IEEE 802.1x：端口访问控制标准详解

需积分: 46 161 浏览量更新于2024-07-24 收藏 1.97MB PDF 举报

"IEEE 802.1x标准是网络访问控制的重要协议，适用于局域网和城域网，主要用于限制未授权设备接入网络。它通过端口为基础的控制机制，确保只有经过身份验证和授权的设备能进行安全通信。该标准在2010年进行了修订，即IEEE Std 802.1X-2010，是对2004版的更新。" IEEE 802.1X是一种基于端口的网络访问控制协议，由IEEE LAN/MAN Standards Committee（IEEE计算机学会的局域网/城域网标准委员会）制定并批准。这一标准的核心目的是提供一种机制，允许网络管理员仅允许认证和授权的设备使用IEEE 802系列局域网服务接入点（即网络端口），从而增强网络安全。 802.1X协议的工作原理涉及三个主要角色：客户端（通常指尝试接入网络的设备）、认证器（通常是交换机或接入点）和认证服务器（如Radius服务器）。当客户端尝试连接到网络时，802.1X协议会启动一个认证过程，这个过程是端口级别的，也就是说，只有在认证成功后，网络端口才会开放，允许数据传输。协议的功能元素包括： 1. **EAP（Extensible Authentication Protocol）**：EAP是802.1X中用于身份验证的主要协议，它支持多种认证方法，如MD5-Challenge、TLS、PEAP等，以适应不同的安全需求。 2. **端口状态控制**：802.1X协议能够将网络端口置于“未认证”（也称为“隔离”或“阻塞”）或“认证”状态，只有认证成功后，端口才会打开，允许数据流。 3. **安全关联建立**：802.1X协议也负责建立和管理安全关联，这些关联定义了设备间通信的安全参数，如加密算法、密钥等。 4. **媒体访问控制方法独立**：802.1X协议不依赖于特定的媒体访问控制（MAC）方法，因此可以应用于各种类型的网络环境。除了基本的身份验证功能，802.1X还支持一些扩展功能，例如端口绑定，它可以限制特定端口只能与预先指定的设备通信。此外，802.1X还可以与其他安全标准结合，如802.11i（无线局域网的安全标准）和802.1AE（MAC层安全，也称为MACsec），以提供端到端的安全解决方案。在实际应用中，802.1X常用于企业网络、无线接入点、远程接入服务器等场景，为用户提供了一种有效的方法来控制网络接入，防止非法设备或恶意用户进入网络。同时，由于其灵活性和可扩展性，802.1X已经成为现代企业网络基础设施中的重要组成部分。

Tables

Table 5-1 System recommendations ..................................................................................................... 18

Table 9-1 MKA Algorithm Agility parameter values........................................................................... 64

Table 9-2 Key Server Priority values.................................................................................................... 67

Table 9-3 MKA Participant timer values .............................................................................................. 75

Table 10-4 Announcement performance parameters .............................................................................. 84

Table 11-1 EAPOL group address assignments...................................................................................... 88

Table 11-2 EAPOL Ethernet Type assignment....................................................................................... 89

Table 11-3 EAPOL Packet Types ........................................................................................................... 90

Table 11-4 EAPOL Packet Type Destination Addressing ...................................................................... 92

Table 11-5 Descriptor Type value assignments ...................................................................................... 95

Table 11-6 MKA parameters—fixed width encoding............................................................................. 97

Table 11-7 MKPDU parameter sets ........................................................................................................ 98

Table 11-8 EAPOL-Announcement TLVs ........................................................................................... 104

Table 11-9 Access Information ............................................................................................................. 106

Table 13-1 Use of ifGeneralInformationGroup objects ........................................................................ 127

Table 13-4 PAE managed object cross-reference table ........................................................................ 128

Table 13-2 Use of ifCounterDiscontinuityGroup Object...................................................................... 128

Table 13-3 Use of ifStackGroup2 Objects ............................................................................................ 128

Table 13-5 PAC managed object cross-reference table ........................................................................ 134

Table C-1 State machine symbols........................................................................................................ 194

IEEE Std 802.1X-2010 IEEE STANDARD FOR LOCAL AND METROPOLITAN AREA NETWORKS

1.3 Introduction

The stations attached to an IEEE 802 LAN transmit and receive data frames using the service provided by

the IEEE 802 LAN MAC at a service access point, often referred to as a port, within each end station or

bridge. Port-based network access control specifies a common architecture comprising cooperative

functional elements and protocols that

a) Use the service provided by the LAN MAC, at a common service access point, to support a

Controlled Port that provides secure access-controlled communication and an Uncontrolled Port that

supports protocols that initiate the secure communication or do not require protection.

b) Support mutual authentication between a Port Access Entity (PAE) associated with a Controlled

Port, and a peer PAE associated with a peer port in a LAN attached station that desires to

communicate through the Controlled Port.

c) Secure the communication between the Controlled Port and the authenticated peer port, excluding

other devices attached to or eavesdropping on the LAN.

d) Provide the Controlled Port with attributes that specify access controls appropriate to the

authorization accorded to the peer station or its user.

This standard specifies the use of EAP, the Extensible Authentication Protocol (IETF RFC 3748 [B14]

), to

support authentication using a centrally administered Authentication Server and defines EAP encapsulation

over LANs (EAPOL, Clause 11) to convey the necessary exchanges between peer PAEs attached to a LAN.

Where communication over the LAN connecting a Controlled Port to its peer(s) is physically secure, no

additional protocol is required to protect their communication. This mode of operation is supported by this

standard. More commonly intrusion into the LAN communication is a principal security threat, and the

result of mutual authentication is not simply Controlled Port authorization to transmit and receive data, but

secure distribution of master keys and associated data to the communicating peers. Proof of possession of

master keys subsequently serves as proof of mutual authentication in key agreement protocols. These

protocols generate keys that are used to cryptographically protect data frames transmitted and received by

the Controlled Port. IEEE Std 802.11™ Wireless LANs specifies protocols that associate wireless stations

with access points and initiate mutual authentication using the procedures specified in this standard, the

subsequent generation of keys to protect data transfer, and the cryptographic methods that protect data

frames using those keys. IEEE Std 802.1AE MAC Security (MACsec) specifies cryptographic support of

the Controlled Port for other media access methods. Authenticated key agreement for MAC Security, as

specified in this standard, specifies the generation of the Secure Association Keys (SAKs) used by MACsec.

Use of the Controlled Port can be restricted by access controls bound to the results of authentication and

distributed via AAA protocols such as Diameter (IETF RFC 3588 [B13]) or RADIUS (IETF RFC 2865

[B8]). Attributes supporting certain port-based network access control scenarios are described in IETF RFC

3580, IETF RFC 4675, and IETF RFC 4849.

Clause 7 illustrates use of the above components and protocols in typical network access control scenarios.

1.4 Provisions of this standard

The scope (1.1) of this standard is addressed by detailed specification of the following:

a) The principles of port-based network access control operation, identifying the protocol components

that compose a port-based network access control implementation (Clause 6).

The numbers in brackets correspond to those of the bibliography in Annex B.

PORT-BASED NETWORK ACCESS CONTROL IEEE Std 802.1X-2010

b) A PAE component, that supports authentication, authorization, and the key agreement functionality

required by IEEE Std 802.1AE to allow a MAC Security Entity (SecY) to protect communication

through a port (6.3, Clause 12).

c) A Port Access Controller (PAC) component, that controls communication where the attached LAN

is deemed to be physically secure and provides point-to-point connectivity (6.4).

d) The key hierarchy used by the PAE and SecY (6.2).

e) The use of EAP by PAEs to support authentication and authorization using a centrally administered

Authentication or AAA Server (Clause 8).

f) An encapsulation format, EAPOL, that allows EAP Messages and other protocol exchanges to

support authentication and key agreement to be carried directly by a LAN MAC service (Clause 11).

g) A MAC Security Key Agreement protocol (MKA) that the PAE uses to discover associations and

agree the keys used by a SecY (Clause 9).

h) An EAPOL Announcement protocol that allows a PAE to indicate the availability of network

services, helping other PAEs to choose appropriate credentials and parameters for authentication and

network access (Clause 10).

i) Requirements for management of port-based access control, identifying the managed objects and

defining the management operations for PAEs (12.9).

j) SMIv2 MIB objects that can be used with SNMPv3 to manage PAEs (Clause 13).

The use of port-based network access control in a number of applications is described (Clause 7) to illustrate

the use of these components and the requirements taken into account in their specification. To facilitate

migration to this standard, Annex G (informative) uses the same concepts to describe the architectural

modeling of unsecured multi-access LANs, a widely deployed form of authenticated port-based network

access control that does not meet the security requirements of this standard. Administrative connectivity to

unauthenticated devices, as required for use of industry standard ‘Wake-on-LAN’ (WoL) protocols, is

described for the scenarios of Clause 7; Annex F (informative) provides background information on WoL.

This standard defines conformance requirements (Clause 5) for the implementation of the following:

k) Port Access Entities (PAEs)

l) Port Access Controllers (PACs)

Annex A provides PICS (Protocol Implementation Conformance Statement) Proformas for completion by

suppliers of implementations that are claimed to conform to this standard.

The basic architectural concepts, such as ‘port’, that this standard relies on are reviewed in Annex D.

This standard uses and selects options provided by EAP and AAA protocol specifications, but does not

modify those specifications (see Clause 2 for references). Annex E (informative) provides EAP and

RADIUS usage guidelines.

The specification and conformance requirements for association discovery and key agreement for IEEE

802.11 Wireless LANs are outside the scope of this standard (see IEEE Std 802.11). That standard makes use

of the PAE specified by this standard.

剩余221页未读，继续阅读

limitw

粉丝: 1
资源: 10

IEEE 802.1x：端口访问控制标准详解

IEEE 802.1x完整文档

IEEE 802.1x standard

IEEE 802.1X

IEEE 802.1x实施方案.docx

IEEE 802.1X MD5.zip

IEEE 802.1x技术白皮书V10

IEEE802.1x技术白皮书V10.doc

配置cisco交换机IEEE802.1x认证.doc

IEEE 802.1x 协议 2010和2004标准

IEEE 802.1x协议介绍——入门资料

最新资源