安全協(xié)議與標(biāo)準(zhǔn)(ppt75頁(yè))(編輯修改稿)
2025-01-27 18:39 本頁(yè)面
【文章內(nèi)容簡(jiǎn)介】 Infrastructure ? WAPI安全系統(tǒng)采用公鑰密碼技術(shù)，鑒權(quán)服務(wù)器AS負(fù)責(zé)證書(shū)的頒發(fā)、驗(yàn)證與吊銷(xiāo)等，無(wú)線客戶端與無(wú)線接入點(diǎn) AP上 都 安裝有 AS頒發(fā)的公鑰證書(shū)，作為自己的 數(shù)字身份 憑證。 ? 當(dāng)無(wú)線客戶端登錄至無(wú)線接入點(diǎn) AP時(shí)，在訪問(wèn)網(wǎng)絡(luò)之前必須通過(guò)鑒別服務(wù)器 AS對(duì)雙方進(jìn)行身份驗(yàn)證。根據(jù) 驗(yàn)證 的結(jié)果，持有合法證書(shū)的移動(dòng)終端才能接入持有合法證書(shū)的無(wú)線接入點(diǎn) AP。 WAPI ? 基于 WAPI協(xié)議的 WLAN安全網(wǎng)絡(luò)由 AP、客戶端 C和認(rèn)證服務(wù)器（ AS）三個(gè)實(shí)體組成，利用公開(kāi)密碼體系完成 C和 AP間的雙向認(rèn)證。 ? 認(rèn)證過(guò)程中利用橢圓曲線密碼算法， C和 AP間協(xié)商出會(huì)話密鑰；數(shù)據(jù)采用國(guó)家密碼主管部門(mén)指定的加密算法完成加密（ SMS4或 AES?）。 ? 支持在通信過(guò)程中在一定時(shí)間間隔后或傳輸了一定數(shù)量的數(shù)據(jù)包后，更新會(huì)話密鑰。 ? WAPI提供有線無(wú)線一體化 IP數(shù)據(jù)訪問(wèn)安全方案，可以在用戶信息系統(tǒng)中提供集中的安全認(rèn)證和管理方案。 SMS4 ? The SMS4 algorithm was invented by Prof. LU Shuwang(呂述望 ). The algorithm was declassified in January, 2023. A few details of the SMS4 cipher are: ? It has a block size of 128 bits. ? Uses an 8bit Sbox ? The key size is 128 bits. ? The only operations used are XOR, circular shifts and SBox applications ? Performs 32 rounds to process one block. ? Each round updates a quarter (32 bits) of the internal state. ? A nonlinear key schedule is used to produce the round keys. ? Decryption is using the same keys as encryption, but in reversed order. WEP、 WAPI和 WAPI爭(zhēng)議 ? 中國(guó)政府為保護(hù)自主知識(shí)產(chǎn)權(quán)，在 WAPI標(biāo)準(zhǔn)的實(shí)施無(wú)限期推延后，由工業(yè)化信息化部宣布所有在中國(guó)大陸發(fā)售的手機(jī)禁止安裝 WiFi。 ? 后來(lái)迫于市場(chǎng)壓力，以及 2023年 WAPI通過(guò)ISO認(rèn)證， 2023年以后中國(guó)政府對(duì) Wifi開(kāi)禁，但所有在中國(guó)大陸銷(xiāo)售的帶 WLAN功能的手機(jī)必須兼容 WAPI ISO進(jìn)程 ? 2023年 3月， ISO通過(guò) ，并駁回 WAPI提案。 ? 2023年 6月，中國(guó)重新提交 WAPI標(biāo)準(zhǔn)申請(qǐng)，期間 WAPI的基礎(chǔ)架構(gòu)虎符 TePA通過(guò) ISO認(rèn)證。 ? 但即便如此，整個(gè) WAPI標(biāo)準(zhǔn)仍未完全通過(guò)ISO認(rèn)證，而且應(yīng)用還是很少，標(biāo)準(zhǔn)幾乎成擺設(shè)，而且 WAPI的國(guó)際標(biāo)準(zhǔn)化進(jìn)程不時(shí)遭遇美國(guó)的阻撓。 2G ? GSM結(jié)構(gòu) ? GSM A* GSM結(jié)構(gòu) ? 移動(dòng)終端 基站子系統(tǒng) 交換子系統(tǒng) 網(wǎng)絡(luò)管理 用戶和終端 設(shè)備數(shù)據(jù)庫(kù) MSC VLR HLR EIR OMC BTS BTS BTS AUC BSC GSM work ? The structure of a GSM work GSM ? 頻段和信道使用 – 900＋ M、 1800Mhz， AMPS 800＋ M ? 先 FDM，再 TDM – 124對(duì)上 /下行子信道寬 200khz，總 124 8＝992個(gè)連接 ? 子信道使用 –用戶數(shù)據(jù)片 57 2＝ 114b – TDM幀含由 8個(gè)用戶數(shù)據(jù)＝ 1250b –多幀＝ 32500b ? 對(duì)應(yīng) 120ms的傳輸時(shí)間 –合 Moderate level security ? GSM was designed with a moderate level of service security. ? The system was designed to authenticate the subscriber using a preshared key and challengeresponse. ? Communications between the subscriber and the base station can be encrypted. A5/1 and A5/2 ? GSM uses several cryptographic algorithms for security. The A5/1 and A5/2 stream ciphers are used for ensuring overtheair voice privacy. A5/1 was developed first and is a stronger algorithm used within Europe and the United States。 A5/2 is weaker and used in other countries. ? Serious weaknesses have been found in both algorithms: it is possible to break A5/2 in realtime with a ciphertextonly attack, and … A5/1 to be broken with a rainbow table attack. ? The system supports multiple algorithms so operators may replace that cipher with a stronger one. A5/1 / A5/2 ? A5/1 is used in Europe and the United States. A5/2 was a deliberate weakening of the algorithm for certain export regions. ? A5/1 was developed in 1987, when GSM was not yet considered for use outside Europe, and A5/2 was developed in 1989. ? Both were initially kept secret. However, the general design was leaked in 1994, and the algorithms were entirely reverse engineered in 1999 by Marc Briceno from a GSM telephone. A5/1 ? A5/1 is used in Europe and the
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1