48
3.5.3 IEEE 802.1x/RADIUS IEEE 802.1x Port-Based Network Access Control is a new standard for solving some
security issues associated with IEEE 802.11, such as lack of user-based authentication
and dynamic encryption key distribution. With IEEE 802.1x and the help of a RADIUS
(Remote Authentication Dial-In User Service) server and a user account database, an
enterprise or ISP (Internet Service Provider) can manage its mobile users’ access to its
wireless LANs. Before granted access to a wireless LAN supporting IEEE 802.1x, a
user has to issue his or her user name and password or digital certificate to the backend
RADIUS server by EAPOL (Extensible Authentication Protocol Over LAN). The RADIUS
server can record accounting information such as when a user logs on to the wireless
LAN and logs off from the wireless LAN for monitoring or billing purposes.
The IEEE 802.1x functionality of the access point is controlled by the security mode
(see Section 0). So far, the wireless access point supports two authentication mecha-
nisms—EAP-MD5 (Message Digest version 5), EAP-TLS (Transport Layer Security). If
EAP-MD5 is used, the user has to give his or her user name and password for authen-
tication. If EAP-TLS is used, the wireless client computer automatically gives the user’s
digital certificate that is stored in the computer hard disk or a smart card for authentica-
tion. And after a successful EAP-TLS authentication, a session key is automatically
generated for wireless packets encryption between the wireless client computer and its
associated wireless access point. To sum up, EAP-MD5 supports only user authentica-
tion, while EAP-TLS supports user authentication as well as dynamic encryption key
distribution.
RADIUS
Server
Internet
Wireless AP
Wireless AP User
Database
user authentication
user authentication
IEEE 802.1x-Compliant
Wireless Client
Fig. 52. IEEE 802.1x and RADIUS.
An access point supporting IEEE 802.1x can be configured to communicate with two