WLAN Mobile Terminal Secure Access via Certificate Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
WLANs face significant security challenges due to inadequate access control and data confidentiality, with existing methods like SSID authentication and WEP encryption being easily compromised, limiting their widespread adoption.
Innovation Solution
Implementing two-way certificate authentication through an authentication server and dynamic secret key negotiation between mobile terminals and access points using common key encryption technology to ensure secure access and communication.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If SSID authentication is used to control WLAN access, then access control is provided, but security is compromised because anyone knowing the SSID can access the network
Solution Approach 1:
The patent applies asymmetric cryptography (public key infrastructure) where the mobile terminal and access point exchange public keys and use private keys for signature verification. This asymmetric authentication mechanism replaces the symmetric SSID authentication, making it computationally infeasible for attackers to derive authentication credentials even if they intercept communication.
Solution Approach 2:
The patent introduces a certificate authority (CA) as an intermediary that issues digital certificates to both the access point and mobile terminal. This CA-mediated authentication system provides a trusted third party that verifies identities and issues cryptographic credentials, replacing the direct but insecure SSID-based mutual authentication.
2Reliability
If MAC address restriction is implemented at the access point, then unauthorized access is prevented, but security remains low because MAC addresses can be easily obtained and forged
Solution Approach 1:
The patent replaces the mechanical MAC address filtering approach with cryptographic authentication using public key infrastructure. Instead of comparing hardware addresses, the system uses digital signatures and certificate verification, which are computationally secure and cannot be easily forged like MAC addresses.
3Reliability
If WEP encryption with RC-4 is used for data confidentiality, then encryption is provided, but security is compromised due to regular initiation vector variation that allows decryption within hours
Solution Approach 1:
The patent fundamentally changes the cryptographic parameters from WEP's RC-4 stream cipher with 24-bit initialization vectors to AES block cipher with 128-bit keys. This parameter change increases the key space from 2^24 to 2^128, making brute-force and statistical attacks computationally infeasible, and eliminates the periodic key repetition vulnerability.
Solution Approach 2:
The patent employs a composite security approach combining multiple cryptographic primitives: AES encryption for confidentiality, HMAC for integrity, and digital certificates for authentication. This layered cryptographic architecture provides defense in depth, where compromise of one layer does not necessarily compromise the entire system.
4Reliability
If certificate authentication and dynamic key negotiation are implemented, then access control and security are enhanced, but system complexity increases
Solution Approach 1:
The patent implements a universal authentication framework based on IEEE 802.1X that can handle multiple authentication scenarios (open, shared key, EAP methods) through a common architecture. The EAP protocol provides a flexible framework that can accommodate various authentication mechanisms while maintaining a consistent system structure, reducing complexity through standardization.
Data Source
AI summary
The present invention relates to a method for the secure access of mobile terminal to the Wireless Local Area Network (WLAN) and for secure data communication via wireless link, which, combining the common key encryption technology and the symmetry encryption technology, has resolved the failure in WLAN to provide effective control on secure MT access, and overcome the limitation on the confidentiality of the data communication via wireless link. When MT logs on AP, both parts must perform the certificate authentication through AS. Only the MT holding the legitimate certificate can access to AP holing the legitimate certificate; MT and AP perform the negotiation of common key for conversation, complete the dynamic revision of the secret key in each authentication, each secret key and in the process of conversation to achieve confidential data communication. Anyway, the method has not only achieved control on the access of MT, but also ensured the security of MT access and high confidentiality of communication.