Wireless Authentication via EAP-FAST

Party of FiveBrandon HoffmanKelly KoenigAzam MasoodPhil Nwafor

MSIT 458: Security (Professor Chen)

Agenda

The Need Alternatives Considered Our Solution (Technical Detail) Real World Example Q & A

The Need

What’s the Big Deal?

Many considerations need to be made to ensure the system is:

Effective Efficient Easy for end users and administrators

With the increase in usage of wireless-based technologies, security has formulated a

substantial focus of IT departments globally.

Tenets of Effective Security*

Secure network platform with integrated security that is scalable to advanced security technologies and services

Threat control services focused on antivirus protection and policy enforcement.

Secure communication services that maintain privacy and confidentiality of sensitive data.

*Cisco Systems

Security: Business Benefits

Rapidly identify and respond to evolving threats

Enforce business policies Protect critical assets Decrease complexity Ease the administrative burden of IT Lower total cost of ownership

Our Scope

Wireless users need to have an account created manually The accounts expire and need manual attention The credentials for wireless require a PAC (certificate) to access

the system that must be manually installed The wireless users authenticate to an island as opposed to the

enterprise Identity Vault

The current wireless security implementation is effective but manually intensive.

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)

*Culled from Secure Wireless: Integrity of Information on the Move (Cisco Paper)

Alternatives Considered

Wireless Authentication

WPA & WPA2: Designed as a stop gap between WEP

and 802.1x (EAP) development. The most common mode of WPA2 is

pre-shared key. Enterprises need a more distributed

model.Wi-Fi Protected

Access

Wireless Authentication

EAP (Extensible Authentication Protocols) were created because a pre-shared key model does not make sense with hundreds or thousands of wireless clients.

Wireless Admin using PSK

Variety in EAP

LEAP- Modified version of MS-CHAP. No credential protection. No native Windows Support

PEAP- Joint venture between Cisco and Microsoft. Similar to EAP-TTLS by using PKI server side certs. Users will only know PEAPv0. PEAPv1 includes different inner authentication mechanisms.

There are many variations of EAP types. Some are no longer widely used due to imperfections.

Variety in EAP (cont’d)

EAP-(T)TLS - Uses PKI to communicate securely with RADIUS or authentication server. Requires client cert. TTLS only requires server cert. Convenience vs. Security.

EAP-IKEv2 – Mutual authentication and session key establishment. Supports Passwords, Asymmetric, or Symmetric keys. Can utilize different methods in each direction. EXPERIMENTAL.

EAP-FAST – Provides multiple secured tunnels. Flexible inner methods for authentication. Exploits TLS without inconvenience of manual client side certs.

EAP TYPE Comparison

Comparison Charts

The many varieties of EAP that have evolved can be quickly evaluated for specific, enterprise desirable benefits by viewing the charts below

Our Solution

Digging into EAP-FAST

EAP-FAST is a Cisco proprietary 802.1x authentication scheme. It contains a feature called “automatic PAC” that allows the system to manage and maintain the user certificates. The mechanism boasts the following features:

Utilizes a series of secure tunnels for credential transport Leverages existing user credentials and authentication back-end

(Radius AAA, and LDAP/IdM3) Encrypts wireless data with leading edge encryption methods such

as WPA2 AES-CCMP EAP-FAST is a triple phase authentication mechanism

EAP-FAST Phase ZeroPhase zero is essential to the automatic PAC creation process. EAP-FAST requires the use of Cisco’s ACS server Phase zero has several custom radius elements and wireless client

components Phase zero consists of the ACS server opening and SSL tunnel with

the client It then checks the credentials sent via GTC (for generic LDAP)

against the enterprise identity system If valid it creates a PAC and sends it to the client.

EAP FAST Phase Zero Link

EAP-FAST Phase One

Phase one is where the ACS server and the client setup the TLS tunnel. The client sends a Hello message to the server The server responds with a variety of information The client checks the info and sends its encrypted PAC file to the server

for mutual authentication Once completed the master secret is generated and the TLS tunnel is

opened. At this point, Phase Two may now commence.

EAP FAST Phase One Link

EAP-FAST Phase Two

Phase two is very simple. The TLS tunnel is already established, the client

simply sends its unencrypted credentials to the ACS server

The ACS server forwards the information to the LDAP server and upon a positive response grants network access.

EAP-FAST Phase Two Link

Real World: Case Studies

Large Telecommunications Company

Provide a unique access point for guests and employees.

Provide employees with a similar end-user experience to the one they have now (transparency)

Reduce maintenance related costs incurred by IT department

CHALLENGES

Large Telecommunications Company

EAP-FAST as opposed to LEAP solution Less susceptible to dictionary attack since

there is less of a reliance on user’s password strength.

Employ the additional security that EAP-FAST provides through ‘tunneling.

Like LEAP, eschews digital certificate need.

SOLUTION

Large Telecommunications Company

More secure and cost-effective client access Tunneling affords less reliance on user

passwords by authenticating only after tunnel is established.

Most of this remains transparent to the user. Repeatable/Predictable and consistent client

experience.

RESULTS

Healthcare Case Study

Lifespan Healthcare emerged as a result of the merger of two of the largest acute care facilities in Rhode Island

Wireless technology was critical strategic and tactical element to support care delivery.

Authentication of mobile clients from two large institutions was a challenge.

Mobile diagnostic devices had to be tethered to Ethernet which was usually logistically inconvenient.

CHALLENGES

Healthcare Case Study

EAP-FAST was visited as an authentication alternative due to some of its inherent benefits.

Less susceptible to dictionary attack since there is less of a reliance on user’s password strength.

Employ the additional security that EAP-FAST provides through ‘tunneling.

Like LEAP, eschews digital certificate need.

SOLUTION (Same as previous)

Healthcare Case Study

The goal was achieved through simplified authentication, via EAP-FAST enabling secure mobility to clinical systems.

Facilitated point-of-care functions to physicians and other clinicians anytime, anywhere.

More secure and cost-effective client access

RESULTS

Q & A

QUESTIONS?

Our References

Secure Wireless: Integrity of Information on the Move, http://www.cisco.com/en/US/solutions/collateral/ns340/ns394/ns348/ns386/net_presentation0900aecd805febbb.pdf (Cisco)

The Business Case for Enterprise-Class Wireless LANS http://safari.oreilly.com/1587201259/gloss01lev1sec6#X2ludGVybmFsX1RvYz94bWxpZD0xNTg3MjAxMjU5L2NoMTA=