移动设备的AAA与网络安全

需积分: 9 28 浏览量更新于2024-07-23 收藏 8.83MB PDF 举报

"AAA和网络安全性对于移动访问的重要性，涉及到RADIUS、Diameter、EAP、PKI以及IP移动性等关键概念。" 本文档主要探讨了在移动访问场景下的认证（Authentication）、授权（Authorization）和计费（Accounting，合称AAA）以及网络安全性问题。这些是确保移动设备安全接入网络的基础机制。其中，RADIUS（Remote Authentication Dial-In User Service）是一种广泛使用的AAA协议，用于在网络中验证用户身份、授权服务并记录用户活动。它在无线网络和远程访问服务中尤其常见。 Diameter是RADIUS的升级版，设计目的是解决RADIUS的某些局限性，如性能、可扩展性和安全性问题。Diameter提供更强大的功能，支持更复杂的计费和管理需求，更适合现代网络环境。 EAP（Extensible Authentication Protocol）是另一种灵活的认证协议，允许不同的身份验证方法，如SIM卡、证书或一次性密码。EAP常用于无线局域网（WLAN）和蜂窝网络中，提供了更高的安全性和互操作性。 PKI（Public Key Infrastructure）是用于创建、分发、存储和撤销数字证书的系统，它在移动网络中的作用是验证用户和设备的身份，确保通信的安全。通过公钥和私钥对，PKI提供了数据加密和签名，防止中间人攻击和信息篡改。 IP移动性是指设备在网络中移动时保持其IP地址不变的能力，这对于移动设备的连续连接至关重要。这通常通过移动IP或IPv6的移动性功能来实现，使得用户在移动过程中仍能保持网络连接，而无需重新建立会话。 "AAA和网络安全性对于移动访问"涵盖了多个关键领域，包括认证协议、网络管理和安全性基础设施，这些都是构建和维护安全、高效移动网络不可或缺的部分。理解并掌握这些技术是确保移动设备及其用户在任何地方都能安全、无缝地接入网络的基础。

Foreword

The market for mobile computers and commmunication devices continues to grow, which

means that every year there are more and more of them. This is creating numerous opportunities

for network providers and operators of all sorts, because many of these devices derive their

usefulness from their ability to get access to the Internet. Recently, within the IETF, there has

been a surge of interest in creating new protocols and protocol interfaces to better enable

operators to take advantage of these opportunities. These new protocols, taken as a whole,

bring about a new kind of operator operation known as “AAA services”, thus the title of the

book. Madjid, one of the two authors of this book, is known to me as a regular in several IETF

working groups, and his work is well represented within this book.

There is no doubt that AAA services are already of tremendous importance in today’s

Internet, given that much of the access control is mediated already by RADIUS servers and

associated protocols. Even so, I think that the true value of AAA services is still in the

process of emerging, as we transition from laptop computing to wireless mobile communications

in the future. As we begin to store more of our credentials on our wireless gadgets, and as the

needs for user authentication continue to expand, it seems very natural that today’s AAA

practice will adapt to the needs of the new wireless technologies. These needs include higher

performance, improved roaming facilities, and interface to a multiplicity of security technologies.

Already, my experience is that I have to carry around a bag of strange connectors, security

cards, credit cards, and telephone numbers in order to be mobile. It seems that when

traveling, leaving any of these behind is much worse than forgetting to pack a toothbrush,

soap, or even shirts or socks. After all, I can usually find a place to buy those latter items.

Within the book, we can see the first glimmerings of how this new wireless mobile world

will look to the user desiring to make use of local Internet connectivity. Several recent speci-

fications have been finally approved and are dutifully described in this book. In particular,

the ideas of seamless mobility and context transfer provide great hope for the desired user

productivity and the experience of well-engineered convenience. Clearly, there is a big gap

separating the barebones specification and widespread deployment. It is to fill just these gaps

that books such as this one are needed. But filling known gaps is only the beginning. Once

the basic hurdles are cleared, I am confident that many new applications will soon be imagined

and built to use the simplified access models provided by the new AAA services.

Charlie Perkins

fbetw.fm Page xv Wednesday, August 3, 2005 8:03 PM

Preface

In today’s world, where computer viruses and security threats are common themes in

anything from Hollywood movies and TV advertisements to political discussions, it seems

unthinkable to ignore security considerations in the design and implementation of any

network. However, it is only in the past 4–5 years that talkative security experts have been

invited to the design table from the start. The common thinking only 5 years ago was either:

this is somebody else’s problem or let us design the major functionalities first, then bring in a

cryptographer to secure it! This treatment of security as an add-on feature typically led either

to design delays, overheads and extra costs when the “feature” had to be included, or to

ignored security provisioning when the “feature” was not a must. The problem, of course,

stemmed from the fact that security “features” have rarely been revenue-makers. As we all

know, many political, social and economic events in the last half decade have forced the

designers, regulators and businessmen to adjust their attitudes towards security consider-

ations. People realized that although security measures are not revenue-makers, their lack is

indeed a deal breaker, to say the least, or has catastrophic aftermaths, at worst.

The Internet Engineering Task Force (IETF) has also played an important role in estab-

lishing the aforementioned trend by making a few bold moves. The rejection of some very

high profile specifications due to the lack of proper security considerations was a message to

the industry that security is not to be taken lightly. This was done in a dot.com era where the

Internet and its applications seemed to have no boundaries and security provisioning seemed

to be only a barrier rather than an enabler.

As a result of this trend, the field of network security gained a lot of attention. A profession

that seemed to belong only to a few mathematically blessed brains opened up to a community

of practitioners dealing with a variety of networking and computing applications. Many stan-

dards, such as 802.1X, IPsec and TLS, were developed to apply cryptographic concepts and

algorithms to networking problems. Many books were written on the topics of security and

cryptography, bringing the dark and difficult secrets of fields such as public key crypto-

graphy to a public that typically was far less mathematically savvy than the original inventors.

Many protocols and procedures were designed to realize infrastructures such as PKIs to bring

these difficult concepts to life. Still, cryptographic algorithms or security protocols such as

IPsec are not enough alone to operate a network that needs to generate services and revenues

or to protect its constituency. Access to the network needs to be controlled. Users and devices

need to be authorized for a variety of services and functions and often must pay for their

usage. This is where the AAA protocols came in. In its simpler form a AAA protocol such as

fpref.fm Page xvii Wednesday, August 3, 2005 8:03 PM

xviii Preface

a base RADIUS protocol only provides authentication-based access control. A few service

types are also included in the authorization signaling. RADIUS was later augmented with

accounting procedures. Diameter as a newer protocol was only standardized less than 2 years ago.

Both RADIUS and Diameter are still evolving at the time of writing. This evolution is to

enable AAA mechanisms and protocols to provide powerful functions to manage many

complicated tasks ranging from what is described above to managing resources and mobility

functions based on a variety of policies. In the near future the networks need to allow the

user through a variety of interfaces, devices and technologies to gain access to the network.

The user will require to be mobile and yet connected. The provision of the connection may

at times have to be aided by third parties. The interaction between AAA and security proce-

dures with entities providing mobility and roaming capabilities is a very complicated one and

is still not completely understood. Despite this complexity, there seem to be very few books

on the market that discuss more than a single topic (either security, or mobility or wireless

technology). The topic of AAA is largely untouched. Very little text in the way of published

literature is available on AAA protocols, let alone describing the interaction of these

protocols with security, mobility and key management protocols.

The idea for writing this book started from an innocent joke by the IETF operation and

management area director during an IETF lunch break a few years ago. When we asked

about the relations between the use of EAP for authentication and Mobile IP-AAA signaling,

the answer was “Maybe you should write a book about the subject”. Even though this was

considered a joke at a time, as we started to work on deploying AAA infrastructure for

Mobile IP and EAP support, the need for easy-to-understand overview material was felt so

strongly that the joke now sounded like black humor. We had to write a book on AAA as a

community service!

The book is geared towards people who have a basic understanding of Internet Protocol

(IP) and TCP/IP stack layering concepts. Except for the above, most of the other IP-related

concepts are explained in the text. Thus, the book is suitable for managers, engineers,

researchers and students who are interested in the topic of network security and AAA but do

not possess in-depth IP routing and security knowledge. We aimed at providing an overview

of IP mobility (Mobile IP) and security (IPsec) to help the reader who is not familiar with

these concepts so that the rest of the material in the book can be understood. However, the

reader may feel that the material quickly jumps from a simple overview of Mobile IP or IPsec

to sophisticated topics such as bootstrapping for IP mobility or key exchange for IP security.

Our reasoning here was that we felt that there are a number of excellently written books on

the topics of Mobile IP and IPsec, to which the reader may refer, so it would not be fair to fill

this book with redundant information. Instead, the book provides just enough material on

those topics to quickly guide the reader into the topics that are more relevant to the rest of the

material in this book. The book may also serve as a reference or introduction depending on the

reader’s need and background, but it is not intended as a complete implementation reference

book. The tables listing the protocol attributes are intentionally not exhaustive to avoid

distractions. Most of the time, only subsets that pertain to the discussions within the related

text are provided to enable the reader to understand the principles behind the design of these

attributes. At the same time, references to full standards specifications are provided for

readers interested in implementation of the complete feature sets.

Chapter 1 of this book provides an overview of what AAA is and stands for. It provides

thorough descriptions of both authorization and accounting mechanisms. Unfortunately the

field and standardization on authorization mechanisms is in the infancy stage at this point and

fpref.fm Page xviii Wednesday, August 3, 2005 8:03 PM

Preface xix

accounting, compared to authentication, has received far less attention in the research and

standards community due to its operator-specific nature. Due to the enormous amount of

research done on authentication, we devote Chapter 2 entirely to authentication concepts and

mechanisms and also provide a rather unique classification (from IAB) of authentication

mechanisms in that chapter. We will come back to the topic of authentication and describe

more sophisticated EAP-based authentications in Chapter 10, but after Chapter 2, we go

through the concepts of key management in Chapter 3 to lay the groundwork for most of the

security and key management discussions in Chapter 4 and the rest of the book. Chapter 4

discusses IPsec and TLS briefly, but provides a thorough discussion on IKE as an important

example of a key management and security association negotiation protocol. As mentioned

earlier, the aim of that chapter is not to describe IPsec or TLS thoroughly. Both these proto-

cols are provided for completeness and to provide the background for the later discussion of

security topics. Chapter 5 discusses mobility protocols for IP networks. It describes basic

Mobile IP procedures and quickly goes through the latest complementary work in IETF, such

as bootstrapping. This chapter also describes two IETF seamless mobility protocols, context

transfer and candidate access router discovery, which may be required to achieve seamless

handovers. This chapter also describes the security procedures for Mobile IPv4 and lays the

groundwork for Mobile IP-AAA discussions in Chapter 8. Chapters 6 and 7 describe the two

most important AAA protocols, namely RADIUS and Diameter and their applications for

authentication and accounting. Many of the specifications that are considered work in

progress in IETF are covered here.

Chapter 8 finally covers the topic discussed in the IETF joke we mentioned earlier: Mobile

IP-AAA signaling to provide authentication and key management for Mobile IP signaling.

Chapter 9 goes on to provide a description of public key infrastructures (PKI) and the

issues and concerns with management of PKIs, certificates and their revocation.

Chapter 10 describes the EAP authentication framework, EAP signaling transport and the

structure for a generic EAP-XXX mechanism. It also provides overviews of a variety of EAP

authentication methods, such as EAP-TLS, EAP-TTLS, EAP-SIM, and so on.

Finally, Chapter 11 makes a humble attempt at describing the overall problem of AAA and

identity management in a multi-operator environment and discusses various architectural

models to tackle the problem. This chapter also provides an overview of the Liberty Alliance.

We wish the readers a joyful read.

Acknowledgements

Finally, it is the time to give acknowledgement to the people who have provided help,

encouragement and support. First, we would like to thank Mike Needham of Motorola Labs

for showing enormous enthusiasm and full confidence when we broached the idea of writing

a book at a time when we were not fully confident ourselves that this was a task we could

tackle. We would like to specially thank Dorsa Mirazandjani for acting as our test audience,

reading and providing comments and corrections on many chapters of this book, despite her

busy work and graduate school schedule. We would also like to thank Jeff Kraus for taking

the time and reading through Chapter 8 and providing technical and editorial feedback.

A special thanks you goes to Mana Mirazanjani for the first draft of the beautiful cover design.

Another very special thank you goes to Charlie Perkins who despite his very busy schedule

took the time and wrote a generous foreword for this book. We would like to thank the IETF for

fpref.fm Page xix Wednesday, August 3, 2005 8:03 PM

剩余317页未读，继续阅读

qq_15855557

粉丝: 0
资源: 6

移动设备的AAA与网络安全

AAA and Network Security for Mobile Access

EVDO名词缩略语.pdf

网络安全与移动接入的AAA协议

移动接入安全：AAA与网络安全详解

中国电信cdma2000 HRPD Rev.A IPv6技术规范详解

numexpr-2.8.3-cp38-cp38-win_amd64.whl

ujson-5.3.0-cp311-cp311-win_amd64.whl

基于MATLAB车牌识别程序技术实现面板GUI.zip

RJFireWall-maste赛资源

msgpack-1.0.4-cp39-cp39-win_amd64.whl

最新资源