WAPI安全技术研究与仿真实现

发布时间：2018-11-21 21:12

【摘要】：我国针对WLAN提出的的安全通信协议(WAPI)由WAI和WPI两部分构成。WAI提供STA与AP的相互身份认证与会话密钥协商,并且采纳了基于椭圆曲线的公钥证书方案;WPI提供对通信数据的机密性传输,并且采纳我国自主研究的分组加密算法SMS4。WAPI协议现存在两个版本,原标准首次介绍了WAPI的概念,新标准中WAI解决了原标准中的部分安全漏洞,包括未对STA的身份进行有效验证、密钥协商算法过于简单等。但是,新标准中仍然存在对用户身份信息的保密性不足、未能抵抗伪AP攻击和重放攻击等安全问题。本文的目的是针对新标准中的上述不足提出改进措施,提高WAI中身份认证和密钥协商的安全性。最后,完成了WAI身份认证和密钥协商的可视化软件。本文研究内容如下:(1)对现行两种版本的WAPI协议进行系统学习和总结;对新旧两个版本的WAI中身份认证和会话密钥协商进行了安全性分析。指出新标准中WAI在保护用户身份信息、抵抗伪AP攻击等方面存在的不足,将原标准和新标准中身份认证和会话密钥协商展开对比介绍。(2)在对新标准中WAI安全性分析的基础上,提出了三点改进措施:第一,针对协议中未对用户身份信息进行保护这一安全漏洞,本文采用使用ASU的公钥对用户数字证书进行加密的方式来解决用户证书隐秘性问题;第二,针对重放攻击对协议带来的威胁,本文采用在协议中加入时间戳来抵抗重放攻击;第三,针对伪AP攻击,本文采取AP对证书鉴别请求消息进行签名来抵抗此攻击,同时取消AP对STA签名验证,增强协议运行效率。(3)针对改进后的WAI方案,在MFC上进行软件实现,对STA、AP和ASU相应的数据处理进行软件可视化仿真分析。
[Abstract]:The secure communication protocol (WAPI) for WLAN is composed of WAI and WPI. WAI provides mutual authentication and session key negotiation between STA and AP, and adopts a public key certificate scheme based on elliptic curve. WPI provides confidential transmission of communication data, and adopts the block encryption algorithm SMS4.WAPI protocol, which is researched by our country, in two versions. The original standard introduces the concept of WAPI for the first time. In the new standard, WAI solves some of the security vulnerabilities in the original standard, including the failure to verify the identity of STA effectively, the simple key agreement algorithm and so on. However, there are still some security problems in the new standard, such as insufficient confidentiality of user identity information and failure to resist pseudo-AP attacks and replay attacks. The purpose of this paper is to improve the security of identity authentication and key agreement in WAI. Finally, the visualization software of WAI identity authentication and key agreement is completed. The main contents of this paper are as follows: (1) the current two versions of WAPI protocol are systematically studied and summarized, and the security of identity authentication and session key agreement in the old and new versions of WAI is analyzed. The shortcomings of WAI in protecting user identity information and resisting pseudo-AP attacks in the new standard are pointed out. The identity authentication and session key agreement in the original standard and the new standard are compared and introduced. (2) based on the analysis of the WAI security in the new standard, three improvement measures are proposed: first, Aiming at the security loophole that the user identity information is not protected in the protocol, this paper uses the public key of ASU to encrypt the user digital certificate to solve the privacy problem of user certificate. Secondly, aiming at the threat of replay attack to the protocol, this paper uses timestamp to resist the replay attack. Thirdly, for the pseudo-AP attack, this paper uses AP to sign the certificate authentication request message to resist this attack, and cancels the AP to verify the STA signature to enhance the efficiency of the protocol. (3) aiming at the improved WAI scheme, The software is implemented on MFC, and the corresponding data processing of STA,AP and ASU is simulated and analyzed.
【学位授予单位】：电子科技大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TN925.93

【相似文献】