802.11i

摘要： 目前,3G和WLAN两种无线通信技术是最具代表性的技术,同时二者各自的优缺点使3G与WLAN融合网络成为备受业界和学术界关注的焦点.3G WLAN网络融合可以充分利用两者的优点,优势互补,用户既可以享受3G网络中完善的漫游、鉴权以及计费机制,也可以享受WLAN的高速数据传输速率,这样用户不仅享受优质的网络服务,也使得网络资源利用最大化.但3G与WLAN融合网络需要同时应对来自两方的安全威胁.由于3G和WLAN网络安全威胁存在差异,因此对于各自的安全解决方案也存在很大差异,如何解决融合网络的安全威胁是亟待解决的问题.文章对802.11i和WAPI接入认证安全性和密钥协商灵活性进行了分析和研究,并总结出其各自的优缺点;针对3G WLAN融合网络中EAP AKA协议,分析了其存在的漏洞与不足,然后综合802.11i和WAPI安全协议的优势,文章提出了一种新的3G WLAN安全接入方案EAP WPI.新协议采用802.11i的EAP认证框架封装认证和WAPI的ECDH密钥协商算法,实现用户终端与后台认证服务器的认证交互以及高安全性的密钥协商,并在认证过程中采用无证书的公钥密码技术免除了部署PKI的负担,并对其进行安全性分析以及仿真测试,其结果表明文章提出的协议具有较高的安全性及执行效率.

摘要： 相比有线网络,无线局域网具有网络建设快捷、建网成本低、用户使用灵活等优点;但其网络使用环境特有的开放性,使其更容易受到非法网络攻击.本文分析了无线局域网安全性技术的发展,并对这些技术的优劣进行了分析比较,最后结合几种具有代表性的网络安全组网技术,给出了设计安全无线局域网的组网建议.

摘要： 校园WLAN网络在校园的全面覆盖为广大师生的学习生活提供了很大的便利,但同时也带来了很多的安全问题.因此对校园WLAN网络的安全问题进行研究就有了重要的意义.文章将会回校园WLAN网络的各种安全问题进行分析,并在此基础上提出完善其安全机制、提升设备性能、对数据进行加密等方式进行解决,本文对校园WLAN网络安全管理工作有着一定的借鉴意义.

摘要： 分析了无线局域网安全标准IEEE 802.11i中的四次握手协议,针对消息1未受保护而易遭受伪造消息DoS攻击的问题,提出一种基于SHA-256的消息1认证改进方案.该方案利用PMK对消息1进行认证,并引入高安全性的SHA-256算法对PMK进行散列,而后用其散列值来进行消息认证,从而能够在消息1阶段辨别并剔除伪造的消息,确保消息3验证成功,提高握手成功率.实验结果表明,在同等攻击强度下,改进方案使得AP的网络负载率降低,网络接入的STA数量增加,提高了网络性能.

摘要： To solve IEEE 802.11i security threats of DoS attacks,no user identity protection and loss of MSK resulting in information leakage because of no provision of security protection for management frames and control frames,a physical layer security solution of iJam was introduced.The physical layer key of Ki between STA and AP before 802.11i authentication was generated to prevent management frames and control frames from DoS attack,and to protect user identity and enhance the PTK security.The scheme of WLAN security enhancement was proposed to analyze the 802.11i security,the increased delay and energy and the compatibility after iJam introduction.The results show that the security threats of 802.11i are overcome with enhanced security by the proposed scheme proposal,while the introduced delay and energy consumption is very limited.The introduction of iJam has little effect on the framework of 802.11i.%针对目前IEEE 802.11i存在的不能为管理帧和控制帧提供安全保护导致DoS攻击、不能为用户提供身份隐私保护、会话主密钥MSK的丢失引起信息泄露等安全威胁,引入物理层安全方案iJam,于802.11i认证之前在移动站STA和接入点AP之间生成物理层密钥Ki.使用生成的Ki保护802.11i的管理帧和控制帧,防止DoS攻击；并在后续认证过程中对消息加密,保护用户的身份信息；参与PTK的生成,增强PTK的安全性.给出了WLAN安全性增强的方案,并对引入iJam后802.11i的安全性、增加的时延、能耗及兼容性进行了分析,结果表明,所提出的方案克服了目前802.11i存在的安全威胁,对其安全性进行了增强；但所引入时延和能耗都非常有限；同时引入Jam并不会对802.11i的框架造成影响.

摘要： 无线网络技术以其部署灵活方便、便携性、较高带宽的优势,在企事业机关单位得到广泛使用.但是,由于无线网络因其在标准协议和体系架构方面存在不足导致其容易受网络攻击,从而形成无线数据在传输过程中容易被他人截获的风险,导致数据的保密性受到破坏.本文先介绍园区无线网在运营过程中可能遇到的风险,接着列举了针对这些风险所采取的应对措施,并提出有线无线安全一体化是WLAN安全未来发展的必然趋势.

摘要： 介绍了无线局域网发展历史、应用、基本安全机制(MAC过滤和SSID匹配、WEP、端口访问控制技术和可扩展认证协议、WPA、802.11i、WAPI).通过分析基本安全机制可以看出现在的无线局域网安全技术还存在较多的安全隐患.

摘要： 介绍了无线局域网中两种加密标准802．11i和WAPI，对其中的数据加密和数据完整性算法进行了详细的分析。802．11i采用AES加密算法实现数据加密和数据完整性校验，WAPI采用SMS4加密算法实现数据加密和数据完整性校验。结合二者的共同点，对AES和SMS4外围电路进行了复用，同时，在实现数据加密和数据完整性校验时，分别对AES和SMS4进行了分时串行复用。本设计采用了一个AES加密核，一个SMS4加密核，实现了802．11i和WAPI的数据加密和完整性校验，减小了电路规模，同时也降低了吞吐率，但该吞吐率完全满足低成本的I腿E802．1labg应用场景。

摘要： 通过对IEEE802.11i四次握手过程的研究，发现其存在缺陷并可能受到的拒绝服务攻击。针对这一安全漏洞，研究TPTK、重用Nonce、消息1身份认证三种改进方法，并对这三种改进方法的安全性进行分析。这三种改进方法在避免拒绝服务攻击的同时，都给无线局域网带来新的安全威胁。提出进一步研究的思路与方向。%Based on the research on the IEEE 802.11i 4-way handshake, it is found that there exists de- fects which will lead to denial of service attacks. Aiming at this security vulnerability, studies three improved methods, TPTK, re-Nonce and authentication to the initial message, and ana- lyzes the security of these three methods. It is found that these improved methods will bring new security threats to WLAN. And puts forward the direction of further research.

摘要： 通过对IEEE 802.11i四次握手过程的研究,发现其存在缺陷并可能受到的拒绝服务攻击。针对这一安全漏洞,研究TPTK、重用Nonce、消息1身份认证三种改进方法,并对这三种改进方法的安全性进行分析。这三种改进方法在避免拒绝服务攻击的同时,都给无线局域网带来新的安全威胁。提出进一步研究的思路与方向。

摘要： Wireless communication can provide ubiquitous access to the Internet and more convenience thanwired communication. Due to the wide open nature of wireless radio, security situation of wireless network ismore serious. From the initial 802.11 to 802.11i, more robust security methods have been adopted to eliminateunderlying attacks. 802.11i is based on the assumption that all participants are honest that they will act as theyare expected. But usually it is not true. How to recognize a genuine user, how to keep authentication data safely,and how to prevent dishonest supplicant accessing WLAN are big challenges. Trusted Computing can be used toimprove security status of endpoint. Applying Trusted Computing technology can solve these challenges andenhance WLAN security.

摘要： Wireless communication can provide ubiquitous access to the Internet and more convenience thanwired communication. Due to the wide open nature of wireless radio, security situation of wireless network ismore serious. From the initial 802.11 to 802.11i, more robust security methods have been adopted to eliminateunderlying attacks. 802.11i is based on the assumption that all participants are honest that they will act as theyare expected. But usually it is not true. How to recognize a genuine user, how to keep authentication data safely,and how to prevent dishonest supplicant accessing WLAN are big challenges. Trusted Computing can be used toimprove security status of endpoint. Applying Trusted Computing technology can solve these challenges andenhance WLAN security.

摘要： Wireless communication can provide ubiquitous access to the Internet and more convenience thanwired communication. Due to the wide open nature of wireless radio, security situation of wireless network ismore serious. From the initial 802.11 to 802.11i, more robust security methods have been adopted to eliminateunderlying attacks. 802.11i is based on the assumption that all participants are honest that they will act as theyare expected. But usually it is not true. How to recognize a genuine user, how to keep authentication data safely,and how to prevent dishonest supplicant accessing WLAN are big challenges. Trusted Computing can be used toimprove security status of endpoint. Applying Trusted Computing technology can solve these challenges andenhance WLAN security.

摘要： Wireless communication can provide ubiquitous access to the Internet and more convenience thanwired communication. Due to the wide open nature of wireless radio, security situation of wireless network ismore serious. From the initial 802.11 to 802.11i, more robust security methods have been adopted to eliminateunderlying attacks. 802.11i is based on the assumption that all participants are honest that they will act as theyare expected. But usually it is not true. How to recognize a genuine user, how to keep authentication data safely,and how to prevent dishonest supplicant accessing WLAN are big challenges. Trusted Computing can be used toimprove security status of endpoint. Applying Trusted Computing technology can solve these challenges andenhance WLAN security.

摘要： Wireless communication can provide ubiquitous access to the Internet and more convenience thanwired communication. Due to the wide open nature of wireless radio, security situation of wireless network ismore serious. From the initial 802.11 to 802.11i, more robust security methods have been adopted to eliminateunderlying attacks. 802.11i is based on the assumption that all participants are honest that they will act as theyare expected. But usually it is not true. How to recognize a genuine user, how to keep authentication data safely,and how to prevent dishonest supplicant accessing WLAN are big challenges. Trusted Computing can be used toimprove security status of endpoint. Applying Trusted Computing technology can solve these challenges andenhance WLAN security.

摘要： 用户的多跳Internet接入认证和数据的多跳安全传输是混合式MANET这种新型网络实际应用需解决的首要问题.目前WLAN中的接入认证只能实现单跳认证,而在Ad Hoc的认证机制中节点不能接入Internet.本文提出了一种基于树结构模型的Internet 接入认证系统,该系统使用树结构提供的虚拟基础设施作为认证过程中的虚拟认证者,为移动用户提供了802.11i中的认证功能,并针对新的结构调整认证过程和密钥管理,以达到更高的效率和安全性。试验结果表明该方案在节点能覆盖整个网络时具有认证成功率高、认证延迟和开销低等优点.

摘要： 用户的多跳Internet接入认证和数据的多跳安全传输是混合式MANET这种新型网络实际应用需解决的首要问题.目前WLAN中的接入认证只能实现单跳认证,而在Ad Hoc的认证机制中节点不能接入Internet.本文提出了一种基于树结构模型的Internet 接入认证系统,该系统使用树结构提供的虚拟基础设施作为认证过程中的虚拟认证者,为移动用户提供了802.11i中的认证功能,并针对新的结构调整认证过程和密钥管理,以达到更高的效率和安全性。试验结果表明该方案在节点能覆盖整个网络时具有认证成功率高、认证延迟和开销低等优点.

摘要： 用户的多跳Internet接入认证和数据的多跳安全传输是混合式MANET这种新型网络实际应用需解决的首要问题.目前WLAN中的接入认证只能实现单跳认证,而在Ad Hoc的认证机制中节点不能接入Internet.本文提出了一种基于树结构模型的Internet 接入认证系统,该系统使用树结构提供的虚拟基础设施作为认证过程中的虚拟认证者,为移动用户提供了802.11i中的认证功能,并针对新的结构调整认证过程和密钥管理,以达到更高的效率和安全性。试验结果表明该方案在节点能覆盖整个网络时具有认证成功率高、认证延迟和开销低等优点.

摘要： 用户的多跳Internet接入认证和数据的多跳安全传输是混合式MANET这种新型网络实际应用需解决的首要问题.目前WLAN中的接入认证只能实现单跳认证,而在Ad Hoc的认证机制中节点不能接入Internet.本文提出了一种基于树结构模型的Internet 接入认证系统,该系统使用树结构提供的虚拟基础设施作为认证过程中的虚拟认证者,为移动用户提供了802.11i中的认证功能,并针对新的结构调整认证过程和密钥管理,以达到更高的效率和安全性。试验结果表明该方案在节点能覆盖整个网络时具有认证成功率高、认证延迟和开销低等优点.

摘要： 目前，802．11b协议广泛应用于人们的工作、生活和学习当中，网络上也有许多的开放源代码可供开发使用。本文利用主流的802．11b网卡和开放的源代码软件，实现802．11i功能，实现一个测试网络。