一种身份和位置分离网络的接入认证方法

发布时间：2018-03-02 21:34

本文选题：身份和位置分离网络　切入点：移动网络　出处：《西安电子科技大学》2014年硕士论文　论文类型：学位论文

【摘要】：移动网络的快速发展,暴露出越来越多传统网络体系的问题。固网中路由表项急剧膨胀导致的路由性能下降问题、网络不能很好地支持多宿主问题、终端发生网络切换时会话中断问题等,主要缘于传统网络中IP地址的语义重载,即IP地址既作为主机的身份标识,又作为主机在网络中的位置标识。IP地址语义重载使得网络不能有效追踪肇事者,给网络安全带来隐患。为解决上述问题,本文提出了一种新的身份和位置分离网络方案。该方案不仅实现了IP地址语义的解耦,同时由于引入了用户标识的ID模型,使得网络能够提供面向用户的服务。更重要的,借助统一的用户标识以及由此衍生出的支撑平台,网络运营商可以找回移动互联网时代的话语权。针对该身份和位置分离网络,本文提出了一种安全的用户设备接入认证和协商密钥的方法,并对此方法开展了深入的研究。目前,传统的接入认证方法已不再适用于身份和位置分离网络。身份和位置分离网络安全认证相关的研究主要采用智能卡、数字证书、可信计算等认证方法。由于上述认证手段对传统网络兼容性较差,部署难度较高,而且上述认证方式并没有实现对用户身份的认证,从而不适用于本文提出的身份和位置分离网络。因此,根据本文描述的网络体系,本文提出了一种新的用户设备初始接入认证方法本文的主要工作包括:1.运用新网络系统对使用者认证的思想,采用基于用户名、口令的认证方式,实现对用户身份的鉴别,进而实现了用户与设备的解耦。采用将口令信息与密钥协商消息结合传输的方法,保证了协议的安全性。2.鉴于新网络系统的安全需求,设计了分层级的密钥体系,为系统提供了完美的前向保密性和后向保密性,同时为后续的快速切换认证奠定了基础。3.设计实现两轮半完成的认证交互协议,实现用户设备与域路由器、用户设备与认证服务器之间的相互认证、密钥协商、密钥分发、关联、以及注册信息更新过程。该方法使用较少的空口消息交互,实现终端快速认证入网过程。4.分析了所述认证协议的安全性,并完成基础实验环境的搭建工作,并测试协议可行性和认证时延。通过将实验数据与背景技术进行对比,从事实角度证明所述协议具有较高的执行效率。
[Abstract]:The rapid development of mobile network, traditional network system exposes more and more problems. The decline of a rapid expansion in the routing performance of the routing table of fixed network, the network can not support multi host, terminal network handover session interruption, semantic overloading IP address in traditional network is the main reason, IP address as host's identity, and as the host location in the network.IP address identifies semantic overloading can make network can not effectively track the perpetrators, bring hidden dangers to the security of the network. To solve the above problems, this paper proposed a new identity and location separation network scheme. This scheme not only realizes decoupling IP address semantics at the same time, because the ID model introduced the identity of the user, so that the network can provide user oriented services. More important, with a unified user identity and derived from the branch Support platform, network operators can find the mobile Internet era discourse. Based on the identity and location separation network, this paper presents a method for secure access of user equipment authentication and key agreement, and this method has been studied in detail. At present, the traditional access authentication method is no longer applicable to identity and location the separation of identity and location separation network. Research on network security authentication mainly related to the use of smart cards, digital certificate, trusted computing authentication method. Due to the poor compatibility of the traditional network authentication method, deployment difficulty is higher, and the authentication and there is no way to authenticate the identity of users, which does not apply to this identity and the position of separation network. Therefore, based on the description of the network system, this paper puts forward to the main work of this paper is an initial access authentication method of user equipment Including: 1. the idea of user authentication system based on the new network, the user name, password authentication, to achieve the user identity authentication, and then realize the decoupling of users and equipment. The password information and key agreement with message transmission method, ensure the security requirements of.2. protocol security in view of the new network system the design of the key system level, for the system to provide backward secrecy and confidentiality to perfect, and laid the foundation for the design and implementation of.3. two semi complete cross certification protocol for subsequent implementation of fast handover authentication, user equipment and domain router, mutual authentication between the user equipment and authentication server key agreement, key distribution, correlation, and registration information update process. The method uses less interactive interface information, realize the fast authentication process of.4. network terminal of the The security of authentication protocol is completed, and the construction of basic experiment environment is completed, and the feasibility and authentication delay of the protocol are tested. By comparing the experimental data with the background technology, it proves that the protocol has high execution efficiency from the fact.

【学位授予单位】：西安电子科技大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TN915.6

【相似文献】