, and if the verification is successful, verifying the validity of the terminal certificate, and if it is legal, querying the local And saving the user service authentication information, and returning, to the root authentication server, a certificate roaming authentication response packet including the user service authentication information;
  • the root authentication server After receiving the certificate roaming authentication response packet, the root authentication server verifies the message authentication field of the certificate roaming authentication response packet, and if the verification is successful, according to the authentication server information of the access location in the certificate roaming authentication response, Constructing a message authentication in the certificate roaming authentication response packet, and forwarding the reconstructed certificate roaming authentication response packet to the external network authentication server;
  • the external network authentication server After successfully verifying the received reconstructed certificate roaming authentication response packet, the external network authentication server parses the reconstructed certificate roaming authentication response packet, and returns a certificate authentication response packet according to a relevant format of the WLAN national standard.
  • the wireless access point stores the service authentication information of the user terminal locally.
  • the method further includes: when the root authentication server forwards the roaming authentication request packet, according to the authentication server information trusted by the terminal, the roaming authentication request packet may be forwarded to another root authentication server by another The root authentication server then forwards it to the home authentication server trusted by the terminal.
  • the roaming certificate authentication response packet is also forwarded to the access authentication server through the two root authentication servers.
  • the method further includes: after the external network authentication server saves the user service authentication information, if the user authentication information query request of the access controller is received, the saved user authentication information is returned. Give access to the controller.
  • the user service authentication information includes a terminal type
  • the certificate roaming authentication response packet further includes: a certificate authentication result.
  • the WAPI authentication process is specifically as follows: According to the WAPI authentication process specified in the GB15629.il series of national standards.
  • the invention provides an authentication method in a roaming process based on WAPI certificate on the basis of conforming to the national standard of wireless local area network, and is a secure, operable and manageable WAPI SOM network (Secure, The Operationable, Manageable WAPI network ) solution provides protection.
  • High security The invention is based on the national standard of wireless local area network (LAN). In the roaming process, full two-way authentication is still adopted to ensure that only legitimate users can access the legal network. At the same time, the certificate is verified by signature verification. The network obtains the security of the certificate.
  • LAN wireless local area network
  • the access authentication server of the present invention can obtain the service authorization information of the user terminal, and can perform the next access control according to the information.
  • FIG. 1 is a flow chart of a WAPI-based roaming authentication and service authentication method according to the present invention
  • FIG. 2 is a topological diagram of a WLAN operation application network according to the present invention.
  • FIG. 1 is a flowchart of a WAPI-based roaming authentication and service authentication method according to the present invention. The method includes:
  • Step 101 The wireless access point of the network where the terminal and the external network authentication server are located enable the WAPI security mechanism, and the terminal associates with the wireless access point to start the WAPI authentication process.
  • Step 102 The external network authentication server accessed by the terminal receives the certificate authentication request packet of the wireless access point, and if it is determined that the terminal is roaming access according to the certificate information of the terminal, according to the trusted home in the terminal certificate The network authentication server information, if the home network authentication server trusted by the terminal is found in the local external network authentication server trust list, sending a certificate roaming authentication request packet to the home network authentication server;
  • Step 103 After receiving the certificate roaming authentication request packet, the home network authentication server verifies the message authentication field of the certificate roaming authentication request packet. If the verification succeeds, the validity of the terminal certificate is verified. And querying locally saved user service authentication information, and returning a certificate roaming authentication response packet including the user service authentication information to the external network authentication server;
  • Step 104 After successfully verifying the received certificate roaming authentication response packet, the external network authentication server parses the certificate roaming authentication response packet according to a relevant format of the WLAN national standard. Returning a certificate authentication response packet to the wireless access point, and locally saving the user service authentication information;
  • Step 105 The wireless access point and the terminal perform corresponding access control according to the returned certificate authentication response packet.
  • the method may further include:
  • the certificate roaming authentication request packet is sent to the upper-level central root authentication server;
  • the root authentication server After receiving the certificate roaming authentication request packet, the root authentication server verifies the message authentication field of the certificate roaming authentication request packet, and if the verification is successful, according to the authentication server information trusted by the terminal in the certificate roaming authentication request packet, Searching the list of trust authentication servers stored locally, if found, constructing a message authentication field and transmitting the certificate roaming authentication request packet to the home network authentication server trusted by the terminal, and if not found, setting the certificate authentication result of the terminal to issue If it is not clear, return the roaming certificate authentication response packet.
  • the home network authentication server After receiving the certificate roaming authentication request packet, the home network authentication server verifies the message authentication field of the certificate roaming authentication request packet, and if the verification is successful, verifying the validity of the terminal certificate, and if it is legal, querying the local And saving the user service authentication information, and returning, to the root authentication server, a certificate roaming authentication response packet including the user service authentication information;
  • the root authentication server After receiving the certificate roaming authentication response packet, the root authentication server verifies the message authentication field of the certificate roaming authentication response packet, and if the verification is successful, according to the authentication server information of the access location in the certificate roaming authentication response, Constructing a message authentication in the certificate roaming authentication response packet, and forwarding the reconstructed certificate roaming authentication response packet to the external network authentication server;
  • the external network authentication server After successfully verifying the received reconstructed certificate roaming authentication response packet, the external network authentication server parses the reconstructed certificate roaming authentication response packet, and returns a certificate authentication response packet according to a relevant format of the WLAN national standard.
  • the wireless access point stores the service authentication information of the user terminal locally.
  • the method further includes: when the root authentication server forwards the roaming authentication request packet, according to the authentication server information trusted by the terminal, the roaming authentication request packet may be forwarded to another root authentication server by another The root authentication server then forwards it to the home authentication server trusted by the terminal.
  • the roaming certificate authentication response packet is also forwarded and sent through the two root authentication servers. Into the local authentication server.
  • the method may further include: after the external network authentication server saves the user service authentication information, if the user authentication information query request of the access controller is received, the saved user authentication information is saved. Return to the access controller.
  • the user service authentication information may include a terminal type.
  • the certificate roaming authentication response packet may include: a certificate authentication result, but is not limited to Therefore, other information or parameters may also be included, which is not limited in this embodiment.
  • the network topology diagram includes: an IPTV network, a home network, a public network, and a carrier network.
  • the Xibo network, the home network and the public network communicate through the carrier network respectively. Specifically, as shown in FIG.
  • the external network includes: a terminal STA (such as a laptop computer, etc.), a wireless access point (AP, Access Point) 2, an access controller, for example, an authentication center (AC, Authenticator Center) / Broadband Access Server (BAS), Remote Authentication Dial In User Service (RADIUS, RADIUS: Remote Authentication Dial In User Service), external network authentication server F-AS; home network includes: terminal STA (such as laptop computer) Etc), API, AC/BAS, RADIUS, home network authentication server H-AS, public network includes: root authentication server R-AS;
  • a terminal STA such as a laptop computer, etc.
  • AP Access Point
  • AP Access Point 2
  • an access controller for example, an authentication center (AC, Authenticator Center) / Broadband Access Server (BAS), Remote Authentication Dial In User Service (RADIUS, RADIUS: Remote Authentication Dial In User Service), external network authentication server F-AS
  • home network includes: terminal STA (such as laptop computer) Etc),
  • the specific implementation process of the network topology diagram is as follows:
  • the specific process of roaming authentication and authentication is as follows:
  • the terminal STA and the wireless access point enable the WAPI security mechanism, and the terminal associates with the wireless access point AP2 to initiate the WAPI authentication process;
  • the external network authentication server F-AS that the terminal accesses receives the certificate authentication request packet of the wireless access point AP2, and determines whether the terminal STA is local access or roaming access according to the certificate information of the terminal STA. Local access, the validity of the STA certificate of the terminal is authenticated and the certificate authentication response packet is returned; if it is roaming access, the H-AS information of the trusted home network authentication server in the terminal STA certificate is authenticated in the local external network.
  • the server W-AS trust list is searched for the home network authentication server H-AS, and if the home network authentication server H-AS is found in the trust list, the certificate roaming authentication request packet is sent to the home network authentication server H-AS; If the home network authentication server H-AS trusted by the terminal STA is not found in the local trust list, the certificate roaming authentication request packet is sent to the upper-level central root authentication server R-AS; 3) after receiving the certificate roaming authentication request packet, the home network authentication server or the root authentication server verifies the message authentication field of the packet according to the locally stored policy, and discards the packet if the verification fails, if the receiving authentication server is home
  • the network authentication server H-AS authenticates the validity of the terminal certificate.
  • the local service user authentication information is stored, including the terminal identification type, and the certificate authentication result and the service authentication information are used to construct the certificate roaming authentication response. Grouping, and returning the certificate roaming authentication response packet; if the receiving authentication server is the root authentication server R-AS, forwarding the certificate roaming authentication request packet of the certificate roaming authentication request packet according to the authentication server AS information trusted by the terminal in the certificate roaming authentication request packet To the home network authentication server H-AS, if the home network authentication server H-AS is not found, the certificate authentication result of the terminal is set to be unclear, and the roaming certificate authentication response packet is returned to the access destination authentication server F-AS;
  • the root authentication server R-AS or the external network authentication server F-AS After receiving the certificate roaming authentication response packet, the root authentication server R-AS or the external network authentication server F-AS verifies the message authentication field of the packet according to the locally stored policy, and discards the packet if the verification fails. If the receiving authentication server is the root authentication server R-AS, reconstruct the message authentication in the certificate roaming authentication response packet according to the authentication server information F-AS of the access location in the certificate roaming authentication response, and forward the reconstructed certificate roaming authentication. The response packet is sent to the F-AS; if the receiving authentication server is the external network authentication server F-AS, the packet is parsed, and the certificate authentication response packet is returned to the wireless access point AP2 according to the relevant format of the WLAN national standard, and the user is locally saved. The service authentication information of the terminal, if receiving the user authentication information query request of the access controller AC/BAS, returning the saved user authentication information to the access controller AC/BAS;
  • the wireless access point AP2 and the terminal STA perform corresponding access control according to the returned certificate authentication result.
  • the identification process in steps 1) and 5) above may be performed in accordance with the WAPI authentication process specified in the GB15629.il series of national standards, or may be performed in accordance with the identification process specified in other similar national standards.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Mobile Radio Communication Systems (AREA)

Description

一种基于 WAPI的漫游认证和业务鉴权方法
本申请要求于 2009 年 3 月 11 日提交中国专利局、 申请号为 200910021603.9、 发明名称为"一种基于 WAPI的漫游认证和业务鉴权方法"的 中国专利申请的优先权， 其全部内容通过引用结合在本申请中。
技术领域
本发明涉及网络安全接入系统领域，尤其是一种基于 WAPI的漫游认证方 法和业务鉴权方法。
背景技术
IP 网络承载的业务种类日益繁多， 已介入到国民经济和社会生活的各个 层面， 特别是无线 IP网络通过无线电波传输数据， 更使网络物理的开放性达 到新的阶段， 由此， 安全接入问题成为网络安全运行的关键问题。
2003 年 5 月份我国颁布了无线局域网国家标准 GB15629.il 和 GB15629.1102, 这是我国在无线局域网领域首批颁布的标准。 2006 年， 无线 局域网国家标准第 1号修改单 GB 15629.11-2003/XG1-2006及其他相关子项标 准 GB15629.1101、 GB/T 15629.1103和 GB15629.1104也颁布实施， 初步形成 了无线局域网国家标准体系。 标准体系中包含了全新的 WAPI ( WLAN Authentication and Privacy Infrastructure )安全机制。
随着移动计算的业务需求发展， 用户漫游上网的需求日益增加。 WLAN 提供用户无线的方式接入网络，使用户不再受限于一根上网网线， 而是可以灵 活的移动， 满足了用户移动访问网络的需求。 当在运营环境下应用 WLAN时， 网络规模覆盖到全国各个地理区域，用户数量非常大，漫游的情况会频繁发生。 而在漫游的情况下， 如何解决认证问题是网络正常运行的关键。 WAPI提供了 基于证书和预共享密钥的安全机制， 其中证书机制适合于运营应用的环境， 然 而 WLAN国标中仅定义了 AS对证书认证的接口， 仍然没有如何实现证书漫 游认证的具体方法。
申请号 200810018166.0的专利公开了一种基于 WAPI的证书漫游认证方 法，该方法中终端在漫游时，由接入地鉴别服务器把证书发回归属地进行认证， 返回证书鉴别结果，接入地根据证书鉴别结果进行相应的接入控制。该方法中 接入地鉴别服务器未得到用户终端的业务授权信息，不能根据该信息进行下一 步的接入控制。
发明内容
本发明为解决背景技术中应用 WAPI安全机制时的证书漫游认证问题，而 提供一种高安全性、便捷性的基于 WAPI的漫游认证和业务鉴权方法，为安全、 可运营、 可管理 WAPI SOM网络（Secure, Operationable, Manageable WAPI network )解决方案提供了保障。
本发明的技术解决方案为：本发明为一种基于 WAPI的漫游认证和业务鉴 权方法， 其特殊之处在于： 该方法包括以下步骤：
终端和外网鉴别服务器所在网络的无线接入点启用 WAPI安全机制，终端 关联到无线接入点， 启动 WAPI鉴别过程；
所述终端接入的外网鉴别服务器接收到所述无线接入点的证书鉴别请求 分组， 若根据终端的证书信息判断该终端是漫游接入， 则根据终端信任的家网 鉴别服务器信息，若在本地的外网鉴别服务器信任列表中查找到该终端信任的 家网鉴别服务器， 则发送证书漫游鉴别请求分组到该家网鉴别服务器；
所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证 书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端证书的合法 性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述外网鉴别服务器 返回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
所述外网鉴别服务器在成功验证接收到的所述证书漫游鉴别响应分组后， 解析所述证书漫游鉴别响应分组， 并按照 WLAN国标的相关格式返回证书鉴 别响应分组给所述的无线接入点， 并在本地保存所述用户业务鉴权信息；
所述的无线接入点和终端根据返回的证书鉴别响应分组进行相应的接入 控制。
可选的， 所述方法还包括：
若在本地的外网鉴别服务器信任列表中未查找到终端信任的家网鉴别服 务器， 则发送证书漫游鉴别请求分组到上一级中心根鉴别服务器；
所述根鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证书 漫游鉴别请求分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别请求分 组中的终端信任的鉴别服务器信息， 在本地存储的信任鉴别服务器列表查找， 若找到则构造消息鉴别字段并将所述证书漫游鉴别请求分组发送给终端信任 的家网鉴别服务器， 若找不到则将终端的证书鉴别结果设为颁发者不明确，返 回漫游证书鉴别响应分组。
所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证 书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端证书的合法 性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述根鉴别服务器返 回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
所述根鉴别服务器收到所述证书漫游鉴别响应分组后，验证所述证书漫游 鉴别响应分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别响应中的接 入地的鉴别服务器信息， 重新构造证书漫游鉴别响应分组中的消息鉴别， 并将 所述重新构造的证书漫游鉴别响应分组转发给所述外网鉴别服务器；
所述外网鉴别服务器在成功验证接收到的重新构造的所述证书漫游鉴别 响应分组后， 则解析重新构造的所述证书漫游鉴别响应分组， 并按照 WLAN 国标的相关格式返回证书鉴别响应分组给所述的无线接入点，并在本地保存用 户终端的业务鉴权信息。
可选的， 所述方法还包括： 在所述的根鉴别服务器转发漫游鉴别请求分组 时，根据终端信任的鉴别服务器信息， 可能需要把漫游鉴别请求分组转发给另 一个根鉴别服务器，由另一个根鉴别服务器再转发给终端信任的归属地鉴别服 务器。相应的， 漫游证书鉴别响应分组也通过两个根鉴别服务器中转发送给接 入地鉴别服务器。
可选的， 所述方法还包括： 在所述外网鉴别服务器保存所述用户业务鉴权 信息后， 若接收到访问控制器的用户鉴权信息查询请求， 则把保存的用户鉴权 信息返回给访问控制器。
可选的， 所述用户业务鉴权信息包括终端类型； 所述证书漫游鉴别响应分 组还包括： 证书鉴别结果。
可选的， WAPI鉴别过程具体为： 按照 GB15629.il 系列国家标准中规定 的 WAPI鉴别流程执行。
本发明是在符合无线局域网国家标准的基础上， 提供了基于 WAPI证书 的漫游过程中的认证方法，为安全、可运营、可管理 WAPI SOM网络（ Secure, Operationable, Manageable WAPI network )解决方案提供了保障。
其具有以下优点：
1、 高安全性： 本发明完全基于无线局域网国家标准， 在漫游过程中依然 采用完全的双向认证，保障只有合法的用户才能接入合法的网络； 同时证书获 得后均通过签名验证， 保证了通过网络获取证书的安全性。
2、 便捷性： 用户漫游时， 无需到营业厅更换证书， 且无需用户的额外操 作， 即可实现无缝的无线网络漫游接入。
3、本发明的接入地鉴别服务器可以得到用户终端的业务授权信息， 能根 据该信息进行下一步的接入控制。
附图说明
图 1为本发明提供的一种基于 WAPI的漫游认证和业务鉴权方法的流程 图；
图 2为本发明提供的一种 WLAN运营应用网络拓朴图。
具体实施方式
请参阅图 1 , 为本发明提供的一种基于 WAPI的漫游认证和业务鉴权方法 的流程图， 所述方法包括：
步骤 101 : 终端和外网鉴别服务器所在网络的无线接入点启用 WAPI安全 机制， 终端关联到无线接入点， 启动 WAPI鉴别过程；
步骤 102: 所述终端接入的外网鉴别服务器接收到所述无线接入点的证书 鉴别请求分组， 若根据终端的证书信息判断该终端是漫游接入， 则根据终端证 书中的信任的家网鉴别服务器信息，若在本地的外网鉴别服务器信任列表中查 找到该终端信任的家网鉴别服务器，则发送证书漫游鉴别请求分组到该家网鉴 别服务器；
步骤 103: 所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后， 验证所述证书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端 证书的合法性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述外网 鉴别服务器返回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
步骤 104: 所述外网鉴别服务器在成功验证接收到的所述证书漫游鉴别响 应分组后， 解析所述证书漫游鉴别响应分组， 并按照 WLAN国标的相关格式 返回证书鉴别响应分组给所述的无线接入点，并在本地保存所述用户业务鉴权 信息；
步骤 105: 所述的无线接入点和终端根据返回的证书鉴别响应分组进行相 应的接入控制。
可选的， 所述方法还可以包括：
若在本地的外网鉴别服务器信任列表中未查找到终端信任的家网鉴别服 务器， 则发送证书漫游鉴别请求分组到上一级中心根鉴别服务器；
所述根鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证书 漫游鉴别请求分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别请求分 组中的终端信任的鉴别服务器信息， 在本地存储的信任鉴别服务器列表查找， 若找到则构造消息鉴别字段并将所述证书漫游鉴别请求分组发送给终端信任 的家网鉴别服务器， 若找不到则将终端的证书鉴别结果设为颁发者不明确，返 回漫游证书鉴别响应分组。
所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证 书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端证书的合法 性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述根鉴别服务器返 回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
所述根鉴别服务器收到所述证书漫游鉴别响应分组后，验证所述证书漫游 鉴别响应分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别响应中的接 入地的鉴别服务器信息， 重新构造证书漫游鉴别响应分组中的消息鉴别， 并将 所述重新构造的证书漫游鉴别响应分组转发给所述外网鉴别服务器；
所述外网鉴别服务器在成功验证接收到的重新构造的所述证书漫游鉴别 响应分组后， 则解析重新构造的所述证书漫游鉴别响应分组， 并按照 WLAN 国标的相关格式返回证书鉴别响应分组给所述的无线接入点，并在本地保存用 户终端的业务鉴权信息。
可选的， 所述方法还包括： 在所述的根鉴别服务器转发漫游鉴别请求分组 时，根据终端信任的鉴别服务器信息， 可能需要把漫游鉴别请求分组转发给另 一个根鉴别服务器，由另一个根鉴别服务器再转发给终端信任的归属地鉴别服 务器。相应的， 漫游证书鉴别响应分组也通过两个根鉴别服务器中转发送给接 入地鉴别服务器。
可选的， 所述方法还可以包括： 在所述外网鉴别服务器保存所述用户业务 鉴权信息后， 若接收到访问控制器的用户鉴权信息查询请求， 则把保存的用户 鉴权信息返回给访问控制器。
可选的， 在该实施例中， 所述用户业务鉴权信息可以包括终端类型； 所述 证书漫游鉴别响应分组除了包括用户业务鉴权信息外，还可以包括： 证书鉴别 结果， 但并不限于此， 也可以包括其他的信息或参数， 本实施例不作限制。
还请参阅图 2, 为本发明提供的一种 WLAN运营应用网络拓朴图， 在该 网络拓朴图中， 包括： 夕卜网、 家网、 公共网和运营商网络。 夕卜网、 家网和公共 网分别通过运营商网进行通信。 具体如图 2所示， 其中， 所述外网包括： 终端 STA (比如膝上型计算机等）， 无线接入点 （AP, Access Point ) 2, 访问控制 器， 比如， 鉴权中心 （AC, Authenticator Center ) /宽带接入服务器 (BAS), 远 程用户拨号认证系统（ RADIUS , RADIUS :Remote Authentication Dial In User Service ),外网鉴别服务器 F-AS;家网包括：终端 STA(比如膝上型计算机等）、 API , AC/BAS、 RADIUS, 家网鉴别服务器 H-AS, 公共网包括： 根鉴别服务 器 R-AS;
该网络拓朴图的具体实现过程为： 当终端 STA从家网到外网漫游时， 其 漫游认证和鉴权的具体过程如下：
1 )终端 STA和无线接入点启用 WAPI安全机制， 终端关联到无线接入点 AP2, 启动 WAPI鉴别过程；
2 )终端接入的外网鉴别服务器 F-AS接收到所述的无线接入点 AP2的证 书鉴别请求分组， 根据终端 STA的证书信息判断该终端 STA是本地接入还是 漫游接入， 若为本地接入， 则鉴别该终端 STA证书的合法性并返回证书鉴别 响应分组； 若为漫游接入， 则根据终端 STA证书中的信任的家网鉴别服务器 H-AS信息， 在本地的外网鉴别服务器 W-AS信任列表中查找该家网鉴别服务 器 H-AS, 若在信任列表中查到该家网鉴别服务器 H-AS, 则发送证书漫游鉴 别请求分组到该家网鉴别服务器 H-AS; 若在本地的信任列表中未查找到终端 STA信任的家网鉴别服务器 H-AS, 则发送证书漫游鉴别请求分组到上一级中 心根鉴别服务器 R-AS; 3 )所述家网鉴别服务器或根鉴别服务器接收到证书漫游鉴别请求分组后， 根据本地存储的策略验证该分组的消息鉴别字段， 若验证不通过则丟弃该分 组， 若接收鉴别服务器为家网鉴别服务器 H-AS, 则验证终端证书的合法性， 若验证结果为成功， 则查询本地保存的用户业务鉴权信息， 包括终端类型等由 证书鉴别结果和业务鉴权信息构造证书漫游鉴别响应分组，并返回证书漫游鉴 别响应分组； 若接收鉴别服务器为根鉴别服务器 R-AS, 则根据证书漫游鉴别 请求分组中终端信任的鉴别服务器 AS信息转发该证书漫游鉴别请求分组的证 书漫游鉴别请求分组给家网鉴别服务器 H-AS , 若找不到家网鉴别服务器 H-AS, 则设置终端的证书鉴别结果为颁发者不明确， 返回漫游证书鉴别响应 分组给接入地鉴别服务器 F-AS;
4 )所述根鉴别服务器 R-AS或外网鉴别服务器 F-AS接收到证书漫游鉴别 响应分组后，根据本地存储的策略验证该分组的消息鉴别字段， 若验证不通过 则丟弃该分组， 若接收鉴别服务器为根鉴别服务器 R-AS, 则根据证书漫游鉴 别响应中接入地的鉴别服务器信息 F-AS, 重新构造证书漫游鉴别响应分组中 的消息鉴别， 并转发重新构造的证书漫游鉴别响应分组发送给 F- AS; 若接收 鉴别服务器为外网鉴别服务器 F-AS, 则解析该分组， 并按照 WLAN国标的相 关格式返回证书鉴别响应分组给无线接入点 AP2,并在本地保存用户终端的业 务鉴权信息，若接收到访问控制器 AC/BAS的用户鉴权信息查询请求，则把保 存的用户鉴权信息返回给访问控制器 AC/BAS;
5 )所述的无线接入点 AP2和终端 STA根据返回的证书鉴别结果进行相应 的接入控制。
上述步骤 1 )和 5 ) 中的鉴别过程， 可以是按照 GB15629.il系列国家标 准中规定的 WAPI鉴别流程执行，也可以按照其他类似的国家标准中规定的鉴 别流程执行。

Claims

权 利 要 求
1、 一种基于 WAPI的漫游认证和业务鉴权方法， 其特征在于： 该方法 包括以下步骤：
终端和外网鉴别服务器所在网络的无线接入点启用 WAPI安全机制，终端 关联到无线接入点， 启动 WAPI鉴别过程；
所述终端接入的外网鉴别服务器接收到所述无线接入点的证书鉴别请求 分组， 若根据终端的证书信息判断该终端是漫游接入， 则根据终端证书中的信 任的家网鉴别服务器信息，若在本地的外网鉴别服务器信任列表中查找到该终 端信任的家网鉴别服务器， 则发送证书漫游鉴别请求分组到该家网鉴别服务 器；
所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证 书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端证书的合法 性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述外网鉴别服务器 返回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
所述外网鉴别服务器在成功验证接收到的所述证书漫游鉴别响应分组后， 解析所述证书漫游鉴别响应分组， 并按照 WLAN国标的相关格式返回证书鉴 别响应分组给所述的无线接入点， 并在本地保存所述用户业务鉴权信息； 所述的无线接入点和终端根据返回的证书鉴别响应分组进行相应的接入 控制。
2、 根据权利要求 1所述的基于 WAPI的漫游认证和业务鉴权方法， 其特 征在于： 所述方法还包括：
若在本地的外网鉴别服务器信任列表中未查找到终端信任的家网鉴别服 务器， 则发送证书漫游鉴别请求分组到上一级中心根鉴别服务器；
所述根鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证书 漫游鉴别请求分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别请求分 组中的终端信任的鉴别服务器信息， 在本地存储的信任鉴别服务器列表查找， 若找到则构造消息鉴别字段并将所述证书漫游鉴别请求分组发送给终端信任 的家网鉴别服务器， 若找不到则将终端的证书鉴别结果设为颁发者不明确，返 回漫游证书鉴别响应分组； 所述家网鉴别服务器在接收到所述证书漫游鉴别请求分组后，验证所述证 书漫游鉴别请求分组的消息鉴别字段， 若在验证成功， 则验证终端证书的合法 性， 若合法， 则查询本地保存的用户业务鉴权信息， 并向所述根鉴别服务器返 回包括所述用户业务鉴权信息的证书漫游鉴别响应分组；
所述根鉴别服务器收到所述证书漫游鉴别响应分组后，验证所述证书漫游 鉴别响应分组的消息鉴别字段， 若验证成功， 则根据证书漫游鉴别响应中的接 入地的鉴别服务器信息， 重新构造证书漫游鉴别响应分组中的消息鉴别， 并将 所述重新构造的证书漫游鉴别响应分组转发给所述外网鉴别服务器；
所述外网鉴别服务器在成功验证接收到的重新构造的所述证书漫游鉴别 响应分组后， 则解析重新构造的所述证书漫游鉴别响应分组， 并按照 WLAN 国标的相关格式返回证书鉴别响应分组给所述的无线接入点，并在本地保存用 户终端的业务鉴权信息。
3、 根据权利要求 1或 2所述的基于 WAPI的漫游认证和业务鉴权方法， 其特征在于： 所述方法还包括：
在所述的根鉴别服务器转发漫游鉴别请求分组时， 根据终端信任的鉴别 服务器信息， 可能需要把漫游鉴别请求分组转发给另一个根鉴别服务器， 由另 一个根鉴别服务器再转发给终端信任的归属地鉴别服务器。相应的， 漫游证书 鉴别响应分组也通过两个根鉴别服务器中转发送给接入地鉴别服务器。
4、 根据权利要求 1或 2所述的基于 WAPI的漫游认证和业务鉴权方法， 其特征在于： 所述方法还包括：
在所述外网鉴别服务器保存所述用户业务鉴权信息后，若接收到访问控制 器的用户鉴权信息查询请求， 则把保存的用户鉴权信息返回给访问控制器。
5、 根据权利要求 1或 2所述的一种基于 WAPI的漫游认证和业务鉴权方 法， 其特征在于： 所述用户业务鉴权信息包括终端类型； 所述证书漫游鉴别响 应分组还包括： 证书鉴别结果。
6、 根据权利要求 1或 2所述的一种基于 WAPI的漫游认证和业务鉴权方 法， 其特征在于： 所述 WAPI鉴别过程具体为： 按照 GB15629.il系列国家标 准中规定的 WAPI鉴别流程执行。
PCT/CN2009/075758 2009-03-11 2009-12-21 一种基于wapi的漫游认证和业务鉴权方法 WO2010102497A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN200910021603A CN101541004A (zh) 2009-03-11 2009-03-11 一种基于wapi的漫游认证和业务鉴权方法
CN200910021603.9 2009-03-11

Publications (1)

Publication Number Publication Date
WO2010102497A1 true WO2010102497A1 (zh) 2010-09-16

Family

ID=41123926

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2009/075758 WO2010102497A1 (zh) 2009-03-11 2009-12-21 一种基于wapi的漫游认证和业务鉴权方法

Country Status (2)

Country Link
CN (1) CN101541004A (zh)
WO (1) WO2010102497A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101541004A (zh) * 2009-03-11 2009-09-23 中太数据通信(深圳)有限公司 一种基于wapi的漫游认证和业务鉴权方法
CN108183804B (zh) * 2018-03-28 2021-01-26 湖南东方华龙信息科技有限公司 证书共享方法
CN112136299B (zh) * 2018-05-17 2023-02-14 诺基亚技术有限公司 经由公共服务提供方网络上的vpn连接性促进住宅无线漫游
CN115314895B (zh) * 2022-08-09 2024-05-14 中国电信股份有限公司 一种wapi用户的鉴别方法、系统及接入地as

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6285871B1 (en) * 1996-11-27 2001-09-04 Cellco Partnership Cellular fraud prevention using selective roaming
CN1859739A (zh) * 2005-12-07 2006-11-08 华为技术有限公司 一种向漫游用户提供数字广播的鉴权方法和系统
CN101282352A (zh) * 2008-05-09 2008-10-08 西安西电捷通无线网络通信有限公司 一种基于wapi的漫游认证方法
CN101541004A (zh) * 2009-03-11 2009-09-23 中太数据通信(深圳)有限公司 一种基于wapi的漫游认证和业务鉴权方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6285871B1 (en) * 1996-11-27 2001-09-04 Cellco Partnership Cellular fraud prevention using selective roaming
CN1859739A (zh) * 2005-12-07 2006-11-08 华为技术有限公司 一种向漫游用户提供数字广播的鉴权方法和系统
CN101282352A (zh) * 2008-05-09 2008-10-08 西安西电捷通无线网络通信有限公司 一种基于wapi的漫游认证方法
CN101541004A (zh) * 2009-03-11 2009-09-23 中太数据通信(深圳)有限公司 一种基于wapi的漫游认证和业务鉴权方法

Also Published As

Publication number Publication date
CN101541004A (zh) 2009-09-23

Similar Documents

Publication Publication Date Title
JP3869392B2 (ja) 公衆無線ｌａｎサービスシステムにおけるユーザ認証方法および該方法をコンピュータで実行させるためのプログラムを記録した記録媒体
US8417951B2 (en) Roaming authentication method based on WAPI
CN101616410B (zh) 一种蜂窝移动通信网络的接入方法和系统
US7231521B2 (en) Scheme for authentication and dynamic key exchange
US7370350B1 (en) Method and apparatus for re-authenticating computing devices
WO2017028593A1 (zh) 网络接入设备接入无线网络接入点的方法、网络接入设备、应用程序服务器和非易失性计算机可读存储介质
JP4804983B2 (ja) 無線端末、認証装置、及び、プログラム
CN103391543B (zh) 一种实现漫游切换的方法和装置
US20070098176A1 (en) Wireless LAN security system and method
WO2008101426A1 (fr) Procédé d'identification d'itinérance en fonction du certificat wapi
TW201304486A (zh) 通信系統中之金鑰產生
WO2011017924A1 (zh) 无线局域网的认证方法、系统、服务器和终端
DK2924944T3 (en) Presence authentication
US20050071682A1 (en) Layer 2 switch device with verification management table
US20230344626A1 (en) Network connection management method and apparatus, readable medium, program product, and electronic device
WO2011026404A1 (zh) 一种认证授权计费会话更新方法、装置和系统
CN104982053B (zh) 用于获得认证无线设备的永久身份的方法和网络节点
WO2008080351A1 (fr) Procédé d'exploitation de réseau local sans fil basé sur une infrastructure d'authentification et de confidentialité de wlan (wapi)
WO2010000185A1 (zh) 一种网络认证的方法、装置、系统及服务器
WO2013189389A2 (zh) 一种无线局域网共享认证的方法、系统及设备
KR100863135B1 (ko) 이동환경에서의 듀얼 인증 방법
WO2010102497A1 (zh) 一种基于wapi的漫游认证和业务鉴权方法
WO2011082529A1 (zh) 一种组临时密钥更新方法、装置和系统
JP2008097264A (ja) 無線ｌａｎ端末を認証する認証システム、認証方法、認証サーバ、無線ｌａｎ端末、及びプログラム
JP2007074180A (ja) 通信システム及び通信方式

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 09841366

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 09841366

Country of ref document: EP

Kind code of ref document: A1