1 / 8

Deliverable G

A comparison of each national solution was made against Del C – “requirements”, the following solutions were assessed 802.1x based authentication solution. VPN based authentication solution. Variation to VPN based authentication solution with client certificates.

richardwilliamson
Download Presentation

Deliverable G

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. A comparison of each national solution was made against Del C – “requirements”, the following solutions were assessed 802.1x based authentication solution. VPN based authentication solution. Variation to VPN based authentication solution with client certificates. Web-based redirect authentication solution. Roamnode (PPPoE) authentication solution. Deliverable G

  2. 802.1x based authentication solution Layer 2 solution, standard is still maturing, some cheaper AP that support 802.1x are appearing on the market. Uses EAP or EAPOL. Uses RADIUS for authentication, authorisation and accounting. Can be scaled using a RADIUS Proxy Hierarchy to enable the visitor to authenticate at their home institution. Admin overhead involves loading 802.1x client on mobile devices, RADIUS configurations and VLAN assignment. Non 802.1x client support offered via website support and may look into general web-redirect authentication system. EAP-TLS and TTLS security support with WPA, TKIP, 802.11i extensions). Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

  3. VPN based authentication solution Layer 3 solution, mature standard. Can be scaled using an overlay network of assigned address space for VPN Gateways or control lists of VPN Gateways. Admin overhead in loading VPN client on mobile devices, configuration of VPN gateways, access lists & VLANs. Strong security via encrypted tunnels for each connection. Accountability via the user’s home institution as the user authenticates and gets their IP address from there, also reports to the helpdesk e.g. stolen mobile device. VPN based authentication solution with client certificates Admin overhead required to install client certificates on mobile devices and maintain / manage a PKI. Deliverable G

  4. Web based redirect authentication solution Requires a http or https supported web browser, no additional client software is likely to be required Uses RADIUS for authentication, authorisation and accounting. Can be scaled using a RADIUS Proxy Hierarchy with authentication at visitor user home institution. Minimum admin overhead as unknown authentication requests are forwarded back across a RADIUS proxy hierarchy. Less secure than other authentication solutions due to web based login page for authentication and no provision to protect authentication of authorised users in a VLAN from seeing each others traffic Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

  5. Roamnode (PPPoE) authentication solution Uses PPPoE. Decouples process of establishing a physical network from establishing a logical network connection. Uses RADIUS back end for AAA service. Uses an overlay network for visitor users. Uses a VPN gateway via an IP-in-IP tunnel. Requires proprietary equipment at the home and visited institution and client operating systems with PPPoE support. Accountability via RADIUS logging and user reports to helpdesk (e.g. stolen mobile device). Deliverable G

  6. Conclusion A European AAA based on one solution is not practical. A solution that supports the various national solutions is needed. Recommendations: A phased development / testing approach • Extend solution to agree mechanisms for exchange of credentials (e.g. PKI) Subject to feasibility, build the proposed VPN solution • Conduct feasibility tests on creating an scalable VPN solution • Resolve scaling and interoperability issues for all AAA (802.1x, VPN, VPN +PKI, web-based redirect, PPPoE) • Consolidate findings into a trial report Build and scale a RADIUS proxy hierarchy for non-VPN AAA Could extend to VPN if possible?

  7. Revised Recommendations (as a result of discussions in Berlin) - A phased development / testing approach Subject to feasibility, build the proposed CASG solution • Conduct feasibility tests on creating an scalable VPN solution • Resolve scaling and interoperability issues for 802.1x, VPN, web-based redirect, PPPoE) Extend to VPN in parallel Build and scale a RADIUS proxy hierarchy for non-VPN AAA • Consolidate findings into a trial report Work on software changes to PPPoE to facilitate roaming

  8. Update on inter NREN tests Organizational RADIUS Server D Organizational RADIUS Server E Organizational RADIUS Server F Organizational RADIUS Server G Currently linked to CARNET, Croatia National RADIUS Proxy Server National RADIUS Proxy Server Currently linked to FCCN, Portugal Top-level RADIUS Proxy Server Backup Top-level RADIUS Proxy Server Currently linked to SURFnet, Netherlands Currently hosted at SURFnet National RADIUS Proxy Server Currently directly linked to the University of Southampton etlr1.radius.terena.nl (192.87.36.6) etlr2.radius.terena.nl (195.169.131.2) Organizational RADIUS Server C Organizational RADIUS Server A Organizational RADIUS Server B

More Related