XinWindows课件.pptVIP

802.1X in Windows Tom Rixom Alfa Ariss Overview 802.1X/EAP 802.1X in Windows Tunneled Authentication Certificates in Windows WIFI Client in Windows (WZC) Configuration examples Questions? 802.1X/EAP Port Based Network Access Control Authenticated/Unauthenticated Port Supplicant/Authenticator/Authentication Server Uses EAP (Extensible Authentication Protocol) Allows authentication based on user credentials EAP over LAN(EAPOL) 802.1X Client 802.1X Protocol Driver (EAPOL Driver) Handles all EAPOL communication Extracts EAP messages from EAPOL which can be read by applications Inserts EAP messages into EAPOL that applications wish to send 802.1X Client Application Uses Driver to send and receive EAP messages Handles EAP messages accordingly 802.1X Client in Windows Implements 802.1X Driver (NDIS) and Application Uses Microsoft EAP API to handle the EAP communication Controls user interaction (Balloon) User/Computer context EAP in Windows Microsoft EAP API An EAP Module is “Microsoft DLL” that implements Microsoft EAP API 802.1X Client calls modules using EAP API to handle authentication Other example is the Microsoft VPN Client EAP Modules EAP-MD5 (Built-in) Username/password EAP-TLS (Built-in) Client/server certificates (PKI) EAP-MSCHAPV2 (Built-in) Username/password (Windows credentials) Protected EAP (PEAP) (Built-in) Server certificate Tunneled EAP Authentication EAP-MD5,EAP-MSCHAPV2, EAP-… EAP-TTLS Server certificate Tunneled Diameter Authentication Diameter (PAP/CHAP/…), EAP Tunneled Authentication (TTLS/PEAP) Uses TLS tunnel to protect data The TLS tunnel is established using the Server certificate automatically authenticating the server and preventing man-in-the-middle attacks Allows use of dynamic session keys for line encryption PEAP? PEAP Version 1, 2 Supported by Cisco, Apple OS X Panther /internet-drafts/draft-josefsson-pppext-eap-tls-eap-07.txt Microsoft PEAP (Windows XP SP1) Version 0 No headers Implemented by Microsoft PEAP modu