以多重Kerberos建構無線區域網路之全域認證

Cross-Realm Authentication Based on Multiple Kerberi in WLAN (IEEE 802.1X)

賴昱宏(Yu-Hung Lai)

指導教授 ： 涂世雄

中原大學/工學院/電機工程研究所/碩士(2003年)

https://doi.org/10.6840/cycu200300121

摘要

摘要
在本論文中，我們主要針對無線區域網路(WLAN)安全各提出兩個單一領域與跨領域之新的認證機制，此新的認證機制是以多重Kerberos認證協定和公開金鑰密碼系統為基礎。我們所提出的跨領域認證機制具有使用者只須在一個領域註冊便可以全球漫遊之優點。就安全性方面來說，也比現有的無線網路安全機制來的更加安全。
在第一與第三個新的認證機制之中，減少使用者對AP的認證動作將可以加快認證時間卻不失其安全性。首先，AS接收到來自漫遊使用者的身分資料並決定是否需要轉送到使用者的home AS。然後，使用者利用門票核准門票向TGS兌換所需的服務核准門票。最後，使用者便可利用這張特定的服務核准門票去存取他所需要的網路服務。
而第二與第四個新的認證機制的主要目的是為了加強在無線區域網路中認證的安全性。首先，經過了一連串的認證動作之後，漫遊使用者可以從visit AS得到visit端的門票核准門票。然後，使用者利用visit端的門票核准門票去兌換AP與應用伺服器的服務核准門票。最後，應用伺服器利用session key來加密訊息以達成雙向認證。
在本論文中，我們主要的研究貢獻如下: (1)我們提出了四個新的無線區域網路安全機制。(2)結合了傳統Kerberos認證協定與公開金鑰密碼系統之認證機制可以有效的阻絕重送與中間人攻擊。(3)藉由跨領域認證的優點，漫遊使用者可以利用原有的註冊資訊來證明本身是合法的使用者，以存取全球任一地方的網路服務。
我們相信本論文的研究成果，對未來無線區域網路安全機制的研究領域上有相當的助益。

關鍵字

公開金鑰密碼系統 ； 無線區域網路 ； 全域認證

並列摘要

Abstract
In this thesis, we propose four new authentication protocols for Single-Realm and Cross-Realm Authentications based on multiple Kerberi authentication technique. Single-Realm authentication is used when user is in the home area. Cross-Realm authentication with multiple Kerberi protocols achieves the goal that users roam anytime around worldwide. The roaming user can be authenticated in the visit area by his home authentication server (AS). Additionally, because of insecure feature of symmetric cryptosystems, we adopt public key cryptosystems to realize the proposed protocols.
In the first and third proposed protocols, the actions for user authenticates with access point (AP) is reduced to speed up the authentication time. At first, AS receives the identity from the user and forwards the message to the home AS when the user is roaming subscriber. Then, the user sends ticket-granting ticket (TGT) to Ticket-Granting Server (TGS) to obtain for service-granting ticket. Finally, depending on service-granting ticket, user will access the network service he wants.
The main purpose of the second and fourth proposed protocols is to enhance the security of authentication in WLAN. At first, a roaming user obtains the visit TGT form visit AS after a series of authentication steps. Then, the user exchanges service-granting ticket via visit TGT for AP and desirable server, and takes service-granting ticket of AP to authenticate AP. Finally, mutual authentication is achieved by way of the response which is encrypted with session key between the user and desirable server.
The contributions of our research are as follows: (1) Four new protocols authentication applied to wireless local area network are given. (2) We combine traditional Kerberos protocol and public key cryptosystems to prevent effectively the replay attack and man-in-middle attack. (3) We can use our original registered information to access the network service worldwide by proposed Cross-Realm Authentication.
It is believed that the results of our research in this thesis will be probably practical and efficient on the security of the wireless local area network.

並列關鍵字

Cross-Realm Authentication ； Multiple Kerberi ； Public Key Cryptosystem ； Wireless LANs ； Kerberos

參考文獻

[1] Crow, B.P.; Widjaja, I.; Kim, L.G.; Sakai, P.T.; IEEE Communications Magazine, Volume: 35 Issue: 9, Sep 1997 Page(s): 116 -126.

[2] Candolin, C.; Kari, H.H.; MILCOM 2002. Proceedings, Volume: 2, 2002 Page(s): 1095 -1100.

[6] Prasad, A.R.; Moelard, H.; Kruys, J.; Vehicular Technology Conference Proceedings, 2000. VTC 2000-Spring Tokyo. 2000 IEEE 51st, Volume: 1, 2000 Page(s): 283 -287 vol.1.

[7] Needham, R.M. and M.D. Schroeder, “Using encryption for authentication in large networks of computers”. Communications of the ACM, 1978. 21 (December 1978): p. 99-999.

[11] J. T. Kohl, B. C. Neuman. “The Kerberos network authentication service.” Internet RFC 1510, September 1993.