無線網路安全認證系統之研究與實作

The Study and Implementation of a Wireless Network Security Authentication System

簡傳益(Chuan-Yi Chien)

指導教授 ： 劉如生

元智大學/資訊學院/資訊工程學系/碩士(2011年)

摘要

近年來隨著行動裝置普及與網路速度不斷提升，Wi-Fi無線網路也發展到目前的802.11n，提供了更高的傳輸速度，更寬廣的傳輸範圍與更穩定的傳輸品質。 相較於傳統有線網路，無線網路具高移動性、使用方便，建置簡單迅速，硬體安裝及配置較有彈性，容易擴充網路規模等優點，所以許多企業因應時勢所需，開始架設無線網路供員工及訪客公務使用。 然而目前員工及訪客混合共用公司網路的管理方式是有其風險及安全上的疑慮。

為了改善員工及訪客混合共用公司網路的安全性考量及管理的方式，本論文將實作出一套無線區域網路的認證、授權和安全管理系統，以RADIUS當作認證伺服器，並採用具有Network Access Server(NAS)功能的Access Point當作Authenticator。 我們使用無線網路安全機制，結合虛擬區域網路(VLAN)的特性，於員工與訪客連上無線網路的同時，就將其導向分屬於不同的VLAN群組，使員工與訪客互相看不到對方網路，且可因應使用者無線網路的要求，依身份劃分不同認證、加密、授權策略，提供帳號、密碼、有效時數，設定不同之認證方式。 我們利用C、PHP、Perl、MySQL開發本系統，來完成本論文的認證、授權和安全管理目的。

關鍵字

無線區域網路 ； 身份認證 ； 虛擬區域網路

並列摘要

In recent years, due to the popularity of mobile devices and the continuously increasing speeds of network, Wi-Fi wireless network has been developed to the current 802.11n, which provides a higher transmission speed, a wider transmission range, and more stable transmission quality. Comparing to the traditional wired network, wireless network has the advantages of high mobility, easy to use and expand, simple and quick to build, more flexible of hardware installation and configuration. Therefore, many companies began to set up wireless network for public use for staff and visitors. However, the current mixed network management shared by staff and visitors has high risks and security problems.

In order to improve the above problems, this thesis will implement a wireless local area network system for authentication, authorization and security management. We use the RADIUS as the authentication server, and adopt a Network Access Server (NAS) as a function of the Access Point Authenticator. Through combining the wireless network security with the characteristics of the virtual LAN (VLAN), staff and visitors will be oriented to different VLAN groups, such that employees and visitors could not see each other online. In response to the requirements of users, we will set different authentication methods according to the different identity-based authentication, encryption, authorization policy, account number, password, and valid time. We will use C, PHP, Perl, MySQL to develop our system.

並列關鍵字

wireless LAN ； authentication ； virtual LAN

參考文獻

[3] Carlton R. Davis, “IPSec: Securing VPNs book,” The McGraw-Hill Companies, 2002.

[1] Matthew S. Gast, “O’Reilly 802.11 Wireless Networks: The Definitive Guide book, “ April 2002.

[4] William Stallings, “Cryptography and Network Security : Principles and Practice 5/e, “ Prentice Hall, 2010.

[13] Juniper, http://www.juniper.net/

[2] Bob O’Hara Al Petrick, “The IEEE 802.11 Handbook,” A Designer’s Companion,1999.