應用EAP-TLS 與 X.509 實現 WLAN (IEEE 802.1X) 之全域認證研究

An Application of EAP-TLS and X.509 to Globoid Authentication on WLAN(IEEE 802.1X)

徐敬堯(CHIN-YAO HSU)

指導教授 ： 涂世雄

中原大學/工學院/電機工程研究所/碩士(2003年)

https://doi.org/10.6840/cycu200300125

摘要

摘要

在本論文中，我們提出兩種新的WLAN全域認證協定。這兩種WLAN全域認證協定是針對現行認證延伸協定的缺點所提出的。在此我們採用X.509及EAP-TLS的優點設計出這兩種WLAN全域認證協定。如此一來不但解決了認證延伸協定跨領域認證的不足處，同時也實現了只需一張數位憑證，便可以漫遊所有無線網路的理念。
於第一個認證協定中，我們將認證伺服器視為一個旁路的機制，當認證伺服器判斷出用戶端的憑證不是自己所核發時，認證伺服器會嘗試連接用戶所註冊的伺服器，並讓用戶與用戶所註冊的伺服器執行雙向認證的機制。當認證成功後，用戶註冊得伺服器會傳一認證成功的訊息給認證伺服器，如此一來便完成了全域認證的機制。
大體而言，這兩個WLAN全域認證協定所使用的認證方法十分的相似，然而最大的不同點是第二個認證方法要比第一個認證方法來得簡單多了。於第二個認證協定中，認證伺服器會先去審查用戶的數位憑證。當澄清用戶憑證的來源後，認證伺服器會向用戶所註冊的伺服器申請用戶的公開金鑰以及認證伺服器的數位憑證。最後認證伺服器會用這把用戶公開金鑰及數位憑證與用戶座雙向認證，並且完成認證的機制。
本篇論文所提出的主要貢獻如下: (一) 結合X.509與EAP-TLS的優點，實現WLAN跨領域認證的機制。(二) 提供比X.509或EAP-TLS更安全的無線網路使用環境。（三）減輕用戶及認證伺服器的記憶體消耗。（四）避免數位憑證重新申請及製作所造成的時間浪費。
我們相信運用本論文所提出的兩個無線網路全域認證協定的方式，會讓無線網路更加的安全以及便利。

關鍵字

WLAN全域認證研究

並列摘要

Abstract

This article proposes two new types of WLAN (wireless local area network) globoid authentication protocols. These two types of WLAN globoid authentication protocols are designing in consideration for EAP (Extensible Authentication Protocol) globoid authentication shortcomings. These two types of WLAN globoid authentication protocols are applied on the behalf of X.509 and EAP-TLS advantages. These will solve EAP Cross- Realm imperfection such that getting Digital Certificate from one Certificate center, any user can be acknowledged by every WLAN authentication server.
The main idea of the TYPE 1 WLAN globoid authentication method are described as follows. First, RADIUS server ascertains and passes Client’s acknowledged data to the Client registered server. Then, the mutual authentication is done between Client and Client registered server. Finally, the Client registered server notifies RADIUS server a acknowledge message when authentication succeeded.
At integer, the procedures of these two types of WLAN globoid authentication methods are similar. However, TYPE 2 is simpler than TYPE 1. The main idea of the TYPE 2 is given in the following. First, RADIUS server receives and ascertains Client’s acknowledged data. Then, RADIUS server asks for its Certificate and Client’s public key from Client registered server. Finally, RADIUS server uses this Client’s public key and its Certificate to perform mutual authentication with Client and finish the authentication.
The contributions of this article show below. (1) Combine X.509 and EAP-TLS to achieve WLAN Cross-Realm authentication. (2) Make more secure environment than EAP or X.509 on WLAN. (3) Retrench Client and Server memories. (4) Reduce time waste when Certificate repeats applying and making.
Applying these two types of WLAN globoid authentication methods, we believe WLAN will be more secure and convenient.

並列關鍵字

Globoid Authentication on WLAN

參考文獻

[1] Yi-Bing Lin, Imrich Chlamtac, Wireless and Mobile Network Architectures, Wiley Computer Publishing, 2000

[2] Jim Geier, Wireless LANs, Second Edition, SAMS, 2002

[4] William Stallings, CRYPTOGRAPHY AND NETWORK SECURITY Principles and Practice- second edition, Prentice-Hall, 1999

[6] Andreas Kopsel, Adam Wolisz, Voice transmission in an IEEE 802.11 WLAN based on access network, Telecommunication Networks Group Technical University, 2002

[10] Tyson Macaulay, Hardening IEEE 802.11 wireless networks, EWA Canada, February 2002