基於IEEE 802.11i 的快速預先認証

Abstract

IEEE 802.11i目的是為了加強無線網路(IEEE 802.11)的安全，但太過複雜的認証程序會增加無線工作站(STA)在漫遊時重新連線所需的時間，影嚮即時性軟體的傳輸品質。對此IEEE 802.11i提出兩個因應的技術，分別為PMK快取(PMK Caching)以及預先認証(Pre-Authentication) ; 藉由無線工作站與下一個AP連線前事先完成認証的過程，並把認証的結果PMK快取下來，將可大幅減少漫遊過程中重新認証所造成的延遲情況。但缺點是會產生過多的封包流量以及佔用認証伺服器的資源，此外過長的時間亦會增加無線工作站的負荷。本篇論文即在此架構下提出一個新的機制-快速預先認証(Fast Pre-Authentication)，方法為在相同延伸服務區(ESS)的無線基地台(AP)中透過認証伺服器的協助建立一個安全的通道，將無線工站作先前完成認証所產生的金鑰相關資訊，提前交送給下一個連線的無線基地台，以較少的負擔(Overhead)達到快速漫遊的目的。另外以較少的時間完成預先認証，意謂著我們所提出的機制更加適合快速移動的無線設備。透過實作比較的方式，証明此機制是有效的。

The goal of IEEE 802.11i is for strengthening the wireless local area network (IEEE 802.11) security, but it’s complex authentication procedure will increase the STA’s re-authentication time while roaming happened, and affect the quality of real-time application. To solve this problems, IEEE 802.11i proposed two methods called the PMK Caching and Pre-Authentication, which complete the authentication in advance between STA and next candidate APs and then caching the PMKSA each others, will reduce the roaming latency caused by re-authentication procedure. However the shortcoming besides will produce too much message flow and engage the resource of authentication server, the long duration will also increase more burden to the STA. This thesis presents a new approach called as Fast Pre-Authentication which achieve the goal of fast secure roaming with less overhead. Adjacent APs in the same ESS will set up secure channels through the assistance of the authentication server, and then transfer the STA key relevant information to the candidate AP in advance. Shortening of pre-authentication time will be more suitable for the faster wireless device. Experimental results are given to show the effectiveness of the proposed approach.