Abstract:
A method for increasing security of plaintext authentication in a wireless local area network (WLAN) is provided. The method includes steps of: establishing a basic server set in the WLAN; establishing a blank learning table for saving identities of the faked users; generating identities to the faked users; performing a faked extensible authentication protocol process according to the generated identities; determining whether the learning table should be updated; and updating the learning table if the learning table should be updated.

Description:
FIELD OF THE INVENTION  
       [0001]     The present invention relates to a method for increasing security of a network, and particularly to a method for increasing security of plaintext authentication in a wireless local area network.  
       DESCRIPTION OF RELATED ART  
       [0002]     Wireless local area network (WLAN) technology has become an integral part of modern computer network architecture, but accompanied with other questions, such as user authentication, security of WLAN, and so on. Because in WLAN, information is transmitted by radio, and hackers may easily receive the radio to steal the information therein, therefore a user must use an authentication method to increase the security to protect the information transmitted over WLAN.  
         [0003]     In a conventional authentication of the WLAN, plaintext authentication is employed for authenticating users, such as Lightweight Extensible Authentication Protocol (LEAP), which uses password to authenticates users. However, the LEAP is only applicable for hardware or software of the Cisco or other specific companies, and is prone to suffering from a dictionary attack.  
       SUMMARY OF INVENTION  
       [0004]     According to an exemplary embodiment of the present invention, a method for increasing security of plaintext authentication in a wireless local area network (WLAN) is provided. The method comprises steps of: establishing a basic server set in the WLAN; establishing a blank learning table for saving identities of the faked users; generating identities to the faked users; performing a faked extensible authentication protocol process according to the generated identities; determining whether the learning table should be updated; and updating the learning table if the learning table should be updated.  
         [0005]     Other advantages and novel features will become more apparent from the following detailed description when taken in conjunction with the accompanying drawings, in which: 
     
    
     BRIEF DESCRIPTION OF DRAWINGS  
       [0006]      FIG. 1  is a structural schematic diagram of an application environment according to an exemplary embodiment of the invention;  
         [0007]      FIG. 2  illustrates a learning table according to an exemplary embodiment of the invention;  
         [0008]      FIG. 3  illustrates a time line of a frame of a faked EAP process in different application environments according to an exemplary embodiment of the invention;  
         [0009]      FIG. 4  is a flow chart of increasing security of a method accordance to an exemplary embodiment of the invention; and  
         [0010]      FIG. 5  is a flow chart of increasing security of a method according to another exemplary embodiment of the invention. 
     
    
     DETAILED DESCRIPTION  
       [0011]      FIG. 1  is a structural schematic diagram of an application environment according to an exemplary embodiment of the invention. In the exemplary embodiment, a basic service set (BSS) includes an access point  10 , a client  20 , and a server  30 . The client  20  is connected with the access point  10 , and the access point  10  is connected with the server  30 , thus a communication between the client  20  and the server  30  is established. In the exemplary embodiment, the server  30  is an authentication server.  
         [0012]     When the BSS begins operating, the client  20  transmits an Associate-Request to the access point  10  for establishing a communication with the server  30 . The access point  10  then feeds back an Associate-Response to the client  20 , which indicates whether the access point  10  accepts the Associate-Request. If yes, the communication between the client  20  and the server  30  is established, and the BSS enters an Extensible Authentication Protocol (EAP) process.  
         [0013]     In the EAP process, the access point  10  acts as a communication medium between the client  20  and the server  30 . Firstly, the client  20  transmits an EAP-start frame to the access point  10 . The EAP-start frame is used for showing the BSS has come into an EAP process. Upon receiving the EAP-start frame, the access point  10  transmits an EAP-Request/Identity frame, which requests the client  20  to transmit user identity information. The client  20  then transmits an EAP-Response/Identity frame that includes the user identity information to the access point  10 . The access point  10  encapsulates the user identity information in a Remote Authentication Dial-In User Service (RADIUS) Access-Request frame, and transmits the RADIUS Access-Request frame to the server  30 . After receiving the RADIUS Access-Request frame, the server  30  transmits a RADIUS Access-Challenge frame that includes an EAP-Request/Challenge frame to the access point  10 . The EAP-Request/Challenge frame is used for requesting the client  20  to respond a challenge to the server  30 . In the exemplary embodiment, the EAP-Request/Challenge frame includes a string. The access point  10  then transmits the EAP-Request/Challenge frame to the client  20 . The client  20  processes the string in the EAP-Request/Challenge frame and transmits an EAP-Response frame that includes the string processed by the client  20  to the access point  10 . The access point  10  transmits a RADIUS Access Request frame that includes the EAP-Response frame and the EAP-Request/Challenge to the server  30 . The server  30  determines whether the user identity information is legitimate. If the user identity information is legitimate, the server  30  transmits a RADIUS-access-accept frame to the access point  10 . Upon receiving the RADIUS-access-accept frame, the access point  10  transmits an EAP-Success frame to the client  20 . In the EAP process, the partie receiving frames automatically generates an acknowledgement (ACK) frame to the partie transmitting frames after each frame is successfully transmitted.  
         [0014]     In the present invention, the access point  10  generates all the frames to build a covering for the true user and enforce protection against a dictionary attack, thereby preventing an attacker from obtaining true information.  
         [0015]     In the exemplary embodiment, once the access point  10  starts operating, identities of faked users are generated.  
         [0016]      FIG. 2  illustrates a learning table  110 , which is used for generating the identities of the faked users. The learning table  110  includes a user identity type column, a true user number column, a faked user number column, a true user identity column and a faked user identity column. In the exemplary embodiment, the user identity type includes Message-Digest Algorithm 5 (MD5), Lightweight Extensible Authentication Protocol (LEAP), Microsoft Challenge Authentication Protocol v2 (MSCHAP-v2) and so on.  
         [0017]     In the exemplary embodiment, the access point  10  generates fifteen faked users to protect one true user. Because no connection is established between the client  20  and the access point  10  at the initialization phase of the access point  10 , the number of true users in the learning table  110  is zero, and the column of “True User Identity” is blank. The access point  10  uses a string regarded legitimate by ordinary attackers to generate fifteen faked user identities and stores them in the learning table  110 . In the exemplary embodiment, the string is a hexadecimal string. The number of faked users in the learning table  110  can be updated automatically. For example, in the LEAP, if the number of true users is N, wherein N is an integer (1, 2, 3 . . . ), the access point  10  generates faked users for each true user, ie. the access point  10  further generates 15 N faked users. Thus the number of faked user in the learning table  110  is [15*(N+1)].  
         [0018]     The access point  10  performs the EAP process according to the faked user identities of the learning table  110 . When the client  20  tries to communicate with the server  30  employing one of the user identity types, if the access point  10  receives an access accept frame from the server  30 , the access point  10  compares the user identity with those in the learning table  110 . If the user identity does not exist in the learning table  110 , the access point  10  learns the new client  20 . The access point  10  then records the user identity and the user identity type in the learning table  110 , and updates the number of faked users. The access point  10  performs the EAP process according to the updated learning table  110 . In the embodiment, each faked EAP process is performed every fifteen seconds, and the same principle is applicable to other authentication processes.  
         [0019]     In the exemplary embodiment, the access point  10  generates fifteen faked user for each true user, but the invention is not limited to this number. In other embodiments, the number of faked users can be x, wherein x is an integer (1, 2, 3 . . . ), and the access point  10  generates faked users for each true user, ie. The access point  10  further generates x*N faked users. Thus the number of faked user in the learning table  110  is [x*(N+1)].  
         [0020]      FIG. 3  illustrates a time line of a frame of the faked EAP process in different environments. In the exemplary embodiment, the time line can be used in different WLAN environments such as 802.11a, b, or g. In the exemplary embodiment, the fourteen frames are generated in one faked EAP process, the frames includes a faked Associate-Request frame, a faked Associate-Response frame, a faked EAP-Request/Identity frame, a faked EAP-Response/Identity frame, a faked EAP-Challenge frame, a faked Challenge-Response frame, a faked EAP-Success frame, and so on.  
         [0021]      FIG. 4  is a flow chart of increasing security of a method in accordance with the present invention. In step S 401 , a basic service set (BSS) is established in the wireless local area network (WLAN). The BSS is used for transmitting data between the client  20  and the server  30 . In the exemplary embodiment, the BSS includes the access point  10 , the client  20  and the server  30 .  
         [0022]     In step S 403 , the access point  10  establishes a blank learning table  110 . The learning table  110  is used for generating the identities of the faked users to protect the true users. In the exemplary embodiment, the learning table  110  includes a user identity type column, a true user number column, a faked user number column, a true user identity column and a faked user identity column.  
         [0023]     In step S 405 , the access point  10  generates the identities of the faked users according to a random hexadecimal string to protect the identities of the true users.  
         [0024]     In step S 407 , the access point  10  performs the faked EAP process according to the identities generated in step S 405  at a fixed time interval. In the exemplary embodiment, the fixed time interval is fifteen seconds.  
         [0025]     In step S 409 , the access point  10  determines whether the learning table  110  should be updated according to a new user identity from the client  20 . If there is a new user identity transmitted from the client  20 , the access point  10  updates the learning table  110  in step S 411 , and then the process returns to step S 407 . If no new user identity transmitted from the client  20 , the process returns to step S 407 , the access point  10  performs the faked EAP process at the fixed time interval.  
         [0026]      FIG. 5  is a flow chart of increasing security of a method in accordance with another embodiment of the present invention. Firstly, the BSS is provided in step S 501 . The BSS is used for transmitting data between the client  20  and the server  30 . In the exemplary embodiment, the BSS includes the access point  10 , the client  20  and the server  30 .  
         [0027]     In step S 503 , the access point  10  establishes a blank learning table  110 . The learning table  110  is used for generating the identities to the faked users to protect the true users. In the exemplary embodiment, the learning table  110  includes a user identity type column, a true user number column, a faked user number column, a true user identity column and a faked user identity column.  
         [0028]     In step S 505 , the access point  10  generates the identities to the faked users according to a random hexadecimal string to protect the identities of the true users.  
         [0029]     In step S 507 , the identities of the faked users are recorded in the learning table  110 , and the faked user number column and the faked user identity column of the learning table  110  are updated.  
         [0030]     In step S 509 , the access point  10  initializes the faked EAP process, and generates the frames required by the faked EAP process according to the identities of faked users generated in step S 507 . In the exemplary embodiment, the identities of the fakes users include the faked Associate-Request frame, the faked Associate-Response frame, the faked EAP-Request/Identity frame, the faked EAP-Response/Identity frame, the faked EAP-Challenge frame, the faked Challenge-Response frame, the faked EAP-Success frame, and seven ACK frames.  
         [0031]     In step S 511 , the access point  10  transmits the frames generated in step S 509  to the network at a fixed time interval to perform the faked EAP process. In the exemplary embodiment, the fixed time interval is fifteen seconds.  
         [0032]     In step S 513 , the access point  10  determines whether the client  20  transmits the EAP-Response/Identity frame. If the client  20  does not transmits the EAP-Response/Identity frame to the access point  10 , then the process returns to step S 511 .  
         [0033]     In step S 515 , the access point  10  determines whether the RADIUS-access-accept frame from the server  30  is received, if the client  20  transmits the EAP-Response/Identity frame to the access point  10 .  
         [0034]     If the RADIUS-access-accept frame from the server  30  is not received by the access point  10 , the process returns to step S 511 .  
         [0035]     In step S 517 , access point  10  determines whether the user identity of the client  20  exists in the learning table  110 , if the RADIUS-access-accept frame from the server  30  is received by the access point  10 .  
         [0036]     If the user identity exists in the learning table  110 , then the process returns to step S 511 .  
         [0037]     If the user identity of the client  20  does not exist in the learning table  110 , the access point  10  records the user identity and the EAP type in the learning table  110 , updates the number of the true users in the learning table  1110  in step S 519 , and then.  
         [0038]     After the access point  10  updates the number of the true users in the learning table  110  in step S 519 , the process returns to step S 511 , the access point  10  performs the faked EAP process according to the updated learning table  110 .  
         [0039]     It is believed that the present embodiments and their advantages will be understood from the foregoing description, and it will be apparent that various changes may be made thereto without departing from the spirit and scope of the invention or sacrificing all of its material advantages, the examples hereinbefore described merely being preferred or exemplary embodiments.