Wireless metropolitan area network (MAN) safe access method

Abstract

The invention discloses a wireless metropolitan area network (MAN) safe access method, comprising the steps of: completing security capability negotiation between a GW (Gateway) and an SS (Subscriber Station); performing first configuration on a BS (Base Station) by the GW, and closing a controlled port corresponding to the SS by the BS; completing an identity authentication based on WMAN-SA (Wireless Metropolitan Area Network-Security Access) by the GW, the SS and an AS (Authentication Server); negotiating to obtain a session key TEK (Traffic Encryption Key) by the GW and the SS; performing second configuration on the BS by the GW, and opening the controlled port corresponding to the SS by the BS; and encrypting and deciphering business data by using the TEK by the GW. In the invention, the access GW is used for controlling and managing the WMAN-SA of the BS, which can meet the requirement on large-scale deployment of the WMAN-SA.

Description

technical field [0001] The present invention relates to the field of wireless communication systems, in particular to a method for secure access to a wireless metropolitan area network. Background technique [0002] As an important development direction of future wireless access technology, IEEE 802.16 wireless metropolitan area network has attracted widespread attention from all walks of life. However, security issues have been restricting its further promotion and development. An authentication protocol based on a public key encryption algorithm (RSA) and a digital certificate is defined in IEEE 802.16d, which can realize the authentication of the base station BS to the subscriber station SS. The main disadvantage of IEEE 802.16d is that it only provides one-way authentication of the base station BS to the subscriber station SS, but does not provide the authentication of the SS to the BS, and it is very easy to fake the BS to deceive the SS. In addition, both the authori...

AI Technical Summary

Problems solved by technology

However, safety issues have always restricted its further promotion and development.

The main disadvantage of IEEE 802.16d is that it only provides one-way authentication of base station BS to user station SS, but does not provide authentication of SS to BS. It is very easy for fake BS to deceive SS

[0004] When WMAN-SA is deployed on a large scale in the future, in addition to authenticating and communicating with SS, the BS also needs a gateway (GW) to configure and manage the WMAN-SA module of the BS itself. At this time, it must be introduced in the network for base station management. However, the existing solutions only define functions such as identity authentication, key management, data encryption, data authentication, and replay protection, and do not fully explain the specific method of applying WMAN-SA after the introduction of gateway devices, and cannot realize WMAN - SA large-scale deployment

Images