WAPI single broadcasting key negotiation method

Abstract

The invention relates to a WAPI unicast key negotiation method, which comprises the following steps: (1) an identifier entity adds a message integrity code to a unicast key negotiation request group and sends to an identification requester entity; (2) the identification requester entity receives the unicast key negotiation request group and then checks, if incorrect, the identification requester entity directly discards the group, otherwise performs other checks, if the check succeeds, the identification requester entity responses a unicast key negotiation response group; (3) the identifier entity receives unicast key negotiation request group and checks, if the check succeeds, response a unicast key negotiation acknowledgement group to the requester entity; (4) the identifier entity receives the unicast key negotiation acknowledgement group and then checks, if the check succeeds, the agreement of a unicast session key is reached. The invention solves the DoS attack problem of the unicast key management protocol in the existing WAPI security mechanism.

Description

technical field [0001] The invention relates to a wireless local area network key management method, in particular to a WAPI unicast key negotiation method. Background technique [0002] In order to solve the security loopholes in the WEP (Wired Equivalent Privacy) security mechanism defined in the WLAN (Wireless Local Area Network) international standard ISO / IEC 8802-11, my country promulgated the National Standard for Wireless Local Area Network and its No. 1 amendment, WLAN authentication and privacy infrastructure WAPI (WLAN Authentication and Privacy Infrastructure) is used to replace WEP to solve the security problem of wireless LAN. [0003] WAPI uses certificates or pre-shared key authentication and key management protocols to implement authentication and key distribution functions. This security mechanism solves the security problem of WLAN well, but because this mechanism is designed with more security in mind than the usability of the protocol, the unicast key agr...

AI Technical Summary

Problems solved by technology

Although the calculation of the unicast session key is not expensive, it will not cause a CPU exhaustion attack, but if the attacker intentionally increases the frequency of sending forged unicast key negotiation request packets, there is a danger of memory exhaustion

This kind of forgery attack is easy to implement, and the harm caused is relatively serious. A successful attack will make all the previous efforts on the authentication process come to naught