臺灣博碩士論文加值系統

隨著區域網路(LAN)由傳統有線連結方式進步到無線區域網路(WLAN)，通信網路(cellular network)也由傳統單純語音服務(1G, 2G)進步到提供多樣化的數據服務的功能(2.5G, 3G)，如何整合利用此兩大現成網路技術整合成單一網路已成為後3G世代(B3G)的重要話題。
在這篇論文中我們針對WLAN的inter-AP fast handover提出快速認證方案(fast authentication scheme)，它是以Subscriber Identity Module為基礎(SIM-based)整合認證程序(authentication procedure)、訊息完整性檢查(message integrity check)、資料隱密(data privacy)與先期認證(pre-authentication)等四項技術，來免去行動台(Mobile Node, MN) 在換手時與network的再認證動作，如此一來除了可以節省inter-AP handover所花費的時間外，同時也可以讓WLAN與cellular network採用同樣的認證機制，為將來WLAN/cellular network 系統間漫遊的 fast handover鋪路。除了達成fast handover scheme目的外，我們也利用上述四項技術提出一套更完整的安全機制，改進目前WLAN安全性不足的全套措施，讓WLAN能提供足夠的安全性與使用便利性，以達成本篇論文最後的目的建構公眾無線網路(public WLAN)來與cellular network整合一起以提供新的B3G的服務

With the progress of technique, wireless LAN (WLAN) provides wireless access beyond original wired connection. Simultaneously, cellular telecommunication network has extended much more data relative services (2.5G, 3G) from traditional voice service (1G, 2G). It becomes an urgent topic that how to integrate WLAN and current cellular network into a B3G (Beyond 3G) network.
In this thesis, we propose a WLAN inter-AP fast handover scheme. It relies on SIM-based and integrates authentication procedure, message integrity check, data privacy and pre-authentication four techniques together to eliminate re-authentication requirement during handover. With this scheme we can not only shorten the inter-AP handover delay but also provide an identical authentication mechanism for both WLAN and cellular network. The identical authentication mechanism makes the possibility of further inter system fast handover. Beyond the fast handover benefit, these four techniques integrated together eventually provide a watertightly secure WLAN environment. Only the security and convenience of public WLAN environment can make the goal that fast deploys public WLAN/cellular integrated networks for next B3G service.

摘要 i
ABSTRACT ii
致謝 iii
目錄 iv
圖目錄 vi
一、序論 1
1.1　研究動機 1
1.2　方法介紹 1
1.3　章節介紹 4
二、相關協定規格與研究 5
2.1　802.11 SERIES WIRELESS LAN RELATIVE SPECIFICATIONS 6
2.2　802.1X PORT-BASED NETWORK ACCESS CONTROL 7
2.3　WEP (WIRE EQUIVALENT PRIVACY) 9
2.3.1　WEP的frame格式與加密方式 9
2.3.2　WEP的認證程序 11
2.3.3　WEP的缺陷與常見的攻擊方法 12
2.3.4　TKIP的改進 14
2.4　CHAP (CHALLENGE HANDSHAKING AUTHENTICATION PROTOCOL)與EAP (EXTENSIBLE AUTHENTICATION PROTOCOL) 15
2.5　RADIUS與DIAMETER 17
2.5.1　RADIUS (Remote Authentication Dial-In User Service) 17
2.5.2　Diameter 18
2.6　SIM (SUBSCRIBER IDENTITY MODULE) 19
2.7　SS7 21
2.8　HMAC 22
2.9　WPA 23
三、SIM-based Authentication系統架構與Fast handover機制 25
3.1　SIM-BASED AUTHENTICATION架構概論 26
3.2　SIM-BASED的認證程序 29
3.2.1　MN與network的雙向認證 29
3.2.2　MN的再認證程序 32
3.3　INTER-AP FAST HANDOVER快速換手的精神與方法 33
3.3.1　支援fast handover的MN端的設計 35
3.3.2　AP發起再認證的時機 37
3.3.3　黑名單與灰名單 (black list and gray list) 38
3.4　KEY PRE-DISTRIBUTION的方法與策略 39
3.4.1　MN主動刺激法Key pre-distribution 40
3.4.2　AAA server主動式Key pre-distribution 41
3.4.3　金鑰先期投遞(Key Distribution)的方法 42
3.5　其他快速HANDOVER方法的比較 42
四、結論與未來工作 45
4.1　結論 45
4.2　未來工作 46

[1] Arunesh Mishra, Minho Shin, and William Arbaugh, An Empirical Analysis of the IEEE 802.11 MAC Layer Handoff Process (http://www.cs.umd.edu/~waa/pubs/handoff-lat-acm.pdf)
[2] Chris Grier, Mike Perry, and Andy Washington, Wireless Security (http://fscked.org/proj/minihax/WirelessSec/)
[3] Jesse Walker, 802.11 Key Management series: Part I, Key Management for WEP and TKIP (http://cedar.intel.com/media/pdf/wireless/80211_1.pdf)
[4] Jesse Walker, 802.11 Security Series: Part II, The temporal Key Integrity Protocol (TKIP) (http://cedar.intel.com/media/pdf/security/80211_part2.pdf)
[5] Jesse Walker, Overview of 802.11 Security, March 2001 (http://grouper.ieee.org/groups/802/15/pub/2001/Mar01/01154r0P802-15_TG3-Overview-of-802-11-Security.ppt)
[6] Kaj J. Grahn, Goran Pulkkis, and Jean-Sebastien Guillard, Security of Mobile and Wireless Networks, June 2002.
[7] Nikita Borisov, Ian Goldberg, and David Wagner, Intercepting Mobile Communications: The Insecurity of 802.11, July 2001. (http://www.isaac.cs.berkeley.edu/isaac/wep-faq.html)
[8] Sangheon Pack and Yanghee Choi, Pre-Authenticated Fast Handoff in a Public Wireless LAN Based on IEEE 802.1x Model, 2002
[9] W. A. Arbaugh, N. Shankar, and Y. J. Wan., Your 802.11 wireless network has no clothes. (http://www.cs.umd.edu/~waa/wireless.pdf)
[10] Yi-Bing Lin, and Imrich Chlamtac, Wireless and Mobile Network Architecture, pp. 164-165, 2001.
[11] ETSI ETS 300 929 (GSM 03.20 version 5.1.1) Security related network functions.
[12] IEEE Std 802.11 Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specifications, 1999.
[13] IEEE Std 802.1X Port-Based Network Access Control, 2001.
[14] IEEE Std 802.11i/D3.0, Wireless LAN Medium Access (MAC) and physical layer (PHY) specifications: Specification for Enhanced Security, November 2002.
[15] IETF RFC 1994 PPP Challenge Handshake Authentication Protocol (CHAP), August 1996
[16] IETF RFC 2104 HMAC: Keyed-Hashing for Message Authentication, February 1997.
[17] IETF RFC 2284 PPP Extensible Authentication Protocol (EAP), March 1998.
[18] IETF RFC 2865 Remote Authentication Dial In User Service (RADIUS), June 2000.
[19] IETF internet draft Diameter Base Protocol, December 2002. (http://www.ietf.org/internet-drafts/draft-ietf-aaa-diameter-17.txt )
[20] IETF internet draft EAP SIM authentication, February 2003.
(http://www.ietf.org/internet-drafts/ draft-haverinen-pppext-eap-sim-10.txt )
[21] http://www.gsmworld.com/news/statistics/substats.shtml
[22] http://www.cs.umd.edu/~waa/wireless.html
[23] http://www.cisco.com/warp/public/707/32.pdf
[24] http://citeseer.nj.nec.com/fluhrer01weaknesses.html
[25] http://www.cs.berkeley.edu/~daw/my-posts/my-rc4-weak-keys