CN106921965B - Method for realizing EAP authentication in W L AN network - Google Patents

Abstract

The invention discloses a method for realizing EAP authentication in a WLAN network. The WLAN network includes a mobile phone terminal bound with a SIM card or a USIM card, a wireless AP, a dedicated AAA server and a dedicated authentication server, and the mobile phone terminal communicates with the wireless AP, The wireless AP communicates with the dedicated AAA server, and the dedicated AAA server communicates with the dedicated authentication server. Each dedicated AAA user stores IMSI, encryption algorithm, algorithm identification and key information on the dedicated authentication server. The multi-group EAP-SIM/AKA authentication combination based on the mobile phone user identification card (SIM/USIM card) of the present invention is based on the WIFI authentication of the mobile terminal of the mobile phone, and uses the EAP-SIM/AKA as the authentication method, without affecting the SIM/USIM In the case of the authentication key and algorithm required by the standard authentication command of the card, other keys and algorithms in the SIM/USIM card are used, and WIFI authentication and login are automatically completed. It is easy to operate and the user can use WIFI without perception. , In addition, it avoids the traditional HLR or HSS pointing to mobile operators, providing convenient conditions for the popularization and promotion of EAP‑SIM/AKA.

Description

A method for realizing EAP authentication in WLAN network

technical field

The invention relates to the technical field of network communication, in particular to a method for realizing EAP authentication in a WLAN network.

Background technique

EAP protocol (Extensible Authentication Protocol) is the abbreviation of Extensible Authentication Protocol. It is a collection of a sequence of authentication methods to meet the authentication requirements of any link layer and supports multiple link authentication methods. The EAP protocol is the core of the IEEE802.1x authentication mechanism. It hands over the implementation details to the attached EAP Method protocol. How to select the EAP Method is determined by the authentication system characteristics. It realizes the expansibility and flexibility of EAP. EAP can provide different methods to support the link authentication of PPP, Ethernet and wireless local area network respectively.

EAP-SIM/AKA (referring to EAP-SIM and EAP-AKA) is a mechanism that uses SIM/USIM card as EAP authentication and key distribution (among which, SIM card uses EAP-SIM authentication mechanism, USIM card uses EAP-AKA authentication mechanism ). It is based on the certification of Universal Mobile Telecommunication System (UMTS). On the basis of UMTS authentication, EAP-SIM/AKA provides two-way authentication. Only after the mutual authentication between the server and the client is passed, the server sends an EAP-Success authentication success message to the client, and the client can access the network. At the same time, the EAP-SIM/AKA authentication mechanism also supports multiple authentication mechanisms to generate stronger session keys.

RADIUS (Remote Authentication Dial In User Service), a remote user dial-in authentication system, is the most widely used AAA protocol (AAA is the abbreviation of Authentication, Authorization and Accounting). A security management mechanism for access control, providing three security services of authentication, authorization and accounting).

Because the RADIUS protocol is simple and clear, and has strong scalability, it has been widely used, including ordinary telephone Internet access, ADSL Internet access, residential broadband Internet access, IP telephony, and mobile phone prepaid services. The IEEE proposed the 802.1x standard, which is a port-based standard for authentication of access to wireless networks. The authentication also supports the use of the RADIUS protocol.

The working principle of EAP-SIM/AKA authentication is that the client (mobile phone or a device with a SIM card read/write interface) communicates with a wireless access point (AP) supporting 802.1x through a secure channel, and connects to a wireless access point (AP) supporting EAP- Connect to the RADIUS server of the SIM/AKA authentication protocol, and then connect to the HLR (Home Location Register) or HSS (Home Subscriber Server, server home subscriber server) that stores user information through a dedicated channel to complete a sequence of mutual authentication. At present, the key KI used for SIM/USIM card authentication is only stored in the HLR or HSS of the mobile operator. Since the HLR or HSS stores the core data of mobile users, the mobile operator temporarily does not open it to the outside world, which is not conducive to EAP-SIM The popularization and promotion of /AKA; on the other hand, directly using HLR or HSS as the authentication server has higher requirements on the exchange network bandwidth. In addition, it will lead to a sharp increase in the HLR or HSS message interaction, which increases the burden of the HLR or HSS. Unstable or business peak hours may cause normal calls to be affected or even lead to downtime.

SUMMARY OF THE INVENTION

In view of the above problems, the present invention provides a method for implementing EAP authentication in a WLAN network that overcomes the above problems or at least partially solves the above problems. In addition to the standard SIM/USIM key and authentication algorithm, it also supports other keys and authentication algorithms. At the same time, the authentication system is pointed to a new dedicated authentication server, which avoids the traditional HLR or HSS pointed to the mobile operator, and is an EAP-SIM/AKA The popularization and promotion provide convenient conditions.

The technical scheme adopted by the present invention to solve its technical problems is:

A method for implementing EAP authentication in a WLAN network, the WLAN network includes a mobile phone terminal bound with a SIM card or a USIM card, a wireless AP, a dedicated AAA server and a dedicated authentication server, the mobile phone terminal and the wireless AP pass through EAP message communication, the wireless AP communicates with the dedicated AAA server through a RADIUS message, the dedicated AAA server communicates with the dedicated authentication server through a MAP message, and the method includes:

The mobile phone terminal initiates an EAP authentication request message; the wireless AP authenticates the access of the mobile phone terminal, and sends the EAP authentication request message to the dedicated AAA server; the dedicated AAA server sends an obtain authentication vector request message To the dedicated authentication server, the request message for obtaining an authentication vector carries the mobile subscriber identification number IMSI;

The dedicated authentication server receives the request message for obtaining the authentication vector, determines whether the mobile subscriber identification number IMSI is stored locally, and if so, generates a challenge random number RAND through the dedicated random number generation module, and then passes the first dedicated authentication module. generating other authentication vectors and sending the authentication vectors to the dedicated AAA server;

The dedicated AAA server sends an authentication challenge request message carrying a random number RAND to the mobile terminal through the wireless AP, and the mobile terminal determines whether the RAND is a dedicated random number according to the RAND in the authentication challenge message, If yes, the authentication challenge request message is verified by generating a key through the second dedicated authentication module, and an authentication challenge response message is returned to the dedicated AAA server through the AP.

The length of the random number RAND is 16 bytes, including the following fields: a dedicated random number identifier with a length of 2 bytes, an algorithm identifier with a length of 1 byte, a random number with a length of 12, and a random number with a length of 1. Checksum.

If the algorithm identifier and the checksum are consistent with the expected value, it is judged that the RAND is a dedicated random number.

If the RAND is not a dedicated random number, it means that the authentication challenge message is not sent by the dedicated AAA server, and the mobile terminal sends the message to the GSM algorithm authentication module or the UMTS algorithm authentication module for processing.

The WLAN network further includes an HLR or an HSS, and if the dedicated authentication server determines that the mobile subscriber identification number IMSI is not stored locally, the request message for obtaining an authentication vector is forwarded to the HLR or the HSS.

The first dedicated authentication module and the second dedicated authentication module include the same authentication algorithm, and the algorithm identification stored in the SIM card or the USIM card is consistent with the algorithm identification stored in the dedicated authentication server.

The first dedicated authentication module and the second dedicated authentication module include one or more of A3A8, AES, DES, TDES, RSA, and MD5 algorithms.

The dedicated AAA server is a RADIUS server.

If the EAP authentication request message is initiated by a mobile phone terminal bound with a SIM card, the authentication vector is an authentication triplet, including the challenge random number RAND, the symbol response SRES and the key Kc; the other authentication The vector includes the symbolic response SRES and the key Kc; the second dedicated authentication module generates the key to verify the message authentication code MAC in the authentication challenge request message.

If the EAP authentication request message is initiated by a mobile terminal bound with a USIM card, the authentication vector is an authentication quintuple, including: challenge random number RAND, expected response XRES, integrity key IK, key CK and authentication mark AUTH; the other authentication vectors include expected response XRES, integrity key IK, key CK and authentication mark AUTH; the second dedicated authentication module generates a key pair in the authentication challenge request message The message authentication code MAC and authentication mark AUTH are verified.

A method for realizing EAP authentication in a WLAN network described in the present invention provides a combination of multiple groups of EAP-SIM/AKA authentication based on a mobile phone subscriber identity card (SIM/USIM card), which is based on WIFI authentication of a mobile phone terminal, Using EAP-SIM/AKA as the authentication method, without affecting the authentication keys and algorithms required by the standard authentication commands of the SIM/USIM card, use other keys and algorithms in the SIM/USIM card, and automatically complete the WIFI Authentication, login, easy to operate, users can use WIFI without perception. In addition, the method of the present invention avoids the traditional HLR or HSS directed to the mobile operator, and provides convenient conditions for the popularization and promotion of EAP-SIM/AKA.

The above description is only an overview of the technical solution of the present invention, in order to be able to understand the technical means of the present invention more clearly, so that it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy It is understood that specific embodiments of the present invention are listed below.

The above and other objects, advantages and features of the present invention will be more apparent to those skilled in the art from the following detailed description of the specific embodiments of the present invention in conjunction with the accompanying drawings.

Description of drawings

Fig. 1 is a brief flow chart of judging whether a dedicated AAA user is on the dedicated authentication server of the invention;

Fig. 2 is a brief flow chart of judging whether the random number in the challenge message is a dedicated random number on the SIM/USIM card of the present invention;

Fig. 3 is the EAP-SIM authentication flow chart of the present invention;

FIG. 4 is a flow chart of the EAP-AKA authentication of the present invention.

Detailed ways

In order to make the objectives, technical solutions and advantages of the present invention clearer, the embodiments of the present invention will be further described in detail below with reference to the accompanying drawings.

A method for implementing EAP authentication in a WLAN network, the WLAN network includes a mobile phone terminal bound with a SIM card or a USIM card, a wireless AP, a dedicated AAA server and a dedicated authentication server, the mobile phone terminal and the wireless AP pass through EAP Message communication (refer to RFC4186 and RFC4187 for message definition), the wireless AP communicates with the dedicated AAA server through RADIUS messages (refer to RFC2865 and RFC3579 for message definition), and the dedicated AAA server communicates with the dedicated authentication server through MAP messages ( The message definition refers to TS23.002 and TS29.002), and the method includes: the mobile phone terminal initiates an EAP authentication request message; the wireless AP authenticates the access of the mobile phone terminal, and sends the EAP authentication request message to the the dedicated AAA server; the dedicated AAA server sends a request message for obtaining an authentication vector to the dedicated authentication server, and the request message for obtaining an authentication vector carries the mobile subscriber identification number IMSI;

The dedicated authentication server receives the request message for obtaining the authentication vector, determines whether the mobile subscriber identification number IMSI is stored locally, and if so, generates a challenge random number RAND through the dedicated random number generation module, and then passes the first dedicated authentication module. generating other authentication vectors and sending the authentication vectors to the dedicated AAA server;

The dedicated AAA server sends an authentication challenge request message carrying a random number RAND to the mobile terminal through the wireless AP, and the mobile terminal determines whether the RAND is a dedicated random number according to the RAND in the authentication challenge message, If yes, the authentication challenge request message is verified by generating a key through the second dedicated authentication module, and an authentication challenge response message is returned to the dedicated AAA server through the AP.

Figure 1 shows a brief flow chart of judging whether a dedicated AAA user is a dedicated AAA user on the dedicated authentication server. The dedicated authentication server selects the target authentication module by judging whether the mobile subscriber identification number (IMSI) is stored locally. If the IMSI is stored locally, indicating that it is a dedicated AAA user, the dedicated random number generation module is used to generate a challenge random number, and the first dedicated authentication module is used to generate the authentication triplet/quintuple and the authentication result, and Return the dedicated random number, authentication triplet/quintuple, and authentication result to the dedicated AAA server (that is, the RADIUS server); if it is not a dedicated AAA user, use the HLR/HSS of the mobile operator to generate ordinary The random number is generated and the authentication result is generated by the UMTS/GSM authentication module. The ordinary random number and the authentication result are returned to the RADIUS server of the mobile operator.

Figure 2 is a brief flow chart of judging whether the random number in the challenge message is a dedicated random number on the SIM/USIM card. When the SIM/USIM card receives the challenge random number RAND, the The required random number structure, by judging the characteristic value of the special field of the challenge random number RAND, select the target authentication module and the corresponding authentication algorithm, so that the SIM/USIM card supports multiple EAP-SIM/AKA authentication combinations.

Specifically, according to the protocol standard, the length of the random number of the authentication command is fixed to 16 bytes. Table 1 shows the structure of the challenge random number customized by the method of the present invention according to the protocol standard. The length is 16 bytes and includes the following fields: a dedicated random number identifier of 2 bytes in length, an algorithm identifier of length 1 byte, a random number of length 12, and a checksum of length 1.

Table 1

Specifically, if the algorithm identifier and the checksum are consistent with the expected value, it is determined that the RAND is a dedicated random number.

Further, if it is a dedicated random number, the authentication challenge request message is verified by generating a key through the second dedicated authentication module, and the authentication result is returned to the dedicated AAA server through the AP; if it is not a dedicated random number, the The message is sent to the GSM algorithm authentication module or the UMTS algorithm authentication module for processing.

Further, the authentication algorithms of the first dedicated authentication module and the second dedicated authentication module may be one or more of general symmetric encryption algorithms such as AES/DES/TDES, or may be asymmetric algorithms such as RSA and MD5. one or more; the first dedicated authentication module and the second dedicated authentication module include the same authentication algorithm, and the algorithm identification stored in the SIM card or the USIM card is consistent with the algorithm identification stored in the dedicated authentication server .

Specifically, FIG. 3 is a flowchart of the EAP-SIM authentication of the present invention, and the detailed message interaction process is as follows:

1) After the mobile terminal is associated with the wireless AP, the mobile terminal sends EAPoL-Start to the wireless AP to initiate an authentication request.

2) The wireless AP sends the EAP-Req mobile terminal st/Identity message to the mobile terminal.

3) The mobile terminal replies to the EAP-Response/Identity message, and sends its user identity information to the network, and the identity can be pseudo-random NAI or permanent NAI.

4) The wireless AP encapsulates the EAP message with the RADIUS Access-Req mobile terminal st message, puts the Identity in the User-Name attribute of the RADIUS, and sends it to the dedicated AAA server.

5) The dedicated AAA server receives the EAP-Response/Identity packet containing the user identity.

6) The dedicated AAA server recognizes that the authentication method to be used by the user is EAP-SIM. If the Identity sent by the mobile terminal is a pseudo-random NAI, the dedicated AAA server checks that there is no mapping relationship between the pseudo-random NAI and IMSI locally, and then uses the EAP Req mobile terminal st/SIM-Start message to request the permanent NAI again (6, 7, 8 , Step 9 is only used in the scenario where the mobile terminal roams to a new visited place and uses the pseudo-random NAI assigned by other AAA for access authentication). EAP packets are encapsulated in RADIUSAccess-Challenge messages and sent to wireless APs.

7) The wireless AP forwards the EAP-Req mobile terminal st/SIM-Start message to the mobile terminal.

8) The mobile terminal responds with the EAP-Response/SIM-Start message carrying the permanent NAI

9) The wireless AP forwards the EAP-Response/SIM-Start message carrying the permanent NAI to the dedicated AAA server, and the EAP message is encapsulated in the RADIUS Access-Req mobile terminal st message.

10) The dedicated AAA server checks whether there is an available authentication vector cached locally, and if not, sends a MAP_SEND_AUTH_INFO request to the dedicated authentication server, requesting to obtain n groups of authentication vectors (n is configurable, and ranges from 1 to 5).

11) The dedicated authentication server responds to the dedicated AAA server authentication request and issues n groups of authentication triples.

12) The dedicated AAA server checks whether the user's subscription information exists locally. If not, the dedicated AAA server initiates a MAP_UPDATE_GPRS_LOC or MAP-RESTORE-DATA (which can be controlled by a configuration switch) request to the dedicated authentication server to obtain user subscription information.

13) The dedicated authentication server initiates a request for inserting user data MAP_INSERT_SUBS_DATA to the dedicated AAA server, and inserts data into the dedicated AAA server.

14) The dedicated AAA server responds to the dedicated authentication server and inserts the user data message to complete the acquisition of user subscription information.

15) The dedicated authentication server replies to the dedicated AAA server with a MAP_UPDATE_GPRS_LOC or MAP-RESTORE-DATA (which can be controlled by a configuration switch) response message to complete the interaction process of the dedicated authentication server.

16) After the dedicated AAA server checks that the user's subscription is passed, it generates TEKs, MSK and EMSK (see IETF RFC 4186) according to the authentication triplet returned by the dedicated authentication server, and sets m groups (default m=2, configurable, synchronous device specifications) )RAND is concatenated to generate an N*RAND. In order to support the identity confidentiality function, the dedicated AAA server also generates pseudo-random NAI and fast re-authentication NAI for subsequent full authentication and fast re-authentication processes.

17) The dedicated AAA server sends RAND, a message authentication code (MAC) and 2 user identities (pseudo-random NAI and fast re-authentication NAI) to the wireless AP in the EAP-Req mobile terminal st/SIM-Challenge message, EAP Packets are encapsulated in RADIUS Access-Challenge messages.

18) The wireless AP forwards the EAP Req mobile terminal st/SIM-Challenge message to the mobile terminal.

19) The mobile terminal parses out m RANDs according to each RAND being 128 bits, and obtains it according to the encryption algorithm (one of A3A8, AES, DES, TDES, RSA, MD5) in the second dedicated authentication module specified by the algorithm identification K_sres, K_int, K_ency, Session_Key, and use K_int to get the AT_MAC, and compare it with the received AT_MAC. If they are consistent, it means that the dedicated AAA server has passed the authentication. MAC_SRES is generated by a predetermined algorithm using K_sres as a key.

20) The mobile terminal uses the new key material to cover the entire EAP message to calculate a new message authentication code (message authentication code, MAC) value. The mobile terminal sends an EAP Response/SIM/Challenge message containing the RES and the new message authentication code to the wireless AP.

21) The wireless AP sends an EAP Response/SIM-Challenge message to the dedicated AAA server, and the EAP message is encapsulated in a RADIUS Access-Req mobile terminal st message.

22) The dedicated AAA server uses the K_sres generated by the local end as the key to generate the MAC_SRES, and compares it with the received MAC_SRES. If they are consistent, it means that the client has passed the authentication.

23) If all checks are successful, and the dedicated AAA server has previously sent the authentication result protection identifier, the dedicated AAA server must send the EAP Req mobile terminal st/SIM/Notification message before sending the EAP Success message. EAP packets are encapsulated in RADIUS Access-Challenge messages and protected by MAC.

24) The wireless AP forwards the EAP message to the mobile terminal.

25) The mobile terminal sends EAP Response/SIM-Notification.

26) The wireless AP forwards the EAP Response/SIM-Notification message to the dedicated AAA server, and the EAP message is encapsulated in the RADIUS Access-Req mobile terminal st message.

27) The dedicated AAA server sends an EAP-Success message to the wireless AP (possibly before sending EAPNotification, see step 23 for description). If the dedicated AAA server generates additional authentication keys for confidentiality and/or integrity protection of the link between the WLAN and the mobile terminal, the dedicated AAA server includes these key materials in the RADIUSAccess-Accept message.

28) The wireless AP notifies the mobile terminal that the authentication is successful through the EAP Success message. So far, the EAP-SIM interaction has been successfully completed, and the mobile terminal and the wireless AP share the key material generated during the interaction.

Specifically, FIG. 4 is the EAP-AKA authentication flow chart of the present invention, and the detailed message interaction process is as follows:

1) After the mobile terminal is associated with the wireless AP, the mobile terminal sends EAPoL-Start to the wireless AP to initiate an authentication request.

2) The wireless AP sends the EAP-Req mobile terminal st/Identity message to the mobile terminal.

3) The mobile terminal replies to the EAP-Response/Identity message, and sends its user identity information to the network, and the identity can be pseudo-random NAI or permanent NAI.

4) The wireless AP encapsulates the EAP message with the RADIUS Access-Req mobile terminal st message, puts the Identity in the User-Name attribute of the RADIUS, and sends it to the dedicated authentication server.

5) The dedicated authentication server receives the EAP-Response/Identity packet containing the user identity.

6) The dedicated authentication server recognizes that the authentication method to be used by the user is EAP-SIM. If the Identity sent by the mobile terminal is pseudo-random NAI, the dedicated authentication server checks that there is no mapping relationship between the pseudo-random NAI and IMSI locally, and then uses the EAP Req mobile terminal st/SIM-Start message to request the permanent NAI again (6, 7, 8 , Step 9 is only used in the scenario where the mobile terminal roams to a new visited place and uses the pseudo-random NAI assigned by other AAA for access authentication). EAP packets are encapsulated in RADIUS Access-Challenge messages and sent to wireless APs.

7) The wireless AP forwards the EAP-Request/AKA-Identity message to the mobile terminal.

8) The mobile terminal responds with the EAP-Response/AKA-Identity message carrying the permanent NAI

9) The wireless AP forwards the EAP-Response/AKA-Identity message carrying the permanent NAI to the dedicated AAA server, and the EAP message is encapsulated in the RADIUS Access-Request message.

10) The dedicated AAA server checks whether there is an available authentication vector cached locally, and if not, sends a MAP_SEND_AUTH_INFO request to the dedicated authentication server, requesting to obtain n groups of authentication vectors (n is configurable, and ranges from 1 to 5).

11) The dedicated authentication server responds to the dedicated AAA server authentication request, and issues n groups of authentication quintuple.

12) The dedicated AAA server checks whether the user's subscription information exists locally. If not, the AAA initiates a MAP_UPDATE_GPRS_LOC or MAP-RESTORE-DATA (which can be controlled through a configuration switch) request to the dedicated authentication server to obtain user subscription information.

13) The dedicated authentication server initiates a request for inserting user data MAP_INSERT_SUBS_DATA to the dedicated AAA server, and inserts data into the dedicated AAA server.

14) The AA Server responds to the dedicated authentication server and inserts the user data message to complete the acquisition of the user subscription information.

15) The dedicated authentication server replies to the dedicated AAA server with a MAP_UPDATE_GPRS_LOC or MAP-RESTORE-DATA (which can be controlled by a configuration switch) response message to complete the interaction process of the dedicated authentication server.

16) After the dedicated AAA server checks that the user's subscription is passed, it generates TEKs, MSK and EMSK according to the authentication triplet returned by the dedicated authentication server (see IETF RFC 4187). In order to support the identity confidentiality function, the dedicated AAA server also generates pseudo-random NAI and fast re-authentication NAI for subsequent full authentication and fast re-authentication processes.

17) The dedicated AAA server sends RAND, AUTH, a message authentication code (MAC) and 2 user identities (pseudo-random NAI and fast re-authentication NAI) to the wireless AP in the EAP-Request/AKA-Challenge message, and the EAP reports The text is encapsulated in the RADIUS Access-Challenge message.

18) The wireless AP forwards the EAP-Request/AKA-Challenge message to the mobile terminal.

19) The mobile phone terminal runs the encryption algorithm (one of A3A8, AES, DES, TDES, RSA, MD5) in the second dedicated authentication module specified by the algorithm identification. The USIM verifies the AUTN and authenticates the network accordingly, and if the AUTN verification is correct, the USIM calculates RES, IK and CK.

The mobile terminal derives a new additional key material from the IK and CK newly calculated by the USIM, and checks the received MAC with the newly derived key material.

If the protected pseudo-random identities and fast re-authentication identities are received, the mobile terminal saves these temporary identities for subsequent authentication.

20) The mobile terminal uses the new key material to cover the entire EAP message to calculate a new message authentication code (message authentication code, MAC) value. The mobile terminal sends an EAP Response/AKA-Challenge message containing the RES and the new message authentication code to the wireless AP.

21) The wireless AP sends an EAP-Response/AKA-Challenge message to the dedicated AAA server, and the EAP message is encapsulated in a RADIUS Access-Request message.

22) The dedicated AAA server checks the received message authentication code (MAC) and compares the XRES with the received RES.

23) If all checks are successful and the dedicated AAA server has previously sent the authentication result protection flag, the dedicated AAA server must send an EAP-Request/AKA-Notification message before sending the EAP Success message. EAP packets are encapsulated in RADIUS Access-Challenge messages and protected by MAC.

24) The wireless AP forwards the EAP message to the mobile terminal.

25) The mobile terminal sends EAP-Response/AKA-Notification.

26) The wireless AP sends the EAP-Response/AKA-Notification message to the dedicated AAA server, and the EAP message is encapsulated in the RADIUS Access-Request message.

27) The dedicated AAA server sends an EAP Success message to the wireless AP (possibly before sending EAP-Notification, see step 23 for description). If the dedicated AAA server generates additional authentication keys for confidentiality and/or integrity protection of the link between the WLAN and the mobile terminal, the dedicated AAA server includes these key materials in the RADIUSAccess-Accept message.

28) The wireless AP notifies the mobile terminal that the authentication is successful through the EAP Success message. So far, the EAP-AKA interaction has been successfully completed.

In a specific embodiment, the entire implementation steps are as follows:

1. Build a dedicated RADIUS server and dedicated authentication server supporting EAP-SIM/AKA authentication protocol;

2. Make a SIM/USIM card supporting the present invention, and write the key and algorithm identification used for the special EAP-SIM/AKA authentication;

3. Put the SIM/USIM card into the mobile phone client that supports EAP-SIM/AKA authentication, and set the WIFI authentication mode of the mobile phone to EAP-SIM/AKA mode;

4. Configure any one or more wireless routers (APs) that support the wireless 802.1x protocol to adopt RADIUS authentication and point to the pre-built RADIUS server.

5. Import the dedicated EAP-SIM/AKA authentication key and algorithm identifier of the target SIM/USIM card into the dedicated authentication server.

6. As long as the target mobile phone enters the signal coverage of the wireless router (AP), it can automatically realize WIFI authentication and log in to the network. The user can use the WIFI network without perception, and the wireless AP is not restricted by regions.

The above description is only an overview of the technical solution of the present invention, in order to be able to understand the technical means of the present invention more clearly, so that it can be implemented according to the content of the description, and in order to make the above and other purposes, features and advantages of the present invention more obvious and easy It is understood that specific embodiments of the present invention are listed below.

The above are only preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included in the protection of the present invention. within the range.

Claims (10)

1. A method for realizing EAP authentication in W L AN network is characterized in that the W L AN network comprises a mobile phone terminal bound with SIM card or USIM card, a wireless AP, a special AAA server and a special authentication server, the mobile phone terminal and the wireless AP communicate through EAP message, the wireless AP and the special AAA server communicate through RADIUS message, the special AAA server and the special authentication server communicate through MAP message, the method comprises:

the mobile phone terminal initiates an EAP authentication request message; the wireless AP authenticates the access of the mobile phone terminal and sends an EAP authentication request message to the special AAA server; the special AAA server sends an authentication vector acquisition request message to the special authentication server, wherein the authentication vector acquisition request message carries a mobile subscriber identification number IMSI; the special authentication server receives the request message for obtaining the authentication vector, judges whether the mobile subscriber identification number IMSI is stored locally, generates a challenge random number RAND through a special random number generation module if the mobile subscriber identification number IMSI is stored locally, generates other authentication vectors through a first special authentication module, and sends the authentication vectors to the special AAA server;

the special AAA server sends an authentication challenge request message carrying a random number RAND to the mobile phone terminal through the wireless AP, the mobile phone terminal judges whether the RAND is the special random number according to the RAND in the authentication challenge message, if so, a key is generated by a second special authentication module to verify the authentication challenge request message, and an authentication challenge response message is returned to the special AAA server through the AP;

the WIFI authentication mode of the mobile phone terminal is set to be an EAP-SIM mode or an AKA mode; the wireless AP is set to adopt a RADIUS authentication mode and points to the AAA server.

2. The method for implementing EAP authentication in W L AN network as in claim 1, wherein the random number RAND has a length of 16 bytes, and comprises fields of a specific random number id with a length of 2 bytes, AN algorithm id with a length of 1 byte, a random number with a length of 12, and a checksum with a length of 1.

3. The method of claim 2 wherein the RAND is determined to be a dedicated random number if the algorithm id and the checksum match expected values.

4. The method of claim 3 for implementing EAP authentication in W L AN network, wherein if the RAND is not a special random number, the handset terminal sends message to GSM algorithm authentication module or UMTS algorithm authentication module for processing.

5. The method of claim 1, wherein the W3556 AN network further comprises AN H L R or AN HSS, and wherein the request message for obtaining authentication vector is forwarded to the H L R or the HSS if the dedicated authentication server determines that the IMSI is not locally stored.

6. The method of claim 1, wherein the first and second dedicated authentication modules comprise the same authentication algorithm, and the algorithm id stored in the SIM card or USIM card is consistent with the algorithm id stored in the dedicated authentication server.

7. The method of claim 6, wherein the first and second dedicated authentication modules comprise one or more of A3a8, AES, DES, TDES, RSA, MD5 algorithms.

8. The method for implementing EAP authentication in a W L AN network as in claim 1, wherein the dedicated AAA server is a RADIUS server.

9. The method of claim 1, wherein if the EAP authentication request message is initiated by a mobile phone terminal with a SIM card bound thereto, the authentication vector is AN authentication triple comprising a challenge random number (RAND), a Symbolic Response (SRES) and a secret key (Kc), the other authentication vectors comprise a Symbolic Response (SRES) and a secret key (Kc), and the second authentication module generates a secret key to verify a Message Authentication Code (MAC) in the authentication challenge request message.

10. The method of claim 1, wherein if the EAP authentication request message is initiated by a USIM-bound mobile phone terminal, the authentication vector is AN authentication quintuple comprising a challenge random number (RAND), AN expected response (XRES), AN Integrity Key (IK), a key (CK) and AN authentication tag (AUTH), and the other authentication vectors comprise AN expected response (XRES), AN Integrity Key (IK), a key (CK) and AN authentication tag (AUTH), and the second authentication module generates a key to verify the Message Authentication Code (MAC) and the authentication tag (AUTH) in the authentication challenge request message.

Images