臺灣博碩士論文加值系統

隨著網際網路的盛行，網路設備傳輸速度越來越快，並且在政府大力推展下，公眾無線區域網路熱點（Hot Spot）的數量明顯增多，例如車站、飯店、機場、咖啡連鎖店等已經都有這項服務，也是推動無線網路普及的一大主因。使用者只要利用Notebook或PDA，就可以上網去獲得網路資源。至2004年底為止，全台灣公私立大學院校共 158所，已有 30 所大學參加國家高速網路與計算機中心之校園無線網路漫遊機制，未來 1 到 2 年預計全國 94%的大學將完成校園無線網路建置。隨著跨校漫遊需求的激增，對於漫遊使用者身份驗證就顯的更重要了，由於IEEE 802.11的安全性不足包含缺乏使用者身分認證機制及缺乏動態資料加密金鑰配送機制，IEEE802.11標準採用SSID及WEP作為認證安全機制，但這些機制已經被證明是不安全的，如何確保合法的使用者及網路安全就成為一個相當重要的議題。本論文將針對校園無線網路漫遊機制所採用的認證機制、安全機制進行探討，並提出以WAPI認證機制及自然人憑證，設計新的校園無線漫遊的應用架構，用WAPI來完成雙向身份認證機制，同時也實現了只要一張數位憑證及所屬學校之網域名稱等公開資訊，便可以漫遊於校園無線網路的理想。

With the fashion of internet and the popularization from our government, the amount of WLAN Hot Spot which located on railway station, hotel, airport or cafe is increasing obviously. User can get on net simply using a notebook or a PDA to obtain any resource from the internet. Up to the end of 2004, 30 of 158 academies joined the roaming scenario across campus of national high speed network project and 94% of those academies will construct their own WLAN environment in the near future.However, the security insufficiency of IEEE 802.11 which includes user identity authentication and data encryption caused a loophole of risk. SSID and WEP were used for authentication but have been proved to be not safe already. Hence, it would be an important topic to ensure a legitimate user and a safe internet environment.In this paper, we will discuss the authentication method and security of campus WLAN roaming environment and propose a WAPI with Citizen Digital Certificate to design a new way for campus WLAN roaming application. Simply using a digital certification and related public information, roaming between different campus was finally realized.

中文摘要 i
Abstract ii
圖目錄 v
表目錄 vi
第一章 導論 1
1.1 研究背景 1
1.2 研究動機與目的 2
1.3 論文架構 4
第二章 相關研究 5
2.1 IEEE802.11 5
2.1.1 IEEE802.11網路架構 5
2.1.2 IEEE802.11安全機制 7
2.2 IEEE802.1x 12
2.2.1 IEEE802.1x架構 13
2.2.2 EAP 13
2.2.3 EAP-TLS 15
2.3 RADIUS PROTOCOL 18
2.4數位憑證 18
2.4.1 X.509憑證架構 19
2.4.2 X.509憑證的種類 21
2.4.3 憑證的申請(Certificate Applying) 22
2.4.4 憑證的撤銷(Certificate revocation) 22
2.5自然人憑證 23
2.5.1自然人憑證簡介 23
2.5.2自然人憑證目標 23
2.6 WAPI 24
2.6.1 WAPI簡介 24
2.6.2 WAPI的運作原理 25
第三章 無線網路安全機制分析 28
3.1 IEEE802.11安全機制分析 28
3.1.1開放認證系統分析 28
3.1.2 MAC認證分析 28
3.1.3 WEP分析 29
3.2 無線網路攻擊分析 30
3.2.1網路監聽 30
3.2.2偽造AP 30
3.2.3中間人攻擊（Man-in-the-Middle） 31
3.2.4連線劫持（Session Hijacking） 31
3.2.5阻絕服務式攻擊（Denial-of- Service） 32
3.3 現行校園無線網路漫遊機制 32
3.3.1校園無線漫遊認證機制 33
3.3.2校園無線認證機制之分析 35
第四章 建議的漫遊認證機制系統設計 37
4.1 系統設計目標與規劃 37
4.2 漫遊認證機制架構設計 39
4.3 系統分析 44
4.3.1 系統評估分析 44
4.3.2 系統比較分析 47
第五章 結論與未來發展 49
參考文獻 50
誌謝 53
作者簡介 54

[1] B. Mansfiedld, “WLAN & 802.11 SECURITY,” Internet Developers Group, June 18, 2002.
[2] M. S. Gast, 802.11 Wireless Networks, O’REILLY, April 2002.
[3] R. J. Boncella, “Wireless Security: An OVERVIEW,” Eighth Americas Conference on Information Systems, 2002.
[4] IEEE, “Wireless LAN Medium Access Control (MAC) and Physical Layer (PHY) Specification：Specification for Enhanced Security,” IEEE Standard 802.11i/D2.0, March 2002.
[5] Borisov, Nikita, I. Goldberg and D. Wagner, “Security of WEP Algorithm”,
http://www.isaac.cs.berkeley.edu/isaac/wep-faq.htm
[6] 經濟部九十三年度無線寬頻網路示範應用計畫文件，http://www.pwlan.org.tw/upload/doc/20040429192946.doc
[7] A. Mishra and W. A. Arbaugh, “An Initial Security Analysis of the IEEE 802.1X Standard,” Department of Computer Science University of Maryland, Feb 6, 2002, CS-TR-43228.
[8] W. Stallings, “Cryptography and Network Security Principles and Practice, Second Edittion” ,1999
[9] D. Hulton, “Practical Exploitation of RC4 Weaknesses in WEP Environments
,http://www.dachb0den.com/projects/bsd-airtools.html”
[10] T. Newsham''s web page about WEP problems:
http://www.lava.net/~newsham/wlan/
[11] S. Fluhrer, I. Mantin and A. Shamir, “Weaknesses in the Key Scheduling Algorithm of RC4,” Eighth Annual Workshop on Selected Areas in Cryptography, August 2001.
[12] IEEE, “IEEE Standard for Local and metropolitan area networks - Port-based Networks Access Control,” IEEE Standard 802.1X, 2001
[13] C. Rigney, “Remote Authentication Dial In User Service (RADIUS)”, RFC 2865, June 2000.
[14] Blunk, L., Vollbrecht, “PPP Extensible Authentication Protocol (EAP) ”, RFC 2284, March 1998
[15] A. Sulmicki, “HOWTO on EAP/TLS authentication between FreeRadius and XSupplicant”， http://www.missl.cs.umd.edu/wireless/eaptls/.
[16] B. Aboba, “PPP EAP-TLS Authentication Protocol”, IEFT RFC 2716
[17] 賴溪松、邱榮輝、林祝興、盧而輝、張克章，電子簽章應用與實習，旗標出版股份有限公司，2003年。
[18] 內政部憑證管理中心,
http://moica.nat.gov.tw/
[19] WAPI打造安全互聯的公共無線局域網，
http://tech.sina.com.cn/other/2003-08-26/0934225352.shtml
[20] A. Stubblefield, J. Ioannidis, and A. Rubin, "Using the Fluhrer, Mantin, and Shamir Attack to Break WEP", http://www.cs.rice.edu/~astubble/wep_attack.pdf
[21] W. A. Arbaugh, N. Shankar, Y. C. J. Wan, “Your Wireless Network has No Clothes”, http://www.cs.umd.edu/~waa/wireless.pdf
[22] B. Lloyd, W. Simpson, "PPP Authentication Protocols(PAP)" RFC 1334, October 1992.
[23] W. Simpson, “ PPP Challenge Handshake Authentication Protocol (CHAP)”, RFC 1994, August 1996.
[24] 國家高速網路與計算中心校園無線漫遊機制整合實驗與推廣計畫網頁，http://wlanrc.nchc.org.tw/
[25] J. Edney and W. A. Arbaugh, Real 802.11 Security Wi-Fi Protected Access and 802.11i, Addison-Wesley, July 2003.