基于EAP-TLS的可信网络连接认证方案设计与实现  

Design and Implementation of an Authentication Scheme for Trusted Network Connection Based on EAP-TLS

作　　者：池亚平[1] 杨磊[1,2] 李兆斌[1] 方勇[1] 

机构地区：[1]北京电子科技学院通信工程系,北京100070 [2]西安电子科技大学通信学院,陕西西安710071

出　　处：《计算机工程与科学》2011年第4期8-12,共5页Computer Engineering & Science

基　　金：国家自然科学基金资助项目(60951001);北京市自然科学基金资助项目(4102057);中办信息安全重点实验室项目(YZDJ0806)

摘　　要：TNC架构在终端接入网络前对终端的平台身份和平台环境进行可信认证,保证了接入终端的可信,但这种可信认证存在单向性的局限,无法保证网络服务器的可信。EAP-TLS是802.1x中一种基于证书的扩展认证协议,支持双向认证机制。本文在分析TNC架构和EAP-TLS双向认证机制基础上,设计了一种基于EAP-TLS的可信网络连接双向认证方案,该方案能够对终端和服务器的平台身份、平台完整性和平台可信环境进行双向认证。在FHH@TNC开源架构搭建的可信网络环境上实现了客户端与服务器之间双向可信认证方案,并进行了方案测试,证明了方案的正确性。When a terminal access network,a trusted authentication of the terminal platform identity and the platform environment are implemented in the TNC architecture,which ensures the credibility of access terminal.However,the trusted authentication has the one-way limitation that can not guarantee the network server＇s credibility.EAP-TLS is a extended authentication protocol based on 802.1x,which suports mutual authentication.On the basis of analyzing the architecture of TNC and the mutual authentication mechanism of EAP-TLS,a mutual authentication scheme used in TNC based on EAP-TLS is designed in this paper.The mutual authentication scheme is based on the certificates,the integrity and the trusted environment of platform,both for clients and servers.Finally,the paper implements a two-way trusted authentication scheme between the client and the server on the basis of the open source software FHH@TNC,and proves its validity.

关 键 词：可信网络连接 双向认证 EAP-TLS 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]