Hand Held Products 9500 - Manual (Page 141)

Dolphin® 9500 Series User’s Guide 7 - 39
For example, the following graphic displays the authentication flow for a mobile user who wishes to create a virtual private
network with his home office.
By using the Client, the user can associate with a wireless network provided by a third party, in this case the ISP. We assume
that the company and the ISP have established a service relationship beforehand. When the ISP receives the user's credentials,
the ISP proxies the credentials to the company's AAA server, which returns a message telling the ISP to either accept or deny
the user access. This response is then propagated to the remote user.
Dynamic Session Specific Wireless Encryption Keys
There have been many published reports recently about the lack of security provided by the Wired Equivalent Privacy (WEP)
protocol. One of the problems with WEP is that the shared key used by the station and the access point is inherently static. That
is, this shared key will only change if it is manually reconfigured on both devices. The Client remedies this by supporting the
Transport Layer Security (TLS) protocol. TLS ensures that a new shared key is generated each time a station associates itself
with an access point. TLS has proven itself an excellent authentication and encryption protocol in commercial environments. The
Client also supports the MD5 and TTLS security protocols.
Additional Advantages of TTLS and PEAP
The Client provides the advantage of Tunneled TLS (TTLS) and PEAP support. These protocols provide the security of TLS
with greatly reduced administrative load. Security is enhanced by never passing user ID and password in the clear. No "real" user
ID or password is required in Phase 1. After the secure tunnel is established, Phase 2, user credentials are passed in safe,
encrypted form. To further enhance security, the WEP keys, which encrypt the data between the wireless card and the AP, may
be automatically changed on a per-session basis, limiting the time available to an unauthorized sniffer to crack the keys. By
limiting the session time (the reauthentication period), the keys can essentially be made uncrackable.
Administration is eased by greatly reduced certificate requirements in comparison to TLS. In TLS, each client must have a client
certificate to pass to the server, and a CA certificate with which to verify a server certificate, while the server must have a client
certificate from each user and CA certificates for each possible CA chain and its own server certificate. TTLS and PEAP require
only that a single server certificate be created for the server to present to the client, and that the client have a CA certificate to
verify the server. Because these are the same for each client on the network, they are easily managed, unlike TLS, where every
client certificate is unique. TTLS and PEAP thus provide the security of a TLS channel without the need for managers to distribute
and manage client certificates. Lastly, TTLS allows for the use of existing legacy authentication protocols. Administrators may
continue to use established authentication databases.
Cisco LEAP
The message exchange used by Cisco LEAP is proprietary. This protocol is not a standard EAP type, but is supported by the
Client through a licensing arrangement with Cisco.
Relative Merits of Authentication Protocols
MD5 is the least secure of the EAP protocols as it only does a one-way authentication, and does not support automatic
distribution and rotation of WEP keys, increasing the administrative burden of manual WEP key maintenance.
TLS, while the most secure EAP protocol, requires client certificates to be installed on each wireless client. Establishing and
maintaining this PKI infrastructure is normally a burden most administrators do not feel is worth the extra level of security gained.
TTLS and PEAP bypassed the certificate issue by tunneling TLS, and thus eliminating the need for a certificate on the client side.
PEAP supports only EAP-compliant authentication protocols within the tunnel structure, and is rapidly becoming the most widely
supported of the EAP methods. TTLS supports pre-EAP authentication protocols within the tunnel structure, and should be used
in those circumstances when pre-EAP interior protocols are desirable.