CN101013940A - Identity authentication method compatible 802.11i with WAPI - Google Patents

Abstract

The invention discloses a method for identity authentication compatible with 802.11i and WAPI to solve the problem that foreign wireless products do not support WAPI and cannot enter the Chinese market. The interaction process of the present invention is: the mobile station STA sends the extended authentication protocol EAP start message to the access point AP, and the AP sends a time stamp request message to the STA, and if the STA supports WAPI, it returns a time stamp response message to the AP, and sends its identity and access information to the AP. The AP signs the message and sends it to the ASU. If the ASU supports WAPI authentication, the ASU and the STA perform key negotiation in WAI and send a key transmission message to the AP. If the STA or WAPI does not support WAPI authentication, the STA and the ASU perform 802.11i authentication, and finally the STA and the AP perform a four-step handshake protocol. The invention has the advantage of being compatible with 802.11i and WAPI, and can be used for identity authentication in the wireless local area network.

Description

A Identity Authentication Method Compatible with 802.11i and WAPI

technical field

The present invention belongs to the technical field of wireless communication, and relates to the security technology of wireless local area network, and specifically aims at the problem that the international wireless local area network security standard 802.11i is not compatible with the Chinese wireless local area network security standard WAPI, and proposes an authentication scheme compatible with both, To solve the identity authentication and key negotiation problems when foreign wireless products enter the Chinese market.

Background technique

With the rapid development and popularization of wireless local area network (WLAN), its security issues have aroused more and more people's attention. The IEEE802.11 working group is committed to formulating a new generation of security standards called 802.11i. This security standard enhances the data encryption and authentication performance of WLAN, and has made many improvements to the defects of the previous encryption mechanism WEP. The standard was approved in June 2004 as a standard security solution for wireless LANs.

In order to solve the security problem in the wireless local area network, China also launched its own wireless local area network national standard GB15629.11 in 2003. Its security mechanism WAPI is composed of two modules, the authentication infrastructure WAI and the security infrastructure WPI, which respectively realize the authentication of the user's identity and the encryption of the transmitted data. In 2004, the Broadband Wireless IP Standard Working Group of the National Information Technology Standardization Technical Committee promulgated the implementation guide of the national standard, and revised the security defects in the original WAI. In January 2006, relevant state departments clearly stipulated that in government procurement, products that meet the national LAN security standard GB 15629.11/1102 and have passed product certification should be purchased first; for projects with special national information security requirements, certified products must be purchased.

But the two standards of 802.11i and WAPI are incompatible, so wireless products produced by foreign manufacturers, such as notebook computers and PDAs using 802.11i technology, cannot enter the Chinese market. A series of problems caused by this have become the focus of attention in the WLAN field. At present, it is unlikely that one of the two options will replace the other. In order to expand the promotion and use of wireless local area networks, it is necessary to consider how these two programs are compatible.

1. Wireless LAN international security standard 802.11i

The international standard 802.11i for wireless LAN is based on two security protocols: the Extended Authentication Protocol (EAP) and the authentication framework based on IEEE 802.1X.

The Extended Authentication Protocol (EAP) was originally formulated for the Point-to-Point Protocol (PPP). Its purpose is to delay the selection of the authentication mechanism of PPP in the link control protocol LCP stage to the optional PPP authentication stage, which allows the authentication system to decide on the specific authentication mechanism. Previously it was possible to request more information. The Extended Authentication Protocol (EAP) is not a real authentication protocol, but only an encapsulation format of an authentication protocol. Through the use of encapsulation, the client and the authentication server can realize dynamic negotiation on specific authentication protocols.

IEEE 802.1X is a port-based access control framework. There are three types of entities in this framework: mobile station STA, authenticator Authenticator and authentication server AS. The mobile station STA is a user who wants to use network resources, and the authenticator is a device that separates the mobile station STA from the network to prevent unauthorized access, usually an access point AP. The authentication server AS is a back-end device, which is used to complete the authentication of the mobile station STA, and decide to allow or deny its access request.

IEEE 802.1X messages are transmitted in two EAP ways: (1) Run the EAPOL protocol on the link between the mobile station STA and the access point AP. (2) The EAP protocol is also run between the access point AP and the AS, but this protocol is encapsulated into a high-level protocol. For this connection, IEEE does not define its own protocol, but most of them now adopt the EAP on RADIUS standard. Figure 1 shows the entities in a typical IEEE 802.1X/EAP.

In a typical 802.1X/EAP authentication process, the mobile station STA first sends an EAP start message: EAPOL-start to the access point AP, indicating that it wishes to join the network. After receiving the message, the access point AP sends an EAP identity request message: EAP-Req/Identity to the mobile station STA, requesting the mobile station STA to send its identity. After receiving the message, the mobile station STA must return an EAP identity response message: EAP-Resp/Idemity to respond to the identity request message. After receiving the response message, the access point AP sends the message to the authentication server AS. Thereafter, the exchange of authentication messages starts between the mobile station STA and the authentication server AS. The details of the exchange of authentication messages depend on the actual authentication protocol used. Although the authentication messages go through the access point AP, it does not need to understand the meaning of the authentication message. After the authentication process is over, the authentication server AS decides whether to allow or deny the access of the mobile station STA, and the authentication server AS notifies the mobile station STA of the final result through EAP-Success or EAP-Failure. When the access point AP forwards the EAP-Success or EAP-Failure message, it also allows or blocks the data flow of the mobile station STA to pass through it according to this message. If the authentication is successful, the mobile station STA and the authentication server AS will get a master key MK, and the access point AP will share a primary master key PMK with the mobile station STA.

After the IEEE 802.11i authentication is completed, the access point AP and the mobile station STA perform four message interactions (four-step handshake protocol). Through this process, the mobile station STA and the access point AP can mutually confirm the existence and freshness of each other, and can synchronize session keys, and bind the primary master key PMK to the physical address of the mobile station STA. At the same time, the four-step handshake also realizes the hierarchy of keys, which can better protect the encryption keys.

2. China's wireless LAN security standard WAPI

China's WLAN security standard WAPI consists of two modules, the authentication infrastructure WAI and the confidentiality infrastructure WPI, which respectively implement the functions of authenticating user identities and encrypting transmitted data. The authentication infrastructure WAI adopts a port-based authentication model similar to the IEEE802.1X structure, and the whole system is composed of a mobile station STA, an access point AP, and an authentication service unit ASU. The authentication service unit ASU is the most important part of the authentication infrastructure WAI. Its basic function is to realize the management of user certificates and the identification of user identities.

Authentication infrastructure WAI uses public key certificates for authentication and key agreement. The goal is to realize the two-way authentication between the mobile station STA and the access point AP, and it has a strong resistance to the attack method using the "false" access point AP. The interactive process of WAI is shown in Figure 2. It mainly consists of two parts: certificate authentication and key agreement.

1. Certificate identification process

(1) The access point AP sends an authentication activation request to the mobile station STA;

(2) In the access authentication request, the mobile station STA submits its own public key certificate and access request time to the access point AP;

(3) In the certificate authentication request, the access point AP sends the certificate of the mobile station STA, the time of the access request, the certificate of the access point AP itself, and its signature on these three parts to the authentication service unit ASU;

(4) After the authentication service unit ASU receives the certificate authentication request sent by the access point AP, it first verifies the signature and certificate of the access point AP. After the identification is successful, further verify the certificate of the mobile station STA; after that, the authentication service unit ASU signs the identification result of the mobile station STA and the access point AP certificate and the access request time of the mobile station STA with its own private key, and This signature is sent back to the access point AP together with the certificate verification result.

(5) The access point AP verifies the received certificate authentication response, and obtains the authentication result of the certificate of the mobile station STA. At the same time, the access point AP needs to forward the verification result of the authentication service unit ASU to the mobile station STA, and the mobile station STA also needs to verify the signature of the authentication service unit ASU, and obtain the authentication result of the authentication service unit ASU on the access point AP certificate .

2. Key negotiation process

First we explain the symbols used.

PK _A represents the public key of A;

ENC(PK _A , m) means to encrypt message m with A's public key PK _A ;

Sig _A (m) represents that A digitally signs message m with the private key.

The key negotiation process in the national standard implementation guide is shown in Figure 3, and the specific process is as follows:

(1) The key agreement request in the implementation guide stipulates that it must be sent by the access point AP. In this request, the access point AP selects a random number r ₁ , encrypts it with the public key PK _STA of the mobile station STA, and then uses the mobile station STA The access request time of the STA, and the medium access address (MAC address) of the mobile station STA and the access point AP to calculate the security parameter index SPI. Finally, the access point AP calculates the digital signature for the encrypted random number and the security parameter index SPI;

(2) After receiving the key agreement request, the mobile station STA first checks whether the security parameter index SPI and the signature of the access point AP are correct, and if they are correct, decrypt ENC(PK _STA , r ₁ ) to obtain r ₁ , and then move The station STA also generates its own random number r ₂ , and performs a bitwise XOR operation on r ₁ and r ₂ to obtain a unicast master key k=r ₁ r ₂ with a length of 16 octets, and then uses KD -The HMAC-SHA256 algorithm extends it to generate a 48-octet unicast session key (the first 16 octets are the unicast encryption key k _d , and the middle 16 octets are the unicast Integrity verification key, the last 16 octets are the message authentication key d _a ). After that, use the public key PK _AP of the access point AP to encrypt r ₂ with the public key. Finally, the STA uses k _a to calculate a message authentication code for SPI and ENC (PK _AP , r ₂ ) through the HMAC-SHA256 algorithm.

(3) After the access point AP receives the key agreement response, it first decrypts ENC(PK _AP , r ₂ ) to obtain r ₂ , and then uses the same key generation algorithm as the mobile station STA to calculate the encryption key k _d , the integrity A verification key and a message authentication key k _a . Finally, verify the message authentication code sent by the mobile station STA. If correct, the mobile station STA's access to the network is allowed; otherwise, the message is discarded and the mobile station STA's access is blocked.

content of the invention

The purpose of the present invention is to overcome the above-mentioned defect that 802.11i and WAPI are not compatible with each other, and propose an authentication method compatible with 802.11i and WAPI, so as to solve the identity authentication problem in the wireless local area network.

The purpose of the present invention is achieved like this:

1. Method main frame

1) The mobile station STA sends an EAP start message EAPOL-Start to the access point AP;

2) The access point AP sends a timestamp request message EAP-Req/WTS to the mobile station STA, requesting the mobile station STA to send the identity and access request time;

3) Select the response message mode according to whether the mobile station STA supports the WAPI protocol, if the mobile station STA supports the authentication of WAPI, then return the timestamp response message EAP-Resp/WTS to the access point AP, and its message content includes the mobile station STA's Identity and access request time;

4) The access point AP signs the time stamp response message EAP-Resp/WTS, and sends it to the authentication service unit ASU through the access request message;

5) After receiving the access request message, the authentication service unit ASU selects a response method according to whether it supports WAPI, and if it supports WAPI authentication, it sends a WAPI key negotiation request message to the mobile station STA to perform WAPI authentication;

6) The mobile station STA sends a WAPI key negotiation response message to the authentication service unit ASU, and performs WAPI authentication with the ASU;

7) After the WAPI authentication is completed, the authentication service unit ASU sends EAP-success and key transmission messages to the access point AP;

8) The access point AP forwards the authentication success message EAP-success sent by the authentication service unit ASU to the mobile station STA;

9) The mobile station STA and the access point AP perform a four-step handshake protocol interaction, that is, the interaction ends.

2. according to the framework described in 1, it is characterized in that said mobile station STA in step 3) according to the mode that supports WAPI protocol selection response message, if mobile station STA does not support WAPI, then returns Nak to access point AP The message Nak is the message specified in the EAP framework RFC3748, and then the access point AP first sends an identity request message EAP-Req/ID to the mobile station STA, requesting the mobile station STA to send its identity; then the mobile station STA communicates with the authentication service unit The ASU conducts negotiation and authentication of the 802.11i authentication algorithm; finally, the mobile station STA and the access point AP perform a four-step handshake protocol interaction, that is, the interaction ends.

3. According to the framework described in 1, it is characterized in that after the said authentication service unit ASU in step 5) receives the access request message, it selects the response mode according to whether it supports WAPI itself, if the authentication service unit ASU does not support WAPI Authentication, the authentication service unit ASU first negotiates and authenticates the 802.11i authentication algorithm with the mobile station STA; then the mobile station STA and the access point AP perform a four-step handshake protocol interaction, that is, the interaction ends.

The present invention has the following advantages

In the present invention, the mobile equipment adopting the compatibility scheme can not only carry out the authentication of 802.11i, but also can carry out the authentication of WAPI, which solves the problem that the mobile equipment produced by foreign manufacturers cannot enter the Chinese market; Support WAPI authentication, domestic mobile devices can also be used abroad because they can support 802.11i.

Simultaneously, because the present invention maintains the key negotiation protocol in the authentication infrastructure WAI to the greatest extent, the modification to WAPI is reduced as much as possible, and the compatibility with WAPI is easy to be achieved.

In addition, the present invention basically keeps the framework of 802.11i unchanged, but adds a certificate request message EAP-Req/WTS of the extended authentication protocol EAP at the initial stage; and uses the key agreement agreement in the authentication infrastructure WAI as 802.11i An implementation scheme under the framework, which maintains the advantages of the flexibility of the 802.11i protocol. The main performance is that it is not necessary to specify the specific authentication protocol between the mobile station STA and the authentication server in advance, but to negotiate dynamically between them during the protocol execution process. ; Second, in the compatible scheme, when the mobile station STA supports WAPI authentication, the authentication service unit ASU can choose to use WAPI authentication or 802.11i authentication according to specific application requirements.

In a word, the compatibility scheme of the present invention makes as little modification as possible to 802.11i and WAPI, which not only maintains the advantages of 802.11i framework and flexibility, but also maintains the characteristics of WAPI, and has strong compatibility.

Description of drawings

Figure 1 is the entity diagram in IEEE 802.1X/EAP

Figure 2 is the WAI diagram in the WAPI implementation

Figure 3 is a key negotiation diagram in the WAPI implementation

Figure 4 is a flow chart for the execution of the compatibility scheme protocol

Figure 5 is a protocol interaction process diagram for implementing WAPI in a compatible solution

Figure 6 is the EAP-Req/WTS message diagram

Figure 7 is a message diagram of EAP-Resp/WTS

Figure 8 is a diagram of an access request message

Figure 9 is a key agreement request message diagram

Figure 10 is a key agreement response message diagram

Figure 11 is a message diagram of EAP-Success and key transmission

Figure 12 is the EAP-Success message diagram

Figure 13 is the EAP-Failure message diagram

Figure 14 is the EAP-Req/ID message diagram

Detailed ways

The following is a detailed description of the method of the present invention in conjunction with the flow chart 4 of compatible scheme execution and the protocol interaction process 5 of executing WAPI:

1. The mobile station STA sends an EAP start message EAPOL-Start to the access point AP.

This message indicates that the mobile station STA requests EAP identity authentication, and its specific message format adopts the definition of EAPOL-Start in 802.11i.

2. The access point AP sends a timestamp request message EAP-Req/WTS to the mobile station STA.

Through the time stamp request message EAP-Req/WTS, the access point AP requests the mobile station STA to send its identity and current access time. Since there is no such message type in the current EAP message, a new message type type: WAPI-WTS needs to be added to the EAP message. The format of this message is shown in Figure 6.

The message format shown in Figure 6 is defined according to the regulations in the EAP framework (IETF RFC3748). The message is composed of four parts, wherein the first part "1" represents that the message is an EAP request message, and the second part of the message identifier is for Each EAP message is unique, its specific value is determined by the runtime, generally a random value, the third part of the message length Length represents the length of the entire message, and the fourth part EAP-WTS is newly added An EAP type value.

3. Select a message response method according to whether the mobile station STA supports WAPI.

If the mobile station STA supports WAPI authentication, the mobile station STA returns an EAP time stamp response message EAP-Resp/WTS to the access point AP, sending its own identity and access time. The message format is shown in Figure 7. The message consists of six parts. The "2" in the first part means that the message is a response to the time stamp request message EAP-Req/WTS; the second part of the message identifier is the identifier of the message; the third part of the message length length represents the length of the entire message; the fourth part EAP-WTS is a newly added EAP type type value, which is consistent with the EAP type in the timestamp request message EAP-Req/WTS; the fifth part is the identity of the STA; The sixth part is the access time of STA.

If the mobile station STA does not support WAPI, follow the steps below:

(1) The mobile station STA returns a Nak message to the access point AP. The message Nak is a message specified in the EAP framework RFC3748.

(2) The access point AP sends an EAP identity request message EAP-Req/ID to the mobile station STA, requesting the mobile station STA to send its identity. The format of the identity request message is shown in Figure 14, where "1" in the first part represents that the message is a request message, the definition of the message identifier in the second part and the length of the message in the third part are the same as those in Figure 6, The fourth part EAP-Identify="1" represents that the access point AP requests the mobile station STA to send the identity.

(3) The authentication service unit ASU conducts 802.11i authentication with the mobile station STA. The authentication service unit ASU first negotiates with the mobile station STA on the 802.11i authentication protocol, and then conducts identity authentication and key negotiation according to the selected authentication protocol.

(4) The mobile station STA and the authentication service unit ASU perform a four-step handshake protocol interaction, and the protocol interaction ends. The execution process of the four-step handshake protocol adopts the definition in 802.11i.

4. The access point AP sends an EAP access request message to the authentication service unit ASU.

The access point AP first checks whether the access request time in the time stamp response message sent by the STA is correct, and if it is correct, calculates a signature for the identity of the mobile station STA and the access request time of the mobile station STA, and finally combines the signature and the access request time. The identity of the access point AP is added to the EAP-Resp/WTS message, and sends an EAP access request message to the authentication service unit ASU. The format of the message is shown in Figure 8, where the AP's signature adopts the signature algorithm specified in WAPI.

5. According to whether WAPI authentication is supported, the authentication service unit ASU chooses whether to perform WAPI authentication or 802.11i authentication.

When the authentication service unit ASU receives the access request message, it first checks the EAP type of the message, if it is EAP-WTS, checks whether it supports WAPI authentication, and if so, performs WAPI authentication with the mobile station STA. The authentication service unit ASU first authenticates the AP's signature and checks whether the STA's certificate is valid. If both checks pass, it sends a key negotiation request message to the mobile station STA. Since 802.11i does not support WAPI authentication currently, a new authentication type EAP-WAPI needs to be added in the type field of the EAP message. The type field of the EAP message needs to be set to this value in both the key agreement request and the response, and the message format of the key agreement request message is shown in FIG. 9 . The message consists of eight parts. "1" in the first part indicates that the message is a request message; the message identifier in the second part is the identifier of the message; the length of the message in the third part is the length of the entire message; the fourth part is a newly added one EAP type EAP-WAPI, which indicates that the mobile station STA performs WAPI authentication with the authentication service unit ASU; the fifth part is the security parameter index SPI, which is marked by the access request time of the STA, the MAC address of the STA, and the basic service group of the AP Composed of BSSID; the sixth part is ENC (PK _STA , r ₁ ), r ₁ is a random number selected by the authentication service unit, and the authentication service unit encrypts r ₁ with the public key PK _STA of the mobile station STA, and the encryption algorithm adopts WAPI The algorithm specified in ; the seventh part is the access time of STA; the eighth part is the signature of the whole message by ASU, and its signature algorithm adopts the algorithm specified in WAPI.

If the authentication service unit ASU does not support WAPI authentication, proceed as follows:

(1) The authentication service unit ASU conducts 802.11i authentication with the mobile station STA. The authentication service unit ASU first negotiates with the mobile station STA on the 802.11i authentication protocol, and then conducts identity authentication and key negotiation according to the selected authentication protocol.

(2) The mobile station STA performs a four-step handshake protocol interaction with the authentication service unit ASU, and the protocol interaction ends.

The execution process of the four-step handshake protocol adopts the definition in 802.11i.

6. After receiving the WAPI key negotiation request sent by the ASU, the mobile station STA returns a key negotiation response message to the authentication service unit ASU.

The key agreement response message format is shown in Figure 10. The message consists of six parts, where the calculation methods of ENC (PK _ASU , r ₂ ) and HMAC-SHA256 _ka (SPI, PK _AP (r ₂ )) are the same as those in WAPI calculation method is the same. The access point STA calculates the session key k=r ₁ r ₂ as the master key MK shared by the mobile station STA and the authentication service unit ASU. The key primary master key PMK shared by the mobile station STA and the access point AP can be obtained by the following formula:

PMK＝prf(MK，STA-MAC-address‖AP-MAC-address) (1)

Among them, prf is a pseudo-random generating function, and the SHA1 algorithm can be used. STA-MAC-address is the MAC address of the STA, and AP-MAC-address is the MAC address of the AP.

7. ASU sends EAP-Success and key transmission message to AP.

If the WAPI authentication is successful, the authentication service unit ASU calculates the shared key MK between itself and the mobile station STA and the primary master key PMK sent to the access point AP. The calculation method is the same as the calculation method in step 6. Afterwards, the authentication service unit ASU sends EAP-Success and key transmission messages to the access point AP to notify the access point AP of successful authentication and sends the primary master key PMK to the access point AP, which will be used later In the four-step handshake between the access point AP and the mobile station STA, a signature of the authentication service unit ASU is added to the EAP-Success and key transmission messages to ensure its security. The message format is shown in Figure 11 and consists of seven parts, wherein the first part is Success="3", indicating that the mobile station STA and the authentication service unit ASU have successfully authenticated; the second part of the message identifier is the unique identifier of the message , the third part length message length length is the entire length of the message, the fourth part ENC (PK _AP , PMK) is the authentication service unit ASU uses the public key PK _AP of the access point AP to perform public key encryption on the primary master key PMK , the encryption algorithm adopted is the encryption algorithm specified in WAPI; the fifth part is the access time of STA; the sixth part is the identity of AP; the seventh part is the signature of the authentication service unit ASU on the whole message.

If the authentication fails, the authentication service unit ASU sends an EAP-Failure message to the AP and the STA, and its message format is shown in FIG. 12 . The message consists of three parts, the first part Failure="4" indicates authentication failure, the second part is the message identifier, and the third part is the length of the entire message.

8. The access point AP sends an EAP-Success message to the mobile station STA.

The message format is shown in FIG. 13 , where “3” represents an authentication success message, and the definitions of the message identifier and the message length are the same as those in FIG. 6 .

9. The mobile station STA and the authentication service unit ASU perform a four-step handshake protocol interaction, and the protocol interaction ends. The execution process of the four-step handshake protocol is carried out according to the definition in 802.11i.

The above method can be used to achieve compatibility with 802.11i and WAPI, which solves the problem that foreign wireless products cannot enter the Chinese market because they do not support WAPI.

Symbol Description:

WAPI: China wireless local area network security standard;

WAI: Wireless LAN Authentication Infrastructure;

WPI: WLAN Privacy Infrastructure;

EAP: Extended Authentication Protocol;

PPP: point-to-point protocol;

LCP: Link Control Protocol;

STA: mobile station;

AP: access point;

Authenticator: authenticator;

AS: authentication server;

EAPOL: Extended Authentication Protocol on Link Layer;

RADIUS: Remote Authentication Dial-in User Service;

EAPOL-start: EAP start message;

EAP-Req/Identity: EAP identity request message;

EAP-Resp/Identity: EAP identity response message;

EAP-Success: EAP success message;

EAP-Failure: EAP failure message;

MK: the master key shared between the mobile station and the authentication server;

PMK: the primary master key shared by the mobile station and the access point;

PKA: A's public key;

ENC(PK _A , m): use A's public key PK _A to encrypt message m;

Sig _A (m): A uses the private key to digitally sign the message m;

MAC address: medium access address;

EAP-Req/WTS: time stamp request message;

EAP-Resp/WTS: Timestamp response message;

type: EAP type;

identifier: message identifier;

Length: message length;

EAP-WTS: A newly added EAP type, which represents the interaction between WAPI timestamp and identity;

Nak: Negative response message;

prf: pseudorandom generator function;

STA-MAC-address: MAC address of STA;

AP-MAC-address: MAC address of the AP.

Claims (7)

1. the identity identifying method of compatible WAPI and 802.11i, carry out according to the following procedure:

1) mobile radio station STA begins message EAPOL-Start to access point AP transmission EAP;

2) access point AP sends time stamp request message EAP-Req/WTS to mobile radio station STA, and request mobile radio station STA sends identity and inserts request time;

3) whether support the WAPI agreement to select the mode of response message according to mobile radio station STA, if mobile radio station STA supports the authentication of WAPI, then return time stamp response message EAP-Resp/WTS to access point AP, its message content comprises the identity of mobile radio station STA and inserts request time;

4) access point AP signs to described time stamp response message EAP-Resp/WTS, sends it to authentication service unit ASU by inserting request message;

5) receive insert request message after, authentication service unit ASU if support the authentication of WAPI, then sends WAPI key negotiation request message to mobile radio station STA according to self whether supporting WAPI to select response mode, carries out the authentication of WAPI;

6) mobile radio station STA sends WAPI key agreement response message to authentication service unit ASU, carries out the authentication of WAPI with ASU;

7) after the WAPI authentication finished, authentication service unit ASU sent EAP-success and cipher key delivery message to access point AP;

8) access point AP transmits the authentication success message EAP-success that authentication service unit ASU sends to mobile radio station STA;

9) mobile radio station STA and access point AP carry out the mutual of four way handshake protocols, promptly finish alternately.

2. identity identifying method according to claim 1, it is characterized in that whether supporting the WAPI agreement to select the mode of response message according to mobile radio station STA described in the step 3), if mobile radio station STA does not support WAPI, then return passive response message Nak to access point AP, this message Nak is the message of stipulating among the Extensible Authentication Protocol EAP framework RFC3748, afterwards, access point AP at first sends identity request message EAP-Req/ID to mobile radio station STA, and request mobile radio station STA sends its identity; Mobile radio station STA and authentication service unit ASU carry out the negotiation and the authentication of 802.11i identifying algorithm then; Last mobile radio station STA and access point AP carry out the mutual of four way handshake protocols, promptly finish alternately.

3. identity identifying method according to claim 1, after its spy just is being that said authentication service unit ASU receives the access request message in the step 5), according to self whether supporting WAPI to select response mode, if authentication service unit ASU does not support the authentication of WAPI, then authentication service unit ASU at first carries out the negotiation and the authentication of 802.11i identifying algorithm with mobile radio station STA; Mobile radio station STA and access point AP carry out the mutual of four way handshake protocols then, promptly finish alternately.

4. authentication according to claim 1 and key agreement protocol method is characterized in that step 2) described in time stamp request message EAP-Req/WTS, this request message is made up of four parts, it is request message that this message is represented in " 1 " in the first; Second portion message indications identifier is the indications of this message, and its concrete value the time is determined by operation, generally is a random value; Third part message-length length represents the length of whole message; And the 4th part EAP-WTS is a new Extensible Authentication Protocol EAP types value that adds.

5. authentication according to claim 1 and key agreement protocol method, it is characterized in that the time stamp response message EAP-Resp/WTS described in the step 3), this response message is made up of six parts, and it is replying time stamp request message EAP-Req/WTS that this message is represented in " 2 " in the first; Second portion message indications identifier is the indications of this message; Third part message-length length represents the length of whole message; The 4th part EAP-WTS is a new EAP types value that adds, and the EAP type among this value and the time stamp request message EAP-Req/WTS is consistent, and shows that mobile radio station STA returns the identity of mobile radio station STA and inserts request time to access point AP; The 5th part is the identity of STA; The 6th part is the access time of STA.

6. authentication according to claim 1 and key agreement protocol method is characterized in that the WAPI key negotiation request message described in the step 5), and this message is made of eight parts." 1 " in the first shows that this message is request message; Message indications identifier in the second portion is the indications of this message; Third part message-length length is the length of whole message; The 4th part is a new EAP type EAP-WAPI who adds, and the type shows that mobile radio station STA carries out the authentication of WAPI with authentication service unit ASU; The 5th part is Security Parameter Index SPI, and it is made up of the access request time of mobile radio station STA, the MAC Address of STA and the basic service sets sign BSSID of AP; The 6th part is ENC (PK _STA, r ₁), r ₁Be the random number that authentication service unit is selected, the authentication service unit PKI PK of mobile radio station STA _STATo r ₁Encrypt, cryptographic algorithm adopts the algorithm of stipulating among the WAPI; The 7th part is the access time of STA; The 8th part is the signature of ASU to whole message, and its signature algorithm adopts the algorithm of stipulating among the WAPI.

7. authentication according to claim 1 and key agreement protocol method is characterized in that EAP-success described in the step 7) and cipher key delivery message, and this message is made up of seven parts.First is Success=" 3 ", shows mobile radio station STA and authentication service unit ASU authentication success; Second portion message indications identifier is unique indications of this message, and third part length message length l ength is the whole length of this message, the 4th part ENC (PK _AP, PMK) be the PKI PK of authentication service unit ASU with access point AP _APElementary master key PMK is carried out public key encryption, and the cryptographic algorithm that is adopted is the cryptographic algorithm of stipulating among the WAPI; The 5th part is the access time of STA; The 6th part is the identity of AP; The 7th part is the signature of authentication service unit ASU to whole message, and wherein the computational methods of elementary master key PMK are as follows:

PMK＝prf(MK，STA-MAC-address‖AP-MAC-address)

Wherein, prf is a pseudorandom generating function, can adopt the SHA1 algorithm.MK is the master key of sharing between STA and the authentication service unit ASU, and STA-MAC-address is the MAC Address of STA, and AP-MAC-address is the MAC Address of AP.

Images