基于RADIUS/EAP的WLAN认证及其安全性分析

介绍了基于RADIUS/EAP协议的IEEE 802.1x无线局域网的接入认证过程与结构，针对无线局域网访问控制具有的三方协作过程特点，分析了无线局域网的安全机制，指出了或者由于协议自身缺陷或者由于不恰当的系统实现或者由于协议恶化，均可以导致有无线局域网的6个方面的安全漏洞，指出了需充分利用RADIUS/EAP分组结构的数据段提供加密认证并且还需设计双门接入的认证机制。最后比较了常见的四种安全接入方案，指出了在不同程度和范围内具有一定的抵御各种攻击的能力。This paper introduces the authentication and the architecture of IEEE802.1x Wireless Local Area Network based on the RADIUS/EAP, with respect to the characteristics of three parties coloration in accessing to WLAN, analyses the security mechanism, indicates that there would exist six security crushers either by the protocol defects or by the inadequate usage and deteriorating and it is necessary to fully utilize the data frame in the RADIUS/EAP structure for the encryption and authentication as well as to design the double-doors authenticated access mechanism. The four common authentication solutions are compared and the corresponding security functions in certain different extents are evaluated.