NETGEAR WPN111 user manual Figure B-5 WPA Overview

User Manual for the NETGEAR RangeMax™ Wireless USB 2.0 Adapter WPN111

Wireless Network

Wired Network with Optional WPA 802.1x Port Based Network Access Control

W P A	W P A e n a b le d
e n a b le d	A cce ss P oin t
wire le ss	u sin g
clie n t with	p re -sh a re d ke y
“su p p lica n t”	or
	8 02 . 1 x/E A P

Figure B-5: WPA Overview

T C P /I P

P orts C lose d U n til

T C P /I P

Ports O p e n e d A fte r

A u th e n tica te d

RADIUS Server

Login

Authentication

Op tion a l C e rtifica te A u th ority

(eg W in S e rve r, eriS ign , e tc)

The strength WPA comes from an integrated sequence of operations that encompass 802.1X/EAP authentication and sophisticated key management and encryption techniques. Its major operations include:

•Network security capability determination. This occurs at the 802.11 level and is communicated through WPA information elements in Beacon, Probe Response, and (Re) Association Requests. Information in these elements includes the authentication method (802.1X or Pre-shared key) and the preferred cipher suite (WEP, TKIP, or AES).

The primary information conveyed in the Beacon frames is the authentication method and the cipher suite. Possible authentication methods include 802.1X and Pre-shared key. Pre-shared key is an authentication method that uses a statically configured pass phrase on both the stations and the access point. This eliminates the need for an authentication server, which in many home and small office environments will not be available nor desirable. Possible data encryption options include: WEP, TKIP, and AES (Advanced Encryption Standard). We’ll talk more TKIP and AES when addressing data privacy below.

•Authentication. EAP over 802.1X is used for authentication. Mutual authentication is gained by choosing an EAP type supporting this feature and is required by WPA. 802.1X port access control prevents full access to the network until authentication completes. 802.1X EAPOL-Key packets are used by WPA to distribute per-session keys to those stations successfully authenticated.

B -1 6 W ire le ss N e tworkin g B a sics

202-10076-01