WO2014117524A1 - Wlan接入网络中传递成对主密钥的方法和系统 - Google Patents
Wlan接入网络中传递成对主密钥的方法和系统 Download PDFInfo
- Publication number
- WO2014117524A1 WO2014117524A1 PCT/CN2013/083632 CN2013083632W WO2014117524A1 WO 2014117524 A1 WO2014117524 A1 WO 2014117524A1 CN 2013083632 W CN2013083632 W CN 2013083632W WO 2014117524 A1 WO2014117524 A1 WO 2014117524A1
- Authority
- WO
- WIPO (PCT)
- Prior art keywords
- access
- authentication
- message
- point
- key
- Prior art date
Links
- 238000000034 method Methods 0.000 title claims abstract description 48
- 238000013475 authorization Methods 0.000 claims abstract description 20
- 230000004044 response Effects 0.000 claims description 33
- 230000008569 process Effects 0.000 claims description 17
- 230000005540 biological transmission Effects 0.000 abstract description 2
- 230000006855 networking Effects 0.000 description 5
- 238000010586 diagram Methods 0.000 description 3
- 230000001960 triggered effect Effects 0.000 description 3
- 238000012508 change request Methods 0.000 description 2
- 238000005538 encapsulation Methods 0.000 description 2
- 230000007246 mechanism Effects 0.000 description 2
- 238000012545 processing Methods 0.000 description 2
- 230000005641 tunneling Effects 0.000 description 2
- 238000004364 calculation method Methods 0.000 description 1
- 238000004891 communication Methods 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 230000000694 effects Effects 0.000 description 1
- 238000005516 engineering process Methods 0.000 description 1
- 230000008521 reorganization Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 230000009466 transformation Effects 0.000 description 1
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04W—WIRELESS COMMUNICATION NETWORKS
- H04W12/00—Security arrangements; Authentication; Protecting privacy or anonymity
- H04W12/04—Key management, e.g. using generic bootstrapping architecture [GBA]
- H04W12/043—Key management, e.g. using generic bootstrapping architecture [GBA] using a trusted network node as an anchor
- H04W12/0433—Key management protocols
Definitions
- the present invention relates to the field of wireless communication technologies, and in particular, to a method and system for transmitting a pair master key in a wireless local area network (WLAN) access network.
- WLAN wireless local area network
- WLAN applications have become very common, and many public places have been deployed. Users can access the Internet for online office and entertainment activities through mobile phones, computers and other terminal devices. Accessing the network through wireless LAN is one of the most important means for users to access network resources.
- IEEE 802.1 and 1£££802.111 define the 8021 X+EAP access authentication mode and the EAPOL-Key key agreement mechanism.
- the WLAN uses 4-Way Handshake's key agreement mechanism to cause the wireless server and the access client to negotiate to generate the keys PTK and GTK.
- the generated key is used for encryption and decryption of air interface data between wireless devices to protect the wireless network. Reliable and secure.
- the wireless access client and the wireless server need to have the same pairwise master key (PMK), and use the 802.1X+EAP access authentication mode to access the client.
- the PMK can be obtained in the process of authentication and authentication, and the wireless device server obtains the PMK from the authorization information successfully sent by the AAA server.
- PMK is the key material for EAPOL-Key key negotiation and is the basis for EAPOL-Key key negotiation.
- the access key negotiation point and the access authentication point of the wireless user STA are often not one device.
- the BNG device is usually used as the access authentication point, and the AP serves as the access key negotiation point.
- the accessing client STA obtains the PMK through the MSK of the 802.1X authentication process, and the BNG can obtain the PMK from the authorization information of the AAA server, but the AP cannot directly obtain the PMK from the authorization information of the AAA authentication success. In this way, it is necessary to solve the problem of the PMK's transfer interface between the BNG and the AP.
- the BNG proxy AP performs key negotiation with the STA and delivers the PTK and GTK to the AP through a specific tunnel or a specific protocol interface, it will give BNG equipment brings unnecessary The burden you want.
- the PMK or PTK/GTK is delivered to the AP by extending the CAPWAP message element.
- a dedicated interface between the AC and the BNG needs to be established. (Specific tunneling interfaces or extensions of certain protocols) to pass PMKs, which are not currently standardized interfaces, and thus cause problems such as poor compatibility and poor interoperability.
- the main object of the present invention is to provide a method and system for transmitting a pairwise master key in a WLAN access network, which aims to avoid network compatibility caused by the access authentication point transmitting the paired master key to the key negotiation authentication point. Problems such as poor performance and complex interfaces.
- the present invention provides a method for transmitting a pairwise master key in a WLAN access network, including: an access key negotiation point receives an access authentication message sent by an access client, and expands in the access authentication message. Notifying the information, and sending the extended access authentication packet to the access authentication point; the access authentication point acquires the identity information of the access client, and sends the identity information carrying the access client to the authentication server. After receiving the request message, after receiving the authentication success message returned by the authentication server according to the access request message, obtaining the paired master key, and according to the previously notified information, Encrypting the master key, and encapsulating the encrypted ciphertext in the authentication success packet to the access key negotiation point;
- the access key negotiation point decrypts the authentication success message, obtains the paired master key, and reassembles the authentication success packet that does not include the paired master key to the access client.
- the advertisement information includes at least a public key of the access key negotiation point and an encryption algorithm for encrypting the paired master key; the public key and the encryption algorithm may be configured locally or through a network. Manage system configuration.
- the access authentication point acquires the identity information of the access client, and sends an access request message carrying the identity information of the access client to the authentication server; and receives the authentication server according to the access request.
- the paired master key is obtained from the packet, and the paired master key is encrypted according to the previously notified information, and the ciphertext formed by the encryption is encapsulated in the packet.
- sending the access key negotiation point to the access key negotiation point includes:
- the access authentication point processes the access authentication packet, saves the advertisement information therein, and sends an identity information request packet for requesting the identity information of the access client to the access key negotiation point for access.
- the key negotiation point forwards the identity information request packet to the access client;
- the paired master key After receiving the authentication success message returned by the authentication server, the paired master key is obtained from the authorization information, and the paired master key is paired by the encryption algorithm and the public key in the previously saved notification information. Encryption is performed, and the ciphertext obtained by the encryption is encapsulated in the authentication success packet and forwarded to the access key negotiation point, so that the packet is forwarded to the access client, and the authentication is passed.
- the access key negotiation point decrypts the authentication success message, acquires the paired master key, and reassembles the authentication success packet not including the paired master key to be sent to the access
- the client includes: the access key negotiation point decrypts the received authentication success message according to the notification information, and obtains the paired master key carried therein;
- the method further includes:
- the access client receives the authentication success packet that does not include the paired master key, and sends an IP address request message to obtain an IP address.
- the present invention also provides a system for transmitting a pairwise master key in a WLAN access network, including an access client, an authentication server, an access key negotiation point, and an access authentication point, where
- the access key negotiation point is set to: receive an access authentication packet sent by the access client, expand the advertisement information in the access authentication packet, and expand the access authentication packet Sending to the access authentication point; decrypting the authentication success message sent by the access authentication point, acquiring the paired master key, and reassembling the authentication success message not including the paired master key Into the client;
- the access authentication point is set to: obtain the identity information of the access client, and send an access request message carrying the identity information of the access client to the authentication server; and receive the authentication server according to the access After requesting the successful authentication packet returned by the packet, obtaining the paired master key from the packet, and encrypting the paired master key according to the notification information, and encapsulating the encrypted ciphertext Sending to the access key negotiation point in the authentication success message;
- the access client is configured to: send an access authentication packet to the access key negotiation point, and receive the authentication success packet that does not include the paired master key, and send an IP address request Message to obtain an IP address;
- the authentication server is configured to: determine, according to the access request packet sent by the access authentication point, whether the access client passes the authentication, and if yes, return the authorization information to carry the authentication of the paired master key. Successfully sent a message to the access authentication point.
- the access authentication point is set as:
- Processing the access authentication packet storing the advertisement information therein, and sending an identity information request message for requesting the identity information of the access client to the access key negotiation point, where the access key negotiation point is used to identify the identity
- the information request message is forwarded to the access client;
- the paired master key After receiving the authentication success message returned by the authentication server, the paired master key is obtained from the authorization information, and the paired master key is paired by the encryption algorithm and the public key in the previously saved notification information. Encryption is performed, and the ciphertext obtained by the encryption is encapsulated in the authentication success packet and forwarded to the access key negotiation point, so that the packet is forwarded to the access client, and the authentication is passed.
- the access key negotiation point is set as:
- the embodiment of the present invention receives the access authentication message sent by the access client through the access key negotiation point, expands the advertisement information in the access authentication message, and sends the extended access authentication message to the access.
- the authentication point obtains the identity information of the access client, and sends an access request message carrying the identity information of the access client to the authentication server.
- the device After receiving the authentication success packet, the device obtains the paired message.
- the master key, and encrypts the paired master key according to the notification information, and the encrypted key is obtained.
- the encapsulation is sent to the access key negotiation point in the authentication success message; the access key negotiation point decrypts the authentication success message, obtains the paired master key, and reassembles the authentication that does not include the paired master key.
- Successful packets are sent to the access client.
- the paired master key is transmitted to the access authentication point and the access key negotiation point, since there is no need for an access key negotiation point.
- a dedicated interface is established between the access authentication point and the access authentication point, thereby avoiding problems such as poor network compatibility and complicated interface caused by the access authentication point transmitting the paired master key to the access key negotiation point.
- FIG. 1 is a schematic flowchart of a method for transmitting a paired master key in a WLAN access network according to the present invention
- FIG. 2 is a schematic flowchart of an access authentication point sent by an access authentication point to an authentication server in a method for transmitting a paired master key in a WLAN access network according to an embodiment of the present invention
- FIG. 3 is a schematic flowchart of obtaining a paired master key by an access key negotiation point in a method for transmitting a paired master key in a WLAN access network according to an embodiment of the present invention
- FIG. 4 is a schematic flowchart of another embodiment of a method for transmitting a pairwise master key in a WLAN access network according to the present invention
- FIG. 5 is a schematic structural diagram of an embodiment of a system for transmitting a pairwise master key in a WLAN access network according to the present invention.
- the implementation, functional features, and advantages of the present invention will be further described with reference to the accompanying drawings. Preferred embodiment of the invention
- Embodiments of the present invention provide a method for transmitting a pairwise master key in a WLAN access network.
- the paired master key is transmitted from the access authentication point to the key negotiation authentication point without the need to access the access key negotiation point.
- a dedicated interface is established between the authentication points to pass.
- FIG. 1 is a schematic flowchart of a method for transmitting a paired master key in a WLAN access network according to the present invention.
- the method for transmitting the paired master key in the WLAN access network includes: Step S10:
- the access key negotiation point receives the access authentication packet sent by the access client, and accesses the authentication packet
- the advertisement information is extended and the extended access authentication message is sent to the access authentication point.
- the authentication protocol between the access client and the authentication server may be an authentication protocol.
- the authentication protocol may include protocols such as EAP-PEAP, EAP-SIM, EAP-AKA, EAP-TLS, and EAP-TTLS; and the authentication protocol between the access authentication point and the authentication server may be a Radius protocol or a Diameter protocol;
- the access key negotiation point can be an AP device or an AC device, and the access authentication point can be a BNG device.
- the access client accesses the network through the WLAN, it first associates with the access key negotiation point located in the vicinity of the access client. After the association is successful, the access client sends the access key negotiation point to the identity of the access key.
- the access authentication packet may be an EAPOL-Start packet.
- the access key negotiation point expands the advertisement information, that is, the advertisement information is extended in the EAPOL-Start message, and the advertisement information may include the public key of the access key negotiation point and the public key.
- the public key and encryption algorithm required for such information can be configured locally or through a network management system. After the access authentication is extended, it is sent to the access authentication point.
- Step S20 The access authentication point acquires the identity information of the access client, and sends an access request message carrying the identity information of the access client to the authentication server.
- the authentication server returns the authentication according to the access request message.
- the paired master key is obtained, and the paired master key is encrypted according to the previously notified information.
- the encrypted ciphertext is encapsulated in the authentication success packet and sent to the access.
- the access authentication point After receiving the extended access authentication packet, the access authentication point obtains the identity information of the access client, and after obtaining the identity information of the access client, encapsulates the identity information of the access client to the access authentication point.
- the authentication server sends an access request message to the authentication server.
- the access request message may be an Access-Request message of the Radius protocol.
- the authentication server negotiates a specific authentication mode with the access client, and finally determines whether the access client can pass the authentication.
- the authentication server returns an authentication success packet to the access authentication point. In this embodiment, the authentication is performed.
- the success message can be an Access-Accept message of the Radius protocol, and the attribute of the message includes an EAP-SUCCESS message.
- the access authentication point After receiving the authentication success message, the access authentication point obtains the paired master key from the authorization attribute of the authentication success message, and then encrypts the paired master key according to the encryption algorithm in the notification information.
- the encrypted ciphertext is encapsulated in an authentication success packet (EAP-SUCCESS packet), and the authentication success packet is sent to the access key negotiation point.
- Step S30 The access key negotiation point decrypts the authentication success packet, obtains the paired master key, and reassembles the authentication success packet that does not include the paired master key to the access client.
- the access key negotiation point decrypts the received authentication success message according to the same encryption algorithm, thereby acquiring the paired master key, and reorganizing the authentication success message, that is, reorganizing one does not include the paired master key
- the authentication succeeds in the packet, and the reassembled authentication success packet is sent to the access client.
- the access key negotiation point is used to receive the access authentication message sent by the access client, the advertisement information is extended in the access authentication message, and the extended access authentication message is sent to the interface.
- the access authentication point obtains the identity information of the access client, and sends an access request message carrying the identity information of the access client to the authentication server; and after receiving the authentication success packet, the packet is obtained from the authentication server.
- the encrypted ciphertext is encapsulated in the authentication success message and sent to the access key negotiation point; the access key negotiation point decryption
- the successful packet is obtained, and the paired master key is obtained, and the authentication success packet that does not include the paired master key is sent to the access client.
- FIG. 2 is a schematic flowchart of an access authentication point sent by an access authentication point to an authentication server in a method for transmitting a paired master key in a WLAN access network according to the present invention.
- step S20 includes:
- Step S201 The access authentication point processes the access authentication message, saves the notification information therein, and sends an identity information request message for requesting the identity information of the access client to the access key negotiation point, for the access key.
- the negotiation point forwards the identity information request message to the access client; After receiving the access authentication sent by the access client forwarded by the access key negotiation point, the access authentication point first saves the public key including the access key negotiation point and is used for pairing the master. The announcement information of the encryption algorithm such as the encryption key. Then, the identity information request message for requesting the identity information of the access client is sent to the access key negotiation point.
- the identity information request message may be an EAPoL/Eap-Request/Identity message.
- the access key negotiation point forwards the identity information request message to the access client.
- Step S202 receiving an identity information response message that is sent by the access client, and the identity information response message is encapsulated in an access request message for requesting the authentication server to access the WLAN. Sending the access request packet to the authentication server;
- the access client After receiving the identity information request message, the access client will respond to the identity information response message carrying the identity information to the access key negotiation point, and the access key negotiation point forwards the identity information response message to the Access to the authentication point.
- the access authentication point encapsulates the received identity information response message in an access request message for requesting access to the WLAN to the authentication server, and then sends the access request message to the authentication server. Request access.
- Step S203 After receiving the authentication success message returned by the authentication server, obtain the paired master key from the authorization information, and perform the paired master key by using the encryption algorithm and the public key in the previously saved notification information. Encryption, the ciphertext obtained by the encryption is encapsulated in the authentication success packet and forwarded to the access key negotiation point, and the packet is forwarded to the access client, and the authentication is passed.
- the access authentication point After receiving the authentication success message returned by the authentication server, the access authentication point obtains the paired master key from the authorization information of the authentication success message, and then passes the encryption algorithm in the previously saved notification information.
- the paired master key is encrypted, and the encrypted ciphertext is encapsulated in the authentication success packet, and the authentication success packet is sent to the access key negotiation point for receiving the authentication. After the packet is successfully sent, the authentication success packet is forwarded to the access client to notify the access client of the authentication.
- FIG. 3 is a schematic flowchart of obtaining a pairwise master key by an access key negotiation point in a method for transmitting a paired master key in a WL AN access network according to the present invention.
- step S30 includes:
- Step S31 The access key negotiation point decrypts the received authentication success packet according to the notification information, and obtains the paired master key carried therein;
- Step S32 Deleting the paired master key from the authentication success message, reassembling an authentication success message that does not include the paired master key, and transmitting the reassembled authentication success message to the access client;
- the paired master key is used for key negotiation with the access client.
- the access key negotiation point After receiving the authentication success message including the encrypted paired master key sent by the access authentication point, the access key negotiation point decrypts and receives the same encryption algorithm according to the encryption of the paired master key in the notification information.
- the obtained successful authentication packet obtains the paired master key carried in the packet; and then, according to the obtained paired master key, performs key negotiation with the access client.
- the authentication success packet is reorganized, and the paired master key is removed from the authentication success packet to form an authentication success packet that does not include the paired master key, and the reconstituted authentication succeeds.
- the packet is sent to the access client to notify the access client that the access authentication is successful, and the WLAN can be accessed.
- FIG. 4 is a schematic flowchart diagram of another embodiment of a method for transmitting a pairwise master key in a WLAN access network according to the present invention.
- An embodiment of the method for transmitting a pair of master keys in a WLAN access network according to the present invention after performing step S30, the method further includes:
- Step S40 The access client receives an authentication success packet that does not include the paired master key, and sends an IP request message to obtain an IP address. After receiving the authentication success message sent by the access key negotiation point that does not include the paired master key, the access client starts to access the WLAN, that is, sends an IP request packet to the server on the WLAN side. The IP address of the access network is obtained by request, thereby completing network access according to the obtained IP address.
- the access client After receiving the authentication success message sent by the access key negotiation point that does not include the paired master key, the access client sends an IP request packet to complete the network access according to the obtained IP address, thereby Further, the extension of the access authentication packet and the authentication success packet provides greater convenience for the user to access the WLAN network.
- the following is a three-network mode of the present invention to describe a method for transmitting a pairwise master key in the WLAN access network of the present invention.
- the client STA is accessed.
- the authentication protocol between the authentication server AAA server is the EAP authentication protocol
- the authentication protocol between the access authentication point BNG and the authentication server AAA server is the Radius protocol
- the access key negotiation point is the AP device
- the access is The authentication point is a BNG device.
- the AP forwards the local device.
- the AP is in between the STA and the BNG.
- AC participation is not required.
- the specific implementation method is as follows:
- Step 1 After the AP is associated with the AP, the EAPol-Start packet is triggered to trigger EAP authentication.
- Step 2 After receiving the EAPol-Start message from the STA, the AP extends the notification information supported by the EAPoL V3 version in the EAPol-Start message, that is, the information such as the public key and encryption algorithm of the AP is carried through the TLV option. The message is sent to BNG.
- Step 3 The BNG processes the EAPol-Start packet, and saves the association between the STA and the AP and the public key and encryption algorithm of the AP.
- the EAPol/Eap-Req/Identity packet is sent to the STA to request identity information.
- Step 4 The AP forwards the EAPol/Eap-Req/Identity packet to the access client STA.
- Step 5 The STA responds to the EAPol/Eap-Req/Identity packet and sends an identity response message EAPol/Eap-Res/Identity to the AP.
- Step 6 The AP forwards the EAPol/Eap/Res/Identity packet to the BNG.
- Step 8 The AAA server and the STA negotiate a specific authentication mode, and finally determine whether the STA is available. To pass the certification.
- Step 9 The AAA server sends the EAP-SUCCESS packet with the authentication succeeded or the EAP-FAILURE packet with the authentication failure according to the judgment result, and encapsulates the EAP-SUCCESS packet or the EAP-FAILURE packet in the Access-Accept of the RADIUS protocol. In the /Reject message, it is sent to BNG.
- Step 10 If the BNG receives the Access-Accept packet, parses the authorization attribute key material related field (for example, MS_MPPE-RCV-KEY) sent by the AAA server to obtain the paired master key PMK, and uses the agreement with the AP. The encryption algorithm and the key encrypt it and encapsulate the PMK to the end of the EAP-SUCCESS message. If the BNG receives the Access-Reject packet, the AP sends an EAP-FAILURE packet to the STA, and the STA re-triggers the authentication process.
- the authorization attribute key material related field for example, MS_MPPE-RCV-KEY
- Step 11 The BNG sends the encapsulated EAP-SUCCESS packet to the AP. Add the encrypted PmkData field at the end of the EAP-Success message. The Length in the EAPol packet and the Length in the EAP packet must increase the length of the PMK ciphertext pmk-len.
- Step 12 The AP obtains the PMK from the extended EAP-SUCCESS message by using the encryption algorithm and the local private key agreed by the BNG, and removes the PMK from the EAPOL-SUCCESS, and reassembles an EAP-SUCCESS to send to the STA.
- EAP-Success packets you need to restore the original EAPol Length and EAP Length, minus the length of the PMK ciphertext.
- the STA and the AP respectively acquire the PMK.
- Step 13 The AP sends the reassembled EAP-SUCCESS packet to the STA. After receiving the message of successful authentication, the STA starts the DHCP process to obtain an IP address. Second, the implementation of the second:
- the AP performs centralized forwarding.
- the radio access controller AC and BNG can use the converged mode or the separate combination mode, regardless of the AC separated network or the AC and BNG converged networking, the EAP-SUCCES carries the PMK. Both PMK can be parsed on the AP side.
- a networking mode in which AC and BNG are separated is used.
- the AP completes the online connection of the AP and establishes a CAPWAP control tunnel with the AC by discovering the AC request/response, the AP joining the AC request/response, the AP status change request/response, and the configuration update request/response.
- Step 1 After the client and the AP establish an association, the EAPol-Start packet is triggered to trigger EAP authentication.
- Step 2 After receiving the EAPol-Start packet sent by the STA, the AP expands the EAPol-Start packet.
- the EAPoL V3 version supports the advertisement information, that is, the information such as the public key and the encryption algorithm of the AP is carried in the TLV option, and the extended EAPol-Start message is used to send the EAPol-Start message to the AC through the CAPWAP data tunnel between the AC and the AC. .
- Step 3 The AC parses the EAPol-Start packet received by the CAPWAP tunnel and forwards the EAPol-Start packet to the BNG through the Layer 2 network.
- Step 4 The BNG processes the EAPol-Start packet, and saves the association between the STA and the AP and the public key and encryption algorithm of the AP.
- the EAPol/Eap-Req/Identity packet is sent to the AC to request the identity information from the STA.
- Step 5 The AC sends an EAPol/Eap-Req/Identity packet to the AP through the CAPWA tunnel.
- Step 6 The AP forwards the EAPol/Eap-Req/Identity packet to the STA.
- Step 7 The STA responds to the EAPol/Eap-Req/Identity message and sends an identity information response message EAPol/Eap-Res/Identity to the AP.
- Step 8 The AP transmits EAPol/Eap-Res/Identity packets to the AC through the CAPWAP tunnel.
- Step 9 The AC forwards the received EAPol/Eap-Res/Identity packet to the BNG.
- Step 10 The BNG encapsulates the EPol/Eap-Res/Identity packet in the RADIUS protocol.
- Access-Request packet In the Access-Request packet, it is sent to the AAA server.
- Step 11 The AAA server and the STA negotiate a specific authentication mode, and finally determine whether the STA can pass the authentication.
- the EAP-SUCCESS packet or the authentication loss is sent to the BNG in the Access-Accept/Reject packet of the RADIUS protocol.
- Step 12 If the BNG receives the Access-Accept packet, parses the authorization attribute key material related field (for example, MS_MPPE-RCV-KEY) delivered by the AAA server to obtain the pairwise master key PMK, and uses the agreement with the AP. The encryption algorithm and the key encrypt it and encapsulate the PMK to the end of the EAP-SUCCESS message. If the BNG receives the Access-Reject packet, the AP sends an EAP-FAILURE packet to the STA, and the STA re-triggers the authentication process.
- the authorization attribute key material related field for example, MS_MPPE-RCV-KEY
- Step 13 The BNG sends the encapsulated EAP-SUCCESS packet to the AC. Add the encrypted PmkData field at the end of the EAP-Success message. The Length in the EAPol packet and the Length in the EAP packet must increase the length of the PMK ciphertext pmk-len.
- Step 14 The extended EAP-Success message is transmitted by the AC through the CAPWAP tunnel to the AP.
- Step 15 The AP uses the encryption calculation agreed with the BNG from the extended EAP-SUCCESS message. The method and the local private key are decrypted to obtain the PMK, and the PMK is removed from the EAPOL-SUCCESS, and an EAP-SUCCESS is reassembled and sent to the STA.
- Step 16 The AP sends the reassembled EAP-SUCCESS packet to the STA. After receiving the message of successful authentication, the STA starts the DHCP process to obtain an IP address.
- the AC can also proxy the AP to obtain the STA's PMK from the BNG in the same way, and then deliver the PMK to the AP through the message element in the CAPWAP tunneling protocol.
- AP local forwarding mode In this embodiment, the networking mode in which AC and BNG are separated is used, and AC, AP, and BNG are connected through SW.
- the AP completes by discovering AC request/response, AP join AC request/response, AP status change request/response, configuration update request/response, etc.
- the CAPWAP control tunnel is established between the AP and the AC.
- Step 1 After the client and the AP establish an association, the EAPol-Start packet is triggered to trigger EAP authentication.
- Step 2 After receiving the EAPol-Start message sent by the STA, the AP extends the notification information supported by the EAPoL V3 version in the EAPol-Start message, that is, the information such as the public key and encryption algorithm of the AP is carried through the TLV option.
- the EAPol-Start message is sent to the BNG.
- Step 3 The BNG process receives the EAPol-Start packet, saves the association between the STA and the AP, and the information such as the AP's public key and encryption algorithm, and sends an EAPol/Eap-Req/Identity packet to the AC to request the STA. Identity Information.
- Step 6 The AP forwards the EAPol/Eap-Req/Identity packet to the STA.
- Step 7 The STA responds to the EAPol/Eap-Req/Identity message and sends an identity information response message EAPol/Eap-Res/Identity to the AP.
- Step 8 The AP forwards the received EAPol/Eap-Res/Identity packet to the BNG.
- Step 9 The BNG encapsulates the EPOL/Eap-Res/Identity packet in the Access-Request packet of the RADIUS protocol and sends it to the AAA server.
- Step 10 The AAA server and the STA negotiate a specific authentication mode, and finally determine whether the STA can pass the authentication. Send an EAP-SUCCESS message with successful authentication or authentication loss according to the judgment result. It is sent to the BNG in the Access-Accept/Reject packet of the RADIUS protocol.
- Step 11 If the BNG receives the Access-Accept packet, parses the authorization attribute key material related field (for example, MS_MPPE-RCV-KEY) delivered by the AAA server to obtain the pairwise master key PMK, and uses the agreement with the AP. The encryption algorithm and the key encrypt it and encapsulate the PMK to the end of the EAP-SUCCESS message. If the BNG receives the Access-Reject packet, the AP sends an EAP-FAILURE packet to the STA, and the STA re-triggers the authentication process.
- the authorization attribute key material related field for example, MS_MPPE-RCV-KEY
- Step 12 The BNG sends the encapsulated EAP-SUCCESS packet to the AP. Add the encrypted PmkData field at the end of the EAP-Success message. The Length in the EAPol packet and the Length in the EAP packet must increase the length of the PMK ciphertext pmk-len.
- Step 13 The AP obtains the PMK from the extended EAP-SUCCESS message by using the encryption algorithm agreed with the BNG and the local private key, and removes the PMK from the EAPOL-SUCCESS, and reassembles an EAP-SUCCESS to send to the STA.
- EAP-Success packets you need to restore the original EAPol Length and EAP Length, minus the length of the PMK ciphertext.
- the STA and the AP respectively acquire the PMK.
- Step 14 The AP sends the reassembled EAP-SUCCESS packet to the STA. After receiving the message of successful authentication, the STA starts the DHCP process to obtain an IP address.
- the present invention also provides a system for delivering a pairwise master key in a WLAN access network.
- FIG. 5 is a schematic structural diagram of an embodiment of a system for transmitting a pairwise master key in a WLAN access network according to the present invention.
- the system for transmitting a paired master key in the WLAN access network includes an access client 100, an authentication server 200, an access key negotiation point 300, and an access authentication point 400, where
- the key negotiation point 300 is configured to receive an access authentication packet sent by the access client, extend the advertisement information in the access authentication packet, and send the extended access authentication packet to the access authentication point;
- the method is used for decrypting the authentication success message sent by the access authentication point, obtaining the paired master key, and reassembling the authentication success packet not including the paired master key to the access client;
- the access authentication point 400 is configured to obtain the identity information of the access client, and send an access request message carrying the identity information of the access client to the authentication server, and receive the packet returned by the authentication server according to the access request message. After the success message, obtain the paired master key from it and learn from the previous one. The notification information is used to encrypt the paired master key, and the encrypted ciphertext is encapsulated in the authentication success message and sent to the access key negotiation point;
- the access client 100 is configured to send an access authentication packet to the access key negotiation point, and receive an authentication success packet that does not include the paired master key, and send an IP request packet to obtain an IP address.
- the authentication server 200 is configured to determine, according to the access request packet sent by the access authentication point, whether the access client passes the authentication, and if yes, returns an authentication success packet to the access authentication point.
- the authentication protocol between the access client 100 and the authentication server 200 may be an EAP authentication protocol, and the EAP authentication protocol may include EAP-PEAP, EAP-SIM, EAP-AKA, and EAP-TLS.
- the authentication protocol between the access authentication point 400 and the authentication server 200 may be a Radius protocol or a Diameter protocol; the access key negotiation point 300 may be an AP device, and the access authentication point 400 may be BNG equipment.
- the access client 100 accesses the network through the WLAN, it first associates with the access key negotiation point 300 located in the vicinity thereof. After the association is successful, the access client 100 sends the access key negotiation point 300 to the access key negotiation point 300.
- the access authentication packet may be an EAPOL-Start packet.
- the access key negotiation point 300 expands the advertisement information, that is, the advertisement information supported by the EAP authentication protocol is extended in the EAPOL-Start message, and the notification information may include the access secret.
- the access authentication point 400 After receiving the extended access authentication packet, the access authentication point 400 obtains the access client.
- the identity information of the access client 100 is encapsulated into an access request message sent to the authentication server 200 to request access, and sent to the authentication service.
- the access request packet may be an Access-Request packet of the Radius protocol.
- the authentication server 200 negotiates a specific authentication mode with the access client 100, and finally determines whether the access client 100 can pass the authentication.
- the authentication server 200 returns an authentication success packet to the access authentication point 400.
- the authentication success packet can be an EAP-SUCCESS packet.
- the paired master key is obtained from the authentication success message, and then the paired master key is encrypted according to the encryption algorithm in the notification information. , will The obtained ciphertext is encapsulated in the authentication success packet, and the authentication success packet is sent to the access key negotiation point 300.
- the access key negotiation point 300 decrypts the received authentication success message according to the same encryption algorithm, thereby acquiring the paired master key, and reorganizing the authentication success message, that is, reorganizing one does not include the paired primary key.
- the key is successfully authenticated, and the reassembled authentication success message is sent to the access client 100.
- the access client 100 After receiving the authentication success message sent by the access key negotiation point 300 and not including the paired master key, the access client 100 starts the WLAN access, that is, sends the IP address to the server on the WLAN side. ⁇ , to obtain the IP address of the access network, to complete the network access according to the obtained IP address.
- the access authentication point 400 is specifically used to:
- Processing the access authentication packet storing the notification information therein, and sending an identity information requesting message for requesting the identity information of the access client to the access key negotiation point, where the access key negotiation point obtains the identity information
- the packet is forwarded to the access client.
- the incoming request message is sent to the authentication server.
- the encrypted ciphertext encapsulation is forwarded to the access key negotiation point in the authentication success packet, and is forwarded to the access client to inform the authentication.
- the access authentication point 400 After receiving the access authentication message sent by the access client 100 forwarded by the access key negotiation point 300, the access authentication point 400 first saves the public key including the access key negotiation point and uses it for the pairing. Announcement information such as an encryption algorithm that encrypts the master key. Then, the identity information request message for requesting the identity information of the access client 100 is sent to the access key negotiation point 300.
- the identity information request message may be EAPol/Eap-Req/Identity.
- the identity information request message is forwarded to the access client 100.
- the access client 100 After receiving the identity information request message, the access client 100 responds to the identity information response message carrying the identity information to the access key negotiation point 300, and the access key negotiation point 300 reports the identity information response.
- the text is forwarded to the access authentication point 400.
- the access authentication point 400 will receive the body
- the information response message is encapsulated in an access request message for requesting access to the WLAN to the authentication server 200, and then the access request message is sent to the authentication server 200 to request access.
- the paired master key After receiving the authentication success message returned by the authentication server 200, the paired master key is obtained from the authorization information of the authentication success message, and then paired by the encryption algorithm in the previously saved notification information.
- the master key is encrypted, and the encrypted ciphertext is encapsulated in the authentication success packet, and the authentication success packet is sent to the access key negotiation point 300 for receiving the authentication success report.
- the authentication success message is forwarded to the access client 100 to notify the access client 100 that the authentication is passed.
- the access authentication point processes the received access authentication message, saves the notification information therein, and sends the identity information request message to the access key negotiation point, and receives the access client forwarded by the access key negotiation point.
- the identity information response message is sent, the identity information response message is encapsulated in an access request message for requesting access to the WLAN to the authentication server, and the access request message is sent to the authentication service end.
- the paired master key is encrypted, and the obtained ciphertext is encapsulated in the authentication success message and sent to the access key negotiation. point. Therefore, the extension of the access request packet provides a basis for avoiding problems such as poor network compatibility and complicated interface caused by the access authentication point passing the paired master key to the access key negotiation point.
- the access key negotiation point 300 is specifically used to:
- the access key negotiation point 300 After receiving the authentication success message including the encrypted paired master key sent by the access authentication point 400, the access key negotiation point 300 performs the same encryption algorithm as the encryption of the paired master key in the notification information. And decrypting the received authentication success packet to obtain the paired master key carried in the pair; and then performing key negotiation with the access client 100 according to the obtained paired master key. Then, the authentication success packet is reassembled, and the paired master key is removed from the authentication success packet to form an authentication success packet that does not include the paired master key, and the reassembled authentication succeeds. The packet is sent to the access client 100 to notify the access client 100 that the access authentication is successful, and the WLAN can be accessed.
- the access key negotiation point decrypts the received authentication success packet according to the notification information, and obtains the carried
- the paired master key is used, and the key is negotiated with the access client according to the paired master key; then, the paired master key is removed from the authentication success message, and the reassembly does not include the paired master key.
- the authentication success message is sent to the access client, so that the access key negotiation point can obtain the paired master key through the extension of the authentication success packet, thereby further avoiding the access authentication.
- the point provides a basis for the problem of poor network compatibility and complex interface caused by the pair of master keys to the key agreement authentication point.
- the access key negotiation point is used to receive the access authentication message sent by the access client, the advertisement information is extended in the access authentication message, and the extended access authentication message is sent to the interface.
- the access authentication point obtains the identity information of the access client, and sends an access request message carrying the identity information of the access client to the authentication server; and after receiving the authentication success packet, the packet is obtained from the authentication server.
- the encrypted paired master key is encapsulated in the authentication success message and sent to the access key negotiation point; the access key negotiation point Decrypt the authentication success packet, obtain the paired master key, and reassemble the authentication success packet that does not include the paired master key to the access client.
- the paired master key is transmitted to the access authentication point and the access key negotiation point, since there is no need for an access key negotiation point.
- a dedicated interface is established between the access authentication point and the access authentication point, thereby avoiding problems such as poor network compatibility and complicated interface caused by the access authentication point transmitting the paired master key to the access key negotiation point.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Mobile Radio Communication Systems (AREA)
Abstract
一种无线局域网络WLAN接入网络中传递成对主密钥的方法,包括:接入密钥协商点接收接入客户端发送的接入认证报文,在接入认证报文中扩展通告信息,并将扩展后的接入认证报文发送至接入认证点;接入认证点向认证服务端发送携带接入客户端的身份信息的接入请求报文;在接收到鉴权成功报文后从其中获取成对主密钥,并根据通告信息对成对主密钥进行加密,将所得到的密文封装在鉴权成功报文中发送至接入密钥协商点;接入密钥协商点获取成对主密钥,并重组不包含成对主密钥的鉴权成功报文发送至接入客户端。本发明实施例还提供了相应的系统。上述方案,避免了因接入认证点传递成对主密钥给接入密钥协商点造成的组网兼容性差和接口复杂等问题。
Description
WLA 接入网络中传递成对主密钥的方法和系统
技术领域
本发明涉及到无线通信技术领域, 特别涉及到一种无线局域网络 ( Wireless Local Area Networks , WLAN )接入网络中传递成对主密钥的方法 和系统。
背景技术
随着互联网应用和智能终端的快速发展, WLAN应用已经非常普遍, 很 多公共场所被部署, 用户可以通过手机、 电脑等各种终端设备, 随时随地访 问互联网进行网上办公、 娱乐等活动。 通过无线局域网接入网络已是用户访 问网络资源最重要的手段之一。
为了加强无线设备空口数据传输的安全性, IEEE 802.1 和1£££802.111 定义了 8021 X+EAP接入认证方式和 EAPOL-Key密钥协商机制。 WLAN釆用 4-Way Handshake的密钥协商机制,促使无线服务端和接入客户端协商产生密 钥 PTK和 GTK, 产生的密钥用于无线设备之间空口数据的加解密, 保护无线 网络的可靠和安全。 而在进行 EAPOL-Key密钥协商前, 无线接入客户端和无 线服务端需要有相同的成对主密钥 PMK ( pairwise master key ) , 使用 802.1X+EAP接入认证方式, 接入客户端可以在鉴权认证的过程获取 PMK, 而无线设备服务端是从 AAA服务器发送的鉴权成功的授权信息中获取 PMK。 PMK是进行 EAPOL-Key密钥协商的密钥素材, 是进行 EAPOL-Key密钥协商 的基础。
现在实际组网部署中,无线用户 STA的接入密钥协商点和接入认证点往 往不是一个设备, 通常釆用 BNG设备作为接入认证点, AP作为接入密钥协 商点。接入客户端 STA通过 802.1 X认证过程的 MSK获取 PMK , BNG可以 从 AAA服务器的授权信息中获取 PMK, 但 AP却无法直接从 AAA鉴权成 功的授权信息中获取 PMK。这样 ,就需要解决 PMK在 BNG和 AP之间的传 递接口的问题, 而如果由 BNG代理 AP来与 STA进行密钥协商, 并通过特 定隧道或特定协议接口传递 PTK和 GTK给 AP, 就会给 BNG设备带来不必
要的负担。 相关技术中, 在 AC和 BNG融合的设备上, 通过扩展 CAPWAP 消息元素传递 PMK或 PTK/GTK给 AP,但是这种方法对于 AC和 BNG分离 的场景,则需要在 AC和 BNG间建立专用的接口(特定隧道接口或扩展某些 协议)来传递 PMK,而这个接口目前并非标准化接口,因而会导致兼容性差、 互操作性差等问题。
发明内容
本发明的主要目的为提供一种 WLAN接入网络中传递成对主密钥的方法 和系统, 旨在避免因接入认证点传递成对主密钥给密钥协商认证点造成的组 网兼容性差和接口复杂等问题。
本发明提供一种 WLAN接入网络中传递成对主密钥的方法, 包括: 接入密钥协商点接收接入客户端发送的接入认证报文, 在所述接入认证 报文中扩展通告信息, 并将扩展后的所述接入认证报文发送至接入认证点; 接入认证点获取接入客户端的身份信息, 向认证服务端发送携带所述接 入客户端的身份信息的接入请求报文; 在接收到认证服务端根据所述接入请 求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根据之前获悉的 所述通告信息对所述成对主密钥进行加密, 将加密后所得到的密文封装在所 述鉴权成功报文中发送至所述接入密钥协商点;
接入密钥协商点解密所述鉴权成功报文, 获取所述成对主密钥, 并重组 不包含所述成对主密钥的鉴权成功报文发送至接入客户端。
优选地, 所述通告信息至少包括所述接入密钥协商点的公钥和用于对成 对主密钥进行加密的加密算法; 所述公钥和加密算法可以本地配置, 也可通 过网络管理系统配置。
优选地, 所述接入认证点获取接入客户端的身份信息, 向认证服务端发 送携带所述接入客户端的身份信息的接入请求报文; 在接收到认证服务端根 据所述接入请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根 据之前获悉的所述通告信息对所述成对主密钥进行加密, 将加密后所形成的 密文封装在所述鉴权成功报文中发送至所述接入密钥协商点包括:
接入认证点处理所述接入认证报文, 保存其中的通告信息, 并发送用于 索取接入客户端的身份信息的身份信息索取报文至接入密钥协商点, 供接入
密钥协商点将该身份信息索取报文转发至接入客户端;
接收接入密钥协商点转发的接入客户端回应的身份信息应答报文, 将所 述身份信息应答报文封装在用于向认证服务端请求接入 WLAN 的接入请求 报文中, 将该接入请求报文发送至认证服务端;
接收到认证服务端返回的鉴权成功报文后, 从授权信息中获取成对主密 钥, 并通过之前所保存的所述通告信息中的加密算法和公钥对所述成对主密 钥进行加密, 将加密后所得到的密文封装在所述鉴权成功报文中转发至接入 密钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
优选地, 所述接入密钥协商点解密所述鉴权成功报文, 获取所述成对主 密钥,并重组不包含所述成对主密钥的鉴权成功报文发送至接入客户端包括: 接入密钥协商点根据所述通告信息解密接收到的所述鉴权成功报文, 获 取其中携带的所述成对主密钥;
将所述成对主密钥从所述鉴权成功报文拆除, 重组一不包含所述成对主 密钥的鉴权成功报文, 并将重组的所述鉴权成功报文发送至接入客户端; 并 根据所述成对主密钥, 与所述接入客户端进行密钥协商。
优选地, 在执行所述重组不包含所述成对主密钥的鉴权成功报文发送至 接入客户端之后, 还包括:
接入客户端接收所述不包含所述成对主密钥的鉴权成功报文,发送 IP地 址请求 ^艮文, 以获取 IP地址。 本发明还提供一种 WLAN接入网络中传递成对主密钥的系统,包括接入 客户端、 认证服务端、 接入密钥协商点和接入认证点, 其中,
所述接入密钥协商点, 设置为: 接收接入客户端发送的接入认证报文, 在所述接入认证报文中扩展通告信息, 并将扩展后的所述接入认证报文发送 至接入认证点; 还解密接入认证点发送的鉴权成功报文, 获取所述成对主密 钥, 并重组不包含所述成对主密钥的鉴权成功报文发送至接入客户端;
所述接入认证点, 设置为: 获取接入客户端的身份信息, 向认证服务端 发送携带所述接入客户端的身份信息的接入请求报文; 在接收到认证服务端 根据所述接入请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并 4艮据所述通告信息对所述成对主密钥进行加密, 将加密后所得到的密文封装
在所述鉴权成功报文中发送至所述接入密钥协商点;
所述接入客户端, 设置为: 发送接入认证报文至所述接入密钥协商点, 并接收所述不包含所述成对主密钥的鉴权成功报文, 发送 IP地址请求报文, 以获取 IP地址;
所述认证服务端, 设置为: 根据所述接入认证点发送的接入请求报文, 判断所述接入客户端是否通过认证, 若是, 则返回授权信息携带成对主密钥 的鉴权成功报文至所述接入认证点。
优选地, 所述接入认证点设置为:
处理所述接入认证报文, 保存其中的通告信息, 并发送用于索取接入客 户端的身份信息的身份信息索取报文至接入密钥协商点, 供接入密钥协商点 将该身份信息索取报文转发至接入客户端;
接收接入密钥协商点转发的接入客户端回应的身份信息应答报文, 将所 述身份信息应答报文封装在用于向认证服务端请求接入 WLAN 的接入请求 报文中, 将该接入请求报文发送至认证服务端;
接收到认证服务端返回的鉴权成功报文后, 从授权信息中获取成对主密 钥, 并通过之前所保存的所述通告信息中的加密算法和公钥对所述成对主密 钥进行加密, 将加密后所得到的密文封装在所述鉴权成功报文中转发至接入 密钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
优选地, 所述接入密钥协商点设置为:
根据所述通告信息解密接收到的所述鉴权成功报文, 获取其中携带的所 述成对主密钥;
将所述成对主密钥从所述鉴权成功报文拆除, 重组一不包含所述成对主 密钥的鉴权成功报文, 并将重组的所述鉴权成功报文发送至接入客户端; 并 根据所述成对主密钥, 与所述接入客户端进行密钥协商。 本发明实施例通过接入密钥协商点接收接入客户端发送的接入认证 4艮文, 在接入认证报文中扩展通告信息, 并将扩展后的接入认证报文发送至接入认 证点; 接入认证点获取接入客户端的身份信息, 向认证服务端发送携带接入 客户端的身份信息的接入请求报文; 并在接收到鉴权成功报文后, 从其中获 取成对主密钥, 并根据通告信息对成对主密钥进行加密, 将加密后得到的密
文封装在鉴权成功报文中发送至接入密钥协商点; 接入密钥协商点解密鉴权 成功报文, 获取成对主密钥, 并重组不包含成对主密钥的鉴权成功报文发送 至接入客户端。 通过对接入认证报文进行扩展, 以及对鉴权成功报文进行扩 展, 从而实现传递成对主密钥给接入认证点和接入密钥协商点, 由于无需在 接入密钥协商点和接入认证点之间建立专用的接口, 从而避免了因接入认证 点传递成对主密钥给接入密钥协商点造成的组网兼容性差和接口复杂等问题。 附图概述
图 1为本发明 WLAN接入网络中传递成对主密钥的方法一实施例的流程 示意图;
图 2为本发明实施例 WLAN接入网络中传递成对主密钥的方法中接入认 证点向认证服务端发送接入请求报文的流程示意图;
图 3为本发明实施例 WLAN接入网络中传递成对主密钥的方法中接入密 钥协商点获取成对主密钥的流程示意图;
图 4为本发明 WLAN接入网络中传递成对主密钥的方法另一实施例的流 程示意图;
图 5为本发明 WLAN接入网络中传递成对主密钥的系统一实施例的结构 示意图。 本发明目的的实现、 功能特点及优点将结合实施例, 参照附图做进一步 说明。 本发明的较佳实施方式
应当理解, 此处所描述的具体实施例仅仅用以解释本发明, 并不用于限 定本发明。
本发明实施例提供一种 WLAN接入网络中传递成对主密钥的方法。 通过 对接入认证报文进行扩展, 以及对鉴权成功报文进行扩展, 实现从接入认证 点传递成对主密钥给密钥协商认证点, 而无需在接入密钥协商点和接入认证 点之间建立专用的接口来传递。
参照图 1 , 图 1为本发明 WLAN接入网络中传递成对主密钥的方法一实施 例的流程示意图。
本实施例所提供的 WLAN接入网络中传递成对主密钥的方法, 包括: 步骤 S10, 接入密钥协商点接收接入客户端发送的接入认证报文, 在接 入认证报文中扩展通告信息,并将扩展后的接入认证报文发送至接入认证点; 本实施例中,接入客户端与认证服务端之间的鉴权协议可以为 ΕΑΡ鉴权 协议,该 ΕΑΡ鉴权协议可以包括 EAP-PEAP、EAP-SIM、EAP-AKA、EAP-TLS、 EAP-TTLS 等协议; 而接入认证点与认证服务端之间的认证协议可以是 Radius协议或 Diameter协议; 接入密钥协商点可以为 AP设备或 AC设备, 接入认证点可以为 BNG设备。
在接入客户端通过 WLAN接入网络时,首先与位于其附近的接入密钥协 商点关联, 关联成功后, 接入客户端会向该接入密钥协商点发送用于对自身 身份进行认证的接入认证报文, 本实施例中, 该接入认证报文可以为 EAPOL-Start报文。 而接入密钥协商点接收到该接入认证报文后, 对其进行 扩展, 即在 EAPOL-Start报文中扩展通告信息, 该通告信息可以包括接入密 钥协商点的公钥和用于对成对主密钥进行加密的加密算法等信息, 这些信息 所需要的公钥和加密算法可以本地配置, 也可通过网络管理系统配置。 对接 入认证艮文进行扩展后, 将其发送至接入认证点。
步骤 S20, 接入认证点获取接入客户端的身份信息, 向认证服务端发送 携带接入客户端的身份信息的接入请求报文; 在接收到认证服务端根据接入 请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根据之前获悉 的通告信息对成对主密钥进行加密, 将加密后所得到的密文封装在鉴权成功 报文中发送至接入密钥协商点;
接入认证点接收到进行扩展后的接入认证报文后, 获取接入客户端的身 份信息, 并在得到接入客户端的身份信息后, 将接入客户端的身份信息封装 至接入认证点发送至认证服务端以请求接入的接入请求报文中发送至认证服 务端, 本实施例中, 该接入请求 ^艮文可以为 Radius协议的 Access-Request报 文。 而认证服务端在接收到接入请求报文后, 会与接入客户端协商具体的鉴 权方式, 并最终判断该接入客户端是否可以通过认证。 在接入客户端认证成 功后, 认证服务端会返回鉴权成功报文至接入认证点, 本实施例中, 该鉴权
成功才艮文可以为 Radius 协议的 Access-Accept才艮文, 该才艮文的属性中包含 EAP-SUCCESS报文。
而接入认证点接收到鉴权成功报文后, 从该鉴权成功报文的授权属性中 获取成对主密钥,然后,根据通告信息中的加密算法对成对主密钥进行加密, 将加密后所形成的密文封装在鉴权成功报文(EAP-SUCCESS报文) 中, 并 将该鉴权成功报文发送至接入密钥协商点。
步骤 S30, 接入密钥协商点解密鉴权成功报文, 获取成对主密钥, 并重 组不包含成对主密钥的鉴权成功报文发送至接入客户端。
接入密钥协商点根据相同的加密算法解密所接收到的鉴权成功报文, 从 而获取成对主密钥, 并且对鉴权成功报文进行重组, 即重组一个不包含成对 主密钥的鉴权成功报文, 并将重组后的鉴权成功报文发送至接入客户端。
本发明实施例, 通过接入密钥协商点接收接入客户端发送的接入认证才艮 文, 在接入认证报文中扩展通告信息, 并将扩展后的接入认证报文发送至接 入认证点; 接入认证点获取接入客户端的身份信息, 向认证服务端发送携带 接入客户端的身份信息的接入请求报文; 并在接收到鉴权成功报文后, 从其 中获取成对主密钥, 并根据通告信息对成对主密钥进行加密, 将加密后得到 的密文封装在鉴权成功报文中发送至接入密钥协商点; 接入密钥协商点解密 鉴权成功报文, 获取成对主密钥, 并重组不包含成对主密钥的鉴权成功报文 发送至接入客户端。 通过对接入认证报文进行扩展, 以及对鉴权成功报文进 行扩展, 从而实现从接入认证点传递成对主密钥给接入密钥协商点, 由于无 需在接入密钥协商点和接入认证点之间建立专用的接口, 从而避免了因接入 认证点传递成对主密钥给接入密钥协商点造成的组网兼容性差和接口复杂等 问题。 参照图 2 , 图 2为本发明 WLAN接入网络中传递成对主密钥的方法中接入 认证点向认证服务端发送接入请求报文的流程示意图。
在上述实施例中, 步骤 S20包括:
步骤 S201 , 接入认证点处理接入认证报文, 保存其中的通告信息, 并发 送用于索取接入客户端的身份信息的身份信息索取报文至接入密钥协商点, 供接入密钥协商点将该身份信息索取报文转发至接入客户端;
接入认证点接收到接入密钥协商点转发的接入客户端所发送的接入认证 才艮文后, 首先保存其中的包括接入密钥协商点的公钥和用于对成对主密钥进 行加密的加密算法等信息的通告信息。 然后, 向接入密钥协商点发送用于索 取接入客户端的身份信息的身份信息索取报文, 本实施例中, 该身份信息索 取报文可以为 EAPoL/Eap-Request/Identity报文,以供接入密钥协商点将该身 份信息索取报文转发至接入客户端。
步骤 S202,接收接入密钥协商点转发的接入客户端回应的身份信息应答 报文,将身份信息应答报文封装在用于向认证服务端请求接入 WLAN的接入 请求报文中, 将该接入请求报文发送至认证服务端;
在接入客户端接收到身份信息索取报文后, 会回应携带自身身份信息的 身份信息应答报文至接入密钥协商点, 而接入密钥协商点则将身份信息应答 报文转发至接入认证点。 而接入认证点将接收到的身份信息应答报文封装在 用于向认证服务端请求接入 WLAN的接入请求报文中,然后,将该接入请求 报文发送至认证服务端, 以请求接入。
步骤 S203 ,接收到认证服务端返回的鉴权成功报文后, 从授权信息中获 取成对主密钥, 并通过之前所保存的通告信息中的加密算法和公钥对成对主 密钥进行加密, 将加密后所得到的密文封装在鉴权成功报文中转发至接入密 钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
接入认证点接收到认证服务端所返回的鉴权成功报文后, 从该鉴权成功 报文的授权信息中获取成对主密钥, 然后, 通过之前所保存的通告信息中的 加密算法对成对主密钥进行加密, 将加密后所得到的密文封装在鉴权成功报 文中, 并将该鉴权成功报文发送至接入密钥协商点, 供其在收到鉴权成功报 文后, 将鉴权成功报文转发至接入客户端, 以告知接入客户端认证通过。
接入认证点处理接收到的接入认证报文, 保存其中的通告信息, 并发送 身份信息索取报文至接入密钥协商点, 而在接收到接入密钥协商点转发的接 入客户端回应的身份信息应答报文后, 将身份信息应答报文封装在用于向认 证服务端请求接入 WLAN的接入请求报文中, 将该接入请求报文发送至认证 月良务端; 并且, 在接收到认证服务端所返回的鉴权成功报文后, 对其中的成 对主密钥进行加密, 将得到的密文封装在鉴权成功报文中发送至接入密钥协 商点。 从而通过对接入请求报文进行扩展, 为避免因传递成对主密钥给接入
认证点造成的组网兼容性差和接口复杂等问题提供了基础。 参照图 3 , 图 3为本发明 WL AN接入网络中传递成对主密钥的方法中接入 密钥协商点获取成对主密钥的流程示意图。
在上述实施例中, 步骤 S30包括:
步骤 S31 , 接入密钥协商点根据通告信息解密接收到的鉴权成功报文, 获取其中携带的成对主密钥;
步骤 S32, 将成对主密钥从鉴权成功报文拆除, 重组一不包含成对主密 钥的鉴权成功报文, 并将重组的鉴权成功报文发送至接入客户端; 并根据成 对主密钥, 与接入客户端进行密钥协商。
接入密钥协商点在接收到接入认证点发送的包括加密后的成对主密钥的 鉴权成功报文后, 根据通告信息中与加密该成对主密钥同样的加密算法解密 接收到的鉴权成功报文, 获取其中携带的成对主密钥; 然后, 根据所获取的 成对主密钥,与接入客户端进行密钥协商。然后,对鉴权成功报文进行重组, 即将成对主密钥从鉴权成功报文中拆除, 形成一不包含成对主密钥的鉴权成 功报文, 将该重组后的鉴权成功报文发送至接入客户端, 以通知接入客户端 接入认证成功, 可以进行 WLAN的接入。
接入密钥协商点根据通告信息解密接收到的鉴权成功报文, 获取其中携 带的成对主密钥, 并根据成对主密钥, 与接入客户端进行密钥协商; 然后, 将成对主密钥从鉴权成功报文拆除, 重组一不包含成对主密钥的鉴权成功报 文发送至接入客户端, 这样, 接入密钥协商点便可以通过对鉴权成功报文所 进行的扩展获取到成对主密钥, 从而进一步为避免因传递成对主密钥给接入 认证点造成的组网兼容性差和接口复杂等问题提供了基础。 参照图 4, 图 4为本发明 WLAN接入网络中传递成对主密钥的方法另一实 施例的流程示意图。
基于本发明 WLAN接入网络中传递成对主密钥的方法一实施例, 在执行 步骤 S30之后, 该方法还包括:
步骤 S40, 接入客户端接收不包含成对主密钥的鉴权成功报文, 发送 IP 请求 ^艮文, 以获取 IP地址。
在接入客户端接收到接入密钥协商点所发送的不包含成对主密钥的鉴权 成功报文后, 开始进行 WLAN的接入, 即向 WLAN侧的服务器发送 IP请求报 文,以请求获取接入网络的 IP地址,从而根据获取到的 IP地址完成网络接入。
在接入客户端接收到接入密钥协商点所发送的不包含成对主密钥的鉴权 成功报文后, 发送 IP请求报文, 以根据获取到的 IP地址完成网络接入, 从而 更进一步通过对接入认证报文和鉴权成功报文所进行的扩展, 为用户接入 WLAN网络提供了较大的方便。 以下以三种组网方式作为本发明的三个实施方式,来说明本发明 WLAN 接入网络中传递成对主密钥的方法的方案, 在该三个实施方式中, 接入客户 端 STA与认证服务端 AAA服务器之间的鉴权协议为 EAP鉴权协议,而接入 认证点 BNG与认证服务端 AAA服务器之间的认证协议为 Radius协议; 接 入密钥协商点为 AP设备, 接入认证点为 BNG设备。
一、 实施方式一:
胖 AP部署场景, AP进行本地转发。 AP处于 STA和 BNG的之间, 此组网 场景下, 不需要 AC参与。 具体实现方法如下:
步骤 1 : 接入客户端 STA关联 AP后, 发起 EAPol-Start报文触发 EAP鉴权。 步骤 2 : AP收到 STA的 EAPol-Start报文后, 在 EAPol-Start报文中扩展 EAPoL V3版本支持的通告信息, 即通过 TLV选项携带 AP的公钥和加密算法 等信息, 将扩展后的报文发送至 BNG。
步骤 3: BNG处理 EAPol-Start报文, 保存 STA和 AP的关联关系以及 AP的 公钥和加密算法等信息, 通过发送 EAPol/Eap-Req/Identity报文, 向 STA索要 身份信息。
步骤 4: AP转发 EAPol/Eap-Req/Identity报文给接入客户端 STA。
步骤 5: STA对 EAPol/Eap-Req/Identity报文做出回应, 发送身份信息响应 报文 EAPol/Eap-Res/Identity至 AP。
步骤 6: AP转发 EAPol/Eap/Res/Identity报文至 BNG。
Access-Request中, 发送给 AAA服务器。
步骤 8: AAA服务器和 STA协商具体的鉴权方式,并最终判断 STA是否可
以通过认证。
步骤 9: AAA服务器根据判断结果发送鉴权成功的 EAP-SUCCESS报文或 鉴权失败的 EAP-FAILURE报文, 并将 EAP-SUCCESS报文或 EAP-FAILURE 报文封装在 RADIUS协议的 Access-Accept/Reject报文中, 发送至 BNG。
步骤 10: 如果 BNG收到 Access-Accept报文, 则解析 AAA服务器下发的授 权属性密钥素材相关字段(例如 MS— MPPE— RCV— KEY )获得成对主密钥 PMK, 并用和 AP约定的加密算法和密钥对其进行加密, 将 PMK封装到 EAP-SUCCESS报文的尾部。 而如果 BNG收到 Access-Reject报文, 则通过 AP 下发 EAP-FAILURE报文给 STA, 供 STA重新触发鉴权流程。
步骤 11 : BNG把封装后的 EAP-SUCCESS报文发送给 AP。在 EAP-Success 报文最后增加加密的 PmkData字段, EAPol报文中的 Length和 EAP报文中的 Length都要增加 PMK密文的长度 pmk— len。
步骤 12: AP从经过扩展的 EAP-SUCCESS报文中用和 BNG约定的加密算 法和本地私钥解密获得 PMK, 并把 PMK从 EAPOL-SUCCESS拆除, 重组一个 EAP-SUCCESS发送至 STA。 重组 EAP-Success报文时, 也需要还原原来的 EAPol的 Length和 EAP中的 Length, 减去 PMK密文的长度。 至此, STA和 AP 分别获取 PMK。
步骤 13: AP发送重组后的 EAP-SUCCESS报文给 STA。 STA在收到鉴权 成功的消息后, 开始 DHCP流程以获取 IP地址。 二、 实施方式二:
瘦 AP部署场景, AP进行集中转发。 无线接入控制器 AC和 BNG可以釆用 融合的方式, 也可以釆用分离的组合模式, 不管在 AC分离的组网下, 还是 AC和 BNG融合的组网下, EAP-SUCCES携带的 PMK , 都可以在 AP侧进行解 析出 PMK。 本实施方式釆用 AC和 BNG分离的组网模式。 AP通过发现 AC请求 /响应、 AP加入 AC请求 /响应、 AP状态变更请求 /响应、 配置更新请求 /响应等 步骤完成 AP的上线, 和 AC之间建立起 CAPWAP控制隧道。
步骤 1 :接入客户端 STA和 AP建立关联后,发起 EAPol-Start报文触发 EAP 鉴权。
步骤 2: AP接收到 STA发送的 EAPol-Start报文后,在 EAPol- Start报文中扩
展 EAPoL V3版本支持的通告信息, 即通过 TLV选项携带 AP的公钥和加密算 法等信息,将扩展后的 EAPol-Start报文通过和 AC之间的 CAPWAP数据隧道发 送 EAPol-Start报文至 AC。
步骤 3: AC解析通过 CAPWAP隧道收到的 EAPol-Start报文, 并把 EAPol-Start报文通过二层网络转发至 BNG。
步骤 4: BNG处理 EAPol-Start报文, 保存 STA和 AP的关联关系以及 AP的 公钥和加密算法等信息, 通过发送 EAPol/Eap-Req/Identity报文给 AC, 向 STA 索要身份信息。
步骤 5: AC通过 CAPWA隧道发送 EAPol/Eap-Req/Identity报文至 AP。
步骤 6: AP转发 EAPol/Eap- Req /Identity报文至 STA。
步骤 7: STA对 EAPol/Eap-Req/Identity报文做出回应, 发送身份信息响应 报文 EAPol/Eap-Res/Identity至 AP。
步骤 8: AP通过 CAPWAP隧道传输 EAPol/Eap-Res/Identity报文至 AC。 步骤 9: AC转发收到的 EAPol/Eap-Res/Identity报文至 BNG。
步骤 10: BNG把 EPol/Eap-Res/Identity报文封装在 RADIUS协议的
Access-Request报文中, 发送至 AAA^务器。
步骤 11 : AAA服务器和 STA协商具体的鉴权方式, 并最终判断 STA是否 可以通过认证。 根据判断结果发送鉴权成功的 EAP-SUCCESS报文或鉴权失 在 RADIUS协议的 Access-Accept/Reject报文中, 发送至 BNG。
步骤 12: 如果 BNG收到 Access-Accept报文, 则解析 AAA服务器下发的授 权属性密钥素材相关字段(例如 MS— MPPE— RCV— KEY )获得成对主密钥 PMK, 并用和 AP约定的加密算法和密钥对其进行加密, 将 PMK封装到 EAP-SUCCESS报文的尾部。 而如果 BNG收到 Access-Reject报文, 则通过 AP 下发 EAP-FAILURE报文给 STA, 供 STA重新触发鉴权流程。
步骤 13: BNG把封装后的 EAP-SUCCESS报文发送给 AC。在 EAP-Success 报文最后增加加密的 PmkData字段, EAPol报文中的 Length和 EAP报文中的 Length都要增加 PMK密文的长度 pmk— len。
步骤 14: 由 AC通过 CAPWAP隧道传输扩展的 EAP-Success报文至 AP。 步骤 15: AP从经过扩展的 EAP-SUCCESS报文中用和 BNG约定的加密算
法和本地私钥解密获得 PMK, 并把 PMK从 EAPOL-SUCCESS拆除, 重组一个 EAP-SUCCESS发送至 STA。 重组 EAP-Success报文时, 也需要还原原来的 EAPol的 Length和 EAP中的 Length, 减去 PMK密文的长度。 至此, STA和 AP 分别获取 PMK。
步骤 16: AP发送重组后的 EAP-SUCCESS报文给 STA。 STA在收到鉴权 成功的消息后, 开始 DHCP流程以获取 IP地址。
在 AC和 BNG分离式组网环境下, AC也可以代理 AP以相同的方式从 BNG 获得 STA的 PMK, 然后通过 CAPWAP隧道协议中的消息元素下发 PMK给 AP。
三、 实施方式三:
瘦 AP部署场景, AP本地转发模式。 本实施方式釆用 AC和 BNG分离的组 网模式, AC、 AP、 BNG三者通过 SW相连。 AP通过发现 AC请求 /响应、 AP 加入 AC请求 /响应、 AP状态变更请求 /响应、 配置更新请求 /响应等步骤完成
AP的上线, 和 AC之间建立起 CAPWAP控制隧道。
步骤 1 :接入客户端 STA和 AP建立关联后,发起 EAPol-Start报文触发 EAP 鉴权。
步骤 2: AP接收到 STA发送的 EAPol-Start报文后,在 EAPol- Start报文中扩 展 EAPoL V3版本支持的通告信息, 即通过 TLV选项携带 AP的公钥和加密算 法等信息, 将扩展后的 EAPol-Start报文发送至 BNG。
步骤 3: BNG处理所接收到的 EAPol-Start报文, 保存 STA和 AP的关联关 系以及 AP的公钥和加密算法等信息, 通过发送 EAPol/Eap-Req/Identity报文给 AC, 向 STA索要身份信息。
步骤 6: AP转发 EAPol/Eap- Req /Identity报文至 STA。
步骤 7: STA对 EAPol/Eap-Req/Identity报文做出回应, 发送身份信息响应 报文 EAPol/Eap-Res/Identity至 AP。
步骤 8: AP转发收到的 EAPol/Eap-Res/Identity报文至 BNG。
步骤 9: BNG把 EPol/Eap-Res/Identity报文封装在 RADIUS协议的 Access-Request报文中, 发送至 AAA^务器。
步骤 10: AAA服务器和 STA协商具体的鉴权方式, 并最终判断 STA是否 可以通过认证。 根据判断结果发送鉴权成功的 EAP-SUCCESS报文或鉴权失
在 RADIUS协议的 Access-Accept/Reject报文中, 发送至 BNG。
步骤 11 : 如果 BNG收到 Access-Accept报文, 则解析 AAA服务器下发的授 权属性密钥素材相关字段(例如 MS— MPPE— RCV— KEY )获得成对主密钥 PMK, 并用和 AP约定的加密算法和密钥对其进行加密, 将 PMK封装到 EAP-SUCCESS报文的尾部。 而如果 BNG收到 Access-Reject报文, 则通过 AP 下发 EAP-FAILURE报文给 STA, 供 STA重新触发鉴权流程。
步骤 12: BNG把封装后的 EAP-SUCCESS报文发送给 AP。在 EAP-Success 报文最后增加加密的 PmkData字段, EAPol报文中的 Length和 EAP报文中的 Length都要增加 PMK密文的长度 pmk— len。
步骤 13: AP从经过扩展的 EAP-SUCCESS报文中用和 BNG约定的加密算 法和本地私钥解密获得 PMK, 并把 PMK从 EAPOL-SUCCESS拆除, 重组一个 EAP-SUCCESS发送至 STA。 重组 EAP-Success报文时, 也需要还原原来的 EAPol的 Length和 EAP中的 Length, 减去 PMK密文的长度。 至此, STA和 AP 分别获取 PMK。
步骤 14: AP发送重组后的 EAP-SUCCESS报文给 STA。 STA在收到鉴权 成功的消息后, 开始 DHCP流程以获取 IP地址。 本发明还提供一种 WLAN接入网络中传递成对主密钥的系统。
参照图 5 , 图 5为本发明 WLAN接入网络中传递成对主密钥的系统一实施 例的结构示意图。
本实施例所提供的 WLAN接入网络中传递成对主密钥的系统,包括接入 客户端 100、认证服务端 200、接入密钥协商点 300和接入认证点 400,其中, 接入密钥协商点 300, 用于接收接入客户端发送的接入认证报文, 在接 入认证报文中扩展通告信息,并将扩展后的接入认证报文发送至接入认证点; 还用于解密接入认证点发送的鉴权成功报文, 获取成对主密钥, 并重组不包 含成对主密钥的鉴权成功报文发送至接入客户端;
接入认证点 400, 用于获取接入客户端的身份信息, 向认证服务端发送 携带接入客户端的身份信息的接入请求报文; 在接收到认证服务端根据接入 请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根据之前获悉
的通告信息对成对主密钥进行加密, 将加密后所得到的密文封装在鉴权成功 报文中发送至接入密钥协商点;
接入客户端 100, 用于发送接入认证报文至接入密钥协商点, 并接收不 包含成对主密钥的鉴权成功报文, 发送 IP请求报文, 以获取 IP地址;
认证服务端 200, 用于根据接入认证点发送的接入请求报文, 判断接入 客户端是否通过认证, 若是, 则返回鉴权成功报文至接入认证点。
本实施例中, 接入客户端 100与认证服务端 200之间的鉴权协议可以为 EAP鉴权协议 ,该 EAP鉴权协议可以包括 EAP-PEAP、 EAP-SIM、 EAP-AKA、 EAP-TLS、 EAP-TTLS等协议; 而接入认证点 400与认证服务端 200之间的 认证协议可以是 Radius协议或 Diameter协议; 接入密钥协商点 300可以为 AP设备, 接入认证点 400可以为 BNG设备。
在接入客户端 100通过 WLAN接入网络时,首先与位于其附近的接入密 钥协商点 300关联,关联成功后,接入客户端 100会向该接入密钥协商点 300 发送用于对自身身份进行认证的接入认证报文, 本实施例中, 该接入认证报 文可以为 EAPOL-Start报文。 而接入密钥协商点 300接收到该接入认证报文 后,对其进行扩展, 即在 EAPOL-Start报文中扩展 EAP鉴权协议所支持的通 告信息, 该通告信息可以包括接入密钥协商点的公钥和用于对成对主密钥进 行加密的加密算法等信息, 其中, 公钥和加密算法可以本地配置, 也可通过 网络管理系统配置。对接入认证报文进行扩展后,将其发送至接入认证点 400。
接入认证点 400接收到进行扩展后的接入认证报文后, 获取接入客户端
100的身份信息,并在得到接入客户端 100的身份信息后,将接入客户端 100 的身份信息封装至发送至认证服务端 200以请求接入的接入请求报文中发送 至认证服务端 200 , 本实施例中, 该接入请求报文可以为 Radius 协议的 Access-Request报文。 而认证服务端 200在接收到接入请求报文后, 会与接 入客户端 100协商具体的鉴权方式, 并最终判断该接入客户端 100是否可以 通过认证。 在接入客户端 100认证成功后, 认证服务端 200会返回鉴权成功 报文至接入认证点 400,本实施例中,该鉴权成功报文可以为 EAP-SUCCESS 报文。
而接入认证点 400接收到鉴权成功 ^艮文后, 从该鉴权成功 ^艮文中获取成 对主密钥, 然后, 才艮据通告信息中的加密算法对成对主密钥进行加密, 将所
得到的密文封装在鉴权成功报文中, 并将该鉴权成功报文发送至接入密钥协 商点 300。
接入密钥协商点 300根据相同的加密算法解密所接收到的鉴权成功报文, 从而获取成对主密钥, 并且对鉴权成功报文进行重组, 即重组一个不包含成 对主密钥的鉴权成功报文,并将重组后的鉴权成功报文发送至接入客户端 100。
在接入客户端 100接收到接入密钥协商点 300所发送的不包含成对主密钥 的鉴权成功报文后, 开始进行 WLAN的接入, 即向 WLAN侧的服务器发送 IP 地址获取 ^艮文, 以请求获取接入网络的 IP地址, 从而根据获取到的 IP地址完 成网络接入。 在上述实施例中, 接入认证点 400具体用于:
处理接入认证报文, 保存其中的通告信息, 并发送用于索取接入客户端 的身份信息的身份信息索取报文至接入密钥协商点, 供接入密钥协商点将该 身份信息索取报文转发至接入客户端;
接收接入密钥协商点转发的接入客户端回应的身份信息应答报文, 将身 份信息应答报文封装在用于向认证服务端请求接入 WLAN 的接入请求报文 中, 将该接入请求报文发送至认证服务端;
接收到认证服务端返回的鉴权成功报文后, 从授权信息中获取成对主密 钥, 并通过之前所保存的通告信息中的加密算法和公钥对成对主密钥进行加 密, 将加密后所得到的密文封装在鉴权成功报文中转发至接入密钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
接入认证点 400接收到接入密钥协商点 300转发的接入客户端 100所发 送的接入认证报文后, 首先保存其中的包括接入密钥协商点的公钥和用于对 成对主密钥进行加密的加密算法等信息的通告信息。 然后, 向接入密钥协商 点 300发送用于索取接入客户端 100的身份信息的身份信息索取报文, 本实 施例中, 该身份信息索取报文可以为 EAPol/Eap-Req/Identity报文, 以供接入 密钥协商点 300将该身份信息索取报文转发至接入客户端 100。
在接入客户端 100接收到身份信息索取报文后, 会回应携带自身身份信 息的身份信息应答报文至接入密钥协商点 300, 而接入密钥协商点 300则将 身份信息应答报文转发至接入认证点 400。 而接入认证点 400将接收到的身
份信息应答报文封装在用于向认证服务端 200请求接入 WLAN的接入请求报 文中, 然后, 将该接入请求 ^艮文发送至认证服务端 200, 以请求接入。
接收到认证服务端 200所返回的鉴权成功报文后, 从该鉴权成功报文的 授权信息中获取成对主密钥, 然后, 通过之前所保存的通告信息中的加密算 法对成对主密钥进行加密, 将加密后所得到的密文封装在鉴权成功报文中, 并将该鉴权成功报文发送至接入密钥协商点 300 , 供其在收到鉴权成功报文 后, 将鉴权成功 文转发至接入客户端 100, 以告知接入客户端 100认证通 过。
接入认证点处理接收到的接入认证报文, 保存其中的通告信息, 并发送 身份信息索取报文至接入密钥协商点, 而在接收到接入密钥协商点转发的接 入客户端回应的身份信息应答报文后, 将身份信息应答报文封装在用于向认 证服务端请求接入 WLAN的接入请求报文中, 将该接入请求报文发送至认证 月良务端; 并且, 在接收到认证服务端所返回的鉴权成功报文后, 对其中的成 对主密钥进行加密, 将得到的密文封装在鉴权成功报文中发送至接入密钥协 商点。 从而通过对接入请求报文进行扩展, 为避免因接入认证点传递成对主 密钥给接入密钥协商点造成的组网兼容性差和接口复杂等问题提供了基础。 在上述实施例中, 接入密钥协商点 300具体用于:
根据通告信息解密接收到的鉴权成功报文,获取其中携带的成对主密钥; 将成对主密钥从鉴权成功报文拆除, 重组一不包含成对主密钥的鉴权成 功报文, 并将重组的鉴权成功报文发送至接入客户端; 并根据成对主密钥, 与客户端进行密钥协商。
接入密钥协商点 300在接收到接入认证点 400发送的包括加密后的成对 主密钥的鉴权成功报文后, 根据通告信息中与加密该成对主密钥同样的加密 算法解密接收到的鉴权成功报文, 获取其中携带的成对主密钥; 然后, 根据 所获取的成对主密钥, 与接入客户端 100进行密钥协商。 然后, 对鉴权成功 报文进行重组, 即将成对主密钥从鉴权成功报文中拆除, 形成一不包含成对 主密钥的鉴权成功报文,将该重组后的鉴权成功报文发送至接入客户端 100, 以通知接入客户端 100接入认证成功, 可以进行 WLAN的接入。
接入密钥协商点根据通告信息解密接收到的鉴权成功报文, 获取其中携
带的成对主密钥, 并根据成对主密钥, 与接入客户端进行密钥协商; 然后, 将成对主密钥从鉴权成功报文拆除, 重组一不包含成对主密钥的鉴权成功报 文发送至接入客户端, 这样, 接入密钥协商点便可以通过对鉴权成功报文所 进行的扩展获取到成对主密钥, 从而进一步为避免因接入认证点传递成对主 密钥给密钥协商认证点造成的组网兼容性差和接口复杂等问题提供了基础。 以上所述仅为本发明的优选实施例, 并非因此限制本发明的专利范围, 凡是利用本发明说明书及附图内容所作的等效结构或等效流程变换, 或直接 或间接运用在其他相关的技术领域, 均同理包括在本发明的专利保护范围。
工业实用性
本发明实施例, 通过接入密钥协商点接收接入客户端发送的接入认证才艮 文, 在接入认证报文中扩展通告信息, 并将扩展后的接入认证报文发送至接 入认证点; 接入认证点获取接入客户端的身份信息, 向认证服务端发送携带 接入客户端的身份信息的接入请求报文; 并在接收到鉴权成功报文后, 从其 中获取成对主密钥, 并根据通告信息对成对主密钥进行加密, 将加密后的成 对主密钥封装在鉴权成功报文中发送至接入密钥协商点; 接入密钥协商点解 密鉴权成功报文, 获取成对主密钥, 并重组不包含成对主密钥的鉴权成功报 文发送至接入客户端。 通过对接入认证报文进行扩展, 以及对鉴权成功报文 进行扩展, 从而实现传递成对主密钥给接入认证点和接入密钥协商点, 由于 无需在接入密钥协商点和接入认证点之间建立专用的接口, 从而避免了因接 入认证点传递成对主密钥给接入密钥协商点造成的组网兼容性差和接口复杂 等问题。
Claims
1、一种无线局域网络 WLAN接入网络中传递成对主密钥的方法,包括: 接入密钥协商点接收接入客户端发送的接入认证报文, 在所述接入认证 报文中扩展通告信息, 并将扩展后的所述接入认证报文发送至接入认证点; 接入认证点获取接入客户端的身份信息, 向认证服务端发送携带所述接 入客户端的身份信息的接入请求报文; 在接收到认证服务端根据所述接入请 求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根据之前获悉的 所述通告信息对所述成对主密钥进行加密, 将加密后所得到的密文封装在所 述鉴权成功报文中发送至所述接入密钥协商点;
接入密钥协商点解密所述鉴权成功报文, 获取所述成对主密钥, 并重组 不包含所述成对主密钥的鉴权成功报文发送至接入客户端。
2、根据权利要求 1所述的方法, 其中, 所述通告信息至少包括所述接入 密钥协商点的公钥和用于对成对主密钥进行加密的加密算法; 所述公钥和加 密算法可以本地配置, 也可通过网络管理系统配置。
3、根据权利要求 2所述的方法, 其中, 所述接入认证点获取接入客户端 的身份信息, 向认证服务端发送携带所述接入客户端的身份信息的接入请求 报文; 在接收到认证服务端根据所述接入请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并根据之前获悉的所述通告信息对所述成对主密钥 进行加密, 将加密后所形成的密文封装在所述鉴权成功报文中发送至所述接 入密钥协商点包括:
接入认证点处理所述接入认证报文, 保存其中的通告信息, 并发送用于 索取接入客户端的身份信息的身份信息索取报文至接入密钥协商点, 供接入 密钥协商点将该身份信息索取报文转发至接入客户端;
接收接入密钥协商点转发的接入客户端回应的身份信息应答报文, 将所 述身份信息应答报文封装在用于向认证服务端请求接入 WLAN 的接入请求 报文中, 将该接入请求报文发送至认证服务端;
接收到认证服务端返回的鉴权成功报文后, 从授权信息中获取成对主密 钥, 并通过之前所保存的所述通告信息中的加密算法和公钥对所述成对主密
钥进行加密, 将加密后所得到的密文封装在所述鉴权成功报文中转发至接入 密钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
4、根据权利要求 2所述的方法, 其中, 所述接入密钥协商点解密所述鉴 权成功报文, 获取所述成对主密钥, 并重组不包含所述成对主密钥的鉴权成 功报文发送至接入客户端包括:
接入密钥协商点根据所述通告信息解密接收到的所述鉴权成功报文, 获 取其中携带的所述成对主密钥;
将所述成对主密钥从所述鉴权成功报文拆除, 重组一不包含所述成对主 密钥的鉴权成功报文, 并将重组的所述鉴权成功报文发送至接入客户端; 并 根据所述成对主密钥, 与所述接入客户端进行密钥协商。
5、根据权利要求 1至 4中任一项所述的方法, 其中, 在执行所述重组不 包含所述成对主密钥的鉴权成功报文发送至接入客户端之后, 还包括:
接入客户端接收所述不包含所述成对主密钥的鉴权成功报文,发送 IP地 址请求 ^艮文, 以获取 IP地址。
6、 一种无线局域网络 WLAN接入网络中传递成对主密钥的系统, 包括 接入客户端、 认证服务端、 接入密钥协商点和接入认证点, 其中,
所述接入密钥协商点, 设置为: 接收接入客户端发送的接入认证报文, 在所述接入认证报文中扩展通告信息, 并将扩展后的所述接入认证报文发送 至接入认证点; 还解密接入认证点发送的鉴权成功报文, 获取所述成对主密 钥, 并重组不包含所述成对主密钥的鉴权成功报文发送至接入客户端;
所述接入认证点, 设置为: 获取接入客户端的身份信息, 向认证服务端 发送携带所述接入客户端的身份信息的接入请求报文; 在接收到认证服务端 根据所述接入请求报文返回的鉴权成功报文后, 从其中获取成对主密钥, 并 才艮据所述通告信息对所述成对主密钥进行加密, 将加密后所得到的密文封装 在所述鉴权成功报文中发送至所述接入密钥协商点;
所述接入客户端, 设置为: 发送接入认证报文至所述接入密钥协商点, 并接收所述不包含所述成对主密钥的鉴权成功报文, 发送 IP地址请求报文,
以获取 IP地址;
所述认证服务端, 设置为: 根据所述接入认证点发送的接入请求报文, 判断所述接入客户端是否通过认证, 若是, 则返回授权信息携带成对主密钥 的鉴权成功报文至所述接入认证点。
7、 根据权利要求 6所述的系统, 其中, 所述接入认证点设置为: 处理所述接入认证报文, 保存其中的通告信息, 并发送用于索取接入客 户端的身份信息的身份信息索取报文至接入密钥协商点, 供接入密钥协商点 将该身份信息索取报文转发至接入客户端;
接收接入密钥协商点转发的接入客户端回应的身份信息应答报文, 将所 述身份信息应答报文封装在用于向认证服务端请求接入 WLAN 的接入请求 报文中, 将该接入请求报文发送至认证服务端;
接收到认证服务端返回的鉴权成功报文后, 从授权信息中获取成对主密 钥, 并通过之前所保存的所述通告信息中的加密算法和公钥对所述成对主密 钥进行加密, 将加密后所得到的密文封装在所述鉴权成功报文中转发至接入 密钥协商点, 供其将报文转发给接入客户端, 告知其认证通过。
8、 根据权利要求 6所述的系统, 其中, 所述接入密钥协商点设置为: 根据所述通告信息解密接收到的所述鉴权成功报文, 获取其中携带的所 述成对主密钥;
将所述成对主密钥从所述鉴权成功报文拆除, 重组一不包含所述成对主 密钥的鉴权成功报文, 并将重组的所述鉴权成功报文发送至接入客户端; 并 根据所述成对主密钥, 与所述接入客户端进行密钥协商。
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
CN201310037538.5 | 2013-01-30 | ||
CN201310037538.5A CN103139770B (zh) | 2013-01-30 | 2013-01-30 | Wlan接入网络中传递成对主密钥的方法和系统 |
Publications (1)
Publication Number | Publication Date |
---|---|
WO2014117524A1 true WO2014117524A1 (zh) | 2014-08-07 |
Family
ID=48498960
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
PCT/CN2013/083632 WO2014117524A1 (zh) | 2013-01-30 | 2013-09-17 | Wlan接入网络中传递成对主密钥的方法和系统 |
Country Status (2)
Country | Link |
---|---|
CN (1) | CN103139770B (zh) |
WO (1) | WO2014117524A1 (zh) |
Families Citing this family (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103139770B (zh) * | 2013-01-30 | 2015-12-23 | 中兴通讯股份有限公司 | Wlan接入网络中传递成对主密钥的方法和系统 |
CN104521320B (zh) | 2013-07-31 | 2019-06-07 | 华为技术有限公司 | 用户管理设备、bng、bng用户上线方法及系统 |
CN109120405B (zh) * | 2018-10-29 | 2021-11-09 | 全球能源互联网研究院有限公司 | 一种终端安全接入方法、装置及系统 |
Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101013940A (zh) * | 2006-12-22 | 2007-08-08 | 西安电子科技大学 | 一种兼容802.11i及WAPI的身份认证方法 |
CN102185868A (zh) * | 2011-05-20 | 2011-09-14 | 杭州华三通信技术有限公司 | 基于可扩展认证协议的认证方法、系统和设备 |
WO2011137782A1 (zh) * | 2010-09-19 | 2011-11-10 | 华为技术有限公司 | 无线局域网中密钥的发送方法、装置及系统 |
CN102761869A (zh) * | 2012-06-26 | 2012-10-31 | 杭州华三通信技术有限公司 | 一种802.1x认证方法和设备 |
CN103139770A (zh) * | 2013-01-30 | 2013-06-05 | 中兴通讯股份有限公司 | Wlan接入网络中传递成对主密钥的方法和系统 |
-
2013
- 2013-01-30 CN CN201310037538.5A patent/CN103139770B/zh active Active
- 2013-09-17 WO PCT/CN2013/083632 patent/WO2014117524A1/zh active Application Filing
Patent Citations (5)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN101013940A (zh) * | 2006-12-22 | 2007-08-08 | 西安电子科技大学 | 一种兼容802.11i及WAPI的身份认证方法 |
WO2011137782A1 (zh) * | 2010-09-19 | 2011-11-10 | 华为技术有限公司 | 无线局域网中密钥的发送方法、装置及系统 |
CN102185868A (zh) * | 2011-05-20 | 2011-09-14 | 杭州华三通信技术有限公司 | 基于可扩展认证协议的认证方法、系统和设备 |
CN102761869A (zh) * | 2012-06-26 | 2012-10-31 | 杭州华三通信技术有限公司 | 一种802.1x认证方法和设备 |
CN103139770A (zh) * | 2013-01-30 | 2013-06-05 | 中兴通讯股份有限公司 | Wlan接入网络中传递成对主密钥的方法和系统 |
Also Published As
Publication number | Publication date |
---|---|
CN103139770A (zh) | 2013-06-05 |
CN103139770B (zh) | 2015-12-23 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
JP4649513B2 (ja) | 無線携帯インターネットシステムの認証方法及び関連キー生成方法 | |
JP5101620B2 (ja) | アドホックワイヤレスネットワークにおける認証キー材料のセキュリティ処理のための、セキュリティ方法およびセキュリティシステム | |
EP2025088B1 (en) | Provision of secure communiucations connection using third party authentication | |
CN102215487B (zh) | 通过公共无线网络安全地接入专用网络的方法和系统 | |
US7707412B2 (en) | Linked authentication protocols | |
US8561200B2 (en) | Method and system for controlling access to communication networks, related network and computer program therefor | |
CN101371550B (zh) | 自动安全地向移动通信终端的用户供给在线服务的服务访问凭证的方法和系统 | |
US9232398B2 (en) | Method and apparatus for link setup | |
US20060259759A1 (en) | Method and apparatus for securely extending a protected network through secure intermediation of AAA information | |
JP2010503326A5 (ja) | インフラストラクチャベースの無線マルチホップネットワークにおけるセキュリティ認証及び鍵管理方法 | |
JP2011139457A (ja) | 無線通信装置とサーバとの間でデータを安全にトランザクション処理する方法及びシステム | |
US20100161958A1 (en) | Device for Realizing Security Function in Mac of Portable Internet System and Authentication Method Using the Device | |
KR20180057665A (ko) | 사용자 장비(ue)를 위한 액세스 방법, 디바이스 및 시스템 | |
WO2009094942A1 (fr) | Procédé et système de réseau de communication pour établir une conjonction de sécurité | |
WO2014180198A1 (zh) | 终端接入方法、系统、设备和计算机存储介质 | |
WO2007028328A1 (fr) | Procede, systeme et dispositif de negociation a propos d'une cle de chiffrement partagee par equipement utilisateur et equipement externe | |
WO2013166908A1 (zh) | 密钥信息生成方法及系统、终端设备、接入网设备 | |
CN101715190B (zh) | 一种无线局域网下实现终端与服务器鉴别的系统及方法 | |
WO2016184351A1 (zh) | 无线网络的ip地址分配方法和系统 | |
WO2014117524A1 (zh) | Wlan接入网络中传递成对主密钥的方法和系统 | |
CN101052035B (zh) | 多主机安全架构及其空口密钥分发方法 | |
Dey et al. | An efficient dynamic key based eap authentication framework for future ieee 802.1 x wireless lans | |
WO2012068801A1 (zh) | 移动终端的认证方法及移动终端 | |
Sithirasenan et al. | EAP-CRA for WiMAX, WLAN and 4G LTE Interoperability | |
Zegeye et al. | Authentication of iot devices for wifi connectivity from the cloud |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
121 | Ep: the epo has been informed by wipo that ep was designated in this application |
Ref document number: 13873382 Country of ref document: EP Kind code of ref document: A1 |
|
NENP | Non-entry into the national phase |
Ref country code: DE |
|
122 | Ep: pct application non-entry in european phase |
Ref document number: 13873382 Country of ref document: EP Kind code of ref document: A1 |