ZyXEL Communications PLA-470 V2 - V3.0.5 Instalační příručka stáhnout pdf (Strana 103)

message; in this case, the station is not authenticated. The station can deauthenticate

itself at any time by sending an EAPoL-Logoff request.

802.1x uses an authentication server to which the access point relays informa-

tion, as shown in Figure 4.16. The authentication phase can only be initiated by the

station. After having received the authentication request, the access point requests

the station to identify itself with an EAP-Request (Identity). As soon as the station

identifies itself at the access point with an EAP-Response (Identity), this request is

transmitted to the authentication server (Access Request).

In general, the station and the authentication server share a secret (key, login

password, certificate) that depends on the authentication method used. As soon as

the authentication server receives a request from a client (a station) connected to the

PLC network, it sends an Access Challenge message containing a challenge to the

station. This challenge can only be solved by the secret shared between the station

and the authentication server. If the challenge is not solved, the station cannot

authenticate itself; if it is solved, the authentication server authenticates the station,

which can from then on connect to the network via the controlled port located

between it and the PLC device used to have access to the PLC local area network.

Any type of server supporting EAPoL can be used as the authentication server.

However, the most widespread server still is RADIUS.

84 Security

Figure 4.16 Authentication phase in IEEE 802.1x

1 2 ... 98 99 100 101 102 103 104 105 106 107 108 ... 348 349

Žádné komentáře

ZyXEL Communications PLA-470 V2 - V3.0.5 Instalační příručka Strana 103