802.11i标准：安全解析与未来趋势

需积分: 0 38 浏览量更新于2024-08-02 收藏 279KB PDF 举报

"802.11i (How we got here and where are we headed)" 本文将深入探讨IEEE 802.11i标准及其构成部分，该标准旨在确保企业无线局域网（WLAN）中的机密性、完整性和可用性（CIA三元组）的完整性，从而恢复对无线网络安全的信心。机密性、完整性和可用性是任何安全基础设施应满足的基本准则。作者认为，由于缺乏真正安全的标准，企业WLAN的实施受到了限制。 802.11i标准是IEEE为解决无线网络安全性问题而制定的一项重要规范。在802.11最初的无线局域网标准中，安全机制相对薄弱，这导致了对企业WLAN安全性的广泛担忧。802.11i引入了Wi-Fi保护访问（WPA）和后来的WPA2，这两个协议极大地提高了无线网络的安全水平。 WPA（Wi-Fi Protected Access）是802.11i标准的一个早期版本，它主要用以替代不安全的WEP（有线等效加密）。WPA通过使用TKIP（临时密钥完整性协议）改进了WEP的加密方式，解决了WEP的弱点。同时，WPA还引入了IEEE 802.1X身份验证框架，允许使用多种身份验证方法，如EAP（扩展认证协议），提高了网络的访问控制。 WPA2则进一步增强了安全性能，它采用了AES（高级加密标准）作为其加密算法，比WPA的TKIP更加强大且难以破解。WPA2结合了AES和802.1X，提供了强大的加密和身份验证功能，使得802.11i标准成为当时最安全的无线网络标准之一。然而，随着技术的发展和攻击手段的进化，802.11i标准也面临新的挑战。例如，针对WPA2的KRACK（Key Reinstallation Attack）攻击暴露了协议中的漏洞，这促使业界继续更新和增强无线网络安全标准。现在，我们有了WPA3，它在前代的基础上增加了多项增强措施，如更强大的个人网络加密、简化设备的开放网络认证以及对物联网设备的增强安全性支持。 802.11i标准的制定是无线网络安全的重要里程碑，它通过引入WPA和WPA2等技术显著提升了无线网络的安全水平。尽管如此，随着技术的进步和新的威胁出现，安全标准也需要不断迭代和完善。对于企业和组织来说，了解并实施最新的安全标准，如WPA3，是保护其无线网络免受潜在威胁的关键。

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46

WEP protocol introduced three main facets of security to WLANs. These are

Authentication, Encryption, and Integrity checks.

Authentication

When we speak to someone on the phone, we rely on our recognition of the

person’s voice on the other end of the phone. Our conversations are based on

trusting our ability to identify the other party. When we speak to someone for the

first time, we want to get information from them before we divulge any

information. We might ask them their name, why they are calling, and even how

they discovered our phone number. The world of WLAN communication is no

different. Wireless network administrators needed a means by which to ensure

that wireless clients could authenticate themselves to access points. One of

WEP’s components was an authentication process to assist with the need to

ensure that access points only communicated with authorized wireless clients.

To properly follow the exchange between a wireless client and an access point,

we must look at WEP’s use of management frames. Management frames are

used during the authentication process and are one of the three types of frames

that WEP uses. The other two are control and data frames that are used for other

WEP activities. WEP Authentication is based on a shared key also known as the

WEP key. Both the client (station) and the access point need to have the same

WEP key to be able to allow communication beyond the authentication

exchange. Below is an example of the exchange

1. The station sends an a

request to the AP.

uthentication

2. The AP sends back a random

number known as the challenge

text.

3. The station encrypts the challenge

text using the WEP key to create

ciphertext.

4. The AP then verifies that the

challenge text it sent was

encrypted with the correct WEP

key.

“Wireless LAN: Security – WEP.” 30 June 2002.

URL:

http://www.esat.kuleuven.ac.be/~h239/reports/2001/wlan/security.php (26 June 2004.)

Edney, Jon and Arbaugh, William. Real 802.11 Security: Wi-Fi Protected Access and 802.11i. Boston, Addison-Wesley,

2004. 67-72”

Key fingerprint = AF19 FA27 2F94 998D FDB5 DE3D F8B5 06E4 A169 4E46

Encryption

After a client is authenticated and associated to an access point, the client is

allowed to communicate with the network via the access point. This phase of

communication is where WEP’s encryption process is implemented. WEP’s

encryption is based on the RC4 stream cipher algorithm. The cipher takes

plaintext and applies an encryption key to it making the output randomized

encrypted text called ciphertext. The receiving device decrypts the ciphertext

using the pre-determined encryption key.

The initial WEP standard used 40-bit encryption keys due to the export

restrictions in place at the time. Manufacturers quickly saw an opportunity and

increased the length of their WEP key implementations to 104-bits and quickly

labeled their product as more secure than other 40-bit implementations. To add

randomness to the encryption key, an initialization vector (IV) was added to the

fixed-length encryption key. The IV is 24 bits in length and is randomize for each

packet encrypted. The IV is added to the encryption key and is then applied to

the plaintext packet to encrypt it. It is important to note that the IV is sent in

plaintext so that the receiving device knows what it needs to add to the

predefined WEP key used to encrypt the packet. The addition of the IV increases

the number of bits from 40-bit keys and 104-bit keys to 64 bits and 128 bits

respectively. These are the key sizes supported on all WLAN devices that are

WEP compliant.

Some vendors have extended the key length to 256-bit to give

customers the impression that they are “more” secure. The figure below depicts

the major components of a WEP-encrypted 802.11 frame.

Encrypted

Plain

Text

DATA IC

Integrity check

As you can see from the above diagram, an ICV accompanies the data and IV in

a WEP-encrypted 802.11 packet. The ICV is 4-byte Integrity Check Value that is

appended to the original packet. The purpose of this value is to ensure that a

packet is not tampered with during transmission. If just one bit in the packet is

changed, the message is discarded by the receiving device because the ICV

value would change. The ICV is computed by combining all the bytes in the

packet and generating the value. The ICV is simply a Cyclic Redundancy Check.

WEP improved the integrity of the CRC by encrypting it as part of the packet.

Edney, Jon and Arbaugh, William. Real 802.11 Security: Wi-Fi Protected Access and 802.11i. Boston, Addison-Wesley,

2004. 73-74”

Jason Liu, “The Insecurity of WEP.”

URL:

http://www.cse.ogi.edu/class/cse525/summaries/10/TheInsecurityofWEP.ppt (16 June 2004.)

剩余25页未读，继续阅读

edison_huang

粉丝: 0
资源: 1

802.11i标准：安全解析与未来趋势

a project model for the FreeBSD Project.7z

英语表达法.pdf

The headed social forece model.zip_SFM_Social-force-model_The D.

DoG.zip_DOG算子_DoG算子 matlab_headed2qs_site:www.pudn.com_图像处理DOG

高超声速project1.rar_headed6h6_hypersonic_高超_高超声速_高超声速软件

DTCWT-fussionnew.rar_dtcwt_dtcwt fusion_headed8gr_image fusion

Agile.Adoption.Patterns.A.Roadmap.to.Organizational.Success.0321514521

Packt.Python.Interviews.2018.2

简单注册登录（android studio）.zip_android 登录_headed5cb_安卓实现登录_注册安卓实现_登陆

chromedriver-win64_121.0.6167.0.zip

最新资源