WO2017185913A1

WO2017185913A1 - Method for improving wireless local area network authentication mechanism

Info

Publication number: WO2017185913A1
Application number: PCT/CN2017/077417
Authority: WO
Inventors: 刘军华
Original assignee: 上海斐讯数据通信技术有限公司
Priority date: 2016-04-29
Filing date: 2017-03-21
Publication date: 2017-11-02
Also published as: CN105828332A; CN105828332B

Abstract

Provided is a method for improving a wireless local area network authentication mechanism. After a wireless access point sends an authentication success message to a client in clear text during a bidirectional authentication process, the method comprises the steps of: providing a first encryption parameter, and if after the first encryption parameter is encrypted by a client, is decrypted by a wireless access point, is encrypted by the wireless access point and is decrypted by the client, the first encryption parameter still does not change, determining that the wireless access point is legitimate; and providing a second encryption parameter, and if after the wireless access point encrypts the second encryption parameter, the client decrypts same, the client then encrypts same and the wireless access point then decrypts same, the second encryption parameter still does not change, determining that the whole authentication process is completed. The present invention can effectively prevent a "man-in-the-middle attack", i.e. an illegitimate user cannot access a network via a port of a legitimate user, so that a "communication hijack" attack is prevented.

Description

An improved method of wireless local area network authentication mechanism

Technical field

The present invention relates to the field of communications technologies, and in particular, to an improved method for a wireless local area network authentication mechanism.

Background technique

With the development of wireless networks, more and more people are using wireless to access the network. Due to the openness of the wireless channel, intruders can easily intercept wireless data or access wireless networks by scanning or monitoring. Therefore, the security of wireless networks has received more and more attention. In order to protect the security of the wireless network, people adopt the method of terminal authentication. At present, people generally adopt IEEE 802.1X protocol or EAP-TLS (two-way authentication based on digital certificate) to implement access authentication for devices.

The main purpose of the IEEE 802.1X protocol is to solve the problem of access authentication for wireless LAN users. EAP-TLS authentication provides a two-way authentication based on digital certificates. It needs to be pre-published for authentication on the server side of STA (Station, client) and RADIUS (Remote Authentication Dial In User Service) through a secure connection. Digital certificate. EAP-TLS provides both authentication and dynamic session key distribution. The RADIUS server needs to support EAP-TLS authentication and the management capability of the authentication digital certificate. Only after the two-way authentication is passed, the server sends the AP to the AP. (Wireless Access Point, the wireless access point) sends an EAP-Success message indicating that the client can receive the data stream, and the message triggers the encryption of the data stream. Before the encryption key is established, the client Do not send data.

Although the EAP-TLS authentication is based on the mutual authentication of the STA and the RADIUS server, and the key on the pre-issued digital certificate is used in the authentication process, the selected AP is not fully authenticated, and the AP is defaulted to be reliable. Therefore, a malicious user pretends to be an AP, and spoofs the user by sending unprotected EAP-Success information, so that the user connects to the illegal AP, thereby obtaining all network communication of the user, and even by sending the associated frame. A legitimate user disconnected. The AP does not know that the legitimate user has disconnected and continues to communicate. At this time, the illegal user can access the network through the port of the legitimate user, thereby performing a "communication hijacking" attack.

Summary of the invention

In view of the above problems, the present application describes an improved method for a wireless local area network authentication mechanism, which is applied to a client to perform mutual authentication based on digital certificates through a wireless access point and an authentication server, wherein the two-way authentication process After the wireless access point sends the authentication success message to the client in plain text, the method further includes the following steps:

Step S1: The client encrypts a first encryption parameter by using a preset encryption algorithm to form a first packet and sends the first packet to the wireless access point.

Step S2: After receiving the first packet, the wireless access point decrypts the first packet according to the encryption algorithm to obtain the first encryption parameter, and the first encryption parameter and the first packet. The second encryption parameter is respectively encrypted by the encryption algorithm and combined to form a first Sending a second message to the client;

Step S3: The client decrypts and receives the second packet according to the encryption algorithm, to obtain a first encryption parameter and the second encryption parameter in the second packet.

Step S4: The client determines whether the first encryption parameter is the same as the first encryption parameter obtained in the second packet, and if not, the wireless access point is illegal, and exits;

Step S5: The client encrypts the second encryption parameter obtained in the second packet by using the encryption algorithm to form a third packet, and sends the third packet to the wireless access point.

Step S6: The wireless access point decrypts and receives the third packet according to the encryption algorithm to obtain a second parameter in the third packet.

Step S7: The wireless access point determines whether the second encryption parameter is the same as the second encryption parameter in the third packet, and if not, returns an authentication failure to the client, and exits;

Step S8: The wireless access point returns the authentication success to the client.

Preferably, the step S8 comprises the following steps:

Step S81: The wireless access point encrypts a security key and the authentication success packet by using the encryption algorithm to form a fourth packet, and sends the fourth packet to the client.

Step S82: The client decrypts and receives the fourth packet according to the encryption algorithm to obtain the security key and the authentication success packet.

Step S83: The client displays the authentication success message to the user, and communicates with the wireless access point with the security key.

Preferably, the first encryption parameter is randomly generated by the client.

Preferably, the second encryption parameter is randomly generated by the wireless access point.

Preferably, the encryption algorithm is previously agreed by the client and the wireless access point.

Preferably, the security key is generated by the hash algorithm for the wireless access point.

Preferably, the hash algorithm is an MD5 algorithm.

Preferably, the authentication server provides a password rule. Before the wireless access point sends the authentication success message to the client in the two-way authentication process, the method further includes:

Step S01: The authentication server sends an identity request and a request password associated with the password rule to the client.

Step S02: After receiving the identity request, the client returns an identity of the client and a response password corresponding to the request password.

Step S03, the authentication server determines, according to the password rule, whether the received response password is correct, if step S05 is performed correctly;

Step S04: determining whether the number of times the client responds to the incorrect password reaches a preset value, and if not, records the incorrect number of response passwords corresponding to the client, and returns to the step S01. Ignore the request of the client during the time period and exit;

Step S05, continuing the authentication process.

Preferably, the password rule is to provide a password table shared with the client. The password table stores at least one request password and a response password corresponding to the request password, and the authentication server sends the request password to determine whether the received response password is in the password table. The response password corresponding to the request password is consistent, such as the consistency judgment response password is correct, if the inconsistency is determined, the response password is incorrect; and/or

The method for ignoring the client request in the predetermined time period in the step S04 is to provide a silent list, the client is added to the silent list, and the authentication server ignores all terminals in the silent list. Request to delete the client in the silent list after the predetermined time period; and/or

The preset value is 3; and/or

The predetermined time period is 3 minutes.

Preferably, the authentication server is a RADIUS server.

The foregoing technical solution has the following advantages or advantages: the present invention can effectively prevent the "man-in-the-middle attack" by the two-way authentication of the client and the wireless access point, that is, the illegal user cannot access the network through the port of the legitimate user, thereby Avoid "communication hijacking" attacks.

DRAWINGS

Embodiments of the present invention are described more fully with reference to the accompanying drawings. However, the attached drawings are for illustration and illustration only and are not intended to limit the scope of the invention.

1 is a schematic flowchart 1 of a method for improving a wireless local area network authentication mechanism according to the present invention;

2 is a schematic flow chart of an improved method for a wireless local area network authentication mechanism according to the present invention; Figure II;

FIG. 3 is a third schematic flowchart of a method for improving a wireless local area network authentication mechanism according to the present invention.

detailed description

The method for improving the wireless local area network authentication mechanism of the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments.

An improved method for WLAN authentication mechanism is applied to a client to perform mutual authentication based on digital certificates between a wireless access point and an authentication server, wherein, as shown in FIG. 1, a wireless access point in a two-way authentication process After sending the authentication success message to the client in clear text, the following steps are also included:

Step S1: The client encrypts the first encryption algorithm to form a first packet and sends it to the wireless access point by using a preset encryption algorithm.

Step S2: After receiving the first packet, the radio access point decrypts the first packet according to the encryption algorithm to obtain a first encryption parameter, and encrypts the first encryption parameter and a second encryption parameter respectively. After the algorithm is encrypted, the combination forms a second message and sends the message to the client.

Step S3: The client decrypts the received second packet according to the encryption algorithm to obtain the first encryption parameter and the second encryption parameter in the second packet.

Step S4: The client determines whether the first encryption parameter is the same as the first encryption parameter obtained in the second packet, such as differently determining that the wireless access point is illegal, and exiting;

Step S5: The client encrypts the second encryption parameter obtained in the second packet by using an encryption algorithm. After being encrypted, a third message is formed and sent to the wireless access point;

Step S6: The wireless access point decrypts the received third packet according to the encryption algorithm to obtain the second parameter in the third packet.

Step S7: The wireless access point determines whether the second encryption parameter is the same as the second encryption parameter in the third packet, and if not, returns the authentication failure to the client, and exits;

Specifically, in the improved method of the wireless local area network authentication mechanism, the client first encrypts a first encryption parameter by using a predetermined encryption algorithm to form a first message, and the first report is used. The text is sent to the wireless access point. Then, the wireless access point performs decryption processing on the first packet according to the encryption algorithm to obtain the first encryption parameter. Then, a second encryption parameter is further provided, and the first encryption parameter and the second encryption parameter are respectively encrypted by the encryption algorithm, and the encryption result is combined to form a second message, and the second message is sent to the client. . After receiving the second packet, the client performs a decryption process to obtain a first encryption parameter and a second encryption parameter in the second packet. At this time, the client needs to determine whether the first encryption parameter obtained after decryption in the second packet is the same as the first encryption parameter that is initially provided. If not, it indicates that the wireless access point is illegal and exits the entire operation; , continue with the next steps. Briefly, the client provides a first encryption parameter, which is still not changed after client encryption, wireless access point decryption, wireless access point encryption, and client decryption processing. At this time, it is determined that the wireless access point is legal.

However, determining that the wireless access point is legal cannot guarantee the reliability of the authentication process, so the first access parameter is obtained by decrypting the first message at the wireless access point. When the second access parameter is encrypted, the client decrypts, the client re-encrypts, and the wireless access point is decrypted, the wireless access point still needs to be changed. Then it is determined that the entire authentication process is completed.

It is worth noting that when it is determined that the wireless access point is not legal, the decrypted second encryption parameter is no longer encrypted, that is, when the wireless access point is determined to be illegal, the subsequent authentication process is not performed. Directly determine that the authentication failed.

In addition, when performing verification by using the second encryption parameter, the first encryption parameter and the second encryption parameter are first encrypted by the wireless access point to be combined by the encryption algorithm to form a second message, and the second message is combined. The text is sent to the client. The client then parses the first encryption parameter and the second encryption parameter according to the second packet, and when determining that the first encryption parameter parsed from the second packet is the same as the previously provided first encryption parameter And encrypting the second encryption parameter by an encryption algorithm to form a third message and sending the message to the wireless access point. Then, the wireless access point decrypts the received third packet according to the encryption algorithm, and obtains the second encryption parameter in the third packet. Finally, the wireless access point determines whether the second encryption parameter in the third message is the same as the previously preset second encryption parameter. If the authentication fails, the authentication failure information is returned to the client and exited. If not, the wireless access point returns the authentication success information to the client.

In a preferred embodiment, the foregoing preset encryption algorithm may be implemented in the form of a pre-defined secret key by the client and the wireless access input.

In a further preferred embodiment, the first encryption parameter is randomly generated by the client.

In a further preferred embodiment, the second encryption parameter is a wireless access point Machine production.

In a further preferred embodiment, the encryption algorithm is pre-agreed by the client and the wireless access point.

In a further preferred embodiment, as shown in FIG. 2, in step S8, the following steps are specifically included:

Step S81: The wireless access point sends a security message and the authentication success message to form a fourth message to the client through the encryption algorithm.

Step S82: The client decrypts the received fourth packet according to the encryption algorithm to obtain a security key and a successful authentication packet.

Step S83: The client displays the authentication success message to the user, and communicates the security key with the wireless access point.

Specifically, when determining that the wireless access point is successfully authenticated, the wireless access point sends a security key and the authentication success message to form a fourth message to the client through the encryption algorithm, and the client is encrypted according to the encryption. The algorithm decrypts the fourth packet to obtain a security key and an authentication success packet. Finally, the authentication success message is displayed on the client, and the security key is communicated with the wireless access point.

In a further preferred embodiment, the security key is generated by a wireless access point through a hash algorithm.

In a further preferred embodiment, the above hash algorithm may be an MD5 algorithm.

In a further preferred embodiment, in the method provided in this embodiment, the method further includes the steps of:

After the authentication fails, the process returns to the step client to generate a first encryption parameter for the next round of authentication process.

Through the two-way authentication method of AP-STA, it is possible to prevent hijacking by illegal APs and possible man-in-the-middle attacks.

In addition, the above method is the client's authentication to the wireless access point, and in addition, in the two-way authentication process of the digital certificate, the client needs to be authenticated. Specifically, the authentication server provides a password rule. As shown in FIG. 3, before the wireless access point sends the authentication success message to the client in the two-way authentication process, the method further includes the following steps:

Step S01: The authentication server sends an identity request to the client and a request password associated with the password rule.

Step S02: After receiving the identity request, the client returns the identity of the client and the response password corresponding to the request password.

Step S03, the authentication server determines whether the received response password is correct according to the password rule, if step S05 is performed correctly;

In step S04, it is determined whether the number of times the client responds to the incorrect password reaches a preset value; if not, the error number of the response password corresponding to the client is recorded, and then returns to step S01, and if it is reached, the client is ignored in a predetermined time period. Request and quit;

Step S05, continuing the authentication process.

Specifically, in order to prevent a malicious client from joining a wireless access point, a password rule is pre-stored in both the reliable client and the authentication server. That is, the authentication server pre-shares a password rule in a secure manner, and the password rule includes a one-to-one corresponding password request and response password. Therefore, in the process of authenticating the client, the authentication server first sends an identity request to the client and a request password associated with the password rule. After receiving the identity request, the client sends the identity of the client and the response password of the corresponding request password. To the authentication server. The authentication server calculates a hash value of the password, and the hash value and the response password corresponding to the request password in the password rule are the same. If the identity is the same, the client authentication is continued. Briefly, in the authentication server, a password rule is pre-shared in a secure manner to authenticate the server to issue an identity request and a request password - return the identity of the client and the response password corresponding to the request password - the authentication server determines whether the response password is Correct this process, complete the certification of the client.

It is worth noting that if the password is incorrect, it is also necessary to determine whether the number of times the client answers the password incorrectly reaches a preset value. If the password is not reached, the number of the response password corresponding to the client is incorrect, and then returns to step S01; If it is reached, the client's request is ignored and exited within a predetermined time period.

By ignoring the request of the client that failed the authentication multiple times within the predetermined time period, the malicious client can be prevented from initiating the denial attack.

In a further preferred embodiment, the password rule proposed above provides: providing a password table shared with the client, the password table storing at least one request password and a response password corresponding to the request password. After the authentication server sends the request password, it is determined whether the received response password is consistent with the response password corresponding to the requested password in the password table. If the response password is consistent, the response password is correct; if not, the response password is incorrect.

In a further preferred embodiment, a silent table may also be provided to add the client to the silent list, and the authentication server ignores the request of all terminals in the silent list, and deletes the client in the silent list after a predetermined time period. Through the silent table, the effect of ignoring the client request within a predetermined time period is achieved.

In a further step, the preset value can be 3.

In a further step, the predetermined time period can be 3 minutes.

The invention can effectively prevent "man-in-the-middle attacks" by mutual authentication of the client and the wireless access point. At the same time, the first time identification of the user's identity is added, and the attackers are determined, thereby preventing their attack behavior. In short, the present invention provides an improved scheme for 802.1X authentication, so that the wireless device can operate more safely and stably, and does not cause normal users to access the network and the Internet experience due to attacks from other malicious and illegal wireless devices. Drop, even equipment crashes, reboots, etc.

Various changes and modifications will no doubt become apparent to those skilled in the <RTIgt; Accordingly, the appended claims are to cover all such modifications and modifications The scope and content of any and all equivalents are intended to be within the scope and spirit of the invention.

Claims

An improved method for a wireless local area network authentication mechanism, which is applied to a digital certificate-based mutual authentication between a wireless access point and an authentication server by a client, wherein the wireless access point is in the two-way authentication process After the authentication success message is sent to the client in plain text, the following steps are also included:

Step S1: The client encrypts a first encryption parameter by using a preset encryption algorithm to form a first packet and sends the first packet to the wireless access point.

Step S2: After receiving the first packet, the wireless access point decrypts the first packet according to the encryption algorithm to obtain the first encryption parameter, and the first encryption parameter and the first packet. The second encryption parameters are respectively encrypted by the encryption algorithm and combined to form a second message and sent to the client;

Step S3: The client decrypts and receives the second packet according to the encryption algorithm, to obtain a first encryption parameter and the second encryption parameter in the second packet.

Step S4: The client determines whether the first encryption parameter is the same as the first encryption parameter obtained in the second packet, and if not, the wireless access point is illegal, and exits;

Step S5: The client encrypts the second encryption parameter obtained in the second packet by using the encryption algorithm to form a third packet, and sends the third packet to the wireless access point.

Step S6: The wireless access point decrypts and receives the third packet according to the encryption algorithm to obtain a second parameter in the third packet.

Step S7: The wireless access point determines whether the second encryption parameter is the same as the second encryption parameter in the third packet, and if not, returns the recognition to the client. The certificate fails and exits;

Step S8: The wireless access point returns the authentication success to the client.
The method for improving a wireless local area network authentication mechanism according to claim 1, wherein the step S8 comprises the following steps:

Step S81: The wireless access point encrypts a security key and the authentication success packet by using the encryption algorithm to form a fourth packet, and sends the fourth packet to the client.

Step S82: The client decrypts and receives the fourth packet according to the encryption algorithm to obtain the security key and the authentication success packet.

Step S83: The client displays the authentication success message to the user, and communicates with the wireless access point with the security key.
The method for improving a wireless local area network authentication mechanism according to claim 1, wherein the first encryption parameter is randomly generated by the client.
The method for improving a wireless local area network authentication mechanism according to claim 1, wherein the second encryption parameter is randomly generated by the wireless access point.
The method for improving a wireless local area network authentication mechanism according to claim 1, wherein the encryption algorithm is previously agreed between the client and the wireless access point.
The method for improving a wireless local area network authentication mechanism according to claim 2, wherein the security key is generated by the hash algorithm for the wireless access point.
The improved method of the wireless local area network authentication mechanism according to claim 6, wherein the hash algorithm is an MD5 algorithm.
The method for improving the wireless local area network authentication mechanism according to claim 1, wherein the authentication server provides a password rule, and the wireless access point sends the authentication success to the client in the clear text. The message also includes:

Step S01: The authentication server sends an identity request and a request password associated with the password rule to the client.

Step S02: After receiving the identity request, the client returns an identity of the client and a response password corresponding to the request password.

Step S03, the authentication server determines, according to the password rule, whether the received response password is correct, if step S05 is performed correctly;

Step S04: determining whether the number of times the client responds to the incorrect password reaches a preset value, and if not, records the incorrect number of response passwords corresponding to the client, and returns to the step S01. Ignore the request of the client during the time period and exit;

Step S05, continuing the authentication process.
The method for improving a wireless local area network authentication mechanism according to claim 8, wherein the password rule is to provide a password table shared with the client, wherein the password table stores at least one request password, and The request password corresponds to a response password, and the authentication server sends the request password to determine whether the received response password is consistent with a response password corresponding to the request password in the password table, such as a consistent judgment response. The password is correct. If the password is inconsistent, the answer password is incorrect; and/or

In the step S04, the method for ignoring the client request in the predetermined time period is: providing a silent list, adding the client to the silent list, and the acknowledgment The server ignores the request of all terminals in the silent list, and deletes the client in the silent list after the predetermined time period; and/or

The preset value is 3; and/or

The predetermined time period is 3 minutes.
The method for improving a wireless local area network authentication mechanism according to claim 1, wherein the authentication server is a RADIUS server.