WAPI协议的可用性分析与改进

Availability Analysis and Improvements for WAPI

本文分析WAPI安全关联建立过程存在的脆弱性。由于WAPI协议没有强调可用性,因此攻击者可通过来受保护的管理帧引入DoS攻击,本文对其造成的危害进行详细讨论,并给出合理的防御措施。为提高协议的健壮性与可用性,本文还讨论了协议失败的恢复手段,提出了一种改进的WAPI协议实施方案,在尽可能不改变原有协议的框架和封装结构的前提下,最大程度降低或避免所讨论的DoS攻击。

This paper analyzes the security of the establishment procedure of WAPI security association. Since the WAPI design does not emphasize its availability, it is possible to introduce several DoS attacks. We detail the DoS attacks on unprotected management {rames and propose some reasonable countermeasures. In order to enhance the robust and availability, some tradeoffs in failure-recovery strategies are discussed and an improved variant of WAPI is proposed to maintain its primary structure and encapsulation and address all the discussed vulnerabilities.