Research On Security Analysis And Proof Technology Of Improved Extensible Authentication Protocol

With the rapid development of wireless network technology,civil aircraft airborne information domains use Gatelink to connect to the airport Wi Fi under the airport environment to achieve communication with airports and airline private networks.In order to ensure the security of the "airplane-ground" connection and realize the secure communication between the civil aircraft airborne information domain and the airline network facilities,Gatelink introduced an extensible authentication protocol.Extensible Authentication Protocol(EAP)is a widely used authentication framework that provides multiple authentication sub-protocols.While providing security authentication services for Gatelink,it also faces many security threats.This paper focuses on the EAP-TLS extended authentication method.Based on improving the security of the current EAP-TLS authentication scheme as the basic starting point,it analyzes the existing security problems of the existing mainstream EAP-TLS authentication scheme and proposes an EAP-TLS authentication.The protocol is improved,and its security is analyzed and proved automatically.The specific research content is as follows:Analyzing the EAP authentication methods proposed by Shojaie Bahareh et al.And Jingjing Zhang et al.,It is found that the existing EAP-TLS authentication methods have three security flaws.First,in the case of no authentication,the server sends its public key in clear text,and the attacker can monitor in real time between the client and the server,and can directly obtain and tamper with the server’s public key without the communication parties’ knowledge.To complete the authentication and implement a man-in-the-middle attack.Second,during the authentication process,the client uses an unauthenticated key to encrypt its own identity.The attacker can directly obtain the identity of the client and tamper with the identity,which causes the authentication process to fail or leaks directly.User identity.Third,the client and the access point send the EAP-Success message in clear text.The attacker intercepts the Success response packet and tampers with Logoff,causing the client to actively disconnect from the authentication system and re-initiate.Authentication is repeated multiple times,causing the server authentication number to reach the upper limit and closing the authentication port,stopping providing services to the client,and implementing a Do S attack.In view of the above security issues,this paper proposes an improved EAP-TLS authentication protocol scheme.The second phase of the scheme uses the ECDSA signature mechanism.The client and server sign the certificate and random number respectively.The client,access point,and server respectively Decrypt the signature and perform mutual authentication to ensure the legality of the certified entity and effectively resist man-in-the-middle attacks.In the second stage,the server uses the ECDSA signature mechanism to sign its own certificate,and the client verifies the legitimacy of the server certificate.The key performs RSA asymmetric encryption on its own identity,binds the identity with the certificate,and sends it to the authenticator together,which can effectively prevent identity attacks.In the third stage,the server uses AES symmetric encryption to encrypt EAP-Success to prevent attacks.The interceptor directly intercepts the EAP-Success response packet to effectively resist Do S attacks.This paper makes a tool-assisted automated analysis of the security of the EAP-TLS authentication protocol improvement scheme.Formal analysis tool ProVerif is used,and applied PI calculus is used to establish various cryptographic primitives and describe security protocols.For each security attribute,insert a corresponding challenge statement into the security protocol description to obtain the results of the automated attribute verification.The proof results show that the improved authentication protocol proposed in this paper has security attributes such as mutual authentication,key security,message integrity,resistance to man-in-the-middle attacks,resistance to Do S attacks,and resistance to identity attacks.The protocol has security properties such as resistance to replay attacks,resistance to impersonation attacks,and forward confidentiality.By comparing and analyzing the security attributes with the EAP authentication protocols proposed by Shojaie Bahareh et al.And Jingjing Zhang et al.,It is automatically proven that the protocols of Shojaie Bahareh et al.Do not meet the attributes of resistance to man-in-the-middle attacks,resistance to Do S attacks,and resistance to identity attacks.The proposed protocol does not satisfy the property of resisting Do S attacks,which proves the effectiveness of the proposed protocol improvement.This paper also analyzes the communication overhead and calculation overhead of each protocol,showing the practicability of the proposed scheme.