Extensible Authentication Protocol
The extensible authentication protocol (EAP) is required to encrypt the
global authentication key. EAP offers a method necessary for wireless
workstations to be able to create an encryption key for the authentication
service.
Mutual authentication is provided by transport level security (TLS) to
protect the integrity of encrypted transmissions and the exchange of
keys from point to point. Because a combination of EAP and TLS is
used, TLS mechanics facilitate EAP.
Once authentication has occurred, 802.11 can be set to request that
the wireless workstation authenticate itself again at a predefined time
interval. This means that the wireless access point is set to restrict network
traffic when it is sent to a wired network or other wireless workstation
without valid authentication keys.
Both the wireless access point and wireless workstation need to support
a multicast/global authentication key so that the wireless access
point can utilize a server that receives 802.11 network traffic either
with or without a specific authentication key.
When the access point has a new wireless workstation connecting to
it, the access point receives an EAP-Start from the wireless workstation.
Then, the access point sends an EAP-Request to the wireless workstation,
to establish its identity. The access point then sends an EAP-Start
connected with the new access point on your WLAN.
The wireless workstation can then send an EAP-Response using as
an identifier the same specific machine name as the response request if
there is no user logged on at the time. The wireless workstation can
send an EAP-Response using as an identifier the same username as
that request if there is a user logged on at that time.
At that point, the EAP-Response for identity is sent by the access
point to the authentication server, which then transmits an EAPRequest
via a TLS or MD5 challenge to the EAP-Response for an identity
message from the wireless workstation.
Note that TLS is necessary for wireless traffic, since the authentication
server is not able to permit sending multicast/global keys. The wireless
workstation must therefore deal securely with unicast session authentication keys so that the wireless access point sends the EAPRequest
from the authentication server to the wireless workstation.
The wireless workstation then sends an EAP-Response containing its
credentials to the authentication server through the wireless access
point, which then sends the wireless workstation’s credentials to the
authentication server. The authentication server validates the wireless
workstation’s credentials and creates a “Success” message for the wireless
workstation.
The authentication server responds to the wireless access point with
the wireless workstation message and the encryption key from the EAPTLS
session key.
At that point, the wireless access point creates a multicast-global
authentication key either by producing a random number or by choosing
it from a predefined setting. Once the authentication server receives
that message, the wireless access point sends a “Success” message to the
wireless workstation. The wireless access point then sends an EAP-Key
message to the wireless workstation that has the multicast/global
authentication key encrypted through the per-session encryption key.
Should the wireless access point and wireless workstation support
this type of unicast session key, then the access point uses that encryption
key (sent by the authentication server) as the unicast session key.
Once the wireless access point alters the multicast/global authentication
key, it can produce EAP-Key messages that have the new multicast/
global authentication key encrypted with specific wireless workstation
unicast session keys. The wireless access point then adds the
specific wireless workstation unicast session key to the list of unicast
session keys it has logged.
Once the wireless workstation has received the EAP-Key message, it
uses the unicast session encryption key to decrypt the multicast/global
authentication key. Once the wireless access point and wireless workstation
receive these unicast session keys in combination with a multicast/
global authentication key, the encryption key (from the EAP-TLS
session key) is sent to the wireless workstation as the unicast session
key to use.
Finally, when the wireless NIC receives these authentication keys, it
must program the wireless workstation’s NIC to accept them. When the
authentication keys have been successfully programmed, the wireless
workstation uses DHCP to restart its process of communication and
assign an IP address for itself.
120 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|
Sections
Comments (0 posted)
Syndication
