移动接入安全：AAA与网络安全详解

5星 · 超过95%的资源需积分: 4 58 浏览量更新于2024-07-27 收藏 8.52MB PDF 举报

"AAA和网络安全性对于移动访问是关键的，本书深入探讨了这些主题，包括RADIUS、DIAMETER、EAP、PKI以及IP移动性等核心技术。由Madjid Nakhjiri和Mahsa Nakhjiri撰写，来自Motorola Labs和Motorola Personal Devices的专业人士提供权威指导。" 在当今信息化社会中，移动设备的使用日益广泛，移动接入技术成为连接用户与网络的重要桥梁。"AAA（认证、授权和审计）和网络安全性对于移动访问"是确保移动用户安全、有效和受控地接入网络的核心概念。这本书详细阐述了这两个领域的理论和实践，为读者提供了全面的理解。首先，AAA（认证、授权和审计）是网络服务的基础，特别是对于移动用户而言。认证过程确保只有合法用户能够访问网络，通常通过用户名和密码、智能卡或生物识别等方式进行；授权则确定用户可以访问哪些资源和服务；审计则记录所有活动，以便后续分析和安全监控。本书可能涵盖了多种认证协议，如RADIUS（远程用户拨号认证系统）和DIAMETER（一种增强型的AAA协议），它们在大型网络环境中被广泛采用。网络安全性是移动访问的另一个重要方面。随着数据泄露和网络攻击的增加，保护移动用户的数据和通信变得至关重要。书中可能会讨论如何使用加密协议，如EAP（扩展认证协议），以确保数据传输的安全。EAP支持多种身份验证方法，能适应各种安全环境的需求。此外，公钥基础设施（PKI）在保护网络资源和通信中扮演着关键角色。PKI通过数字证书实现身份验证，允许安全的数据加密和解密。对于移动设备，PKI可以确保即使在不安全的网络环境中也能进行安全的通信。最后，IP移动性是移动接入的一个关键技术，它允许设备在不同网络间移动时保持连接。移动IPv4和IPv6协议可能在书中有所提及，它们允许移动设备在不中断服务的情况下改变其网络连接。本书由Madjid Nakhjiri和Mahsa Nakhjiri撰写，他们作为摩托罗拉公司的专家，将实际经验与理论知识相结合，为读者提供了深入了解移动接入安全性的宝贵资料。无论是网络管理员、安全专业人员还是对移动网络感兴趣的学者，都能从这本书中受益，提升对移动接入安全的理解和实践能力。

Foreword

The market for mobile computers and commmunication devices continues to grow, which

means that every year there are more and more of them. This is creating numerous opportunities

for network providers and operators of all sorts, because many of these devices derive their

usefulness from their ability to get access to the Internet. Recently, within the IETF, there has

been a surge of interest in creating new protocols and protocol interfaces to better enable

operators to take advantage of these opportunities. These new protocols, taken as a whole,

bring about a new kind of operator operation known as “AAA services”, thus the title of the

book. Madjid, one of the two authors of this book, is known to me as a regular in several IETF

working groups, and his work is well represented within this book.

There is no doubt that AAA services are already of tremendous importance in today’s

Internet, given that much of the access control is mediated already by RADIUS servers and

associated protocols. Even so, I think that the true value of AAA services is still in the

process of emerging, as we transition from laptop computing to wireless mobile communications

in the future. As we begin to store more of our credentials on our wireless gadgets, and as the

needs for user authentication continue to expand, it seems very natural that today’s AAA

practice will adapt to the needs of the new wireless technologies. These needs include higher

performance, improved roaming facilities, and interface to a multiplicity of security technologies.

Already, my experience is that I have to carry around a bag of strange connectors, security

cards, credit cards, and telephone numbers in order to be mobile. It seems that when

traveling, leaving any of these behind is much worse than forgetting to pack a toothbrush,

soap, or even shirts or socks. After all, I can usually find a place to buy those latter items.

Within the book, we can see the first glimmerings of how this new wireless mobile world

will look to the user desiring to make use of local Internet connectivity. Several recent speci-

fications have been finally approved and are dutifully described in this book. In particular,

the ideas of seamless mobility and context transfer provide great hope for the desired user

productivity and the experience of well-engineered convenience. Clearly, there is a big gap

separating the barebones specification and widespread deployment. It is to fill just these gaps

that books such as this one are needed. But filling known gaps is only the beginning. Once

the basic hurdles are cleared, I am confident that many new applications will soon be imagined

and built to use the simplified access models provided by the new AAA services.

Charlie Perkins

fbetw.fm Page xv Wednesday, August 3, 2005 8:03 PM

Preface

In today’s world, where computer viruses and security threats are common themes in

anything from Hollywood movies and TV advertisements to political discussions, it seems

unthinkable to ignore security considerations in the design and implementation of any

network. However, it is only in the past 4–5 years that talkative security experts have been

invited to the design table from the start. The common thinking only 5 years ago was either:

this is somebody else’s problem or let us design the major functionalities first, then bring in a

cryptographer to secure it! This treatment of security as an add-on feature typically led either

to design delays, overheads and extra costs when the “feature” had to be included, or to

ignored security provisioning when the “feature” was not a must. The problem, of course,

stemmed from the fact that security “features” have rarely been revenue-makers. As we all

know, many political, social and economic events in the last half decade have forced the

designers, regulators and businessmen to adjust their attitudes towards security consider-

ations. People realized that although security measures are not revenue-makers, their lack is

indeed a deal breaker, to say the least, or has catastrophic aftermaths, at worst.

The Internet Engineering Task Force (IETF) has also played an important role in estab-

lishing the aforementioned trend by making a few bold moves. The rejection of some very

high profile specifications due to the lack of proper security considerations was a message to

the industry that security is not to be taken lightly. This was done in a dot.com era where the

Internet and its applications seemed to have no boundaries and security provisioning seemed

to be only a barrier rather than an enabler.

As a result of this trend, the field of network security gained a lot of attention. A profession

that seemed to belong only to a few mathematically blessed brains opened up to a community

of practitioners dealing with a variety of networking and computing applications. Many stan-

dards, such as 802.1X, IPsec and TLS, were developed to apply cryptographic concepts and

algorithms to networking problems. Many books were written on the topics of security and

cryptography, bringing the dark and difficult secrets of fields such as public key crypto-

graphy to a public that typically was far less mathematically savvy than the original inventors.

Many protocols and procedures were designed to realize infrastructures such as PKIs to bring

these difficult concepts to life. Still, cryptographic algorithms or security protocols such as

IPsec are not enough alone to operate a network that needs to generate services and revenues

or to protect its constituency. Access to the network needs to be controlled. Users and devices

need to be authorized for a variety of services and functions and often must pay for their

usage. This is where the AAA protocols came in. In its simpler form a AAA protocol such as

fpref.fm Page xvii Wednesday, August 3, 2005 8:03 PM

xviii Preface

a base RADIUS protocol only provides authentication-based access control. A few service

types are also included in the authorization signaling. RADIUS was later augmented with

accounting procedures. Diameter as a newer protocol was only standardized less than 2 years ago.

Both RADIUS and Diameter are still evolving at the time of writing. This evolution is to

enable AAA mechanisms and protocols to provide powerful functions to manage many

complicated tasks ranging from what is described above to managing resources and mobility

functions based on a variety of policies. In the near future the networks need to allow the

user through a variety of interfaces, devices and technologies to gain access to the network.

The user will require to be mobile and yet connected. The provision of the connection may

at times have to be aided by third parties. The interaction between AAA and security proce-

dures with entities providing mobility and roaming capabilities is a very complicated one and

is still not completely understood. Despite this complexity, there seem to be very few books

on the market that discuss more than a single topic (either security, or mobility or wireless

technology). The topic of AAA is largely untouched. Very little text in the way of published

literature is available on AAA protocols, let alone describing the interaction of these

protocols with security, mobility and key management protocols.

The idea for writing this book started from an innocent joke by the IETF operation and

management area director during an IETF lunch break a few years ago. When we asked

about the relations between the use of EAP for authentication and Mobile IP-AAA signaling,

the answer was “Maybe you should write a book about the subject”. Even though this was

considered a joke at a time, as we started to work on deploying AAA infrastructure for

Mobile IP and EAP support, the need for easy-to-understand overview material was felt so

strongly that the joke now sounded like black humor. We had to write a book on AAA as a

community service!

The book is geared towards people who have a basic understanding of Internet Protocol

(IP) and TCP/IP stack layering concepts. Except for the above, most of the other IP-related

concepts are explained in the text. Thus, the book is suitable for managers, engineers,

researchers and students who are interested in the topic of network security and AAA but do

not possess in-depth IP routing and security knowledge. We aimed at providing an overview

of IP mobility (Mobile IP) and security (IPsec) to help the reader who is not familiar with

these concepts so that the rest of the material in the book can be understood. However, the

reader may feel that the material quickly jumps from a simple overview of Mobile IP or IPsec

to sophisticated topics such as bootstrapping for IP mobility or key exchange for IP security.

Our reasoning here was that we felt that there are a number of excellently written books on

the topics of Mobile IP and IPsec, to which the reader may refer, so it would not be fair to fill

this book with redundant information. Instead, the book provides just enough material on

those topics to quickly guide the reader into the topics that are more relevant to the rest of the

material in this book. The book may also serve as a reference or introduction depending on the

reader’s need and background, but it is not intended as a complete implementation reference

book. The tables listing the protocol attributes are intentionally not exhaustive to avoid

distractions. Most of the time, only subsets that pertain to the discussions within the related

text are provided to enable the reader to understand the principles behind the design of these

attributes. At the same time, references to full standards specifications are provided for

readers interested in implementation of the complete feature sets.

Chapter 1 of this book provides an overview of what AAA is and stands for. It provides

thorough descriptions of both authorization and accounting mechanisms. Unfortunately the

field and standardization on authorization mechanisms is in the infancy stage at this point and

fpref.fm Page xviii Wednesday, August 3, 2005 8:03 PM

Preface xix

accounting, compared to authentication, has received far less attention in the research and

standards community due to its operator-specific nature. Due to the enormous amount of

research done on authentication, we devote Chapter 2 entirely to authentication concepts and

mechanisms and also provide a rather unique classification (from IAB) of authentication

mechanisms in that chapter. We will come back to the topic of authentication and describe

more sophisticated EAP-based authentications in Chapter 10, but after Chapter 2, we go

through the concepts of key management in Chapter 3 to lay the groundwork for most of the

security and key management discussions in Chapter 4 and the rest of the book. Chapter 4

discusses IPsec and TLS briefly, but provides a thorough discussion on IKE as an important

example of a key management and security association negotiation protocol. As mentioned

earlier, the aim of that chapter is not to describe IPsec or TLS thoroughly. Both these proto-

cols are provided for completeness and to provide the background for the later discussion of

security topics. Chapter 5 discusses mobility protocols for IP networks. It describes basic

Mobile IP procedures and quickly goes through the latest complementary work in IETF, such

as bootstrapping. This chapter also describes two IETF seamless mobility protocols, context

transfer and candidate access router discovery, which may be required to achieve seamless

handovers. This chapter also describes the security procedures for Mobile IPv4 and lays the

groundwork for Mobile IP-AAA discussions in Chapter 8. Chapters 6 and 7 describe the two

most important AAA protocols, namely RADIUS and Diameter and their applications for

authentication and accounting. Many of the specifications that are considered work in

progress in IETF are covered here.

Chapter 8 finally covers the topic discussed in the IETF joke we mentioned earlier: Mobile

IP-AAA signaling to provide authentication and key management for Mobile IP signaling.

Chapter 9 goes on to provide a description of public key infrastructures (PKI) and the

issues and concerns with management of PKIs, certificates and their revocation.

Chapter 10 describes the EAP authentication framework, EAP signaling transport and the

structure for a generic EAP-XXX mechanism. It also provides overviews of a variety of EAP

authentication methods, such as EAP-TLS, EAP-TTLS, EAP-SIM, and so on.

Finally, Chapter 11 makes a humble attempt at describing the overall problem of AAA and

identity management in a multi-operator environment and discusses various architectural

models to tackle the problem. This chapter also provides an overview of the Liberty Alliance.

We wish the readers a joyful read.

Acknowledgements

Finally, it is the time to give acknowledgement to the people who have provided help,

encouragement and support. First, we would like to thank Mike Needham of Motorola Labs

for showing enormous enthusiasm and full confidence when we broached the idea of writing

a book at a time when we were not fully confident ourselves that this was a task we could

tackle. We would like to specially thank Dorsa Mirazandjani for acting as our test audience,

reading and providing comments and corrections on many chapters of this book, despite her

busy work and graduate school schedule. We would also like to thank Jeff Kraus for taking

the time and reading through Chapter 8 and providing technical and editorial feedback.

A special thanks you goes to Mana Mirazanjani for the first draft of the beautiful cover design.

Another very special thank you goes to Charlie Perkins who despite his very busy schedule

took the time and wrote a generous foreword for this book. We would like to thank the IETF for

fpref.fm Page xix Wednesday, August 3, 2005 8:03 PM

剩余317页未读，继续阅读

zgwjane

粉丝: 2
资源: 7

移动接入安全：AAA与网络安全详解

AAA and Network Security for Mobile Access

EVDO名词缩略语.pdf

网络安全与移动接入的AAA协议

R语言机器学习.zip

【雷达信号分选】基于matlab CDIF算法雷达信号分选仿真【含Matlab源码 8945期】.mp4

IEC62116-2014中文翻译+英文原版.zip

全国2900多个区县级空间权重矩阵.z.zip

Go：Go语言性能优化.docx

基于VB+Access 实现的网吧管理系统毕业设计(源代码+系统)

全国30省绿色全要素生产率GTFP原始数据+测算结果数据2004-2020年.z.zip

最新资源