Lecture 3.1: Handling Remote Access: RADIUS Motivation

More documents

Recommendations

Info

Giuseppe Bianchi Access-Reject Access Reject Two main reasons: Authentication failed 1+ attributes in the request were not considered acceptable (authorization failed) Giuseppe Bianchi Access-Challenge Access Challenge Used whenever the server wants/needs the user to send a further response E.g. a challenge/response authentication mechanisms Not necessarily CHAP (see CHAP support later on)! Could be RADIUS support for GSM/UMTS authentication! E.g. prompting the user to enter a password Challenge typically contains One or more reply-message attributes » Which MAY be used in a very flexible manner May contain text to be prompted to the user May contain an explicit authentication challenge NAS collects response from the user and sends a NEW Access-Request New ID New User-Password - contains the user response (crypted) Based on this, server accepts or rejects or send another challenge 8
PPP CHAP support with RADIUS CHAP challenge locally generated by NAS No need to know user password for this! CHAP challenge + response sent to RADIUS server RADIUS server retrieves user password from database, computes and compares CHAP response Chap Challenge Chap Response Chap Success RADIUS Access Request (User Name, CHAP password, CHAP Challenge, Service :Framed PPP , …) RADIUS Access Accept (Service : Framed PPP, …) CHAP RADIUS PPP User NAS RADIUS Giuseppe Bianchi SERVER Giuseppe Bianchi UDP/IP Lecture 3.2: RADIUS limits and extensions Verify 9
Page 1 and 2: Giuseppe Bianchi Lecture 3.1: Handl
Page 3 and 4: RADIUS Security features Per-packet
Page 5 and 6: packet format Code: type of radius
Page 7: Native User-Password Step 1: paddin
Page 11 and 12: Properties of a good hash function
Page 13 and 14: Message digest size Must be conside
Page 15 and 16: RADIUS Security Weaknesses Recommen
Page 17 and 18: Attack to shared secret based on Us
Page 19 and 20: poor PRNG implementations Attack to
Page 21 and 22: Giuseppe Bianchi Giuseppe Bianchi A
Page 23 and 24: Why “duplicating duplicating”
Page 25: Diameter improvements at a glance /

Lecture 3.1: Handling Remote Access: RADIUS Motivation

Create successful ePaper yourself

Delete template?

Save as template?