The 802.1X protocol takes the RADIUS methodology and separates it into three distinct groups: the Supplicant, the Authenticator, and Authentication Server. The Supplicant and the Authenticator communicate using the Extensible Authentication Protocol (EAP).
» Return to top
2.1 Supplicant
The Supplicant is the client that requests access to the network. Typically, a supplicant is a user workstation, but it may be router, a switch, an IP phone, or any other device that is seeking network services. Supplicant software is already implemented natively in some operating systems, including Microsoft Windows XP and Vista, or can be downloaded and added to the PC. Note that in the HP ProCurve implementation, a switch port can also be configured as a supplicant, in order to secure links between network devices.
The configuration of Windows XP and Vista supplicants for 802.1X is described in ProCurve Application Note AN-S3, How to configure 802.1X authentication with a Windows XP or Vista supplicant.
» Return to top
2.2 Authenticator
The Authenticator is the device that provides the entry point for the supplicant into the network. It requires the supplicant to provide 802.1X credentials, which are forwarded to the authentication server. HP ProCurve switches and access points can serve as authenticators.
» Return to top
2.3 Authentication Server
The Authentication Server receives authentication information that originates with the supplicant and verifies the information against its stored name/password pairs. In the HP ProCurve implementation, this is a RADIUS server. In the absence of an external authentication server, a switch can be configured to authenticate 802.1X supplicants using its own local database.
» Return to top
2.4 Authentication with EAP
The Extensible Authentication Protocol (EAP) is defined by the IEEE 802.1X standard as the mechanism that controls interaction between the supplicant and the authenticator. As shown in Figure 1, in the ProCurve implementation, the authenticator is a switch.
To enable 802.1X on a switch port, the port must be configured as a port-authenticator. (See the details of the switch configuration below in section 3.1, “Configure the ProCurve switch”.) Port-authenticators are closed to any type of incoming traffic, except the EAP protocol.
 Figure 1. Details of EAP authentication
When the switch sees a client connected on a port-authenticator, it sends an EAP-Identity Request to challenge the user for credentials. The PC replies with its username/password or certificate, and the switch forwards the information to the RADIUS server. Then the switch merely passes messages between the Supplicant and the RADIUS Server, who directly negotiate the type of EAP protocol and the authentication parameters to use.
If the supplicant credentials match the information known in the RADIUS database (a local database or directory—for example, Active Directory in the Microsoft world), the RADIUS server sends a RADIUS Accept message back, and the switch sends the Supplicant an EAP-Success message and opens the port for data transfer. Once the supplicant has been authenticated by the RADIUS server, other tools can be used to add further control on the supplicant.
» Return to top
2.5 EAP versions
The EAP version known as EAP-MD5 is an open standard. It relies on the MD5 hashing algorithm, which offers only comparatively weak security. (For example, it can be cracked by a dictionary attack.) This EAP version may be secure enough for wired authentication, but should not be considered secure on a wireless network.
Another open standard is EAP-TLS. This version of the protocol offers a good security, because it relies on two certificates: one on the client side and one on the server side. However, the implementation of EAP-TLS can be complicated because of the management required for the many certificates it requires.
EAP- TTLS (Tunneled Transport Layer Security) is another open standard that offers a good security; it requires X509 certificates on the server side only. (Certificates on the client side are optional.) It is not natively implemented on Microsoft systems.
PEAP (Protected EAP) is an open standard that exists in two versions: PEAPv0/EAP-MSCHAPv2 and PEAPv1/EAPGTC. The PEAP protocol performs authentication in two phases: Phase 1 authenticates the server with a PKI (Public Key Infrastructure), and creates a secure tunnel to encrypt the data exchange for Phase 2. Phase 2, in turn, identifies the client through the encrypted tunnel.
LEAP (Lightweight Extensible Authentication Protocol) is a Cisco-proprietary version. EAP-Fast is also a Cisco version. Designed to correct weaknesses in LEAP, it utilizes a three-phase authentication scheme, and is defined as a draft in IETF.
EAP-SIM (Subscriber Identity Module) is a method used to distribute keys in the GSM network, while EAP-AKA (Authentication and Key Agreement) is used for UMTS networks.
» Return to top
|
