基于eduroam的跨域无线接入解决方案  

A World-Wide Wireless Access Solution Based on eduroam

作　　者：王丽[1] 曾珊[1] 夏明山[1] 齐法制[1] 陈刚[1] 谢建军[2] 胡笑然 董科军[2] 

机构地区：[1]中国科学院高能物理研究所,北京100049 [2]中国科学院计算机网络信息中心,北京100190

出　　处：《科研信息化技术与应用》2016年第2期3-7,共5页E-science Technology & Application

摘　　要：eduroam(education roaming,教育漫游)满足了授权用户在成员高校和科研机构之间自由、安全的使用无线网络,提高了网络接入效率。eduroam在无线网络的接入认证时,应用IEEE 802.1x协议,采用RADIUS协议进行认证。本文分析了eduroam架构和认证过程,在高能所网络环境中部署实践了eduroam认证环境,验证了账号认证和签发证书认证的可行性,并提出在认证过程中对LDAP明文密码的NT hash加密存储方法。分析证明,该方法简化了eduroam部署,提高了认证效率和安全性。eduroam （education roaming,） is a secure, world-wide roaming wireless access service developed for international research and education community. Its purpose is to set up a wireless LAN roaming infrastructure for the authorized users to facilitate the wireless access freely and securely among the member institutions, eduroam uses IEEE 802.1x protocol and RADIUS protocol for wireless network access authentication. In this paper, the eduroam architecture and authentication processes are analyzed; eduroam has been deployed in IHEP network environment, and the practice verifies the practicability of the account authentication and certificate authentication; in addition, NT hash encryption algorithm for LDAP storage of password is proposed for the authentication processes. Analysis shows that the method simplifies the deployment and improves the efficiency of authenticate and security of the system.

关 键 词：eduroam RADIUS协议 LDAP 

分 类 号：TN925.93[电子电信—通信与信息系统]