OSDP协议一致性指南:libosdp-conformance-guide.pdf解析

版权申诉
5星 · 超过95%的资源 1 下载量 87 浏览量 更新于2024-10-24 收藏 105KB RAR 举报
资源摘要信息: "OSDP协议一致性指南" OSDP(Open Supervised Data Protocol)是一种广泛使用的安全通信协议,专为在访问控制系统和设备之间提供安全、可靠的通信而设计。它被用于智能读卡器和控制面板之间的连接,强调了数据的完整性和加密通信,以保护系统不受某些攻击手段如中间人攻击(MITM)和数据篡改的影响。OSDP 协议由安全设备制造商协会(SDM)开发,并已成为行业标准。 ### 关键知识点 1. **OSDP协议介绍**: - 用于访问控制系统的一种协议。 - 强调双向通信和加密。 - 提供了更高的安全性。 - 是行业标准协议之一。 2. **OSDP协议特性**: - 支持加密和认证,确保通信安全。 - 允许远程设备和控制中心之间的双向通信。 - 支持多读卡器配置。 - 具备实时反馈机制。 3. **应用领域**: - 适用于需要高安全性要求的场合,比如银行、数据中心和政府机构。 - 广泛应用于智能建筑和智能住宅的门禁系统。 4. **libosdp**: - "libosdp"是OSDP协议的一个开源实现。 - 提供了访问控制系统和OSDP设备之间通信的库。 - 用于开发和测试与OSDP兼容的设备。 5. **一致性指南的重要性**: - 为了确保不同厂商的设备能有效互通,一致性测试是必须的。 - “libosdp-conformance-guide”文档提供了如何使用libosdp库进行一致性测试的指南。 - 确保设备满足OSDP标准的功能要求和性能标准。 6. **OSDP协议版本**: - 应关注使用的OSDP协议版本(如OSDP v2.1.1),因为不同版本可能有不同的特性集。 - 确保实现的协议特性与OSDP标准保持一致。 7. **安全性优势**: - 使用OSDP协议能够抵抗各种常见的安全威胁,比如数据篡改、设备仿冒和重放攻击。 - 通过不断更新和升级,OSDP协议可以应对新的安全挑战。 8. **性能优势**: - 提供了快速响应和处理能力。 - 支持多协议和多设备集成。 9. **未来发展**: - OSDP作为行业标准,预计会有更多的厂商和开发者加入。 - 将继续关注OSDP协议的升级和安全性增强。 通过本指南的学习和理解,系统开发者和制造商能够更好地利用libosdp库进行OSDP协议的实现,并确保其产品能够通过一致性测试,达到行业标准,从而为终端用户提供更加安全、可靠、符合标准的产品和服务。
2018-12-05 上传
Table of contents 1 INTRODUCTION .......................................................................................................................................................... 8 1.1 Scope ............................................................................................................................................................ 8 1.2 References.................................................................................................................................................... 8 1.3 Definitions and acronyms............................................................................................................................ 10 1.3.1 Shall/should/may/might word usage .............................................................................................. 10 1.3.2 Conventions ................................................................................................................................... 10 1.3.3 Abbreviations and acronyms.......................................................................................................... 11 1.3.4 Definitions ...................................................................................................................................... 12 1.3.5 Symbols ......................................................................................................................................... 13 1.4 Architecture ................................................................................................................................................. 14 1.5 Device roles ................................................................................................................................................ 14 1.5.1 Authentication roles........................................................................................................................ 14 1.5.2 Configurator delegation.................................................................................................................. 15 1.6 Security considerations............................................................................................................................... 15 1.6.1 Overview ........................................................................................................................................ 15 1.6.2 Threat profile .................................................................................................................................. 15 1.6.3 Trust model .................................................................................................................................... 18 2 DPP PROTOCOL USAGE.......................................................................................................................................... 20 2.1 Overview ..................................................................................................................................................... 20 2.2 Infrastructure setup and connectivity .......................................................................................................... 20 2.2.1 AP configuration............................................................................................................................. 20 2.2.2 STA configuration........................................................................................................................... 20 2.2.3 Infrastructure connectivity .............................................................................................................. 20 2.2.4 Message flows for infrastructure connectivity ................................................................................ 20 2.3 Wi-Fi Direct ................................................................................................................................................. 23 2.3.1 Establishing a P2P group using DPP............................................................................................. 24 2.3.2 P2P Group operation ..................................................................................................................... 26 3 SECURITY.................................................................................................................................................................. 27 3.1 Properties.................................................................................................................................................... 27 3.2 Public key cryptography.............................................................................................................................. 27 3.2.1 Supported public key cryptosystem ............................................................................................... 27 3.2.2 Notation.......................................................................................................................................... 27 3.2.3 Cryptographic suites ...................................................................................................................... 28 3.2.4 Point representation....................................................................................................................... 28 4 DATA STRUCTURES................................................................................................................................................. 29 4.1 Public keys .................................................................................................................................................. 29 4.2 Connectors.................................................................................................................................................. 29 4.3 DPP Configuration object............................................................................................................................ 30 4.3.1 Wi-Fi Technology ........................................................................................................................... 30 4.3.2 DPP Discovery ............................................................................................................................... 30 4.3.3 DPP Credential .............................................................................................................................. 30 5 BOOTSTRAPPING OF TRUST.................................................................................................................................. 32 5.1 Overview ..................................................................................................................................................... 32 5.2 Bootstrapping information ........................................................................................................................... 32 5.2.1 Bootstrapping information format................................................................................................... 32 5.3 Scanning a QR code................................................................................................................................... 33 5.4 NFC............................................................................................................................................................. 34 5.4.1 Overview ........................................................................................................................................ 34 5.4.2 NFC Connection Handover............................................................................................................ 35 5.4.3 DPP bootstrapping via NFC URI record ........................................................................................ 37 5.5 Bluetooth ..................................................................................................................................................... 38 5.5.1 Overview ........................................................................................................................................ 38 5.5.2 Responder procedures .................................................................................................................. 40 5.5.3 Initiator procedures ........................................................................................................................ 40 Device Provisioning Protocol Specification v1.0 © 2018 Wi-Fi Alliance. All Rights Reserved. Used with the permission of Wi-Fi Alliance under the terms as stated in this document. Page 4 of 124 5.6 PKEX: Proof of knowledge of a shared code, key, phrase, or word...........................................................41 5.6.1 PKEX preliminaries ........................................................................................................................ 41 5.6.2 PKEX exchange phase .................................................................................................................. 42 5.6.3 PKEX commit-reveal phase ........................................................................................................... 43 6 DPP AUTHENTICATION............................................................................................................................................ 45 6.1 Overview ..................................................................................................................................................... 45 6.2 DPP Authentication protocol ....................................................................................................................... 45 6.2.1 DPP capabilities negotiation .......................................................................................................... 46 6.2.2 DPP authentication request ........................................................................................................... 47 6.2.3 DPP authentication response ........................................................................................................ 47 6.2.4 DPP authentication confirm ........................................................................................................... 49 6.3 DPP Configuration protocol ........................................................................................................................ 50 6.3.1 Overview ........................................................................................................................................ 50 6.3.2 DPP configuration request ............................................................................................................. 50 6.3.3 DPP configuration response .......................................................................................................... 51 6.3.4 DPP Configuration Attributes object .............................................................................................. 51 6.3.5 Connector....................................................................................................................................... 52 6.3.6 DPP Configuration object............................................................................................................... 53 6.4 Network introduction protocol ..................................................................................................................... 55 6.4.1 Introduction .................................................................................................................................... 55 6.4.2 Connector group comparison......................................................................................................... 56 6.5 Network access protocols ........................................................................................................................... 56 7 STATE MACHINES .................................................................................................................................................... 57 7.1 Initiator state machine................................................................................................................................. 57 7.1.1 States ............................................................................................................................................. 57 7.1.2 Events and output .......................................................................................................................... 57 7.1.3 Variables ........................................................................................................................................ 57 7.1.4 Parent process behavior ................................................................................................................ 57 7.1.5 State machine behavior ................................................................................................................. 57 7.2 Responder state machine ........................................................................................................................... 59 7.2.1 States ............................................................................................................................................. 59 7.2.2 Events and output .......................................................................................................................... 59 7.2.3 Variables ........................................................................................................................................ 59 7.2.4 State machine behavior ................................................................................................................. 60 7.3 Configurator state machine......................................................................................................................... 62 7.3.1 States ............................................................................................................................................. 62 7.3.2 Events and output .......................................................................................................................... 62 7.3.3 Variables ........................................................................................................................................ 62 7.3.4 Parent process behavior ................................................................................................................ 62 7.3.5 State machine behavior ................................................................................................................. 62 7.4 Enrollee state machine................................................................................................................................ 64 7.4.1 States ............................................................................................................................................. 64 7.4.2 Events and output .......................................................................................................................... 64 7.4.3 Variables ........................................................................................................................................ 64 7.4.4 State machine behavior ................................................................................................................. 64 7.5 Detailed protocol description....................................................................................................................... 66 7.5.1 DPP bootstrapping......................................................................................................................... 66 7.5.2 DPP authentication exchange........................................................................................................ 66 7.5.3 DPP configuration exchange ......................................................................................................... 68 7.5.4 DPP network introduction exchange.............................................................................................. 69 7.5.5 Network access.............................................................................................................................. 70 8 DPP ATTRIBUTE, FRAME, AND ELEMENT FORMATS .......................................................................................... 71 8.1 DPP attributes ............................................................................................................................................. 71 8.1.1 DPP attribute body field definitions................................................................................................ 72 8.2 DPP frames................................................................................................................................................. 74 8.2.1 DPP Public Action frames.............................................................................................................. 74 8.2.2 DPP Generic Advertisement Service (GAS) frames...................................................................... 78 Device Provisioning Protocol Specification v1.0 © 2018 Wi-Fi Alliance. All Rights Reserved. Used with the permission of Wi-Fi Alliance under the terms as stated in this document. Page 5 of 124 8.3 DPP status and error codes........................................................................................................................ 81 8.4 Network Introduction protocol elements...................................................................................................... 82 8.4.1 Overview ........................................................................................................................................ 82 8.4.2 Network Introduction protocol AKM suite....................................................................................... 82 9 DPP CONFIGURATION BACKUP AND RESTORE.................................................................................................. 83 9.1 Overview ..................................................................................................................................................... 83 9.2 DPP AsymmetricKeyPackage..................................................................................................................... 83 9.3 DPPEnvelopedData .................................................................................................................................... 84 9.3.1 DPPAsymmetricKeyPackage encryption....................................................................................... 86 9.3.2 DPPEnvelopedData decryption ..................................................................................................... 86 9.4 DPP configuration backup .......................................................................................................................... 86 9.5 DPP configuration restore........................................................................................................................... 86 9.6 Enabling multiple Configurators in DPP...................................................................................................... 87 APPENDIX A (INFORMATIVE) TEST VECTORS ............................................................................................................ 88 A.1 Test vectors for DPP Authentication using P-256 for mutual authentication..............................................88 A.2 Test vectors for DPP Authentication using P-256 for Responder-only authentication ...............................91 A.3 Test vectors for DPP Authentication using P-384 for mutual authentication..............................................94 A.4 Test vectors for DPP Authentication using P-521 for mutual authentication..............................................98 A.5 Test vectors for DPP Authentication using Brainpool P-256r1 for mutual authentication ........................103 A.6 Test vectors for DPP Authentication using Brainpool P-384r1 using mutual authentication....................106 A.7 A.7 Test vectors for DPP Authentication using Brainpool P-512r1 for mutual authentication ..................110 APPENDIX B ROLE-SPECIFIC ELEMENTS FOR PKEX............................................................................................... 115 B.1 Role-specific elements for NIST p256 ...................................................................................................... 115 B.2 Role-specific elements for NIST p384 ...................................................................................................... 115 B.3 Role-specific elements for NIST p521 ...................................................................................................... 116 B.4 Role-specific elements for Brainpool p256r1 ............................................................................................ 117 B.5 Role-specific elements for Brainpool p384r1 ............................................................................................ 117 B.6 Role-specific elements for Brainpool p512r1 ............................................................................................ 118 APPENDIX C PKEX TEST VECTOR FOR NIST P256................................................................................................... 119 C.1 Initial state of Initiator and Responder ...................................................................................................... 119 C.2 Initiator generates PKEX Exchange Request frame................................................................................. 119 C.3 Responder processes PKEX Exchange Request frame........................................................................... 120 C.4 Responder generates PKEX Exchange Response frame ........................................................................ 120 C.5 Initiator processess PKEX Exchange Response frame............................................................................ 121 C.6 Initiator generates PKEX Commit/Reveal request.................................................................................... 121 C.7 Responder processes PKEX Commit/Reveal Request frame.................................................................. 122 C.8 Responder generates PKEX Commit/Reveal Response frame................................................................ 123 C.9 Initiator processes PKEX Commit/Reveal Response frame..................................................................... 124